Changeset 125 for trunk/include/regfi.h

Timestamp:

08/15/08 21:21:54 (16 years ago)

Author:

tim

Message:

added early version of class name parsing. additional work still needed.

File:

• trunk/include/regfi.h (modified) (4 diffs)

trunk/include/regfi.h

@@ -89 +89 @@
 
 /* Constants used for validation */
+/* XXX: Can we add clock resolution validation as well as range?  It has
+ *      been reported that Windows timestamps are never more than a
+ *      certain granularity (250ms?), which could be used to help
+ *      eliminate false positives.  Would need to validate this and
+ *      perhaps conservatively implement a check.
+ */
  /* Minimum time is Jan 1, 1990 00:00:00 */
 #define REGFI_MTIME_MIN_HIGH       0x01B41E6D
@@ -108 +114 @@
 #define NK_TYPE_NORMALKEY          0x0020
 #define NK_TYPE_ROOTKEY            0x002c
- /* TODO: Unknown type that shows up in Vista registries */
+ /* XXX: Unknown type that shows up in Vista registries */
 #define NK_TYPE_UNKNOWN1           0x1020
 
@@ -216 +222 @@
   
   /* header information */
-  /* XXX: should we be looking for types other than the root key type? */
   uint16 key_type;
   uint8  magic[REC_HDR_SIZE];
@@ -224 +229 @@
   char* classname;
   char* keyname;
-  uint32 parent_off;    /* back pointer in registry hive */
-  uint32 classname_off; 
+  uint32 parent_off;                /* pointer to parent key */
+  uint32 classname_off;
   
   /* max lengths */