Changeset 80 for trunk

Timestamp:

01/16/07 20:46:07 (17 years ago)

Author:

tim

Message:

Major API updates for regfi, and started porting reglookup to the API.

Code is non-functional, but should be soon.

Location:

trunk

Files:

• include/regfi.h (modified) (3 diffs)
• include/void_stack.h (modified) (2 diffs)
• lib/regfi.c (modified) (12 diffs)
• lib/void_stack.c (modified) (3 diffs)
• src/reglookup.c (modified) (6 diffs)

trunk/include/regfi.h

@@ -68 +68 @@
 /* XXX: Has MS defined a REG_QWORD_BE? */
 /* Not a real type in the registry */
-#define REG_KEY                        255
+#define REG_KEY                        0xFFFFFFFF
 
 
@@ -258 +258 @@
 
 
-
 typedef struct {
   REGF_FILE* f;
-  void_stack* keys;
+  void_stack* key_positions;
+  REGF_NK_REC* cur_key;
   uint32 cur_subkey;
   uint32 cur_value;
 } REGFI_ITERATOR;
 
+
+typedef struct {
+  REGF_NK_REC* nk;
+  uint32 cur_subkey;
+  /* We could store a cur_value here as well, but didn't see 
+   * the use in it right now.
+   */
+} REGFI_ITER_POSITION;
+
+
 /******************************************************************************/
 /* Function Declarations */
@@ -272 +282 @@
 int           regfi_type_str2val(const char* str);
 
-char*         regfi_get_sacl(SEC_DESC *sec_desc);
-char*         regfi_get_dacl(SEC_DESC *sec_desc);
-char*         regfi_get_owner(SEC_DESC *sec_desc);
-char*         regfi_get_group(SEC_DESC *sec_desc);
-
-REGF_FILE*    regfi_open( const char *filename );
-int           regfi_close( REGF_FILE *r );
-
-REGF_NK_REC*  regfi_rootkey( REGF_FILE *file );
-/* REGF_NK_REC*  regfi_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk ); */
-
-REGFI_ITERATOR* regfi_iterator_create(REGF_FILE* fh);
-bool            regfi_iterator_down(REGFI_ITERATOR* i, const char* subkey_name);
+char*         regfi_get_sacl(SEC_DESC* sec_desc);
+char*         regfi_get_dacl(SEC_DESC* sec_desc);
+char*         regfi_get_owner(SEC_DESC* sec_desc);
+char*         regfi_get_group(SEC_DESC* sec_desc);
+
+REGF_FILE*    regfi_open(const char* filename);
+int           regfi_close(REGF_FILE* r);
+
+REGF_NK_REC*  regfi_rootkey( REGF_FILE* file );
+/* REGF_NK_REC*  regfi_fetch_subkey( REGF_FILE* file, REGF_NK_REC* nk ); */
+
+void            regfi_key_free(REGF_NK_REC* nk);
+void            regfi_value_free(REGF_VK_REC* vk);
+
+REGFI_ITERATOR* regfi_iterator_new(REGF_FILE* fh);
+void            regfi_iterator_free(REGFI_ITERATOR* i);
+bool            regfi_iterator_down(REGFI_ITERATOR* i);
 bool            regfi_iterator_up(REGFI_ITERATOR* i);
+bool            regfi_iterator_to_root(REGFI_ITERATOR* i);
+
+bool            regfi_iterator_find_subkey(REGFI_ITERATOR* i, const char* subkey_name)
+bool            regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path);
+REGF_NK_REC*    regfi_iterator_cur_key(REGFI_ITERATOR* i);
+REGF_NK_REC*    regfi_iterator_first_subkey(REGFI_ITERATOR* i);
+REGF_NK_REC*    regfi_iterator_cur_subkey(REGFI_ITERATOR* i);
 REGF_NK_REC*    regfi_iterator_next_subkey(REGFI_ITERATOR* i);
+
+bool            regfi_iterator_find_value(REGFI_ITERATOR* i, const char* value_name);
+REGF_VK_REC*    regfi_iterator_first_value(REGFI_ITERATOR* i);
+REGF_VK_REC*    regfi_iterator_cur_value(REGFI_ITERATOR* i);
 REGF_VK_REC*    regfi_iterator_next_value(REGFI_ITERATOR* i);
-REGF_VK_REC*    regfi_iterator_fetch_value(REGFI_ITERATOR* i, const char* value_name);
-char*           regfi_iterator_curpath(REGFI_ITERATOR* i);
 
