source3/registry/regfio.h

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  * Windows NT registry I/O library
   4  * Copyright (c) Gerald (Jerry) Carter               2005
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /************************************************************
  21  * Most of this information was obtained from
  22  * http://www.wednesday.demon.co.uk/dosreg.html
  23  * Thanks Nigel!
  24  ***********************************************************/
  25
  26 #include "registry/reg_parse_prs.h"
  27 #include "registry/reg_objects.h"
  28
  29 #ifndef _REGFIO_H
  30 #define _REGFIO_H
  31
  32 struct regsubkey_ctr;
  33
  34 /* Macros */
  35
  36 #define REGF_BLOCKSIZE          0x1000
  37 #define REGF_ALLOC_BLOCK        0x1000
  38
  39 /* header sizes for various records */
  40
  41 #define REGF_HDR_SIZE           4
  42 #define HBIN_HDR_SIZE           4
  43 #define HBIN_HEADER_REC_SIZE    0x24
  44 #define REC_HDR_SIZE            2
  45
  46 #define REGF_OFFSET_NONE        0xffffffff
  47
  48 /* Flags for the vk records */
  49
  50 #define VK_FLAG_NAME_PRESENT    0x0001
  51 #define VK_DATA_IN_OFFSET       0x80000000
  52
  53 /* NK record macros */
  54
  55 #define NK_TYPE_LINKKEY         0x0010
  56 #define NK_TYPE_NORMALKEY       0x0020
  57 #define NK_TYPE_ROOTKEY         0x002c
  58
  59 #define HBIN_STORE_REF(x, y)    { x->hbin = y; y->ref_count++ };
  60 #define HBIN_REMOVE_REF(x, y)   { x->hbin = NULL; y->ref_count-- /* if the count == 0; we can clean up */ };
  61
  62
  63 /* HBIN block */
  64 struct regf_hbin;
  65 typedef struct regf_hbin {
  66         struct regf_hbin *prev, *next;
  67         uint32_t file_off;              /* my offset in the registry file */
  68         uint32_t free_off;              /* offset to free space within the hbin record */
  69         uint32_t free_size;             /* amount of data left in the block */
  70         int ref_count;                  /* how many active records are pointing to this block (not used currently) */
  71
  72         char   header[HBIN_HDR_SIZE];   /* "hbin" */
  73         uint32_t first_hbin_off;                /* offset from first hbin block */
  74         uint32_t block_size;            /* block size of this blockually a multiple of 4096Kb) */
  75
  76         prs_struct ps;                  /* data */
  77
  78         bool dirty;                     /* has this hbin block been modified? */
  79 } REGF_HBIN;
  80
  81 /* ??? List -- list of key offsets and hashed names for consistency */
  82
  83 typedef struct {
  84         uint32_t nk_off;
  85         uint8_t keycheck[sizeof(uint32_t)];
  86         char *fullname;
  87 } REGF_HASH_REC;
  88
  89 typedef struct {
  90         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
  91         uint32_t hbin_off;      /* offset from beginning of this hbin block */
  92         uint32_t rec_size;      /* ((start_offset - end_offset) & 0xfffffff8) */
  93
  94         char header[REC_HDR_SIZE];
  95         uint16_t num_keys;
  96         REGF_HASH_REC *hashes;
  97 } REGF_LF_REC;
  98
  99 /* Key Value */
 100
 101 typedef struct {
 102         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 103         uint32_t hbin_off;      /* offset from beginning of this hbin block */
 104         uint32_t rec_size;      /* ((start_offset - end_offset) & 0xfffffff8) */
 105         uint32_t rec_off;               /* offset stored in the value list */
 106
 107         char header[REC_HDR_SIZE];
 108         char *valuename;
 109         uint32_t data_size;
 110         uint32_t data_off;
 111         uint8_t  *data;
 112         uint32_t type;
 113         uint16_t flag;
 114 } REGF_VK_REC;
 115
 116
 117 /* Key Security */
 118 struct _regf_sk_rec;
 119
 120 typedef struct _regf_sk_rec {
 121         struct _regf_sk_rec *next, *prev;
 122         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 123         uint32_t hbin_off;      /* offset from beginning of this hbin block */
 124         uint32_t rec_size;      /* ((start_offset - end_offset) & 0xfffffff8) */
 125
 126         uint32_t sk_off;                /* offset parsed from NK record used as a key
