Changeset 168 for trunk/include/regfi.h


Ignore:
Timestamp:
03/02/10 19:08:42 (14 years ago)
Author:
tim
Message:

merged remaining smb_deps items into regfi

began formatting API comments for use with doxygen

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/regfi.h

    r167 r168  
    1 /*
     1/** @file
     2 * Windows NT (and later) registry parsing library
     3 *
    24 * Branched from Samba project Subversion repository, version #6903:
    35 *   http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/source/include/regfio.h?rev=6903&view=auto
    46 *
    5  * Windows NT (and later) registry parsing library
    6  *
    7  * Copyright (C) 2005-2009 Timothy D. Morgan
     7 * Copyright (C) 2005-2010 Timothy D. Morgan
    88 * Copyright (C) 2005 Gerald (Jerry) Carter
    99 *
    … …  
    2929 * Thanks Nigel!
    3030 ***********************************************************/
     31
     32/**
     33 * @mainpage Home
     34 *
     35 * See \ref regfiTopLayer
     36 */
    3137
    3238#ifndef _REGFI_H
    … …  
    4753#include <iconv.h>
    4854
     55#include "byteorder.h"
    4956#include "talloc.h"
    50 #include "smb_deps.h"
    5157#include "winsec.h"
    5258#include "void_stack.h"
    … …  
    6167#define REGFI_MSG_ERROR 0x0010
    6268
    63 typedef uint8 REGFI_ENCODING;
     69typedef uint8_t REGFI_ENCODING;
    6470/* regfi library supported character encodings */
    6571#define REGFI_ENCODING_ASCII   0
    … …  
    210216                                    | REGFI_NK_FLAG_UNKNOWN3)
    211217
     218
     219#define CHAR_BIT 8
     220#define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
     221                    : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
     222#define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
     223#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
     224
     225typedef struct _regfi_nttime
     226{
     227  uint32_t low;
     228  uint32_t high;
     229} REGFI_NTTIME;
     230
     231
    212232/* HBIN block */
    213233typedef struct _regfi_hbin
    214234{
    215   uint32 file_off;       /* my offset in the registry file */
    216   uint32 ref_count;      /* how many active records are pointing to this
     235  uint32_t file_off;       /* my offset in the registry file */
     236  uint32_t ref_count;      /* how many active records are pointing to this
    217237                          * block (not used currently)
    218238                          */
    219239 
    220   uint32 first_hbin_off; /* offset from first hbin block */
    221   uint32 block_size;     /* block size of this block
     240  uint32_t first_hbin_off; /* offset from first hbin block */
     241  uint32_t block_size;     /* block size of this block
    222242                          * Should be a multiple of 4096 (0x1000)
    223243                          */
    224   uint32 next_block;     /* relative offset to next block. 
     244  uint32_t next_block;     /* relative offset to next block. 
    225245                          * NOTE: This value may be unreliable!
    226246                          */
    227247
    228   uint8 magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
     248  uint8_t magic[REGFI_HBIN_MAGIC_SIZE]; /* "hbin" */
    229249} REGFI_HBIN;
    230250
    … …  
    236256   * depending on this list's type.
    237257   */
    238   uint32 offset;
    239 
    240   uint32 hash;
     258  uint32_t offset;
     259
     260  uint32_t hash;
    241261} REGFI_SUBKEY_LIST_ELEM;
    242262
    … …  
    245265{
    246266  /* Real offset of this record's cell in the file */
    247   uint32 offset;
    248 
    249   uint32 cell_size;
     267  uint32_t offset;
     268
     269  uint32_t cell_size;
    250270 
    251271  /* Number of immediate children */
    252   uint32 num_children; 
     272  uint32_t num_children; 
    253273
    254274  /* Total number of keys referenced by this list and it's children */
    255   uint32 num_keys;     
     275  uint32_t num_keys;     
    256276
    257277  REGFI_SUBKEY_LIST_ELEM* elements;
    258   uint8 magic[REGFI_CELL_MAGIC_SIZE];
     278  uint8_t magic[REGFI_CELL_MAGIC_SIZE];
    259279
    260280  /* Set if the magic indicates this subkey list points to child subkey lists */
    … …  
    263283
    264284
    265 typedef uint32 REGFI_VALUE_LIST_ELEM;
     285typedef uint32_t REGFI_VALUE_LIST_ELEM;
    266286typedef struct _regfi_value_list
    267287{
    … …  
    269289   * May differ from parent key's num_values if there were parsing errors.
    270290   */
    271   uint32 num_values;
     291  uint32_t num_values;
    272292
    273293  REGFI_VALUE_LIST_ELEM* elements;
    … …  
    281301
    282302  /* Represents raw buffer read from classname cell. */
    283   uint8* raw;
     303  uint8_t* raw;
    284304
    285305  /* Length of the raw data. May be shorter than that indicated by parent key.*/
    286   uint16 size;
     306  uint16_t size;
    287307} REGFI_CLASSNAME;
    288308
    … …  
    290310typedef struct _regfi_data
    291311{
    292   uint32 type;
     312  uint32_t type;
    293313
    294314  /* Length of the raw data. */
    295   uint32 size;
     315  uint32_t size;
    296316
    297317  /* This is always present, representing the raw data cell contents. */
    298   uint8* raw;
     318  uint8_t* raw;
    299319
    300320  /* Represents the length of the interpreted value. Meaning is type-specific.*/
    301   uint32 interpreted_size;
     321  uint32_t interpreted_size;
    302322
    303323  /* These items represent interpreted versions of the raw attribute above.
    … …  
    307327  union _regfi_data_interpreted
    308328  {
    309     uint8* none; /* */
    310     uint8* string;
    311     uint8* expand_string;
    312     uint8* binary; /* */
    313     uint32 dword;
    314     uint32 dword_be;
    315     uint8* link;
    316     uint8** multiple_string;
    317     uint64 qword;
     329    uint8_t* none; /* */
     330    uint8_t* string;
     331    uint8_t* expand_string;
     332    uint8_t* binary; /* */
     333    uint32_t dword;
     334    uint32_t dword_be;
     335    uint8_t* link;
     336    uint8_t** multiple_string;
     337    uint64_t qword;
    318338
    319339    /* The following are treated as binary currently, but this may change in
    320340     * the future as the formats become better understood.
