2 * Unix SMB/CIFS implementation.
3 * Windows NT registry I/O library
4 * Copyright (c) Gerald (Jerry) Carter 2005
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 /*******************************************************************
26 * TODO : Right now this code basically ignores classnames.
28 ******************************************************************/
31 /*******************************************************************
32 *******************************************************************/
34 static int write_block( REGF_FILE
*file
, prs_struct
*ps
, uint32 offset
)
36 int bytes_written
, returned
;
37 char *buffer
= prs_data_p( ps
);
38 uint32 buffer_size
= prs_data_size( ps
);
44 /* check for end of file */
46 if ( sys_fstat( file
->fd
, &sbuf
) ) {
47 DEBUG(0,("write_block: stat() failed! (%s)\n", strerror(errno
)));
51 if ( lseek( file
->fd
, offset
, SEEK_SET
) == -1 ) {
52 DEBUG(0,("write_block: lseek() failed! (%s)\n", strerror(errno
) ));
56 bytes_written
= returned
= 0;
57 while ( bytes_written
< buffer_size
) {
58 if ( (returned
= write( file
->fd
, buffer
+bytes_written
, buffer_size
-bytes_written
)) == -1 ) {
59 DEBUG(0,("write_block: write() failed! (%s)\n", strerror(errno
) ));
63 bytes_written
+= returned
;
69 /*******************************************************************
70 *******************************************************************/
72 static int read_block( REGF_FILE
*file
, prs_struct
*ps
, uint32 file_offset
, uint32 block_size
)
74 int bytes_read
, returned
;
78 /* check for end of file */
80 if ( sys_fstat( file
->fd
, &sbuf
) ) {
81 DEBUG(0,("read_block: stat() failed! (%s)\n", strerror(errno
)));
85 if ( (size_t)file_offset
>= sbuf
.st_size
)
88 /* if block_size == 0, we are parsnig HBIN records and need
89 to read some of the header to get the block_size from there */
91 if ( block_size
== 0 ) {
94 if ( lseek( file
->fd
, file_offset
, SEEK_SET
) == -1 ) {
95 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno
) ));
99 returned
= read( file
->fd
, hdr
, 0x20 );
100 if ( (returned
== -1) || (returned
< 0x20) ) {
101 DEBUG(0,("read_block: failed to read in HBIN header. Is the file corrupt?\n"));
105 /* make sure this is an hbin header */
107 if ( strncmp( hdr
, "hbin", HBIN_HDR_SIZE
) != 0 ) {
108 DEBUG(0,("read_block: invalid block header!\n"));
112 block_size
= IVAL( hdr
, 0x08 );
115 DEBUG(10,("read_block: block_size == 0x%x\n", block_size
));
117 /* set the offset, initialize the buffer, and read the block from disk */
119 if ( lseek( file
->fd
, file_offset
, SEEK_SET
) == -1 ) {
120 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno
) ));
124 prs_init( ps
, block_size
, file
->mem_ctx
, UNMARSHALL
);
125 buffer
= prs_data_p( ps
);
126 bytes_read
= returned
= 0;
128 while ( bytes_read
< block_size
) {
129 if ( (returned
= read( file
->fd
, buffer
+bytes_read
, block_size
-bytes_read
)) == -1 ) {
130 DEBUG(0,("read_block: read() failed (%s)\n", strerror(errno
) ));
133 if ( (returned
== 0) && (bytes_read
< block_size
) ) {
134 DEBUG(0,("read_block: not a vald registry file ?\n" ));
138 bytes_read
+= returned
;
144 /*******************************************************************
145 *******************************************************************/
147 static BOOL
write_hbin_block( REGF_FILE
*file
, REGF_HBIN
*hbin
)
152 /* write free space record if any is available */
154 if ( hbin
->free_off
!= REGF_OFFSET_NONE
) {
155 uint32 header
= 0xffffffff;
157 if ( !prs_set_offset( &hbin
->ps
, hbin
->free_off
-sizeof(uint32
) ) )
159 if ( !prs_uint32( "free_size", &hbin
->ps
, 0, &hbin
->free_size
) )
161 if ( !prs_uint32( "free_header", &hbin
->ps
, 0, &header
) )
165 hbin
->dirty
= (write_block( file
, &hbin
->ps
, hbin
->file_off
) != -1);
170 /*******************************************************************
171 *******************************************************************/
173 static BOOL
hbin_block_close( REGF_FILE
*file
, REGF_HBIN
*hbin
)
177 /* remove the block from the open list and flush it to disk */
179 for ( p
=file
->block_list
; p
&& p
!=hbin
; p
=p
->next
)
183 DLIST_REMOVE( file
->block_list
, hbin
);
186 DEBUG(0,("hbin_block_close: block not in open list!\n"));
188 if ( !write_hbin_block( file
, hbin
) )
194 /*******************************************************************
195 *******************************************************************/
197 static BOOL
prs_regf_block( const char *desc
, prs_struct
*ps
, int depth
, REGF_FILE
*file
)
199 prs_debug(ps
, depth
, desc
, "prs_regf_block");
202 if ( !prs_uint8s( True
, "header", ps
, depth
, file
->header
, sizeof( file
->header
)) )
205 /* yes, these values are always identical so store them only once */
207 if ( !prs_uint32( "unknown1", ps
, depth
, &file
->unknown1
))
209 if ( !prs_uint32( "unknown1 (again)", ps
, depth
, &file
->unknown1
))
212 /* get the modtime */
214 if ( !prs_set_offset( ps
, 0x0c ) )
216 if ( !smb_io_time( "modtime", &file
->mtime
, ps
, depth
) )
221 if ( !prs_uint32( "unknown2", ps
, depth
, &file
->unknown2
))
223 if ( !prs_uint32( "unknown3", ps
, depth
, &file
->unknown3
))
225 if ( !prs_uint32( "unknown4", ps
, depth
, &file
->unknown4
))
227 if ( !prs_uint32( "unknown5", ps
, depth
, &file
->unknown5
))
230 /* get file offsets */
232 if ( !prs_set_offset( ps
, 0x24 ) )
234 if ( !prs_uint32( "data_offset", ps
, depth
, &file
->data_offset
))
236 if ( !prs_uint32( "last_block", ps
, depth
, &file
->last_block
))
239 /* one more constant */
241 if ( !prs_uint32( "unknown6", ps
, depth
, &file
->unknown6
))
244 /* get the checksum */
246 if ( !prs_set_offset( ps
, 0x01fc ) )
248 if ( !prs_uint32( "checksum", ps
, depth
, &file
->checksum
))
254 /*******************************************************************
255 *******************************************************************/
257 static BOOL
prs_hbin_block( const char *desc
, prs_struct
*ps
, int depth
, REGF_HBIN
*hbin
)
261 prs_debug(ps
, depth
, desc
, "prs_regf_block");
264 if ( !prs_uint8s( True
, "header", ps
, depth
, hbin
->header
, sizeof( hbin
->header
)) )
267 if ( !prs_uint32( "first_hbin_off", ps
, depth
, &hbin
->first_hbin_off
))
270 /* The dosreg.cpp comments say that the block size is at 0x1c.
