| 1 | /*
 | 
|---|
| 2 |  * Unix SMB/CIFS implementation.
 | 
|---|
| 3 |  * Windows NT registry I/O library
 | 
|---|
| 4 |  * Copyright (c) Gerald (Jerry) Carter               2005
 | 
|---|
| 5 |  *
 | 
|---|
| 6 |  * This program is free software; you can redistribute it and/or modify
 | 
|---|
| 7 |  * it under the terms of the GNU General Public License as published by
 | 
|---|
| 8 |  * the Free Software Foundation; either version 3 of the License, or
 | 
|---|
| 9 |  * (at your option) any later version.
 | 
|---|
| 10 |  *
 | 
|---|
| 11 |  * This program is distributed in the hope that it will be useful,
 | 
|---|
| 12 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 | 
|---|
| 13 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 | 
|---|
| 14 |  * GNU General Public License for more details.
 | 
|---|
| 15 |  *
 | 
|---|
| 16 |  * You should have received a copy of the GNU General Public License
 | 
|---|
| 17 |  * along with this program; if not, see <http://www.gnu.org/licenses/>.
 | 
|---|
| 18 |  */
 | 
|---|
| 19 | 
 | 
|---|
| 20 | /************************************************************
 | 
|---|
| 21 |  * Most of this information was obtained from 
 | 
|---|
| 22 |  * http://www.wednesday.demon.co.uk/dosreg.html
 | 
|---|
| 23 |  * Thanks Nigel!
 | 
|---|
| 24 |  ***********************************************************/
 | 
|---|
| 25 | 
 | 
|---|
| 26 | #include "registry/reg_parse_prs.h"
 | 
|---|
| 27 | #include "registry/reg_objects.h"
 | 
|---|
| 28 | 
 | 
|---|
| 29 | #ifndef _REGFIO_H
 | 
|---|
| 30 | #define _REGFIO_H
 | 
|---|
| 31 | 
 | 
|---|
| 32 | struct regsubkey_ctr;
 | 
|---|
| 33 | 
 | 
|---|
| 34 | /* Macros */
 | 
|---|
| 35 |  
 | 
|---|
| 36 | #define REGF_BLOCKSIZE          0x1000
 | 
|---|
| 37 | #define REGF_ALLOC_BLOCK        0x1000
 | 
|---|
| 38 | 
 | 
|---|
| 39 | /* header sizes for various records */
 | 
|---|
| 40 | 
 | 
|---|
| 41 | #define REGF_HDR_SIZE           4
 | 
|---|
| 42 | #define HBIN_HDR_SIZE           4
 | 
|---|
| 43 | #define HBIN_HEADER_REC_SIZE    0x24
 | 
|---|
| 44 | #define REC_HDR_SIZE            2
 | 
|---|
| 45 | 
 | 
|---|
| 46 | #define REGF_OFFSET_NONE        0xffffffff
 | 
|---|
| 47 | 
 | 
|---|
| 48 | /* Flags for the vk records */
 | 
|---|
| 49 | 
 | 
|---|
| 50 | #define VK_FLAG_NAME_PRESENT    0x0001
 | 
|---|
| 51 | #define VK_DATA_IN_OFFSET       0x80000000
 | 
|---|
| 52 | 
 | 
|---|
| 53 | /* NK record macros */
 | 
|---|
| 54 | 
 | 
|---|
| 55 | #define NK_TYPE_LINKKEY         0x0010
 | 
|---|
| 56 | #define NK_TYPE_NORMALKEY       0x0020
 | 
|---|
| 57 | #define NK_TYPE_ROOTKEY         0x002c
 | 
|---|
| 58 | 
 | 
|---|
| 59 | #define HBIN_STORE_REF(x, y)    { x->hbin = y; y->ref_count++ };
 | 
|---|
| 60 | #define HBIN_REMOVE_REF(x, y)   { x->hbin = NULL; y->ref_count-- /* if the count == 0; we can clean up */ };
 | 
|---|
| 61 | 
 | 
|---|
| 62 | 
 | 
|---|
| 63 | /* HBIN block */
 | 
|---|
| 64 | struct regf_hbin;
 | 
|---|
| 65 | typedef struct regf_hbin {
 | 
|---|
| 66 |         struct regf_hbin *prev, *next;
 | 
|---|
| 67 |         uint32 file_off;                /* my offset in the registry file */
 | 
|---|
| 68 |         uint32 free_off;                /* offset to free space within the hbin record */
 | 
|---|
| 69 |         uint32 free_size;               /* amount of data left in the block */
 | 
|---|
| 70 |         int ref_count;                  /* how many active records are pointing to this block (not used currently) */
 | 
|---|
| 71 |         
 | 
|---|
| 72 |         char   header[HBIN_HDR_SIZE];   /* "hbin" */
 | 
|---|
| 73 |         uint32 first_hbin_off;          /* offset from first hbin block */
 | 
|---|
| 74 |         uint32 block_size;              /* block size of this blockually a multiple of 4096Kb) */
 | 
|---|
| 75 | 
 | 
|---|
| 76 |         prs_struct ps;                  /* data */