    321341     */
    322     uint8* resource_list;
    323     uint8* full_resource_descriptor;
    324     uint8* resource_requirements_list;
     342    uint8_t* resource_list;
     343    uint8_t* full_resource_descriptor;
     344    uint8_t* resource_requirements_list;
    325345  } interpreted;
    326346} REGFI_DATA;
    … …  
    330350typedef struct
    331351{
    332   uint32 offset;        /* Real offset of this record's cell in the file */
    333   uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
     352  uint32_t offset;      /* Real offset of this record's cell in the file */
     353  uint32_t cell_size;   /* ((start_offset - end_offset) & 0xfffffff8) */
    334354
    335355  REGFI_DATA* data;     /* XXX: deprecated */
    336356
    337357  char*  valuename;
    338   uint8* valuename_raw;
    339   uint16 name_length;
    340   uint32 hbin_off;      /* offset from beginning of this hbin block */
     358  uint8_t* valuename_raw;
     359  uint16_t name_length;
     360  uint32_t hbin_off;    /* offset from beginning of this hbin block */
    341361 
    342   uint32 data_size;     /* As reported in the VK record.  May be different than
     362  uint32_t data_size;     /* As reported in the VK record.  May be different than
    343363                         * That obtained while parsing the data cell itself. */
    344   uint32 data_off;      /* Offset of data cell (virtual) */
    345   uint32 type;
    346   uint8  magic[REGFI_CELL_MAGIC_SIZE];
    347   uint16 flags;
    348   uint16 unknown1;
     364  uint32_t data_off;      /* Offset of data cell (virtual) */
     365  uint32_t type;
     366  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
     367  uint16_t flags;
     368  uint16_t unknown1;
    349369  bool data_in_offset;
    350370} REGFI_VK_REC;
    … …  
    356376typedef struct _regfi_sk_rec
    357377{
    358   uint32 offset;        /* Real file offset of this record */
    359   uint32 cell_size;     /* ((start_offset - end_offset) & 0xfffffff8) */
     378  uint32_t offset;        /* Real file offset of this record */
     379  uint32_t cell_size;   /* ((start_offset - end_offset) & 0xfffffff8) */
    360380
    361381  WINSEC_DESC* sec_desc;
    362   uint32 hbin_off;      /* offset from beginning of this hbin block */
     382  uint32_t hbin_off;    /* offset from beginning of this hbin block */
    363383 
    364   uint32 prev_sk_off;
    365   uint32 next_sk_off;
    366   uint32 ref_count;
    367   uint32 desc_size;     /* size of security descriptor */
    368   uint16 unknown_tag;
    369   uint8  magic[REGFI_CELL_MAGIC_SIZE];
     384  uint32_t prev_sk_off;
     385  uint32_t next_sk_off;
     386  uint32_t ref_count;
     387  uint32_t desc_size;     /* size of security descriptor */
     388  uint16_t unknown_tag;
     389  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
    370390} REGFI_SK_REC;
    371391
    … …  
    374394typedef struct
    375395{
    376   uint32 offset;        /* Real offset of this record's cell in the file */
    377   uint32 cell_size;     /* Actual or estimated length of the cell. 
     396  uint32_t offset;      /* Real offset of this record's cell in the file */
     397  uint32_t cell_size;   /* Actual or estimated length of the cell. 
    378398                         * Always in multiples of 8.
    379399                         */
    … …  
    384404 
    385405  /* header information */
    386   uint16 flags;
    387   uint8  magic[REGFI_CELL_MAGIC_SIZE];
    388   NTTIME mtime;
    389   uint16 name_length;
    390   uint16 classname_length;
     406  uint16_t flags;
     407  uint8_t  magic[REGFI_CELL_MAGIC_SIZE];
     408  REGFI_NTTIME mtime;
     409  uint16_t name_length;
     410  uint16_t classname_length;
    391411  char* keyname;
    392   uint8* keyname_raw;
    393   uint32 parent_off;                /* pointer to parent key */
    394   uint32 classname_off;
     412  uint8_t* keyname_raw;
     413  uint32_t parent_off;              /* pointer to parent key */
     414  uint32_t classname_off;
    395415 
    396416  /* max lengths */
    397   uint32 max_bytes_subkeyname;      /* max subkey name * 2 */
    398   uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */
    399   uint32 max_bytes_valuename;       /* max valuename * 2 */
    400   uint32 max_bytes_value;           /* max value data size */
     417  uint32_t max_bytes_subkeyname;            /* max subkey name * 2 */
     418  uint32_t max_bytes_subkeyclassname; /* max subkey classname length (as if) */
     419  uint32_t max_bytes_valuename;     /* max valuename * 2 */
     420  uint32_t max_bytes_value;           /* max value data size */
    401421 
    402422  /* unknowns */
    403   uint32 unknown1;
    404   uint32 unknown2;
    405   uint32 unknown3;
    406   uint32 unk_index;                 /* nigel says run time index ? */
     423  uint32_t unknown1;
     424  uint32_t unknown2;
     425  uint32_t unknown3;
     426  uint32_t unk_index;               /* nigel says run time index ? */
    407427 
    408428  /* children */
    409   uint32 num_subkeys;
    410   uint32 subkeys_off;   /* offset of subkey list that points to NK records */
    411   uint32 num_values;
    412   uint32 values_off;    /* value lists which point to VK records */
    413   uint32 sk_off;        /* offset to SK record */
     429  uint32_t num_subkeys;
     430  uint32_t subkeys_off; /* offset of subkey list that points to NK records */
     431  uint32_t num_values;
     432  uint32_t values_off;  /* value lists which point to VK records */
     433  uint32_t sk_off;      /* offset to SK record */
    414434} REGFI_NK_REC;
    415435
    … …  
    425445
    426446  /* For sanity checking (not part of the registry header) */
    427   uint32 file_length;
     447  uint32_t file_length;
    428448
    429449  /* Metadata about hbins */
    … …  
    437457
    438458  /* Mask for error message types that will be stored. */
    439   uint16 msg_mask;
     459  uint16_t msg_mask;
    440460
    441461
    442462  /* Data parsed from file header */
    443463  /********************************/
    444   uint8  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
     464  uint8_t  magic[REGFI_REGF_MAGIC_SIZE];/* "regf" */
    445465
    446466 /* These sequence numbers should match if
    447467  * the hive was properly synced to disk.