271 According to a WINXP NTUSER.dat file, this is wrong. The block_size
274 if ( !prs_uint32( "block_size", ps
, depth
, &hbin
->block_size
))
277 block_size2
= hbin
->block_size
;
278 prs_set_offset( ps
, 0x1c );
279 if ( !prs_uint32( "block_size2", ps
, depth
, &block_size2
))
282 if ( MARSHALLING(ps
) )
289 /*******************************************************************
290 *******************************************************************/
292 static BOOL
prs_nk_rec( const char *desc
, prs_struct
*ps
, int depth
, REGF_NK_REC
*nk
)
294 uint16 class_length
, name_length
;
296 uint32 data_size
, start_off
, end_off
;
297 uint32 unknown_off
= REGF_OFFSET_NONE
;
299 nk
->hbin_off
= prs_offset( ps
);
300 start
= nk
->hbin_off
;
302 prs_debug(ps
, depth
, desc
, "prs_nk_rec");
305 /* back up and get the data_size */
307 if ( !prs_set_offset( ps
, prs_offset(ps
)-sizeof(uint32
)) )
309 start_off
= prs_offset( ps
);
310 if ( !prs_uint32( "rec_size", ps
, depth
, &nk
->rec_size
))
313 if ( !prs_uint8s( True
, "header", ps
, depth
, nk
->header
, sizeof( nk
->header
)) )
316 if ( !prs_uint16( "key_type", ps
, depth
, &nk
->key_type
))
318 if ( !smb_io_time( "mtime", &nk
->mtime
, ps
, depth
))
321 if ( !prs_set_offset( ps
, start
+0x0010 ) )
323 if ( !prs_uint32( "parent_off", ps
, depth
, &nk
->parent_off
))
325 if ( !prs_uint32( "num_subkeys", ps
, depth
, &nk
->num_subkeys
))
328 if ( !prs_set_offset( ps
, start
+0x001c ) )
330 if ( !prs_uint32( "subkeys_off", ps
, depth
, &nk
->subkeys_off
))
332 if ( !prs_uint32( "unknown_off", ps
, depth
, &unknown_off
) )
335 if ( !prs_set_offset( ps
, start
+0x0024 ) )
337 if ( !prs_uint32( "num_values", ps
, depth
, &nk
->num_values
))
339 if ( !prs_uint32( "values_off", ps
, depth
, &nk
->values_off
))
341 if ( !prs_uint32( "sk_off", ps
, depth
, &nk
->sk_off
))
343 if ( !prs_uint32( "classname_off", ps
, depth
, &nk
->classname_off
))
346 if ( !prs_uint32( "max_bytes_subkeyname", ps
, depth
, &nk
->max_bytes_subkeyname
))
348 if ( !prs_uint32( "max_bytes_subkeyclassname", ps
, depth
, &nk
->max_bytes_subkeyclassname
))
350 if ( !prs_uint32( "max_bytes_valuename", ps
, depth
, &nk
->max_bytes_valuename
))
352 if ( !prs_uint32( "max_bytes_value", ps
, depth
, &nk
->max_bytes_value
))
354 if ( !prs_uint32( "unknown index", ps
, depth
, &nk
->unk_index
))
357 name_length
= nk
->keyname
? strlen(nk
->keyname
) : 0 ;
358 class_length
= nk
->classname
? strlen(nk
->classname
) : 0 ;
359 if ( !prs_uint16( "name_length", ps
, depth
, &name_length
))
361 if ( !prs_uint16( "class_length", ps
, depth
, &class_length
))
364 if ( class_length
) {
369 if ( UNMARSHALLING(ps
) ) {
370 if ( !(nk
->keyname
= PRS_ALLOC_MEM( ps
, char, name_length
+1 )) )
374 if ( !prs_uint8s( True
, "name", ps
, depth
, nk
->keyname
, name_length
) )
377 if ( UNMARSHALLING(ps
) )
378 nk
->keyname
[name_length
] = '\0';
381 end_off
= prs_offset( ps
);
383 /* data_size must be divisible by 8 and large enough to hold the original record */
385 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
386 if ( data_size
> nk
->rec_size
)
387 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size
, nk
->rec_size
));
389 if ( MARSHALLING(ps
) )
390 nk
->hbin
->dirty
= True
;
395 /*******************************************************************
396 *******************************************************************/
398 static uint32
regf_block_checksum( prs_struct
*ps
)
400 char *buffer
= prs_data_p( ps
);
404 /* XOR of all bytes 0x0000 - 0x01FB */
408 for ( i
=0; i
<0x01FB; i
+=4 ) {
409 x
= IVAL(buffer
, i
);
416 /*******************************************************************
417 *******************************************************************/
419 static BOOL
read_regf_block( REGF_FILE
*file
)
424 /* grab the first block from the file */
426 if ( read_block( file
, &ps
, 0, REGF_BLOCKSIZE
) == -1 )
429 /* parse the block and verify the checksum */
431 if ( !prs_regf_block( "regf_header", &ps
, 0, file
) )
434 checksum
= regf_block_checksum( &ps
);
438 if ( file
->checksum
!= checksum
) {
439 DEBUG(0,("read_regf_block: invalid checksum\n" ));
446 /*******************************************************************
447 *******************************************************************/
