Changeset 152 for trunk/include


Ignore:
Timestamp:
06/02/09 16:00:38 (15 years ago)
Author:
tim
Message:

preliminary support for big data records

switched to using key flags rather than incorrect key types

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/include/regfi.h

    r151 r152  
    9696#define REGFI_REGF_MAGIC_SIZE      4
    9797#define REGFI_REGF_NAME_SIZE       64
    98 
    9998#define REGFI_REGF_RESERVED1_SIZE  340
    10099#define REGFI_REGF_RESERVED2_SIZE  3528
    101 
    102100#define REGFI_HBIN_MAGIC_SIZE      4
    103101#define REGFI_CELL_MAGIC_SIZE      2
     
    127125
    128126/* Flags for the vk records */
     127/* XXX: This next flag may be incorrect.  According to Jeffrey Muir,
     128*       this may actually indicate that the value name is stored in
     129*       UTF-16LE.
     130*/
    129131#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
    130132#define REGFI_VK_DATA_IN_OFFSET    0x80000000
    131 #define REGFI_VK_MAX_DATA_LENGTH   1024*1024
    132 
    133 
    134 /* NK record types */
    135 /* XXX: This is starting to look like this is a flags field. 
    136  *      Need to decipher the meaning of each flag.
    137  */
    138 #define REGFI_NK_TYPE_LINKKEY      0x0010
    139 #define REGFI_NK_TYPE_NORMALKEY    0x0020
    140  /* XXX: Unknown key type that shows up in Vista registries */
    141 #define REGFI_NK_TYPE_UNKNOWN1     0x1020
    142  /* XXX: Unknown key types that shows up in W2K3 registries */
    143 #define REGFI_NK_TYPE_UNKNOWN2     0x4020
    144 #define REGFI_NK_TYPE_UNKNOWN3     0x0000  /* XXX: This type seems to have UTF-16 names!!! */
    145 #define REGFI_NK_TYPE_ROOTKEY1     0x002c
    146  /* XXX: Unknown root key type that shows up in Vista registries */
    147 #define REGFI_NK_TYPE_ROOTKEY2     0x00ac
    148 
    149 #if 0
    150 /* Initial hypothesis of NK flags: */
    151 /***********************************/
    152 #define REGFI_NK_FLAG_LINK         0x0010
    153 /* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
    154 #define REGFI_NK_FLAG_ASCIINAME    0x0020
    155 /* These next two combine to form the "c" on both known root key types */
    156 #define REGFI_NK_FLAG_ROOT1        0x0008
    157 #define REGFI_NK_FLAG_ROOT2        0x0004
     133#define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
     134
     135
     136/* Known key flags */
     137/*******************/
    158138/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
    159139#define REGFI_NK_FLAG_UNKNOWN1     0x4000
    160140#define REGFI_NK_FLAG_UNKNOWN2     0x1000
     141
    161142/* This next one shows up on root keys in some Vista "software" registries */
    162143#define REGFI_NK_FLAG_UNKNOWN3     0x0080
    163 #endif
    164 
     144
     145/* Predefined handle.  Rumor has it that the valuelist count for this key is
     146 * where the handle is stored.
     147 * http://msdn.microsoft.com/en-us/library/ms724836(VS.85).aspx
     148 */
     149#define REGFI_NK_FLAG_PREDEF_KEY   0x0040
     150
     151/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
     152#define REGFI_NK_FLAG_ASCIINAME    0x0020
     153
     154/* Symlink key. 
     155 * See: http://www.codeproject.com/KB/system/regsymlink.aspx
     156 */
     157#define REGFI_NK_FLAG_LINK         0x0010
     158
     159/* This key cannot be deleted */
     160#define REGFI_NK_FLAG_NO_RM        0x0008
     161
     162/* Root of a hive */
     163#define REGFI_NK_FLAG_ROOT         0x0004
     164
     165/* Mount point of another hive.  NULL/(default) value indicates which hive
     166 * and where in the hive it points to.
     167 */
     168#define REGFI_NK_FLAG_HIVE_LINK    0x0002
     169
     170/* These keys shouldn't be stored on disk, according to:
     171 * http://geekswithblogs.net/sdorman/archive/2007/12/24/volatile-registry-keys.aspx
     172 */
     173#define REGFI_NK_FLAG_VOLATILE     0x0001
     174
     175/* Useful for identifying unknown flag types */
     176#define REGFI_NK_KNOWN_FLAGS       (REGFI_NK_FLAG_PREDEF_KEY\
     177                                    | REGFI_NK_FLAG_ASCIINAME\
     178                                    | REGFI_NK_FLAG_LINK\
     179                                    | REGFI_NK_FLAG_NO_RM\
     180                                    | REGFI_NK_FLAG_ROOT\
     181                                    | REGFI_NK_FLAG_HIVE_LINK\
     182                                    | REGFI_NK_FLAG_VOLATILE\
     183                                    | REGFI_NK_FLAG_UNKNOWN1\
     184                                    | REGFI_NK_FLAG_UNKNOWN2)
    165185
    166186/* HBIN block */
     
    350370
    351371  NTTIME mtime;
    352   uint32 major_version;  /* XXX: Unverified. Set to 1 in all known hives */
    353   uint32 minor_version;  /* XXX: Unverified. Set to 3 or 5 in all known hives */
     372  uint32 major_version;  /* Set to 1 in all known hives */
     373  uint32 minor_version;  /* Set to 3 or 5 in all known hives */
    354374  uint32 type;           /* XXX: Unverified.  Set to 0 in all known hives */
    355375  uint32 format;         /* XXX: Unverified.  Set to 1 in all known hives */
    356376
    357377  uint32 root_cell;  /* Offset to root cell in the first (or any?) hbin block */
    358   uint32 last_block; /* Offset to last hbin block in file
    359                       * (or length of file minus header?) */
     378  uint32 last_block; /* Offset to last hbin block in file */
    360379
    361380  uint32 cluster;    /* XXX: Unverified. Set to 1 in all known hives */
     
    516535                                     uint32 max_size, bool strict);
    517536
    518 REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file,
    519                                        uint32 data_type, uint32 offset,
    520                                        uint32 length, uint32 max_size,
    521                                        bool data_in_offset, bool strict);
     537REGFI_BUFFER          regfi_load_data(REGFI_FILE* file,
     538                                      uint32 data_type, uint32 offset,
     539                                      uint32 length, uint32 max_size,
     540                                      bool data_in_offset, bool strict);
     541
     542REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file,
     543                                          uint32 offset, uint32 data_length,
     544                                          uint32 cell_length, bool strict);
    522545
    523546REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32 offset,
Note: See TracChangeset for help on using the changeset viewer.