Changeset 165

Timestamp:

12/11/09 22:13:27 (15 years ago)

Author:

tim

Message:

added misc comments

Location:

trunk

Files:

• include/regfi.h (modified) (2 diffs)
• lib/regfi.c (modified) (3 diffs)

trunk/include/regfi.h

@@ -96 +96 @@
 #define REG_KEY                    0x7FFFFFFF
 
+#define REGFI_OFFSET_NONE          0xffffffff
+
+
+/* This maximum depth is described here:
+ * http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
+ */
 #define REGFI_MAX_DEPTH            512
-#define REGFI_OFFSET_NONE          0xffffffff
-
-/* XXX: This is totally arbitrary right now. */
+
+/* This limit defines the maximum number of levels deep that ri subkey list
+ * trees can go.
+ */
+/* XXX: This is totally arbitrary right now.
+ *      The actual limit may need to be discovered by experimentation.
+ */
 #define REGFI_MAX_SUBKEY_DEPTH     255
+
 
 /* Header sizes and magic number lengths for various records */
@@ -475 +486 @@
 
 
-/* XXX: Should move all caching (SK records, HBINs, NKs, etc) to a single
- *      structure, probably REGFI_FILE.  Once key caching is in place, 
- *      convert key_positions stack to store just key offsets rather than
- *      whole keys.
- */
 typedef struct _regfi_iterator
 {

trunk/lib/regfi.c

@@ -988 +988 @@
     return NULL;
 
+  /* XXX: Registry value names are supposedly limited to 16383 characters 
+   *      according to:
+   *      http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
+   *      Might want to emit a warning if this is exceeded.  
+   *      It is expected that "characters" could be variable width.
+   *      Also, it may be useful to use this information to limit false positives
+   *      when recovering deleted VK records.
+   */
+
   from_encoding = (ret_val->flags & REGFI_VK_FLAG_ASCIINAME)
     ? REGFI_ENCODING_ASCII : REGFI_ENCODING_UTF16LE;
@@ -1076 +1085 @@
   }
 
+  /* XXX: Registry key names are supposedly limited to 255 characters according to:
+   *      http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
+   *      Might want to emit a warning if this is exceeded.  
+   *      It is expected that "characters" could be variable width.
+   *      Also, it may be useful to use this information to limit false positives
+   *      when recovering deleted NK records.
+   */
   from_encoding = (nk->flags & REGFI_NK_FLAG_ASCIINAME) 
     ? REGFI_ENCODING_ASCII : REGFI_ENCODING_UTF16LE;
@@ -2606 +2622 @@
   
   /* Microsoft's documentation indicates that "available memory" is 
-   * the limit on value sizes.  Annoying.  We limit it to 1M which 
-   * should rarely be exceeded, unless the file is corrupt or 
-   * malicious. For more info, see:
-   *   http://msdn2.microsoft.com/en-us/library/ms724872.aspx
+   * the limit on value sizes for the more recent registry format version.
+   * This is not only annoying, but it's probably also incorrect, since clearly
+   * value data sizes are limited to 2^31 (high bit used as a flag) and even 
+   * with big data records, the apparent max size is:
+   *   16344 * 2^16 = 1071104040 (~1GB).
+   *
+   * We choose to limit it to 1M which was the limit in older versions and 
+   * should rarely be exceeded unless the file is corrupt or malicious. 
+   * For more info, see:
+   *   http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
    */
   /* XXX: add way to skip this check at user discression. */