449 static REGF_HBIN
* read_hbin_block( REGF_FILE
*file
, off_t offset
)
452 uint32 record_size
, curr_off
, block_size
, header
;
454 if ( !(hbin
= TALLOC_ZERO_P(file
->mem_ctx
, REGF_HBIN
)) )
456 hbin
->file_off
= offset
;
459 if ( read_block( file
, &hbin
->ps
, offset
, 0 ) == -1 )
462 if ( !prs_hbin_block( "hbin", &hbin
->ps
, 0, hbin
) )
465 /* this should be the same thing as hbin->block_size but just in case */
467 block_size
= prs_data_size( &hbin
->ps
);
469 /* Find the available free space offset. Always at the end,
470 so walk the record list and stop when you get to the end.
471 The end is defined by a record header of 0xffffffff. The
472 previous 4 bytes contains the amount of free space remaining
473 in the hbin block. */
475 /* remember that the record_size is in the 4 bytes preceeding the record itself */
477 if ( !prs_set_offset( &hbin
->ps
, file
->data_offset
+HBIN_HDR_SIZE
-sizeof(uint32
) ) )
481 curr_off
= prs_offset( &hbin
->ps
);
482 while ( header
!= 0xffffffff ) {
483 /* not done yet so reset the current offset to the
484 next record_size field */
486 curr_off
= curr_off
+record_size
;
488 /* for some reason the record_size of the last record in
489 an hbin block can extend past the end of the block
490 even though the record fits within the remaining
491 space....aaarrrgggghhhhhh */
493 if ( curr_off
>= block_size
) {
499 if ( !prs_set_offset( &hbin
->ps
, curr_off
) )
502 if ( !prs_uint32( "rec_size", &hbin
->ps
, 0, &record_size
) )
504 if ( !prs_uint32( "header", &hbin
->ps
, 0, &header
) )
507 SMB_ASSERT( record_size
!= 0 );
509 if ( record_size
& 0x80000000 ) {
510 /* absolute_value(record_size) */
511 record_size
= (record_size
^ 0xffffffff) + 1;
515 /* save the free space offset */
517 if ( header
== 0xffffffff ) {
519 /* account for the fact that the curr_off is 4 bytes behind the actual
522 hbin
->free_off
= curr_off
+ sizeof(uint32
);
523 hbin
->free_size
= record_size
;
526 DEBUG(10,("read_hbin_block: free space offset == 0x%x\n", hbin
->free_off
));
528 if ( !prs_set_offset( &hbin
->ps
, file
->data_offset
+HBIN_HDR_SIZE
) )
534 /*******************************************************************
535 Input a randon offset and receive the correpsonding HBIN
537 *******************************************************************/
539 static BOOL
hbin_contains_offset( REGF_HBIN
*hbin
, uint32 offset
)
544 if ( (offset
> hbin
->first_hbin_off
) && (offset
< (hbin
->first_hbin_off
+hbin
->block_size
)) )
550 /*******************************************************************
551 Input a randon offset and receive the correpsonding HBIN
553 *******************************************************************/
555 static REGF_HBIN
* lookup_hbin_block( REGF_FILE
*file
, uint32 offset
)
557 REGF_HBIN
*hbin
= NULL
;
560 /* start with the open list */
562 for ( hbin
=file
->block_list
; hbin
; hbin
=hbin
->next
) {
563 DEBUG(10,("lookup_hbin_block: address = 0x%x [0x%x]\n", hbin
->file_off
, (uint32
)hbin
));
564 if ( hbin_contains_offset( hbin
, offset
) )
569 /* start at the beginning */
571 block_off
= REGF_BLOCKSIZE
;
573 /* cleanup before the next round */
575 prs_mem_free( &hbin
->ps
);
577 hbin
= read_hbin_block( file
, block_off
);
580 block_off
= hbin
->file_off
+ hbin
->block_size
;
582 } while ( hbin
&& !hbin_contains_offset( hbin
, offset
) );
586 DLIST_ADD( file
->block_list
, hbin
);
591 /*******************************************************************
592 *******************************************************************/
594 static BOOL
prs_hash_rec( const char *desc
, prs_struct
*ps
, int depth
, REGF_HASH_REC
*hash
)
596 prs_debug(ps
, depth
, desc
, "prs_hash_rec");
599 if ( !prs_uint32( "nk_off", ps
, depth
, &hash
->nk_off
))
601 if ( !prs_uint8s( True
, "keycheck", ps
, depth
, hash
->keycheck
, sizeof( hash
->keycheck
)) )
607 /*******************************************************************
608 *******************************************************************/
610 static BOOL
hbin_prs_lf_records( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_NK_REC
*nk
)
613 REGF_LF_REC
*lf
= &nk
->subkeys
;
614 uint32 data_size
, start_off
, end_off
;
616 prs_debug(&hbin
->ps
, depth
, desc
, "prs_lf_records");
619 /* check if we have anything to do first */