 127                                    to lookup reference to this SK record */
 128
 129         char header[REC_HDR_SIZE];
 130         uint32_t prev_sk_off;
 131         uint32_t next_sk_off;
 132         uint32_t ref_count;
 133         uint32_t size;
 134         struct security_descriptor *sec_desc;
 135 } REGF_SK_REC;
 136
 137 /* Key Name */
 138
 139 typedef struct {
 140         REGF_HBIN *hbin;        /* pointer to HBIN record (in memory) containing this nk record */
 141         uint32_t hbin_off;      /* offset from beginning of this hbin block */
 142         uint32_t subkey_index;  /* index to next subkey record to return */
 143         uint32_t rec_size;      /* ((start_offset - end_offset) & 0xfffffff8) */
 144
 145         /* header information */
 146
 147         char header[REC_HDR_SIZE];
 148         uint16_t key_type;
 149         NTTIME mtime;
 150         uint32_t parent_off;    /* back pointer in registry hive */
 151         uint32_t classname_off;
 152         char *classname;
 153         char *keyname;
 154
 155         /* max lengths */
 156
 157         uint32_t max_bytes_subkeyname;          /* max subkey name * 2 */
 158         uint32_t max_bytes_subkeyclassname;     /* max subkey classname length (as if) */
 159         uint32_t max_bytes_valuename;           /* max valuename * 2 */
 160         uint32_t max_bytes_value;                       /* max value data size */
 161
 162         /* unknowns */
 163
 164         uint32_t unk_index;                     /* nigel says run time index ? */
 165
 166         /* children */
 167
 168         uint32_t num_subkeys;
 169         uint32_t subkeys_off;   /* hash records that point to NK records */
 170         uint32_t num_values;
 171         uint32_t values_off;    /* value lists which point to VK records */
 172         uint32_t sk_off;                /* offset to SK record */
 173
 174         /* link in the other records here */
 175
 176         REGF_LF_REC subkeys;
 177         REGF_VK_REC *values;
 178         REGF_SK_REC *sec_desc;
 179
 180 } REGF_NK_REC;
 181
 182 /* REGF block */
 183
 184 typedef struct {
 185         /* run time information */
 186
 187         int fd;                         /* file descriptor */
 188         int open_flags;                 /* flags passed to the open() call */
 189         TALLOC_CTX *mem_ctx;            /* memory context for run-time file access information */
 190         REGF_HBIN *block_list;          /* list of open hbin blocks */
 191
 192         /* file format information */
 193
 194         char   header[REGF_HDR_SIZE];   /* "regf" */
 195         uint32_t data_offset;           /* offset to record in the first (or any?) hbin block */
 196         uint32_t last_block;            /* offset to last hbin block in file */
 197         uint32_t checksum;              /* XOR of bytes 0x0000 - 0x01FB */
 198         NTTIME mtime;
 199
 200         REGF_SK_REC *sec_desc_list;     /* list of security descriptors referenced by NK records */
 201
 202         /* Ignore checksums in input data. Used by fuzzing code to allow more
 203          * coverage without having to calculate a valid checksum. The checksums
 204          * are merely to detect data corruption and don't provide a security
 205          * value.
 206          */
 207         bool ignore_checksums;
 208
 209         /* unknowns used to simply writing */
 210
 211         uint32_t unknown1;
 212         uint32_t unknown2;
 213         uint32_t unknown3;
 214         uint32_t unknown4;
 215         uint32_t unknown5;
 216         uint32_t unknown6;
 217
 218 } REGF_FILE;
 219
 220 /* Function Declarations */
 221
 222 REGF_FILE*    regfio_open( const char *filename, int flags, int mode );
 223 int           regfio_close( REGF_FILE *r );
 224
 225 REGF_NK_REC*  regfio_rootkey( REGF_FILE *file );
 226 REGF_NK_REC*  regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk );
 227 REGF_NK_REC*  regfio_write_key ( REGF_FILE *file, const char *name,
 228                                  struct regval_ctr *values, struct regsubkey_ctr *subkeys,
 229                                  struct security_descriptor *sec_desc, REGF_NK_REC *parent );
 230
 231
 232 #endif  /* _REGFIO_H */
 233