 #endif  /* _REGFI_H */

trunk/include/void_stack.h

@@ -39 +39 @@
 
 
+/* XXX: need to document these interfaces */
 void_stack* void_stack_new(unsigned short max_size);
 void_stack* void_stack_copy(const void_stack* v);
 void_stack* void_stack_copy_reverse(const void_stack* v);
-void void_stack_destroy(void_stack* stack);
-void void_stack_destroy_deep(void_stack* stack);
+void void_stack_free(void_stack* stack);
+void void_stack_free_deep(void_stack* stack);
 unsigned short void_stack_size(void_stack* stack);
 void* void_stack_pop(void_stack* stack);
@@ -49 +50 @@
 const void* void_stack_cur(void_stack* stack);
 void_stack_iterator* void_stack_iterator_new(void_stack* stack);
-void void_stack_iterator_destroy(void_stack_iterator* iter);
+void void_stack_iterator_free(void_stack_iterator* iter);
 const void* void_stack_iterator_next(void_stack_iterator* iter);
 

trunk/lib/regfi.c

@@ -601 +601 @@
   if ( class_length ) 
   {
+    /* XXX: why isn't this parsed? */
     ;;
   }
@@ -833 +834 @@
 
   if ( hbin )
+    /* XXX: this kind of caching needs to be re-evaluated */
     DLIST_ADD( file->block_list, hbin );
 
@@ -1107 +1109 @@
 
   depth++;
-        
+  
   /* check if we have anything to do first */
   if(nk->num_values == 0)
     return true;
-                
+        
   if(hbin->ps.io)
   {
@@ -1118 +1120 @@
       return false;
   }
-        
+  
   /* convert the offset to something relative to this HBIN block */
   if (!prs_set_offset(&hbin->ps, 
@@ -1135 +1137 @@
   if ( !prs_uint32( "record_size", &hbin->ps, depth, &record_size ) )
     return false;
-                
+        
   for ( i=0; i<nk->num_values; i++ ) 
   {
@@ -1157 +1159 @@
       }
     }
-                
+        
     new_offset = nk->values[i].rec_off 
       + HBIN_HDR_SIZE 
@@ -1180 +1182 @@
 {
   REGF_SK_REC *p_sk;
-        
+  
   for ( p_sk=file->sec_desc_list; p_sk; p_sk=p_sk->next ) {
     if ( p_sk->sk_off == offset ) 
       return p_sk;
   }
-        
+  
   return NULL;
 }
@@ -1213 +1215 @@
   int depth = 0;
   REGF_HBIN *sub_hbin;
-        
+  
   depth++;
 
@@ -1283 +1285 @@
 
     nk->sec_desc->sk_off = nk->sk_off;
+    /* XXX: this kind of caching needs to be re-evaluated */
     DLIST_ADD( file->sec_desc_list, nk->sec_desc );
   }
@@ -1411 +1414 @@
 
 /*******************************************************************
+XXX: should this be nuked?
  *******************************************************************/
 static void regfi_mem_free( REGF_FILE *file )
@@ -1443 +1447 @@
 
 
-/*******************************************************************
- There should be only *one* root key in the registry file based 
- on my experience.  --jerry
-*******************************************************************/
+/******************************************************************************
+ * There should be only *one* root key in the registry file based 
+ * on my experience.  --jerry
+ *****************************************************************************/
 REGF_NK_REC* regfi_rootkey( REGF_FILE *file )
 {
@@ -1496 +1500 @@
   }
 
+  /* XXX: this kind of caching needs to be re-evaluated */
   DLIST_ADD( file->block_list, hbin );
 
