diff options
Diffstat (limited to '')
| -rw-r--r-- | source3/registry/regfio.h | 233 |
1 files changed, 233 insertions, 0 deletions
diff --git a/source3/registry/regfio.h b/source3/registry/regfio.h new file mode 100644 index 0000000..172427f --- /dev/null +++ b/source3/registry/regfio.h @@ -0,0 +1,233 @@ +/* + * Unix SMB/CIFS implementation. + * Windows NT registry I/O library + * Copyright (c) Gerald (Jerry) Carter 2005 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +/************************************************************ + * Most of this information was obtained from + * http://www.wednesday.demon.co.uk/dosreg.html + * Thanks Nigel! + ***********************************************************/ + +#include "registry/reg_parse_prs.h" +#include "registry/reg_objects.h" + +#ifndef _REGFIO_H +#define _REGFIO_H + +struct regsubkey_ctr; + +/* Macros */ + +#define REGF_BLOCKSIZE 0x1000 +#define REGF_ALLOC_BLOCK 0x1000 + +/* header sizes for various records */ + +#define REGF_HDR_SIZE 4 +#define HBIN_HDR_SIZE 4 +#define HBIN_HEADER_REC_SIZE 0x24 +#define REC_HDR_SIZE 2 + +#define REGF_OFFSET_NONE 0xffffffff + +/* Flags for the vk records */ + +#define VK_FLAG_NAME_PRESENT 0x0001 +#define VK_DATA_IN_OFFSET 0x80000000 + +/* NK record macros */ + +#define NK_TYPE_LINKKEY 0x0010 +#define NK_TYPE_NORMALKEY 0x0020 +#define NK_TYPE_ROOTKEY 0x002c + +#define HBIN_STORE_REF(x, y) { x->hbin = y; y->ref_count++ }; +#define HBIN_REMOVE_REF(x, y) { x->hbin = NULL; y->ref_count-- /* if the count == 0; we can clean up */ }; + + +/* HBIN block */ +struct regf_hbin; +typedef struct regf_hbin { + struct regf_hbin *prev, *next; + uint32_t file_off; /* my offset in the registry file */ + uint32_t free_off; /* offset to free space within the hbin record */ + uint32_t free_size; /* amount of data left in the block */ + int ref_count; /* how many active records are pointing to this block (not used currently) */ + + char header[HBIN_HDR_SIZE]; /* "hbin" */ + uint32_t first_hbin_off; /* offset from first hbin block */ + uint32_t block_size; /* block size of this blockually a multiple of 4096Kb) */ + + prs_struct ps; /* data */ + + bool dirty; /* has this hbin block been modified? */ +} REGF_HBIN; + +/* ??? List -- list of key offsets and hashed names for consistency */ + +typedef struct { + uint32_t nk_off; + uint8_t keycheck[sizeof(uint32_t)]; + char *fullname; +} REGF_HASH_REC; + +typedef struct { + REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ + uint32_t hbin_off; /* offset from beginning of this hbin block */ + uint32_t rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ + + char header[REC_HDR_SIZE]; + uint16_t num_keys; + REGF_HASH_REC *hashes; +} REGF_LF_REC; + +/* Key Value */ + +typedef struct { + REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ + uint32_t hbin_off; /* offset from beginning of this hbin block */ + uint32_t rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ + uint32_t rec_off; /* offset stored in the value list */ + + char header[REC_HDR_SIZE]; + char *valuename; + uint32_t data_size; + uint32_t data_off; + uint8_t *data; + uint32_t type; + uint16_t flag; +} REGF_VK_REC; + + +/* Key Security */ +struct _regf_sk_rec; + +typedef struct _regf_sk_rec { + struct _regf_sk_rec *next, *prev; + REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ + uint32_t hbin_off; /* offset from beginning of this hbin block */ + uint32_t rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ + + uint32_t sk_off; /* offset parsed from NK record used as a key + to lookup reference to this SK record */ + + char header[REC_HDR_SIZE]; + uint32_t prev_sk_off; + uint32_t next_sk_off; + uint32_t ref_count; + uint32_t size; + struct security_descriptor *sec_desc; +} REGF_SK_REC; + +/* Key Name */ + +typedef struct { + REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ + uint32_t hbin_off; /* offset from beginning of this hbin block */ + uint32_t subkey_index; /* index to next subkey record to return */ + uint32_t rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ + + /* header information */ + + char header[REC_HDR_SIZE]; + uint16_t key_type; + NTTIME mtime; + uint32_t parent_off; /* back pointer in registry hive */ + uint32_t classname_off; + char *classname; + char *keyname; + + /* max lengths */ + + uint32_t max_bytes_subkeyname; /* max subkey name * 2 */ + uint32_t max_bytes_subkeyclassname; /* max subkey classname length (as if) */ + uint32_t max_bytes_valuename; /* max valuename * 2 */ + uint32_t max_bytes_value; /* max value data size */ + + /* unknowns */ + + uint32_t unk_index; /* nigel says run time index ? */ + + /* children */ + + uint32_t num_subkeys; + uint32_t subkeys_off; /* hash records that point to NK records */ + uint32_t num_values; + uint32_t values_off; /* value lists which point to VK records */ + uint32_t sk_off; /* offset to SK record */ + + /* link in the other records here */ + + REGF_LF_REC subkeys; + REGF_VK_REC *values; + REGF_SK_REC *sec_desc; + +} REGF_NK_REC; + +/* REGF block */ + +typedef struct { + /* run time information */ + + int fd; /* file descriptor */ + int open_flags; /* flags passed to the open() call */ + TALLOC_CTX *mem_ctx; /* memory context for run-time file access information */ + REGF_HBIN *block_list; /* list of open hbin blocks */ + + /* file format information */ + + char header[REGF_HDR_SIZE]; /* "regf" */ + uint32_t data_offset; /* offset to record in the first (or any?) hbin block */ + uint32_t last_block; /* offset to last hbin block in file */ + uint32_t checksum; /* XOR of bytes 0x0000 - 0x01FB */ + NTTIME mtime; + + REGF_SK_REC *sec_desc_list; /* list of security descriptors referenced by NK records */ + + /* Ignore checksums in input data. Used by fuzzing code to allow more + * coverage without having to calcuate a valid checksum. The checksums + * are merely to detect data corruption and don't provide a security + * value. + */ + bool ignore_checksums; + + /* unknowns used to simply writing */ + + uint32_t unknown1; + uint32_t unknown2; + uint32_t unknown3; + uint32_t unknown4; + uint32_t unknown5; + uint32_t unknown6; + +} REGF_FILE; + +/* Function Declarations */ + +REGF_FILE* regfio_open( const char *filename, int flags, int mode ); +int regfio_close( REGF_FILE *r ); + +REGF_NK_REC* regfio_rootkey( REGF_FILE *file ); +REGF_NK_REC* regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk ); +REGF_NK_REC* regfio_write_key ( REGF_FILE *file, const char *name, + struct regval_ctr *values, struct regsubkey_ctr *subkeys, + struct security_descriptor *sec_desc, REGF_NK_REC *parent ); + + +#endif /* _REGFIO_H */ + |