    448468  */
    449   uint32 sequence1;           
    450   uint32 sequence2;
    451 
    452   NTTIME mtime;
    453   uint32 major_version;  /* Set to 1 in all known hives */
    454   uint32 minor_version;  /* Set to 3 or 5 in all known hives */
    455   uint32 type;           /* XXX: Unverified.  Set to 0 in all known hives */
    456   uint32 format;         /* XXX: Unverified.  Set to 1 in all known hives */
    457 
    458   uint32 root_cell;  /* Offset to root cell in the first (or any?) hbin block */
    459   uint32 last_block; /* Offset to last hbin block in file */
    460 
    461   uint32 cluster;    /* XXX: Unverified. Set to 1 in all known hives */
     469  uint32_t sequence1;           
     470  uint32_t sequence2;
     471
     472  REGFI_NTTIME mtime;
     473  uint32_t major_version;  /* Set to 1 in all known hives */
     474  uint32_t minor_version;  /* Set to 3 or 5 in all known hives */
     475  uint32_t type;           /* XXX: Unverified.  Set to 0 in all known hives */
     476  uint32_t format;         /* XXX: Unverified.  Set to 1 in all known hives */
     477
     478  uint32_t root_cell;  /* Offset to root cell in the first (or any?) hbin block */
     479  uint32_t last_block; /* Offset to last hbin block in file */
     480
     481  uint32_t cluster;    /* XXX: Unverified. Set to 1 in all known hives */
    462482
    463483  /* Matches hive's base file name. Stored in UTF-16LE */
    464   uint8 file_name[REGFI_REGF_NAME_SIZE];
     484  uint8_t file_name[REGFI_REGF_NAME_SIZE];
    465485
    466486  WINSEC_UUID* rm_id;       /* XXX: Unverified. */
    467487  WINSEC_UUID* log_id;      /* XXX: Unverified. */
    468488  WINSEC_UUID* tm_id;       /* XXX: Unverified. */
    469   uint32 flags;             /* XXX: Unverified. */
    470   uint32 guid_signature;    /* XXX: Unverified. */
    471 
    472   uint32 checksum;          /* Stored checksum from file */
    473   uint32 computed_checksum; /* Our own calculation of the checksum.
     489  uint32_t flags;             /* XXX: Unverified. */
     490  uint32_t guid_signature;    /* XXX: Unverified. */
     491
     492  uint32_t checksum;          /* Stored checksum from file */
     493  uint32_t computed_checksum; /* Our own calculation of the checksum.
    474494                             * (XOR of bytes 0x0000 - 0x01FB) */
    475495
    … …  
    477497  WINSEC_UUID* thaw_rm_id;  /* XXX: Unverified. */
    478498  WINSEC_UUID* thaw_log_id; /* XXX: Unverified. */
    479   uint32 boot_type;         /* XXX: Unverified. */
    480   uint32 boot_recover;      /* XXX: Unverified. */
     499  uint32_t boot_type;         /* XXX: Unverified. */
     500  uint32_t boot_recover;      /* XXX: Unverified. */
    481501
    482502  /* This seems to include random junk.  Possibly unsanitized memory left over
    483503   * from when header block was written.  For instance, chunks of nk records
    484504   * can be found, though often it's all 0s. */
    485   uint8 reserved1[REGFI_REGF_RESERVED1_SIZE];
     505  uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
    486506
    487507  /* This is likely reserved and unusued currently.  (Should be all 0s.)
    488508   * Included here for easier access in looking for hidden data
    489509   * or doing research. */
    490   uint8 reserved2[REGFI_REGF_RESERVED2_SIZE];
     510  uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
    491511
    492512} REGFI_FILE;
    … …  
    499519  REGFI_NK_REC* cur_key;
    500520  REGFI_ENCODING string_encoding;
    501   uint32 cur_subkey;
    502   uint32 cur_value;
     521  uint32_t cur_subkey;
     522  uint32_t cur_value;
    503523} REGFI_ITERATOR;
    504524
    … …  
    507527{
    508528  REGFI_NK_REC* nk;
    509   uint32 cur_subkey;
     529  uint32_t cur_subkey;
    510530  /* We could store a cur_value here as well, but didn't see
    511531   * the use in it right now.
    … …  
    516536typedef struct _regfi_buffer
    517537{
    518   uint8* buf;
     538  uint8_t* buf;
    519539  uint32_t len;
    520540} REGFI_BUFFER;
    521541
    522542
    523 
    524 
    525543/******************************************************************************/
    526 /*                         Main iterator API                                  */
     544/**
     545 * @defgroup regfiBase Base Functions: Usable with Any Layer
     546 *
     547 * These functions don't fit particularly well in any of the other layers or
     548 * are intended for use with any of the API layers.
     549 */
    527550/******************************************************************************/
    528551
    529 /* regfi_open: Attempts to open a registry hive and allocate related data
    530  *             structures.
    531  *
    532  * Arguments:
    533  *   filename -- A string containing the relative or absolute path of the
     552
     553/** Attempts to open a registry hive and allocate related data structures.
     554 *
     555 * @param filename A string containing the relative or absolute path of the
    534556 *               registry hive to be opened.
    535557 *
    536  * Returns:
    537  *   A reference to a newly allocated REGFI_FILE structure, if successful.
    538  *   NULL on error.
     558 * @return A reference to a newly allocated REGFI_FILE structure,
     559 *         if successful;  NULL on error.
     560 *
     561 * @ingroup regfiBase
    539562 */
    540563REGFI_FILE*           regfi_open(const char* filename);
    541564
    542565
    543 /* regfi_alloc: Parses file headers of an already open registry hive file and
    544  *              allocates related structures for further parsing.
    545  *
    546  * Arguments:
    547  *   fd       -- A file descriptor of an already open file.  Must be seekable.
    548  *
    549  * Returns:
    550  *   A reference to a newly allocated REGFI_FILE structure, if successful.
    551  *   NULL on error.
     566/** Parses file headers of an already open registry hive file and
     567 *  allocates related structures for further parsing.
     568 *
     569 * @param fd A file descriptor of an already open file.  Must be seekable.
     570 *
     571 * @return A reference to a newly allocated REGFI_FILE structure, if successful;
     572 *         NULL on error.
     573 *
     574 * @ingroup regfiBase
    552575 */
    553576REGFI_FILE*           regfi_alloc(int fd);
    554577
    555578
    556 /* regfi_close: Closes and frees an open registry hive.
    557  *
    558  * Arguments:
    559  *   file     -- The registry structure to close.
    560  *
    561  * Returns:
    562  *   0 on success, -1 on failure with errno set. 
    563  *   errno codes are similar to those of close(2).
     579/** Closes and frees an open registry hive.
     580 *
     581 * @param file The registry structure to close.
     582 *
     583 * @return 0 on success, -1 on failure with errno set. 
     584 *         errno codes are similar to those of close(2).
     585 *
     586 * @ingroup regfiBase
    564587 */
    565588int                   regfi_close(REGFI_FILE* file);
    566589
    567590
    568 /* regfi_free: Frees a hive's data structures without closing the underlying
    569  *             file.
    570  *
    571  * Arguments:
    572  *   file     -- The registry structure to free.
     591/** Frees a hive's data structures without closing the underlying file.