621 if ( nk
->num_subkeys
== 0 )
624 /* move to the LF record */
626 if ( !prs_set_offset( &hbin
->ps
, nk
->subkeys_off
+ HBIN_HDR_SIZE
- hbin
->first_hbin_off
) )
629 /* backup and get the data_size */
631 if ( !prs_set_offset( &hbin
->ps
, prs_offset(&hbin
->ps
)-sizeof(uint32
)) )
633 start_off
= prs_offset( &hbin
->ps
);
634 if ( !prs_uint32( "rec_size", &hbin
->ps
, depth
, &lf
->rec_size
))
637 if ( !prs_uint8s( True
, "header", &hbin
->ps
, depth
, lf
->header
, sizeof( lf
->header
)) )
640 if ( !prs_uint16( "num_keys", &hbin
->ps
, depth
, &lf
->num_keys
))
643 if ( UNMARSHALLING(&hbin
->ps
) ) {
644 if ( !(lf
->hashes
= PRS_ALLOC_MEM( &hbin
->ps
, REGF_HASH_REC
, lf
->num_keys
)) )
648 for ( i
=0; i
<lf
->num_keys
; i
++ ) {
649 if ( !prs_hash_rec( "hash_rec", &hbin
->ps
, depth
, &lf
->hashes
[i
] ) )
653 end_off
= prs_offset( &hbin
->ps
);
655 /* data_size must be divisible by 8 and large enough to hold the original record */
657 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
658 if ( data_size
> lf
->rec_size
)
659 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size
, lf
->rec_size
));
661 if ( MARSHALLING(&hbin
->ps
) )
667 /*******************************************************************
668 *******************************************************************/
670 static BOOL
hbin_prs_sk_rec( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_SK_REC
*sk
)
672 prs_struct
*ps
= &hbin
->ps
;
674 uint32 data_size
, start_off
, end_off
;
677 prs_debug(ps
, depth
, desc
, "hbin_prs_sk_rec");
680 if ( !prs_set_offset( &hbin
->ps
, sk
->sk_off
+ HBIN_HDR_SIZE
- hbin
->first_hbin_off
) )
683 /* backup and get the data_size */
685 if ( !prs_set_offset( &hbin
->ps
, prs_offset(&hbin
->ps
)-sizeof(uint32
)) )
687 start_off
= prs_offset( &hbin
->ps
);
688 if ( !prs_uint32( "rec_size", &hbin
->ps
, depth
, &sk
->rec_size
))
691 if ( !prs_uint8s( True
, "header", ps
, depth
, sk
->header
, sizeof( sk
->header
)) )
693 if ( !prs_uint16( "tag", ps
, depth
, &tag
))
696 if ( !prs_uint32( "prev_sk_off", ps
, depth
, &sk
->prev_sk_off
))
698 if ( !prs_uint32( "next_sk_off", ps
, depth
, &sk
->next_sk_off
))
700 if ( !prs_uint32( "ref_count", ps
, depth
, &sk
->ref_count
))
702 if ( !prs_uint32( "size", ps
, depth
, &sk
->size
))
705 if ( !sec_io_desc( "sec_desc", &sk
->sec_desc
, ps
, depth
))
708 end_off
= prs_offset( &hbin
->ps
);
710 /* data_size must be divisible by 8 and large enough to hold the original record */
712 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
713 if ( data_size
> sk
->rec_size
)
714 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size
, sk
->rec_size
));
716 if ( MARSHALLING(&hbin
->ps
) )
722 /*******************************************************************
723 *******************************************************************/
725 static BOOL
hbin_prs_vk_rec( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_VK_REC
*vk
, REGF_FILE
*file
)
729 prs_struct
*ps
= &hbin
->ps
;
730 uint32 data_size
, start_off
, end_off
;
732 prs_debug(ps
, depth
, desc
, "prs_vk_rec");
735 /* backup and get the data_size */
737 if ( !prs_set_offset( &hbin
->ps
, prs_offset(&hbin
->ps
)-sizeof(uint32
)) )
739 start_off
= prs_offset( &hbin
->ps
);
740 if ( !prs_uint32( "rec_size", &hbin
->ps
, depth
, &vk
->rec_size
))
743 if ( !prs_uint8s( True
, "header", ps
, depth
, vk
->header
, sizeof( vk
->header
)) )
746 if ( MARSHALLING(&hbin
->ps
) )
747 name_length
= strlen(vk
->valuename
);
749 if ( !prs_uint16( "name_length", ps
, depth
, &name_length
))
751 if ( !prs_uint32( "data_size", ps
, depth
, &vk
->data_size
))
753 if ( !prs_uint32( "data_off", ps
, depth
, &vk
->data_off
))
755 if ( !prs_uint32( "type", ps
, depth
, &vk
->type
))
757 if ( !prs_uint16( "flag", ps
, depth
, &vk
->flag
))
760 offset
= prs_offset( ps
);
761 offset
+= 2; /* skip 2 bytes */
762 prs_set_offset( ps
, offset
);
766 if ( vk
->flag
&VK_FLAG_NAME_PRESENT
) {
768 if ( UNMARSHALLING(&hbin
->ps
) ) {
769 if ( !(vk
->valuename
= PRS_ALLOC_MEM( ps
, char, name_length
+1 )))
772 if ( !prs_uint8s( True
, "name", ps
, depth
, vk
->valuename
, name_length
) )
776 end_off
= prs_offset( &hbin
->ps
);
778 /* get the data if necessary */
780 if ( vk
->data_size
!= 0 ) {
781 BOOL charmode