 | 
|---|
| 77 | 
 | 
|---|
| 78 |         bool dirty;                     /* has this hbin block been modified? */
 | 
|---|
| 79 | } REGF_HBIN;
 | 
|---|
| 80 | 
 | 
|---|
| 81 | /* ??? List -- list of key offsets and hashed names for consistency */
 | 
|---|
| 82 | 
 | 
|---|
| 83 | typedef struct {
 | 
|---|
| 84 |         uint32 nk_off;
 | 
|---|
| 85 |         uint8 keycheck[sizeof(uint32)];
 | 
|---|
| 86 |         char *fullname;
 | 
|---|
| 87 | } REGF_HASH_REC;
 | 
|---|
| 88 | 
 | 
|---|
| 89 | typedef struct {
 | 
|---|
| 90 |         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 | 
|---|
| 91 |         uint32 hbin_off;        /* offset from beginning of this hbin block */
 | 
|---|
| 92 |         uint32 rec_size;        /* ((start_offset - end_offset) & 0xfffffff8) */
 | 
|---|
| 93 | 
 | 
|---|
| 94 |         char header[REC_HDR_SIZE];
 | 
|---|
| 95 |         uint16 num_keys;
 | 
|---|
| 96 |         REGF_HASH_REC *hashes;
 | 
|---|
| 97 | } REGF_LF_REC;
 | 
|---|
| 98 | 
 | 
|---|
| 99 | /* Key Value */
 | 
|---|
| 100 | 
 | 
|---|
| 101 | typedef struct {
 | 
|---|
| 102 |         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 | 
|---|
| 103 |         uint32 hbin_off;        /* offset from beginning of this hbin block */
 | 
|---|
| 104 |         uint32 rec_size;        /* ((start_offset - end_offset) & 0xfffffff8) */
 | 
|---|
| 105 |         uint32 rec_off;         /* offset stored in the value list */
 | 
|---|
| 106 |         
 | 
|---|
| 107 |         char header[REC_HDR_SIZE];
 | 
|---|
| 108 |         char *valuename;
 | 
|---|
| 109 |         uint32 data_size;
 | 
|---|
| 110 |         uint32 data_off;
 | 
|---|
| 111 |         uint8  *data;
 | 
|---|
| 112 |         uint32 type;
 | 
|---|
| 113 |         uint16 flag;
 | 
|---|
| 114 | } REGF_VK_REC;
 | 
|---|
| 115 | 
 | 
|---|
| 116 | 
 | 
|---|
| 117 | /* Key Security */
 | 
|---|
| 118 | struct _regf_sk_rec;
 | 
|---|
| 119 | 
 | 
|---|
| 120 | typedef struct _regf_sk_rec {
 | 
|---|
| 121 |         struct _regf_sk_rec *next, *prev;
 | 
|---|
| 122 |         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 | 
|---|
| 123 |         uint32 hbin_off;        /* offset from beginning of this hbin block */
 | 
|---|
| 124 |         uint32 rec_size;        /* ((start_offset - end_offset) & 0xfffffff8) */
 | 
|---|
| 125 | 
 | 
|---|
| 126 |         uint32 sk_off;          /* offset parsed from NK record used as a key
 | 
|---|
| 127 |                                    to lookup reference to this SK record */
 | 
|---|
| 128 | 
 | 
|---|
| 129 |         char header[REC_HDR_SIZE];
 | 
|---|
| 130 |         uint32 prev_sk_off;
 | 
|---|
| 131 |         uint32 next_sk_off;
 | 
|---|
| 132 |         uint32 ref_count;
 | 
|---|
| 133 |         uint32 size;
 | 
|---|
| 134 |         struct security_descriptor *sec_desc;
 | 
|---|
| 135 | } REGF_SK_REC;
 | 
|---|
| 136 | 
 | 
|---|
| 137 | /* Key Name */ 
 | 
|---|
| 138 | 
 | 
|---|
| 139 | typedef struct {
 | 
|---|
| 140 |         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 | 
|---|
| 141 |         uint32 hbin_off;        /* offset from beginning of this hbin block */
 | 
|---|
| 142 |         uint32 subkey_index;    /* index to next subkey record to return */
 | 
|---|
| 143 |         uint32 rec_size;        /* ((start_offset - end_offset) & 0xfffffff8) */
 | 
|---|
| 144 |         
 | 
|---|
| 145 |         /* header information */
 | 
|---|
| 146 |         
 | 
|---|
| 147 |         char header[REC_HDR_SIZE];
 | 
|---|
| 148 |         uint16 key_type;
 | 
|---|
| 149 |         NTTIME mtime;
 | 
|---|
| 150 |         uint32 parent_off;      /* back pointer in registry hive */
 | 
|---|
| 151 |         uint32 classname_off;   
 | 
|---|
| 152 |         char *classname;
 | 
|---|
| 153 |         char *keyname;
 | 
|---|
| 154 | 