-  return nk;            
-}
-
-
-/* XXX: An interator struct should be used instead, and this function
- *   should operate on it, so the state of iteration isn't stored in the
- * REGF_NK_REC struct itself.
- */
-/*******************************************************************
- This acts as an interator over the subkeys defined for a given 
- NK record.  Remember that offsets are from the *first* HBIN block.
-*******************************************************************/
-REGF_NK_REC* regfi_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk )
-{
-  REGF_NK_REC *subkey;
-  REGF_HBIN   *hbin;
-  uint32      nk_offset;
+  return nk;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+void regfi_key_free(REGF_NK_REC* nk)
+{
+  uint32 i;
+  
+  if((nk->values != NULL) && (nk->values_off!=REGF_OFFSET_NONE))
+  {
+    for(i=0; i < nk->num_values; i++)
+      regfi_value_free(nk->values[i]);
+    free(nk->values);
+  }
+
+  if(nk->keyname != NULL)
+    free(nk->keyname);
+  if(nk->classname != NULL)
+    free(nk->classname);
+
+  /* XXX: not freeing hbin because these are cached.  This needs to be reviewed. */
+  /* XXX: not freeing sec_desc because these are cached.  This needs to be reviewed. */
+  free(nk);
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+void regfi_value_free(REGF_VK_REC* vk)
+{
+  if(vk->valuename != NULL)
+    free(vk->valuename);
+  if(vk->data != NULL)
+    free(vk->data);  
+  
+  /* XXX: not freeing hbin because these are cached.  This needs to be reviewed. */
+  free(vk);
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGFI_ITERATOR* regfi_iterator_new(REGF_FILE* fh)
+{
+  REGF_NK_REC* root;
+  REGFI_ITERATOR* ret_val = (REGFI_ITERATOR*)malloc(sizeof(REGFI_ITERATOR));
+  if(ret_val == NULL)
+    return NULL;
+
+  root = regfi_rootkey(f);
+  if(root == NULL)
+  {
+    free(ret_val);
+    return NULL;
+  }
+
+  ret_val->key_positions = void_stack_new(REGF_MAX_DEPTH);
+  if(ret_val->key_positions == NULL)
+  {
+    free(ret_val);
+    free(root);
+    return NULL;
+  }
+
+  ret_val->f = fh;
+  ret_val->cur_key = root;
+  ret_val->cur_subkey = 0;
+  ret_val->cur_value = 0;
+
+  return ret_val;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+void regfi_iterator_free(REGFI_ITERATOR* i)
+{
+  REGFI_ITER_POSITION* cur;
+
+  if(i->cur_key != NULL)
+    regfi_key_free(i->cur_key);
+
+  while((cur = (REGFI_ITER_POSITION*)void_stack_pop(i->key_positions)) != NULL)
+  {
+    regfi_key_free(cur->nk);
+    free(cur);
+  }
+  
+  free(i);
+}
+
+
+
+/******************************************************************************
+ *****************************************************************************/
+/* XXX: some way of indicating reason for failure should be added. */
+bool regfi_iterator_down(REGFI_ITERATOR* i)
+{
+  REGF_NK_REC* subkey;
+  REGFI_ITER_POSITION* pos;
+
+  pos = (REGFI_ITER_POSITION*)malloc(sizeof(REGFI_ITER_POSITION));
+  if(pos == NULL)
+    return false;
+
+  subkey = regfi_iterator_cur_subkey(i);
+  if(subkey == NULL)
+  {
+    free(pos);
+    return false;
+  }
+
+  pos->nk = i->cur_key;
+  pos->cur_subkey = i->cur_subkey;
+  if(!void_stack_push(i->key_positions, pos))
+  {
+    free(pos);
+    regfi_key_free(subkey);
+    return false;
+  }
+
+  i->cur_key = subkey;
+  i->cur_subkey = 0;
+  i->cur_value = 0;
+
+  return true;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+bool regfi_iterator_up(REGFI_ITERATOR* i)
+{
+  REGFI_ITER_POSITION* pos;
+
+  pos = (REGFI_ITER_POSITION*)void_stack_pop(i->key_positions);
+  if(pos == NULL)
+    return false;
+
+  regfi_key_free(i->cur_key);
+  i->cur_key = pos->nk;
+  i->cur_subkey = pos->cur_subkey;
+  i->cur_value = 0;
+  free(pos);
+
+  return true;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+bool regfi_iterator_to_root(REGFI_ITERATOR* i)
+{
+  while(regfi_iterator_up(i))
+    continue;
+
+  return true;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+bool regfi_iterator_find_subkey(REGFI_ITERATOR* i, const char* subkey_name)
+{
+  REGF_NK_REC* subkey;
+  bool found = false;
+  uint32 old_subkey = i->cur_subkey;
+  
+  if(subkey_name == NULL)
+    return false;
+
+  /* XXX: this alloc/free of each sub key might be a bit excessive */
+  subkey = regfi_iterator_first_subkey(i);
+  while((subkey != NULL) && (found == false))
+  {
+    if(subkey->keyname != NULL 
+       && strcasecmp(subkey->keyname, subkey_name) == 0)
+      found = true;
+
+    regfi_key_free(subkey);
+    subkey = regfi_iterator_next_subkey(i);
+  }
+
+  if(found == false)
+  {
+    i->cur_subkey = old_subkey;
+    return false;
+  }
+
+  return true;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+bool regfi_iterator_walk_path(REGFI_ITERATOR* i, const char** path)
+{
+  uint32 x;
+  if(path == NULL)
+    return false;
+
+  for(x=0; 
+      ((path[x] != NULL) && regfi_iterator_find_subkey(i, path[x])
+       && regfi_iterator_down(i));
+      x++)
+  { continue; }
+
+  if(path[x] == NULL)
+    return true;
+  
+  /* XXX: is this the right number of times? */
+  for(; x > 0; x--)
+    regfi_iterator_up(i);
+  
+  return false;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGF_NK_REC* regfi_iterator_cur_key(REGFI_ITERATOR* i);
+{
+  return i->cur_key;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGF_NK_REC* regfi_iterator_first_subkey(REGFI_ITERATOR* i)
+{
+  REGF_NK_REC* subkey;
+  REGF_HBIN* hbin;
+  
+  i->cur_subkey = 0;
+  return regfi_iterator_cur_subkey(i);
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGF_NK_REC* regfi_iterator_cur_subkey(REGFI_ITERATOR* i)
+{
+  REGF_NK_REC* subkey;
+  REGF_HBIN* hbin;
+  uint32 nk_offset;
 