     592 *
     593 * @param file The registry structure to free.
     594 *
     595 * @ingroup regfiBase
    573596 */
    574597void                  regfi_free(REGFI_FILE* file);
    575598
    576599
    577 /* regfi_get_messages: Get errors, warnings, and/or verbose information
    578  *                     relating to processing of the given registry file.
    579  *
    580  * Arguments:
    581  *   file     -- the structure for the registry file
    582  *
    583  * Returns:
    584  *   A newly allocated char* which must be free()d by the caller.
     600/** Get errors, warnings, and/or verbose information relating to processing of
     601 *  the given registry file.
     602 *
     603 * @param file the structure for the registry file
     604 *
     605 * @return A newly allocated char* which must be free()d by the caller.
     606 *
     607 * @ingroup regfiBase
    585608 */
    586609char*                 regfi_get_messages(REGFI_FILE* file);
    587610
    588611
    589 /* regfi_set_message_mask: Set the verbosity level of errors and warnings
    590  *                         generated by the library
    591  *                         (as accessible via regfi_get_messages).
    592  *
    593  * Arguments:
    594  *   file     -- the structure for the registry file
    595  *   mask     -- an integer representing the types of messages desired.
     612/** Set the verbosity level of errors and warnings generated by the library
     613 *  (as accessible via regfi_get_messages).
     614 *
     615 * This may be called at any time and will take effect immediately.
     616 *
     617 * @param file   the structure for the registry file
     618 *
     619 * @param mask   an integer representing the types of messages desired.
    596620 *               Acceptable values are created through bitwise ORs of
    597621 *               REGFI_MSG_* values.  For instance, if only errors and
    … …  
    606630 *               will prevent message accumulation. 
    607631 *
    608  * This may be called at any time and will take effect immediately.
    609  */
    610 void                  regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
    611 
    612 
    613 /* regfi_iterator_new: Creates a new iterator for the provided registry file.
    614  *
    615  * Arguments:
    616  *   file            -- The opened registry file the iterator should be
    617  *                      created for.
    618  *   output_encoding -- Character encoding that strings should be returned in.
    619  *                      Only supply the REGFI_ENCODING_* constants, as others
    620  *                      will be rejected.
    621  *                      The following values are currently accepted:
    622  *                      REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
    623  *                      REGFI_ENCODING_ASCII
    624  *                      REGFI_ENCODING_UTF8
    625  *
    626  * Returns:
    627  *   A newly allocated REGFI_ITERATOR. Must be free()d with regfi_iterator_free.
     632 * @ingroup regfiBase
     633 */
     634void                  regfi_set_message_mask(REGFI_FILE* file, uint16_t mask);
     635
     636
     637/* Dispose of previously parsed records */
     638
     639/** Frees a key structure previously returned by one of the API functions
     640 *
     641 * XXX: finish documenting
     642 *
     643 * @ingroup regfiBase
     644 */
     645void                  regfi_free_key(REGFI_NK_REC* nk);
     646
     647
     648/** Frees a value structure previously returned by one of the API functions
     649 *
     650 * XXX: finish documenting
     651 *
     652 * @ingroup regfiBase
     653 */
     654void                  regfi_free_value(REGFI_VK_REC* vk);
     655
     656
     657
     658/******************************************************************************/
     659/**
     660 * @defgroup regfiTopLayer Top Layer: Primary regfi Library Interface
     661 *
     662 * This top layer of API functions provides an iterator interface which makes
     663 * traversing registry data structures easy in both single-threaded and
     664 * multi-threaded scenarios.
     665 */
     666/******************************************************************************/
     667
     668/** Creates a new iterator for the provided registry file.
     669 *
     670 * @param file The opened registry file the iterator should be created for.
     671 *
     672 * @param output_encoding Character encoding that strings should be returned in.
     673 *                        Only supply the REGFI_ENCODING_* constants, as others
     674 *                        will be rejected.
     675 *                        The following values are currently accepted:
     676 *                        REGFI_ENCODING_DEFAULT (currently REGFI_ENCODING_ASCII)
     677 *                        REGFI_ENCODING_ASCII
     678 *                        REGFI_ENCODING_UTF8
     679 *
     680 * @return A newly allocated REGFI_ITERATOR.
     681 *         Must be free()d with regfi_iterator_free.
     682 *
     683 * @ingroup regfiTopLayer
    628684 */
    629685REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* file,
    … …  
    631687
    632688
    633 /* regfi_iterator_free: Frees a registry file iterator previously created by
    634  *                      regfi_iterator_new.
     689/** Frees a registry file iterator previously created by regfi_iterator_new.
    635690 *
    636691 * This does not affect the underlying registry file's allocation status.
    637692 *
    638  * Arguments:
    639  *   file            -- the iterator to be freed
     693 * @param i the iterator to be freed
     694 *
     695 * @ingroup regfiTopLayer
    640696 */
    641697void                  regfi_iterator_free(REGFI_ITERATOR* i);
    642698
    643699
    644 /* regfi_iterator_down: Traverse deeper into the registry tree at the
    645  *                      current subkey.
    646  *
    647  * Arguments:
    648  *   i            -- the iterator
    649  *
    650  * Returns:
    651  *   true on success, false on failure.  Note that subkey and value indexes
    652  *   are preserved.  That is, if a regfi_iterator_up call occurs later
    653  *   (reversing the effect of this call) then the subkey and value referenced
    654  *   prior to the regfi_iterator_down call will still be referenced.  This
    655  *   makes depth-first iteration particularly easy.
     700/** Traverse deeper into the registry tree at the current subkey.
     701 *
     702 * @param i the iterator
     703 *
     704 * @return  true on success, false on failure. 
     705 *          Note that subkey and value indexes are preserved.  That is, if a
     706 *          regfi_iterator_up call occurs later (reversing the effect of this
     707 *          call) then the subkey and value referenced prior to the
     708 *          regfi_iterator_down call will still be referenced.  This  makes
     709 *          depth-first iteration particularly easy.
     710 *
     711 * @ingroup regfiTopLayer
    656712 */
    657713bool                  regfi_iterator_down(REGFI_ITERATOR* i);
    658714
    659715
    660 /* regfi_iterator_up: Traverse up to the current key's parent key.
    661  *
    662  * Arguments:
    663  *   i            -- the iterator
    664  *
    665  * Returns:
    666  *   true on success, false on failure.  Any subkey or value state
    667  *   associated with the current key is lost.
     716/** Traverse up to the current key's parent key.
     717 *
     718 * @param i the iterator
     719 *
     720 * @return  true on success, false on failure.  Any subkey or value state
     721 *          associated with the current key is lost.