 | 
|---|
| 155 |         /* max lengths */
 | 
|---|
| 156 | 
 | 
|---|
| 157 |         uint32 max_bytes_subkeyname;            /* max subkey name * 2 */
 | 
|---|
| 158 |         uint32 max_bytes_subkeyclassname;       /* max subkey classname length (as if) */
 | 
|---|
| 159 |         uint32 max_bytes_valuename;             /* max valuename * 2 */
 | 
|---|
| 160 |         uint32 max_bytes_value;                 /* max value data size */
 | 
|---|
| 161 | 
 | 
|---|
| 162 |         /* unknowns */
 | 
|---|
| 163 | 
 | 
|---|
| 164 |         uint32 unk_index;                       /* nigel says run time index ? */
 | 
|---|
| 165 |         
 | 
|---|
| 166 |         /* children */
 | 
|---|
| 167 |         
 | 
|---|
| 168 |         uint32 num_subkeys;
 | 
|---|
| 169 |         uint32 subkeys_off;     /* hash records that point to NK records */     
 | 
|---|
| 170 |         uint32 num_values;
 | 
|---|
| 171 |         uint32 values_off;      /* value lists which point to VK records */
 | 
|---|
| 172 |         uint32 sk_off;          /* offset to SK record */
 | 
|---|
| 173 |         
 | 
|---|
| 174 |         /* link in the other records here */
 | 
|---|
| 175 |         
 | 
|---|
| 176 |         REGF_LF_REC subkeys;
 | 
|---|
| 177 |         REGF_VK_REC *values;
 | 
|---|
| 178 |         REGF_SK_REC *sec_desc;
 | 
|---|
| 179 |         
 | 
|---|
| 180 | } REGF_NK_REC;
 | 
|---|
| 181 | 
 | 
|---|
| 182 | /* REGF block */
 | 
|---|
| 183 |  
 | 
|---|
| 184 | typedef struct {
 | 
|---|
| 185 |         /* run time information */
 | 
|---|
| 186 | 
 | 
|---|
| 187 |         int fd;                         /* file descriptor */
 | 
|---|
| 188 |         int open_flags;                 /* flags passed to the open() call */
 | 
|---|
| 189 |         TALLOC_CTX *mem_ctx;            /* memory context for run-time file access information */
 | 
|---|
| 190 |         REGF_HBIN *block_list;          /* list of open hbin blocks */
 | 
|---|
| 191 | 
 | 
|---|
| 192 |         /* file format information */
 | 
|---|
| 193 | 
 | 
|---|
| 194 |         char   header[REGF_HDR_SIZE];   /* "regf" */
 | 
|---|
| 195 |         uint32 data_offset;             /* offset to record in the first (or any?) hbin block */
 | 
|---|
| 196 |         uint32 last_block;              /* offset to last hbin block in file */
 | 
|---|
| 197 |         uint32 checksum;                /* XOR of bytes 0x0000 - 0x01FB */
 | 
|---|
| 198 |         NTTIME mtime;
 | 
|---|
| 199 |         
 | 
|---|
| 200 |         REGF_SK_REC *sec_desc_list;     /* list of security descriptors referenced by NK records */
 | 
|---|
| 201 | 
 | 
|---|
| 202 |         /* unknowns used to simply writing */
 | 
|---|
| 203 |         
 | 
|---|
| 204 |         uint32 unknown1;
 | 
|---|
| 205 |         uint32 unknown2;
 | 
|---|
| 206 |         uint32 unknown3;
 | 
|---|
| 207 |         uint32 unknown4;
 | 
|---|
| 208 |         uint32 unknown5;
 | 
|---|
| 209 |         uint32 unknown6;
 | 
|---|
| 210 |         
 | 
|---|
| 211 | } REGF_FILE;
 | 
|---|
| 212 | 
 | 
|---|
| 213 | /* Function Declarations */
 | 
|---|
| 214 |  
 | 
|---|
| 215 | REGF_FILE*    regfio_open( const char *filename, int flags, int mode );
 | 
|---|
| 216 | int           regfio_close( REGF_FILE *r );
 | 
|---|
| 217 | 
 | 
|---|
| 218 | REGF_NK_REC*  regfio_rootkey( REGF_FILE *file );
 | 
|---|
| 219 | REGF_NK_REC*  regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk );
 | 
|---|
| 220 | REGF_NK_REC*  regfio_write_key ( REGF_FILE *file, const char *name,
 | 
|---|
| 221 |                                  struct regval_ctr *values, struct regsubkey_ctr *subkeys,
 | 
|---|
| 222 |                                  struct security_descriptor *sec_desc, REGF_NK_REC *parent );
 | 
|---|
| 223 | 
 | 
|---|
| 224 | 
 | 
|---|
| 225 | #endif  /* _REGFIO_H */
 | 
|---|
| 226 | 
 | 
|---|