   /* see if there is anything left to report */
-  if (!nk || (nk->subkeys_off==REGF_OFFSET_NONE) 
-      || (nk->subkey_index >= nk->num_subkeys))
-    return NULL;
+  if (!(i->cur_key) || (i->cur_key->subkeys_off==REGF_OFFSET_NONE)
+      || (i->cur_subkey >= i->cur_key->num_subkeys))
+    return NULL;
+
+  nk_offset = i->cur_key->subkeys.hashes[i->cur_subkey].nk_off;
 
   /* find the HBIN block which should contain the nk record */
-  if(!(hbin 
-       = lookup_hbin_block(file, nk->subkeys.hashes[nk->subkey_index].nk_off )))
-  {
+  hbin = lookup_hbin_block(i->f, nk_offset);
+  if(!hbin)
+  {
+    /* XXX: should print out some kind of error message every time here */
     /*DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing offset [0x%x]\n", 
-      nk->subkeys.hashes[nk->subkey_index].nk_off));*/
-    return NULL;
-  }
-  
-  nk_offset = nk->subkeys.hashes[nk->subkey_index].nk_off;
+      i->cur_key->subkeys.hashes[i->cur_subkey].nk_off));*/
+    return NULL;
+  }
+  
   if(!prs_set_offset(&hbin->ps, 
-                     (HBIN_HDR_SIZE + nk_offset - hbin->first_hbin_off)))
-    return NULL;
-                
-  nk->subkey_index++;
+                     HBIN_HDR_SIZE + nk_offset - hbin->first_hbin_off))
+    return NULL;
+                
   if(!(subkey = (REGF_NK_REC*)zalloc(sizeof(REGF_NK_REC))))
     return NULL;
 