     722 *
     723 * @ingroup regfiTopLayer
    668724 */
    669725bool                  regfi_iterator_up(REGFI_ITERATOR* i);
    670726
    671727
    672 /* regfi_iterator_to_root: Traverse up to the root key of the hive.
    673  *
    674  * Arguments:
    675  *   i            -- the iterator
    676  *
    677  * Returns:
    678  *   true on success, false on failure.
     728/** Traverse up to the root key of the hive.
     729 *
     730 * @param i the iterator
     731 *
     732 * @return true on success, false on failure.
     733 *
     734 * @ingroup regfiTopLayer
    679735 */
    680736bool                  regfi_iterator_to_root(REGFI_ITERATOR* i);
    681737
    682738
    683 /* regfi_iterator_walk_path: Traverse down multiple levels in the registry hive.
    684  *
    685  * Arguments:
    686  *   i            -- the iterator
    687  *   path         -- a list of key names representing the path.  This list must
    688  *                   contain NUL terminated strings.  The list itself is
    689  *                   terminated with a NULL pointer.  All path elements must be
    690  *                   keys; value names are not accepted (even as the last
    691  *                   element).
     739/** Traverse down multiple levels in the registry hive.
    692740 *
    693741 * XXX: This currently only accepts ASCII key names.  Need to look into
    694742 *      accepting other encodings.
    695743 *
    696  * Returns:
    697  *   true on success, false on failure.  If any element of path is not found,
    698  *   false will be returned and the iterator will remain in its original
    699  *   position.
    700  */
    701 bool                  regfi_iterator_walk_path(REGFI_ITERATOR* i,
    702                                                const char** path);
    703 
    704 
    705 /* regfi_iterator_cur_key: Returns the currently referenced key.
    706  *
    707  * Arguments:
    708  *   i            -- the iterator
    709  *
    710  * Returns:
    711  *   A read-only key structure for the current key, or NULL on failure.
     744 * @param i    the iterator
     745 * @param path a list of key names representing the path.  This list must
     746 *             contain NUL terminated strings.  The list itself is
     747 *             terminated with a NULL pointer.  All path elements must be
     748 *             keys; value names are not accepted (even as the last
     749 *             element).
     750 *
     751 * @return true on success, false on failure.  If any element of path is not
     752 *                 found, false will be returned and the iterator will remain
     753 *                 in its original position.
     754 *
     755 * @ingroup regfiTopLayer
     756 */
     757bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
     758
     759
     760/** Returns the currently referenced key.
     761 *
     762 * @param i the iterator
     763 *
     764 * @return A read-only key structure for the current key, or NULL on failure.
     765 *
     766 * @ingroup regfiTopLayer
    712767 */
    713768const REGFI_NK_REC*   regfi_iterator_cur_key(REGFI_ITERATOR* i);
    714769
    715770
    716 /* regfi_iterator_cur_sk: Returns the SK (security) record referenced by the
    717  *                        current key.
    718  *
    719  * Arguments:
    720  *   i            -- the iterator
    721  *
    722  * Returns:
    723  *   A read-only SK structure, or NULL on failure.
     771/** Returns the SK (security) record referenced by the current key.
     772 *
     773 * @param i the iterator
     774 *
     775 * @return A read-only SK structure, or NULL on failure.
     776 *
     777 * @ingroup regfiTopLayer
    724778 */
    725779const REGFI_SK_REC*   regfi_iterator_cur_sk(REGFI_ITERATOR* i);
    726780
    727781
    728 /* regfi_iterator_first_subkey: Sets the internal subkey index to the first
    729  *                              subkey referenced by the current key and returns
    730  *                              that key.
    731  *
    732  * Arguments:
    733  *   i            -- the iterator
    734  *
    735  * Returns:
    736  *   A newly allocated key structure for the newly referenced first subkey, or
    737  *   NULL on failure.  Failure may be due to a lack of any subkeys or other
    738  *   errors.  Newly allocated keys must be freed with regfi_free_key.
     782/** Sets the internal subkey index to the first subkey referenced by the current
     783 *  key and returns that key.
     784 *
     785 * @param i the iterator
     786 *
     787 * @return A newly allocated key structure for the newly referenced first
     788 *         subkey, or NULL on failure.  Failure may be due to a lack of any
     789 *         subkeys or other errors.  Newly allocated keys must be freed with
     790 *         regfi_free_key.
     791 *
     792 * @ingroup regfiTopLayer
    739793 */
    740794REGFI_NK_REC*         regfi_iterator_first_subkey(REGFI_ITERATOR* i);
    741795
    742796
    743 /* regfi_iterator_cur_subkey: Returns the currently indexed subkey.
    744  *
    745  * Arguments:
    746  *   i            -- the iterator
    747  *
    748  * Returns:
    749  *   A newly allocated key structure for the currently referenced subkey,
    750  *   or NULL on failure.  Newly allocated keys must be freed with
    751  *   regfi_free_key.
     797/** Returns the currently indexed subkey.
     798 *
     799 * @param i the iterator
     800 *
     801 * @return A newly allocated key structure for the currently referenced subkey,
     802 *         or NULL on failure.  Newly allocated keys must be freed with
     803 *         regfi_free_key.
     804 *
     805 * @ingroup regfiTopLayer
    752806 */
    753807REGFI_NK_REC*         regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
    754808
    755809
    756 /* regfi_iterator_next_subkey: Increments the internal subkey index to the next
    757  *                             key in the subkey-list and returns the subkey
    758  *                             for that index.
    759  *
    760  * Arguments:
    761  *   i            -- the iterator
    762  *
    763  * Returns:
    764  *   A newly allocated key structure for the next subkey or NULL on
    765  *   failure.  Newly allocated keys must be freed with
    766  *   regfi_free_key.
     810/** Increments the internal subkey index to the next key in the subkey-list and
     811 *  returns the subkey for that index.
     812 *
     813 * @param i the iterator
     814 *
     815 * @return A newly allocated key structure for the next subkey or NULL on
     816 *         failure.  Newly allocated keys must be freed with regfi_free_key.
     817 *
     818 * @ingroup regfiTopLayer
    767819 */
    768820REGFI_NK_REC*         regfi_iterator_next_subkey(REGFI_ITERATOR* i);
    769821
    770822
    771 /* regfi_iterator_find_subkey: Searches for a subkey with a given name under the
    772  *                             current key.
    773  *
    774  * Arguments:
    775  *   i            -- the iterator
    776  *   subkey_name  -- subkey name to search for
    777  *
    778  * Returns:
    779  *   True if such a subkey was found, false otherwise.  If a subkey is found,
    780  *   the current subkey index is set to that subkey.  Otherwise, the subkey
    781  *   index remains at the same location as before the call.
