1/* 2 * Unix SMB/CIFS implementation. 3 * Windows NT registry I/O library 4 * Copyright (c) Gerald (Jerry) Carter 2005 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 3 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20/************************************************************ 21 * Most of this information was obtained from 22 * http://www.wednesday.demon.co.uk/dosreg.html 23 * Thanks Nigel! 24 ***********************************************************/ 25 26 27#ifndef _REGFIO_H 28#define _REGFIO_H 29 30/* Macros */ 31 32#define REGF_BLOCKSIZE 0x1000 33#define REGF_ALLOC_BLOCK 0x1000 34 35/* header sizes for various records */ 36 37#define REGF_HDR_SIZE 4 38#define HBIN_HDR_SIZE 4 39#define HBIN_HEADER_REC_SIZE 0x24 40#define REC_HDR_SIZE 2 41 42#define REGF_OFFSET_NONE 0xffffffff 43 44/* Flags for the vk records */ 45 46#define VK_FLAG_NAME_PRESENT 0x0001 47#define VK_DATA_IN_OFFSET 0x80000000 48 49/* NK record macros */ 50 51#define NK_TYPE_LINKKEY 0x0010 52#define NK_TYPE_NORMALKEY 0x0020 53#define NK_TYPE_ROOTKEY 0x002c 54 55#define HBIN_STORE_REF(x, y) { x->hbin = y; y->ref_count++ }; 56#define HBIN_REMOVE_REF(x, y) { x->hbin = NULL; y->ref_count-- /* if the count == 0; we can clean up */ }; 57 58 59/* HBIN block */ 60struct regf_hbin; 61typedef struct regf_hbin { 62 struct regf_hbin *prev, *next; 63 uint32 file_off; /* my offset in the registry file */ 64 uint32 free_off; /* offset to free space within the hbin record */ 65 uint32 free_size; /* amount of data left in the block */ 66 int ref_count; /* how many active records are pointing to this block (not used currently) */ 67 68 char header[HBIN_HDR_SIZE]; /* "hbin" */ 69 uint32 first_hbin_off; /* offset from first hbin block */ 70 uint32 block_size; /* block size of this blockually a multiple of 4096Kb) */ 71 72 prs_struct ps; /* data */ 73 74 bool dirty; /* has this hbin block been modified? */ 75} REGF_HBIN; 76 77/* ??? List -- list of key offsets and hashed names for consistency */ 78 79typedef struct { 80 uint32 nk_off; 81 uint8 keycheck[sizeof(uint32)]; 82 char *fullname; 83} REGF_HASH_REC; 84 85typedef struct { 86 REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ 87 uint32 hbin_off; /* offset from beginning of this hbin block */ 88 uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ 89 90 char header[REC_HDR_SIZE]; 91 uint16 num_keys; 92 REGF_HASH_REC *hashes; 93} REGF_LF_REC; 94 95/* Key Value */ 96 97typedef struct { 98 REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ 99 uint32 hbin_off; /* offset from beginning of this hbin block */ 100 uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ 101 uint32 rec_off; /* offset stored in the value list */ 102 103 char header[REC_HDR_SIZE]; 104 char *valuename; 105 uint32 data_size; 106 uint32 data_off; 107 uint8 *data; 108 uint32 type; 109 uint16 flag; 110} REGF_VK_REC; 111 112 113/* Key Security */ 114struct _regf_sk_rec; 115 116typedef struct _regf_sk_rec { 117 struct _regf_sk_rec *next, *prev; 118 REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ 119 uint32 hbin_off; /* offset from beginning of this hbin block */ 120 uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ 121 122 uint32 sk_off; /* offset parsed from NK record used as a key 123 to lookup reference to this SK record */ 124 125 char header[REC_HDR_SIZE]; 126 uint32 prev_sk_off; 127 uint32 next_sk_off; 128 uint32 ref_count; 129 uint32 size; 130 SEC_DESC *sec_desc; 131} REGF_SK_REC; 132 133/* Key Name */ 134 135typedef struct { 136 REGF_HBIN *hbin; /* pointer to HBIN record (in memory) containing this nk record */ 137 uint32 hbin_off; /* offset from beginning of this hbin block */ 138 uint32 subkey_index; /* index to next subkey record to return */ 139 uint32 rec_size; /* ((start_offset - end_offset) & 0xfffffff8) */ 140 141 /* header information */ 142 143 char header[REC_HDR_SIZE]; 144 uint16 key_type; 145 NTTIME mtime; 146 uint32 parent_off; /* back pointer in registry hive */ 147 uint32 classname_off; 148 char *classname; 149 char *keyname; 150 151 /* max lengths */ 152 153 uint32 max_bytes_subkeyname; /* max subkey name * 2 */ 154 uint32 max_bytes_subkeyclassname; /* max subkey classname length (as if) */ 155 uint32 max_bytes_valuename; /* max valuename * 2 */ 156 uint32 max_bytes_value; /* max value data size */ 157 158 /* unknowns */ 159 160 uint32 unk_index; /* nigel says run time index ? */ 161 162 /* children */ 163 164 uint32 num_subkeys; 165 uint32 subkeys_off; /* hash records that point to NK records */ 166 uint32 num_values; 167 uint32 values_off; /* value lists which point to VK records */ 168 uint32 sk_off; /* offset to SK record */ 169 170 /* link in the other records here */ 171 172 REGF_LF_REC subkeys; 173 REGF_VK_REC *values; 174 REGF_SK_REC *sec_desc; 175 176} REGF_NK_REC; 177 178/* REGF block */ 179 180typedef struct { 181 /* run time information */ 182 183 int fd; /* file descriptor */ 184 int open_flags; /* flags passed to the open() call */ 185 TALLOC_CTX *mem_ctx; /* memory context for run-time file access information */ 186 REGF_HBIN *block_list; /* list of open hbin blocks */ 187 188 /* file format information */ 189 190 char header[REGF_HDR_SIZE]; /* "regf" */ 191 uint32 data_offset; /* offset to record in the first (or any?) hbin block */ 192 uint32 last_block; /* offset to last hbin block in file */ 193 uint32 checksum; /* XOR of bytes 0x0000 - 0x01FB */ 194 NTTIME mtime; 195 196 REGF_SK_REC *sec_desc_list; /* list of security descriptors referenced by NK records */ 197 198 /* unknowns used to simply writing */ 199 200 uint32 unknown1; 201 uint32 unknown2; 202 uint32 unknown3; 203 uint32 unknown4; 204 uint32 unknown5; 205 uint32 unknown6; 206 207} REGF_FILE; 208 209/* Function Declarations */ 210 211REGF_FILE* regfio_open( const char *filename, int flags, int mode ); 212int regfio_close( REGF_FILE *r ); 213 214REGF_NK_REC* regfio_rootkey( REGF_FILE *file ); 215REGF_NK_REC* regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk ); 216REGF_NK_REC* regfio_write_key ( REGF_FILE *file, const char *name, 217 struct regval_ctr *values, struct regsubkey_ctr *subkeys, 218 SEC_DESC *sec_desc, REGF_NK_REC *parent ); 219 220 221#endif /* _REGFIO_H */ 222 223