-  if(!hbin_prs_key(file, hbin, subkey))
-    return NULL;
+  if(!hbin_prs_key(i->f, hbin, subkey))
+  {
+    regfi_key_free(subkey);
+    return NULL;
+  }
 
   return subkey;
 }
+
+
+/******************************************************************************
+ *****************************************************************************/
+/* XXX: some way of indicating reason for failure should be added. */
+REGF_NK_REC* regfi_iterator_next_subkey(REGFI_ITERATOR* i)
+{
+  REGF_NK_REC* subkey;
+
+  i->cur_subkey++;
+  subkey = regfi_iterator_cur_subkey(i);
+
+  if(subkey == NULL)
+    i->cur_subkey--;
+
+  return subkey;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+bool regfi_iterator_find_value(REGFI_ITERATOR* i, const char* value_name)
+{
+  REGF_VK_REC* cur;
+  bool found = false;
+
+  /* XXX: cur->valuename can be NULL in the registry.  
+   *      Should we allow for a way to search for that? 
+   */
+  if(value_name == NULL)
+    return false;
+
+  cur = regfi_iterator_first_value(i);
+  while((cur != NULL) && (found == false))
+  {
+    if((cur->valuename != NULL)
+       && (strcasecmp(cur->valuename, value_name) == 0))
+      found = true;
+    cur = retfi_iterator_next_value(i);
+  }
+
+  if(cur == NULL)
+    return false;
+  
+  return true;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGF_VK_REC* regfi_iterator_first_value(REGFI_ITERATOR* i)
+{
+  i->cur_value = 0;
+  return regfi_iterator_cur_value(i);
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGF_VK_REC* regfi_iterator_cur_value(REGFI_ITERATOR* i)
+{
+  REGF_VK_REC* ret_val = NULL;
+  if(i->cur_value < i->cur_key->num_values)
+    ret_val = i->cur_key->values[i];
+
+  return ret_val;
+}
+
+
+/******************************************************************************
+ *****************************************************************************/
+REGF_VK_REC* regfi_iterator_next_value(REGFI_ITERATOR* i)
+{
+  REGF_VK_REC* ret_val;
+
+  i->cur_value++;
+  ret_val = regfi_iterator_cur_value(i);
+  if(ret_val == NULL)
+    i->cur_value--;
+
+  return ret_val;
+}

trunk/lib/void_stack.c

@@ -88 +88 @@
 
 
-void void_stack_destroy(void_stack* stack)
+void void_stack_free(void_stack* stack)
 {
   free(stack->elements);
@@ -95 +95 @@
 
 
-void void_stack_destroy_deep(void_stack* stack)
+void void_stack_free_deep(void_stack* stack)
 {
   unsigned short i;
@@ -167 +167 @@
 
 
-void void_stack_iterator_destroy(void_stack_iterator* iter)
+void void_stack_iterator_free(void_stack_iterator* iter)
 {
   free(iter);

trunk/src/reglookup.c

@@ -418 +418 @@
 
   ret_val = void_stack_copy_reverse(rev_ret);
-  void_stack_destroy(rev_ret);
+  void_stack_free(rev_ret);
 
   return ret_val;
@@ -572 +572 @@
 
 
-void printValueList(REGF_NK_REC* nk, char* prefix)
-{
-  uint32 i;
-  
-  for(i=0; i < nk->num_values; i++)
-    if(!type_filter_enabled || (nk->values[i].type == type_filter))
-      printValue(nk->values+i, prefix);
+void printValueList(REGFI_ITERATOR i, char* prefix)
+{
+  REGF_VK_REC* value;
+
+  value = regfi_iterator_first_value(i);
+  while(value != NULL)
+    if(!type_filter_enabled || (value.type == type_filter))
+      printValue(value, prefix);
 }
 