     823/** Searches for a subkey with a given name under the current key.
     824 *
     825 * @param i           the iterator
     826 * @param subkey_name subkey name to search for
     827 *
     828 * @return True if such a subkey was found, false otherwise.  If a subkey is
     829 *         found, the current subkey index is set to that subkey.  Otherwise,
     830 *         the subkey index remains at the same location as before the call.
     831 *
     832 * @ingroup regfiTopLayer
    782833 */
    783834bool                  regfi_iterator_find_subkey(REGFI_ITERATOR* i,
    784835                                                 const char* subkey_name);
    785836
    786 /* regfi_iterator_first_value: Sets the internal value index to the first
    787  *                             value referenced by the current key and returns
    788  *                             that value.
    789  *
    790  * Arguments:
    791  *   i            -- the iterator
    792  *
    793  * Returns:
    794  *   A newly allocated value structure for the newly referenced first value,
    795  *   or NULL on failure.  Failure may be due to a lack of any values or other
    796  *   errors.  Newly allocated keys must be freed with regfi_free_value.
     837/** Sets the internal value index to the first value referenced by the current
     838 *  key and returns that value.
     839 *
     840 * @param i the iterator
     841 *
     842 * @return  A newly allocated value structure for the newly referenced first
     843 *          value, or NULL on failure.  Failure may be due to a lack of any
     844 *          values or other errors.  Newly allocated keys must be freed with
     845 *          regfi_free_value.
     846 *
     847 * @ingroup regfiTopLayer
    797848 */
    798849REGFI_VK_REC*         regfi_iterator_first_value(REGFI_ITERATOR* i);
    799850
    800851
    801 /* regfi_iterator_cur_value: Returns the currently indexed value.
    802  *
    803  * Arguments:
    804  *   i            -- the iterator
    805  *
    806  * Returns:
    807  *   A newly allocated value structure for the currently referenced value,
    808  *   or NULL on failure.  Newly allocated values must be freed with
    809  *   regfi_free_value.
     852/** Returns the currently indexed value.
     853 *
     854 * @param i the iterator
     855 *
     856 * @return A newly allocated value structure for the currently referenced value,
     857 *         or NULL on failure.  Newly allocated values must be freed with
     858 *         regfi_free_value.
     859 *
     860 * @ingroup regfiTopLayer
    810861 */
    811862REGFI_VK_REC*         regfi_iterator_cur_value(REGFI_ITERATOR* i);
    812863
    813864
    814 /* regfi_iterator_next_value: Increments the internal value index to the next
    815  *                            value in the value-list and returns the value
    816  *                            for that index.
    817  *
    818  * Arguments:
    819  *   i            -- the iterator
    820  *
    821  * Returns:
    822  *   A newly allocated key structure for the next value or NULL on failure.
    823  *   Newly allocated keys must be freed with regfi_free_value.
     865/** Increments the internal value index to the next value in the value-list and
     866 *  returns the value for that index.
     867 *
     868 * @param i the iterator
     869 *
     870 * @return  A newly allocated key structure for the next value or NULL on
     871 *          failure.  Newly allocated keys must be freed with regfi_free_value.
     872 *
     873 * @ingroup regfiTopLayer
    824874 */
    825875REGFI_VK_REC*         regfi_iterator_next_value(REGFI_ITERATOR* i);
    826876
    827877
    828 /* regfi_iterator_find_value: Searches for a value with a given name under the
    829  *                            current key.
    830  *
    831  * Arguments:
    832  *   i            -- the iterator
    833  *   value_name   -- value name to search for
    834  *
    835  * Returns:
    836  *   True if such a value was found, false otherwise.  If a value is found,
    837  *   the current value index is set to that value.  Otherwise, the value
    838  *   index remains at the same location as before the call.
     878/** Searches for a value with a given name under the current key.
     879 *
     880 * @param i          the iterator
     881 * @param value_name value name to search for
     882 *
     883 * @return True if such a value was found, false otherwise.  If a value is
     884 *         found, the current value index is set to that value.  Otherwise,
     885 *         the value index remains at the same location as before the call.
     886 *
     887 * @ingroup regfiTopLayer
    839888 */
    840889bool                  regfi_iterator_find_value(REGFI_ITERATOR* i,
    841890                                                const char* value_name);
    842891
    843 
    844 /* regfi_iterator_fetch_classname: Retrieves classname for a given key.
    845  *
    846  * Arguments:
    847  *   i            -- the iterator
    848  *   key          -- the key whose classname is desired
    849  *
    850  * Returns:
    851  *   Returns a newly allocated classname structure, or NULL on failure.
    852  *   Classname structures must be freed with regfi_free_classname.
     892/** Retrieves classname for a given key.
     893 *
     894 * @param i   the iterator
     895 * @param key the key whose classname is desired
     896 *
     897 * @return Returns a newly allocated classname structure, or NULL on failure.
     898 *         Classname structures must be freed with regfi_free_classname.
     899 *
     900 * @ingroup regfiTopLayer
    853901 */
    854902REGFI_CLASSNAME*      regfi_iterator_fetch_classname(REGFI_ITERATOR* i,
    … …  
    856904
    857905
    858 /* regfi_iterator_fetch_data: Retrieves data for a given value.
    859  *
    860  * Arguments:
    861  *   i            -- the iterator
    862  *   value        -- the value whose data is desired
    863  *
    864  * Returns:
    865  *   Returns a newly allocated data structure, or NULL on failure.
    866  *   Data structures must be freed with regfi_free_data.
     906/** Retrieves data for a given value.
     907 *
     908 * @param i     the iterator
     909 * @param value the value whose data is desired
     910 *
     911 * @return Returns a newly allocated data structure, or NULL on failure.
     912 *         Data structures must be freed with regfi_free_data.
     913 *
     914 * @ingroup regfiTopLayer
    867915 */
    868916REGFI_DATA*           regfi_iterator_fetch_data(REGFI_ITERATOR* i,
    … …  
    870918
    871919
    872 /********************************************************/
    873 /* Middle-layer structure loading, linking, and caching */
    874 /********************************************************/
    875 REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32 offset,
     920
     921/******************************************************************************/
     922/**
     923 * @defgroup regfiMiddleLayer Middle Layer: Logical Data Structure Loading
     924 */
     925/******************************************************************************/
     926
     927/** Loads a key at a given file offset along with associated data structures.