= False
;
783 if ( (vk
->type
== REG_SZ
) || (vk
->type
== REG_MULTI_SZ
) )
786 /* the data is stored in the offset if the size <= 4 */
788 if ( !(vk
->data_size
& VK_DATA_IN_OFFSET
) ) {
789 REGF_HBIN
*hblock
= hbin
;
790 uint32 data_rec_size
;
792 if ( UNMARSHALLING(&hbin
->ps
) ) {
793 if ( !(vk
->data
= PRS_ALLOC_MEM( ps
, uint8
, vk
->data_size
) ) )
797 /* this data can be in another hbin */
798 if ( !hbin_contains_offset( hbin
, vk
->data_off
) ) {
799 if ( !(hblock
= lookup_hbin_block( file
, vk
->data_off
)) )
802 if ( !(prs_set_offset( &hblock
->ps
, (vk
->data_off
+HBIN_HDR_SIZE
-hblock
->first_hbin_off
)-sizeof(uint32
) )) )
805 if ( MARSHALLING(&hblock
->ps
) ) {
806 data_rec_size
= ( (vk
->data_size
+sizeof(uint32
)) & 0xfffffff8 ) + 8;
807 data_rec_size
= ( data_rec_size
- 1 ) ^ 0xFFFFFFFF;
809 if ( !prs_uint32( "data_rec_size", &hblock
->ps
, depth
, &data_rec_size
))
811 if ( !prs_uint8s( charmode
, "data", &hblock
->ps
, depth
, vk
->data
, vk
->data_size
) )
814 if ( MARSHALLING(&hblock
->ps
) )
815 hblock
->dirty
= True
;
818 if ( !(vk
->data
= PRS_ALLOC_MEM( ps
, uint8
, 4 ) ) )
820 SIVAL( vk
->data
, 0, vk
->data_off
);
825 /* data_size must be divisible by 8 and large enough to hold the original record */
827 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
828 if ( data_size
!= vk
->rec_size
)
829 DEBUG(10,("prs_vk_rec: data_size check failed (0x%x < 0x%x)\n", data_size
, vk
->rec_size
));
831 if ( MARSHALLING(&hbin
->ps
) )
837 /*******************************************************************
838 read a VK record which is contained in the HBIN block stored
839 in the prs_struct *ps.
840 *******************************************************************/
842 static BOOL
hbin_prs_vk_records( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_NK_REC
*nk
, REGF_FILE
*file
)
847 prs_debug(&hbin
->ps
, depth
, desc
, "prs_vk_records");
850 /* check if we have anything to do first */
852 if ( nk
->num_values
== 0 )
855 if ( UNMARSHALLING(&hbin
->ps
) ) {
856 if ( !(nk
->values
= PRS_ALLOC_MEM( &hbin
->ps
, REGF_VK_REC
, nk
->num_values
) ) )
860 /* convert the offset to something relative to this HBIN block */
862 if ( !prs_set_offset( &hbin
->ps
, nk
->values_off
+HBIN_HDR_SIZE
-hbin
->first_hbin_off
-sizeof(uint32
)) )
865 if ( MARSHALLING( &hbin
->ps
) ) {
866 record_size
= ( ( nk
->num_values
* sizeof(uint32
) ) & 0xfffffff8 ) + 8;
867 record_size
= (record_size
- 1) ^ 0xFFFFFFFF;
870 if ( !prs_uint32( "record_size", &hbin
->ps
, depth
, &record_size
) )
873 for ( i
=0; i
<nk
->num_values
; i
++ ) {
874 if ( !prs_uint32( "vk_off", &hbin
->ps
, depth
, &nk
->values
[i
].rec_off
) )
878 for ( i
=0; i
<nk
->num_values
; i
++ ) {
879 REGF_HBIN
*sub_hbin
= hbin
;
882 if ( !hbin_contains_offset( hbin
, nk
->values
[i
].rec_off
) ) {
883 sub_hbin
= lookup_hbin_block( file
, nk
->values
[i
].rec_off
);
885 DEBUG(0,("hbin_prs_vk_records: Failed to find HBIN block containing offset [0x%x]\n",
886 nk
->values
[i
].hbin_off
));
891 new_offset
= nk
->values
[i
].rec_off
+ HBIN_HDR_SIZE
- sub_hbin
->first_hbin_off
;
892 if ( !prs_set_offset( &sub_hbin
->ps
, new_offset
) )
894 if ( !hbin_prs_vk_rec( "vk_rec", sub_hbin
, depth
, &nk
->values
[i
], file
) )
898 if ( MARSHALLING(&hbin
->ps
) )
906 /*******************************************************************
907 *******************************************************************/
909 static REGF_SK_REC
* find_sk_record_by_offset( REGF_FILE
*file
, uint32 offset
)
913 for ( p_sk
=file
->sec_desc_list
; p_sk
; p_sk
=p_sk
->next
) {
914 if ( p_sk
->sk_off
== offset
)
921 /*******************************************************************
922 *******************************************************************/
924 static REGF_SK_REC
* find_sk_record_by_sec_desc( REGF_FILE
*file
, SEC_DESC
*sd
)
928 for ( p
=file
->sec_desc_list
; p
; p
=p
->next
) {
929 if ( sec_desc_equal( p
->sec_desc
, sd
) )
938 /*******************************************************************
939 *******************************************************************/
941 static BOOL
hbin_prs_key( REGF_FILE
*file
, REGF_HBIN
*hbin
, REGF_NK_REC
*nk
)
946 prs_debug(&hbin
->ps
, depth
, "", "fetch_key");
949 /* get the initial nk record */