@@ -715 +716 @@
 }
 
-
 /*
- * Returns 0 if path was found.
- * Returns 1 if path was not found.
+ * Returns 0 if path was not found.
+ * Returns 1 if path was found as value.
+ * Returns 2 if path was found as key.
  * Returns less than 0 on other error.
  */
-int retrievePath(REGF_FILE* f, void_stack* nk_stack,
-                 void_stack* path_stack)
-{
-  REGF_NK_REC* sub = NULL; 
-  REGF_NK_REC* cur = NULL;
-  void_stack* sub_nk_stack;
-  char* prefix;
-  char* cur_str = NULL;
-  char* path = NULL;
-  char* name;
-  uint16 path_depth;
-  uint32 i, prefix_len;
-  bool found_cur = true;
-  if(path_stack == NULL)
+int retrievePath(REGFI_ITERATOR* iter, char** path)
+{
+  REG_VK_REC* value;
+  uint32 i;
+  char* p;
+  char* tmp_path_joined;
+  char** tmp_path;
+  
+  if(path == NULL)
     return -1;
 
-  path_depth = void_stack_size(path_stack);
-  if(path_depth < 1)
+  /* One extra for any value at the end, and one more for NULL */
+  tmp_path = (char**)malloc(sizeof(char**)*(REGF_MAX_DEPTH+1+1));
+  if(tmp_path == NULL)
     return -2;
 
-  if(void_stack_size(nk_stack) < 1)
-    return -3;
-  cur = (REGF_NK_REC*)void_stack_cur(nk_stack);
+  /* Strip any potential value name at end of path */
+  for(i=0; 
+      (path[i] != NULL) && (path[i+1] != NULL) 
+        && (i < REGF_MAX_DEPTH+1+1);
+      i++)
+    tmp_path[i] = path[i];
+
+  tmp_path[i] = NULL;
 
   if(print_verbose)
-    fprintf(stderr, "VERBOSE: Beginning retrieval of specified path: %s\n", 
+    fprintf(stderr, "VERBOSE: Attempting to retrieve specified path: %s\n",
             path_filter);
 
-  while(void_stack_size(path_stack) > 1)
-  {
-    /* Search key records only */
-    cur_str = (char*)void_stack_pop(path_stack);
-
-    found_cur = false;
-    while(!found_cur &&
-          (sub = regfi_fetch_subkey(f, cur)) != NULL)
-    {
-      if(strcasecmp(sub->keyname, cur_str) == 0)
-      {
-        cur = sub;
-        if(!void_stack_push(nk_stack, sub))
-          bailOut(2, "ERROR: Registry maximum depth exceeded.\n");
-
-        found_cur = true;
-      }
-    }
-    if(print_verbose && !found_cur)
-      fprintf(stderr, "VERBOSE: Could not find KEY '%s' in specified path.\n", 
-              cur_str);
-
-    free(cur_str);
-    if(!found_cur)
-      return 1;
-  }
-
-  /* Last round, search value and key records */
-  cur_str = (char*)void_stack_pop(path_stack);
-
-  if(print_verbose)
-    fprintf(stderr, "VERBOSE: Searching values for last component"
-                    " of specified path.\n");
-
-  for(i=0; (i < cur->num_values); i++)
-  {
-    /* XXX: Not sure when/why this can be NULL, but it's happened. */
-    if(sub->values[i].valuename != NULL 
-       && strcasecmp(sub->values[i].valuename, cur_str) == 0)
-    {
-      path = stack2Path(nk_stack);
-
-      if(print_verbose)
-        fprintf(stderr, "VERBOSE: Found final path element as value.\n");
-
-      if(!type_filter_enabled || (sub->values[i].type == type_filter))
-        printValue(&sub->values[i], path);
-      if(path != NULL)
-        free(path);
-
-      return 0;
-    }
-  }
-
-  if(print_verbose)
-    fprintf(stderr, "VERBOSE: Searching keys for last component"
-                    " of specified path.\n");
-
-  while((sub = regfi_fetch_subkey(f, cur)) != NULL)
-  {
-    if(strcasecmp(sub->keyname, cur_str) == 0)
-    {
-      sub_nk_stack = void_stack_new(REGF_MAX_DEPTH);
-      if(!void_stack_push(sub_nk_stack, sub))
-        bailOut(2, "ERROR: Registry maximum depth exceeded.\n");
-      prefix = stack2Path(nk_stack);
-      prefix_len = strlen(prefix);
-      prefix = realloc(prefix, prefix_len+strlen(sub->keyname)+2);
-      if(prefix == NULL)
-        return -1;
-      name = quote_string(sub->keyname, key_special_chars);
-      strcat(prefix, "/");
-      strcat(prefix, name);
-      free(name);
-
-      if(print_verbose)
-        fprintf(stderr, "VERBOSE: Found final path element as key.\n");
-
-      printKeyTree(f, sub_nk_stack, prefix);
-
-      return 0;
-    }
+  if(!regfi_iterator_walk_path(iter, tmp_path))
+  {
+    free(tmp_path);
+    return 0;
+  }
+
+  if(regfi_iterator_find_value(iter, path[i]))
+  {
+    if(print_verbose)
+      fprintf(stderr, "VERBOSE: Found final path element as value.\n");
+
+    value = regfi_iterator_cur_value(iter);
+    tmp_path_joined = joinPath(tmp_path);
+
+    if((value == NULL) || (tmp_path_joined == NULL))
+      bailOut(2, "ERROR: Unexpected error before printValue.\n");
+
+    printValue(value, tmp_path_joined);
+
+    free(tmp_path);
+    free(tmp_path_joined);
+    return 1;
+  }
+  else if(regfi_iterator_find_subkey(iter, path[i]))
+  {
+    if(print_verbose)
+      fprintf(stderr, "VERBOSE: Found final path element as key.\n");
+    return 2;
   }
 