     928 *
     929 * XXX: finish documenting
     930 *
     931 * @ingroup regfiMiddleLayer
     932 */
     933REGFI_NK_REC*         regfi_load_key(REGFI_FILE* file, uint32_t offset,
    876934                                     REGFI_ENCODING output_encoding,
    877935                                     bool strict);
    878 REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32 offset,
     936
     937
     938/** Loads a value at a given file offset alng with associated data structures.
     939 *
     940 * XXX: finish documenting
     941 *
     942 * @ingroup regfiMiddleLayer
     943 */
     944REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32_t offset,
    879945                                       REGFI_ENCODING output_encoding,
    880946                                       bool strict);
    881 REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,
    882                                             uint32 num_keys, uint32 max_size,
     947
     948
     949/** Loads a logical subkey list in its entirety which may span multiple records.
     950 *
     951 * XXX: finish documenting
     952 *
     953 * @ingroup regfiMiddleLayer
     954 */
     955REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32_t offset,
     956                                            uint32_t num_keys, uint32_t max_size,
    883957                                            bool strict);
    884 REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32 offset,
    885                                            uint32 num_values, uint32 max_size,
     958
     959
     960/** Loads a valuelist.
     961 *
     962 * XXX: finish documenting
     963 *
     964 * @ingroup regfiMiddleLayer
     965 */
     966REGFI_VALUE_LIST*     regfi_load_valuelist(REGFI_FILE* file, uint32_t offset,
     967                                           uint32_t num_values, uint32_t max_size,
    886968                                           bool strict);
    887969
    888 REGFI_BUFFER          regfi_load_data(REGFI_FILE* file, uint32 voffset,
    889                                       uint32 length, bool data_in_offset,
     970
     971/** Loads a data record which may be contained in the virtual offset, in a
     972 *  single cell, or in multiple cells through big data records.
     973 *
     974 * XXX: finish documenting
     975 *
     976 * @ingroup regfiMiddleLayer
     977 */
     978REGFI_BUFFER          regfi_load_data(REGFI_FILE* file, uint32_t voffset,
     979                                      uint32_t length, bool data_in_offset,
    890980                                      bool strict);
    891981
    892 REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file, uint32 offset,
    893                                           uint32 data_length,uint32 cell_length,
     982
     983/** Loads the data associated with a big data record at the specified offset.
     984 *
     985 * XXX: finish documenting
     986 *
     987 * @ingroup regfiMiddleLayer
     988 */
     989REGFI_BUFFER          regfi_load_big_data(REGFI_FILE* file, uint32_t offset,
     990                                          uint32_t data_length,uint32_t cell_length,
    894991                                          range_list* used_ranges,
    895992                                          bool strict);
     993
     994
     995/** Given raw data, attempts to interpret the data based on a specified registry
     996 *  data type.
     997 *
     998 * XXX: finish documenting
     999 *
     1000 * @ingroup regfiMiddleLayer
     1001 */
    8961002bool                  regfi_interpret_data(REGFI_FILE* file,
    8971003                                           REGFI_ENCODING string_encoding,
    898                                            uint32 type, REGFI_DATA* data);
     1004                                           uint32_t type, REGFI_DATA* data);
     1005
     1006
     1007/** Frees the memory associated with a REGFI_CLASSNAME data structure.
     1008 *
     1009 * XXX: finish documenting
     1010 *
     1011 * @ingroup regfiMiddleLayer
     1012 */
    8991013void                  regfi_free_classname(REGFI_CLASSNAME* classname);
     1014
     1015
     1016/** Frees the memory associated with a REGFI_DATA data structure.
     1017 *
     1018 * XXX: finish documenting
     1019 *
     1020 * @ingroup regfiMiddleLayer
     1021 */
    9001022void                  regfi_free_data(REGFI_DATA* data);
    9011023
    9021024
    9031025/* These are cached so return values don't need to be freed. */
    904 const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32 offset,
     1026
     1027/** Loads an "sk" security record at the specified offset.
     1028 *
     1029 * XXX: finish documenting
     1030 *
     1031 * @ingroup regfiMiddleLayer
     1032 */
     1033const REGFI_SK_REC*   regfi_load_sk(REGFI_FILE* file, uint32_t offset,
    9051034                                    bool strict);
    906 const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32 offset);
    907 
    908 
    909 /************************************/
    910 /*  Low-layer data structure access */
    911 /************************************/
     1035
     1036
     1037/** Retrieves the HBIN data structure stored at the specified offset.
     1038 *
     1039 * XXX: finish documenting
     1040 *
     1041 * @ingroup regfiMiddleLayer
     1042 */
     1043const REGFI_HBIN*     regfi_lookup_hbin(REGFI_FILE* file, uint32_t offset);
     1044
     1045
     1046
     1047/******************************************************************************/
     1048/**
     1049 * @defgroup regfiBottomLayer Bottom Layer: Direct Data Structure Access
     1050 */
     1051/******************************************************************************/
     1052
    9121053REGFI_FILE*           regfi_parse_regf(int fd, bool strict);
    913 REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32 offset,
     1054REGFI_HBIN*           regfi_parse_hbin(REGFI_FILE* file, uint32_t offset,
    9141055                                       bool strict);
    9151056
    9161057
    917 /* regfi_parse_nk: Parses an NK record.
    918  *
    919  * Arguments:
    920  *   f        -- the registry file structure
    921  *   offset   -- the offset of the cell (not the record) to be parsed.
    922  *   max_size -- the maximum size the NK cell could be. (for validation)
    923  *   strict   -- if true, rejects any malformed records.  Otherwise,
    924  *               tries to minimally validate integrity.
    925  * Returns:
    926  *   A newly allocated NK record structure, or NULL on failure.
    927  */
    928 REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32 offset,
    929                                      uint32 max_size, bool strict);
    930 
    931 REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32 offset,
    932                                              uint32 max_size, bool strict);
    933 
    934 REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32 offset,
    935                                      uint32 max_size, bool strict);
    936 
    937 REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32 offset,
    938                                      uint32 max_size, bool strict);
    939 
     1058/** Parses an NK record at the specified offset
     1059 *
     1060 * @param file     the registry file structure
     1061 * @param offset   the offset of the cell (not the record) to be parsed.
     1062 * @param max_size the maximum size the NK cell could be. (for validation)
     1063 * @param strict   if true, rejects any malformed records.  Otherwise,
     1064 *                 tries to minimally validate integrity.
     1065 *
     1066 * @return A newly allocated NK record structure, or NULL on failure.
     1067 *
     1068 * @ingroup regfiBottomLayer
     1069 */
     1070REGFI_NK_REC*         regfi_parse_nk(REGFI_FILE* file, uint32_t offset,
     1071                                     uint32_t max_size, bool strict);
     1072
     1073
     1074/** Parses a single cell containing a subkey-list record.