951 if ( !prs_nk_rec( "nk_rec", &hbin
->ps
, depth
, nk
))
956 if ( nk
->num_values
&& (nk
->values_off
!=REGF_OFFSET_NONE
) ) {
958 if ( !hbin_contains_offset( hbin
, nk
->values_off
) ) {
959 sub_hbin
= lookup_hbin_block( file
, nk
->values_off
);
961 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing value_list_offset [0x%x]\n",
967 if ( !hbin_prs_vk_records( "vk_rec", sub_hbin
, depth
, nk
, file
))
971 /* now get subkeys */
973 if ( nk
->num_subkeys
&& (nk
->subkeys_off
!=REGF_OFFSET_NONE
) ) {
975 if ( !hbin_contains_offset( hbin
, nk
->subkeys_off
) ) {
976 sub_hbin
= lookup_hbin_block( file
, nk
->subkeys_off
);
978 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing subkey_offset [0x%x]\n",
984 if ( !hbin_prs_lf_records( "lf_rec", sub_hbin
, depth
, nk
))
988 /* get the to the security descriptor. First look if we have already parsed it */
990 if ( (nk
->sk_off
!=REGF_OFFSET_NONE
) && !( nk
->sec_desc
= find_sk_record_by_offset( file
, nk
->sk_off
)) ) {
993 if ( !hbin_contains_offset( hbin
, nk
->sk_off
) ) {
994 sub_hbin
= lookup_hbin_block( file
, nk
->sk_off
);
996 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing sk_offset [0x%x]\n",
1002 if ( !(nk
->sec_desc
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_SK_REC
)) )
1004 nk
->sec_desc
->sk_off
= nk
->sk_off
;
1005 if ( !hbin_prs_sk_rec( "sk_rec", sub_hbin
, depth
, nk
->sec_desc
))
1008 /* add to the list of security descriptors (ref_count has been read from the files) */
1010 nk
->sec_desc
->sk_off
= nk
->sk_off
;
1011 DLIST_ADD( file
->sec_desc_list
, nk
->sec_desc
);
1017 /*******************************************************************
1018 *******************************************************************/
1020 static BOOL
next_record( REGF_HBIN
*hbin
, const char *hdr
, BOOL
*eob
)
1022 char header
[REC_HDR_SIZE
] = "";
1024 uint32 curr_off
, block_size
;
1026 prs_struct
*ps
= &hbin
->ps
;
1028 curr_off
= prs_offset( ps
);
1029 if ( curr_off
== 0 )
1030 prs_set_offset( ps
, HBIN_HEADER_REC_SIZE
);
1032 /* assume that the current offset is at the reacord header
1033 and we need to backup to read the record size */
1035 curr_off
-= sizeof(uint32
);
1037 block_size
= prs_data_size( ps
);
1041 curr_off
= curr_off
+record_size
;
1042 if ( curr_off
>= block_size
)
1045 if ( !prs_set_offset( &hbin
->ps
, curr_off
) )
1048 if ( !prs_uint32( "record_size", ps
, 0, &record_size
) )
1050 if ( !prs_uint8s( True
, "header", ps
, 0, header
, REC_HDR_SIZE
) )
1053 if ( record_size
& 0x80000000 ) {
1054 /* absolute_value(record_size) */
1055 record_size
= (record_size
^ 0xffffffff) + 1;
1058 if ( memcmp( header
, hdr
, REC_HDR_SIZE
) == 0 ) {
1060 curr_off
+= sizeof(uint32
);
1064 /* mark prs_struct as done ( at end ) if no more SK records */
1065 /* mark end-of-block as True */
1068 prs_set_offset( &hbin
->ps
, prs_data_size(&hbin
->ps
) );
1073 if ( !prs_set_offset( ps
, curr_off
) )
1079 /*******************************************************************
1080 *******************************************************************/
1082 static BOOL
next_nk_record( REGF_FILE
*file
, REGF_HBIN
*hbin
, REGF_NK_REC
*nk
, BOOL
*eob
)
1084 if ( next_record( hbin
, "nk", eob
) && hbin_prs_key( file
, hbin
, nk
) )
1090 /*******************************************************************
1091 Intialize the newly created REGF_BLOCK in *file and write the
1092 block header to disk
1093 *******************************************************************/
1095 static BOOL
init_regf_block( REGF_FILE
*file
)
1100 if ( !prs_init( &ps
, REGF_BLOCKSIZE
, file
->mem_ctx
, MARSHALL
) )
1103 memcpy( file
->header
, "regf", REGF_HDR_SIZE
);
1104 file
->data_offset
= 0x20;
1105 file
->last_block
= 0x1000;
1109 unix_to_nt_time( &file
->mtime
, time(NULL
) );
1111 /* hard coded values...no diea what these are ... maybe in time */
1113 file
->unknown1
= 0x2;
1114 file
->unknown2
= 0x1;
1115 file
->unknown3
= 0x3;
1116 file
->unknown4
= 0x0;
1117 file
->unknown5
= 0x1;
1118 file
->unknown6
= 0x1;
1120 /* write header to the buffer */
1122 if ( !prs_regf_block( "regf_header", &ps
, 0, file
) ) {
1127 /* calculate the checksum, re-marshall data (to include the checksum)
1128 and write to disk */
1130 file
->checksum
= regf_block_checksum( &ps
);
1131 prs_set_offset( &ps