@@ -836 +784 @@
     fprintf(stderr, "VERBOSE: Could not find last element of path.\n");
 
-  return 1;
+  return 0;
 }
 
@@ -860 +808 @@
 int main(int argc, char** argv)
 {
-  void_stack* nk_stack;
   void_stack* path_stack;
+  char** path = NULL;
   REGF_FILE* f;
   REGF_NK_REC* root;
+  REGFI_ITERATOR* iter;
   int retr_path_ret;
   uint32 argi, arge;
@@ -930 +879 @@
   }
 
-  root = regfi_rootkey(f);
-  nk_stack = void_stack_new(REGF_MAX_DEPTH);
-
-  if(void_stack_push(nk_stack, root))
-  {
-    if(print_header)
-    {
-      if(print_security)
-        printf("PATH,TYPE,VALUE,MTIME,OWNER,GROUP,SACL,DACL\n");
-      else
-        printf("PATH,TYPE,VALUE,MTIME\n");
-    }
-
-    path_stack = path2Stack(path_filter);
-    if(void_stack_size(path_stack) < 1)
-      printKeyTree(f, nk_stack, "");
-    else
-    {
-      retr_path_ret = retrievePath(f, nk_stack, path_stack);
-      if(retr_path_ret == 1)
-        fprintf(stderr, "WARNING: specified path not found.\n");
-      else if(retr_path_ret != 0)
-        bailOut(4, "ERROR:\n");
-    }
+  iter = regfi_iterator_new(f);
+  if(iter == NULL)
+    bailOut(3, "ERROR: Couldn't create registry iterator.\n");
+
+  if(path_filter_enabled && path_filter != NULL)
+    path = splitPath(path_filter);
+  
+  if(path != NULL)
+  {
+    retr_path_ret = retrievePath(iter, path);
+    if(retr_path_ret == 0)
+      fprintf(stderr, "WARNING: specified path not found.\n");
+    else if (retr_path_ret == 2)
+      printKeyTree(iter, path_filter);
+    else if(retr_path_ret != 0)
+      bailOut(4, "ERROR: Unknown error occurred in retrieving path.\n");
   }
   else
-    bailOut(2, "ERROR: Registry maximum depth exceeded.\n");
-
-  void_stack_destroy_deep(nk_stack);
+    printKeyTree(iter, "");
+
+  regfi_iterator_free(iter);
   regfi_close(f);