     1075 *
     1076 * XXX: finish documenting
     1077 *
     1078 * @ingroup regfiBottomLayer
     1079 */
     1080REGFI_SUBKEY_LIST*    regfi_parse_subkeylist(REGFI_FILE* file, uint32_t offset,
     1081                                             uint32_t max_size, bool strict);
     1082
     1083
     1084/** Parses a VK (value) record at the specified offset
     1085 *
     1086 * XXX: finish documenting
     1087 *
     1088 * @ingroup regfiBottomLayer
     1089 */
     1090REGFI_VK_REC*         regfi_parse_vk(REGFI_FILE* file, uint32_t offset,
     1091                                     uint32_t max_size, bool strict);
     1092
     1093
     1094/** Parses an SK (security) record at the specified offset
     1095 *
     1096 * XXX: finish documenting
     1097 *
     1098 * @ingroup regfiBottomLayer
     1099 */
     1100REGFI_SK_REC*         regfi_parse_sk(REGFI_FILE* file, uint32_t offset,
     1101                                     uint32_t max_size, bool strict);
     1102
     1103
     1104/** Retrieves information on all cells in the registry hive which are
     1105 *  currently in the unallocated status. 
     1106 *
     1107 * The unallocated status is determined based soley on the cell length sign.
     1108 *
     1109 * XXX: finish documenting
     1110 *
     1111 * @ingroup regfiBottomLayer
     1112 */
    9401113range_list*           regfi_parse_unalloc_cells(REGFI_FILE* file);
    9411114
    942 bool                  regfi_parse_cell(int fd, uint32 offset,
    943                                        uint8* hdr, uint32 hdr_len,
    944                                        uint32* cell_length, bool* unalloc);
    945 
    946 uint8*                regfi_parse_classname(REGFI_FILE* file, uint32 offset,
    947                                             uint16* name_length,
    948                                             uint32 max_size, bool strict);
    949 
    950 REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, uint32 offset,
    951                                        uint32 length, bool strict);
    952 
    953 REGFI_BUFFER          regfi_parse_little_data(REGFI_FILE* file, uint32 voffset,
    954                                               uint32 length, bool strict);
    955 
    956 
    957 /* Dispose of previously parsed records */
    958 void                  regfi_free_key(REGFI_NK_REC* nk);
    959 void                  regfi_free_value(REGFI_VK_REC* vk);
    960 
    961 
    962 
    963 /************************************/
    964 /*    Private Functions             */
    965 /************************************/
     1115
     1116/** Helper function to parse a cell
     1117 *
     1118 * XXX: finish documenting
     1119 *
     1120 * @ingroup regfiBottomLayer
     1121 */
     1122bool                  regfi_parse_cell(int fd, uint32_t offset,
     1123                                       uint8_t* hdr, uint32_t hdr_len,
     1124                                       uint32_t* cell_length, bool* unalloc);
     1125
     1126
     1127/** Parses a classname cell
     1128 *
     1129 * XXX: finish documenting
     1130 *
     1131 * @ingroup regfiBottomLayer
     1132 */
     1133uint8_t*                regfi_parse_classname(REGFI_FILE* file, uint32_t offset,
     1134                                            uint16_t* name_length,
     1135                                            uint32_t max_size, bool strict);
     1136
     1137
     1138/** Parses a single-cell data record
     1139 *
     1140 * XXX: finish documenting
     1141 *
     1142 * @ingroup regfiBottomLayer
     1143 */
     1144REGFI_BUFFER          regfi_parse_data(REGFI_FILE* file, uint32_t offset,
     1145                                       uint32_t length, bool strict);
     1146
     1147
     1148/** Parses a "little data" record which is stored entirely within the
     1149 *  provided virtual offset.
     1150 *
     1151 * XXX: finish documenting
     1152 *
     1153 * @ingroup regfiBottomLayer
     1154 */
     1155REGFI_BUFFER          regfi_parse_little_data(REGFI_FILE* file, uint32_t voffset,
     1156                                              uint32_t length, bool strict);
     1157
     1158
     1159/******************************************************************************/
     1160/*    Private Functions                                                       */
     1161/******************************************************************************/
    9661162REGFI_NK_REC*         regfi_rootkey(REGFI_FILE* file,
    9671163                                    REGFI_ENCODING output_encoding);
    9681164void                  regfi_subkeylist_free(REGFI_SUBKEY_LIST* list);
    969 uint32                regfi_read(int fd, uint8* buf, uint32* length);
     1165uint32_t                regfi_read(int fd, uint8_t* buf, uint32_t* length);
    9701166
    9711167const char*           regfi_type_val2str(unsigned int val);
    … …  
    9771173char*                 regfi_get_group(WINSEC_DESC* sec_desc);
    9781174
    979 REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16 num_lists,
     1175REGFI_SUBKEY_LIST*    regfi_merge_subkeylists(uint16_t num_lists,
    9801176                                              REGFI_SUBKEY_LIST** lists,
    9811177                                              bool strict);
    982 REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32 offset,
    983                                                 uint32 max_size, bool strict,
    984                                                 uint8 depth_left);
    985 void                  regfi_add_message(REGFI_FILE* file, uint16 msg_type,
     1178REGFI_SUBKEY_LIST*    regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
     1179                                                uint32_t max_size, bool strict,
     1180                                                uint8_t depth_left);
     1181void                  regfi_add_message(REGFI_FILE* file, uint16_t msg_type,
    9861182                                        const char* fmt, ...);
    9871183REGFI_NK_REC*         regfi_copy_nk(const REGFI_NK_REC* nk);
    9881184REGFI_VK_REC*         regfi_copy_vk(const REGFI_VK_REC* vk);
    989 int32                 regfi_calc_maxsize(REGFI_FILE* file, uint32 offset);
    990 int32                 regfi_conv_charset(const char* input_charset,
     1185int32_t               regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
     1186int32_t               regfi_conv_charset(const char* input_charset,
    9911187                                         const char* output_charset,
    992                                          uint8* input, char* output,
    993                                          uint32 input_len, uint32 output_max);
     1188                                         uint8_t* input, char* output,
     1189                                         uint32_t input_len, uint32_t output_max);
    9941190REGFI_DATA*           regfi_buffer_to_data(REGFI_BUFFER raw_data);
    9951191
     1192/* XXX: move to base API and document */
     1193void                  regfi_unix2nt_time(REGFI_NTTIME* nt, time_t t);
     1194time_t                regfi_nt2unix_time(const REGFI_NTTIME* nt);
     1195
     1196
    9961197#endif  /* _REGFI_H */
Note: See TracChangeset for help on using the changeset viewer.