, 0 );
1132 if ( !prs_regf_block( "regf_header", &ps
, 0, file
) ) {
1137 if ( write_block( file
, &ps
, 0 ) == -1 ) {
1138 DEBUG(0,("init_regf_block: Failed to initialize registry header block!\n"));
1144 prs_mem_free( &ps
);
1148 /*******************************************************************
1149 Open the registry file and then read in the REGF block to get the
1151 *******************************************************************/
1153 REGF_FILE
* regfio_open( const char *filename
, int flags
, int mode
)
1157 if ( !(rb
= SMB_MALLOC_P(REGF_FILE
)) ) {
1158 DEBUG(0,("ERROR allocating memory\n"));
1164 if ( !(rb
->mem_ctx
= talloc_init( "read_regf_block" )) ) {
1169 rb
->open_flags
= flags
;
1171 /* open and existing file */
1173 if ( (rb
->fd
= open(filename
, flags
, mode
)) == -1 ) {
1174 DEBUG(0,("regfio_open: failure to open %s (%s)\n", filename
, strerror(errno
)));
1179 /* check if we are creating a new file or overwriting an existing one */
1181 if ( flags
& (O_CREAT
|O_TRUNC
) ) {
1182 if ( !init_regf_block( rb
) ) {
1183 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1192 /* read in an existing file */
1194 if ( !read_regf_block( rb
) ) {
1195 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1205 /*******************************************************************
1206 *******************************************************************/
1208 static void regfio_mem_free( REGF_FILE
*file
)
1210 /* free any talloc()'d memory */
1212 if ( file
&& file
->mem_ctx
)
1213 talloc_destroy( file
->mem_ctx
);
1216 /*******************************************************************
1217 *******************************************************************/
1219 int regfio_close( REGF_FILE
*file
)
1223 /* cleanup for a file opened for write */
1225 if ( file
->open_flags
& (O_WRONLY
|O_RDWR
) ) {
1229 /* write of sd list */
1231 for ( sk
=file
->sec_desc_list
; sk
; sk
=sk
->next
) {
1232 hbin_prs_sk_rec( "sk_rec", sk
->hbin
, 0, sk
);
1235 /* flush any dirty blocks */
1237 while ( file
->block_list
) {
1238 hbin_block_close( file
, file
->block_list
);
1243 unix_to_nt_time( &file
->mtime
, time(NULL
) );
1245 if ( read_block( file
, &ps
, 0, REGF_BLOCKSIZE
) != -1 ) {
1246 /* now use for writing */
1247 prs_switch_type( &ps
, MARSHALL
);
1249 /* stream the block once, generate the checksum,
1250 and stream it again */
1251 prs_set_offset( &ps
, 0 );
1252 prs_regf_block( "regf_blocK", &ps
, 0, file
);
1253 file
->checksum
= regf_block_checksum( &ps
);
1254 prs_set_offset( &ps
, 0 );
1255 prs_regf_block( "regf_blocK", &ps
, 0, file
);
1257 /* now we are ready to write it to disk */
1258 if ( write_block( file
, &ps
, 0 ) == -1 )
1259 DEBUG(0,("regfio_close: failed to update the regf header block!\n"));
1262 prs_mem_free( &ps
);
1265 regfio_mem_free( file
);
1267 /* nothing tdo do if there is no open file */
1269 if ( !file
|| (file
->fd
== -1) )
1279 /*******************************************************************
1280 *******************************************************************/
1282 static void regfio_flush( REGF_FILE
*file
)
1286 for ( hbin
=file
->block_list
; hbin
; hbin
=hbin
->next
) {
1287 write_hbin_block( file
, hbin
);
1291 /*******************************************************************
1292 There should be only *one* root key in the registry file based
1293 on my experience. --jerry
1294 *******************************************************************/
1296 REGF_NK_REC
* regfio_rootkey( REGF_FILE
*file
)
1300 uint32 offset
= REGF_BLOCKSIZE
;
1307 if ( !(nk
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_NK_REC
)) ) {
1308 DEBUG(0,("regfio_rootkey: talloc() failed!\n"));
1312 /* scan through the file on HBIN block at a time looking
1313 for an NK record with a type == 0x002c.
1314 Normally this is the first nk record in the first hbin
1315 block (but I'm not assuming that for now) */
1317 while ( (hbin
= read_hbin_block( file
, offset
)) ) {
1321 if ( next_nk_record( file
, hbin
, nk
, &eob
) ) {
1322 if ( nk
->key_type
== NK_TYPE_ROOTKEY
) {
1327 prs_mem_free( &hbin
->ps
);
1333 offset
+= hbin
->block_size
;
1337 DEBUG(0,("regfio_rootkey: corrupt registry file ? No root key record located\n"));
1341 DLIST_ADD( file
->block_list
, hbin
);
1346 /*******************************************************************
1347 This acts as an interator over the subkeys defined for a given
1348 NK record. Remember that offsets are from the *first* HBIN block.
1349 *******************************************************************/
1351 REGF_NK_REC
* regfio_fetch_subkey( REGF_FILE
*file
, REGF_NK_REC
*nk
)
1353 REGF_NK_REC
*subkey
;
1357 /* see if there is anything left to report */
1359 if ( !nk
|| (nk
->subkeys_off
==REGF_OFFSET_NONE
) || (nk
->subkey_index
>= nk
->num_subkeys
) )
1362 /* find the HBIN block which should contain the nk record */
1364 if ( !(hbin
= lookup_hbin_block( file
, nk
->subkeys
.hashes
[nk
->subkey_index
].nk_off
)) ) {
1365 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing offset [0x%x]\n",
1366 nk
->subkeys
.hashes
[nk
->subkey_index
].nk_off
));
1370 nk_offset
= nk
->subkeys
.hashes
[nk
->subkey_index
].nk_off
;
1371 if ( !prs_set_offset( &hbin
->ps
, (HBIN_HDR_SIZE
+ nk_offset
- hbin
->first_hbin_off
) ) )
1375 if ( !(subkey
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_NK_REC
)) )
1378 if ( !hbin_prs_key( file
, hbin
, subkey
) )
1385 /*******************************************************************
1386 *******************************************************************/
1388 static REGF_HBIN
* regf_hbin_allocate( REGF_FILE
*file
, uint32 block_size
)
1391 SMB_STRUCT_STAT sbuf
;
1393 if ( !(hbin
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_HBIN
)) )
1396 memcpy( hbin
->header
, "hbin", sizeof(HBIN_HDR_SIZE
) );
1399 if ( sys_fstat( file
->fd
, &sbuf
) ) {
1400 DEBUG(0,("regf_hbin_allocate: stat() failed! (%s)\n", strerror(errno
)));
1404 hbin
->file_off
= sbuf
.st_size
;
1406 hbin
->free_off
= HBIN_HEADER_REC_SIZE
;
1407 hbin
->free_size
= block_size
- hbin
->free_off
+ sizeof(uint32
);;
1409 hbin
->block_size
= block_size
;
1410 hbin
->first_hbin_off
= hbin
->file_off
- REGF_BLOCKSIZE
;
1412 if ( !prs_init( &hbin
->ps
, block_size
, file
->mem_ctx
, MARSHALL
) )
1415 if ( !prs_hbin_block( "new_hbin", &hbin
->ps
, 0, hbin
) )
1418 if ( !write_hbin_block( file
, hbin
) )
1421 file
->last_block
= hbin
->file_off
;
1426 /*******************************************************************
1427 *******************************************************************/
1429 static void update_free_space( REGF_HBIN
*hbin
, uint32 size_used
)
1431 hbin
->free_off
+= size_used
;
1432 hbin
->free_size
-= size_used
;
1434 if ( hbin
->free_off
>= hbin
->block_size
) {
1435 hbin
->free_off
= REGF_OFFSET_NONE
;
1441 /*******************************************************************
1442 *******************************************************************/
1444 static REGF_HBIN
* find_free_space( REGF_FILE
*file
, uint32 size
)
1446 REGF_HBIN
*hbin
, *p_hbin
;
1450 /* check open block list */
1452 for ( hbin
=file
->block_list
; hbin
!=NULL
; hbin
=hbin
->next
) {
1453 /* only check blocks that actually have available space */
1455 if ( hbin
->free_off
== REGF_OFFSET_NONE
)
1458 /* check for a large enough available chunk */
1460 if ( (hbin
->block_size
- hbin
->free_off
) >= size
) {
1461 DLIST_PROMOTE( file
->block_list
, hbin
);
1466 /* parse the file until we find a block with
1467 enough free space; save the last non-filled hbin */
1469 block_off
= REGF_BLOCKSIZE
;
1471 /* cleanup before the next round */
1474 prs_mem_free( &hbin
->ps
);
1476 hbin
= read_hbin_block( file
, block_off
);
1480 /* make sure that we don't already have this block in memory */
1482 for ( p_hbin
=file
->block_list
; p_hbin
!=NULL
; p_hbin
=p_hbin
->next
) {
1483 if ( p_hbin
->file_off
== hbin
->file_off
) {
1489 block_off
= hbin
->file_off
+ hbin
->block_size
;
1492 prs_mem_free( &hbin
->ps
);
1497 /* if (cached block or (new block and not enough free space)) then continue looping */
1498 } while ( cached
|| (hbin
&& (hbin
->free_size
< size
)) );
1500 /* no free space; allocate a new one */
1505 /* allocate in multiples of REGF_ALLOC_BLOCK; make sure (size + hbin_header) fits */
1507 alloc_size
= (((size
+HBIN_HEADER_REC_SIZE
) / REGF_ALLOC_BLOCK
) + 1 ) * REGF_ALLOC_BLOCK
;
1509 if ( !(hbin
= regf_hbin_allocate( file
, alloc_size
)) ) {
1510 DEBUG(0,("find_free_space: regf_hbin_allocate() failed!\n"));
1513 DLIST_ADD( file
->block_list
, hbin
);
1517 /* set the offset to be ready to write */
1519 if ( !prs_set_offset( &hbin
->ps
, hbin
->free_off
-sizeof(uint32
) ) )
1522 /* write the record size as a placeholder for now, it should be
1523 probably updated by the caller once it all of the data necessary
1526 if ( !prs_uint32("allocated_size", &hbin
->ps
, 0, &size
) )
1529 update_free_space( hbin
, size
);
1534 /*******************************************************************
1535 *******************************************************************/
1537 static uint32
sk_record_data_size( SEC_DESC
* sd
)
1539 uint32 size
, size_mod8
;
1543 /* the record size is sizeof(hdr) + name + static members + data_size_field */
1545 size
= sizeof(uint32
)*5 + sec_desc_size( sd
) + sizeof(uint32
);
1548 size_mod8
= size
& 0xfffffff8;
1549 if ( size_mod8
< size
)
1555 /*******************************************************************
1556 *******************************************************************/
1558 static uint32
vk_record_data_size( REGF_VK_REC
*vk
)
1560 uint32 size
, size_mod8
;
1564 /* the record size is sizeof(hdr) + name + static members + data_size_field */
1566 size
= REC_HDR_SIZE
+ (sizeof(uint16
)*3) + (sizeof(uint32
)*3) + sizeof(uint32
);
1568 if ( vk
->valuename
)
1569 size
+= strlen(vk
->valuename
);
1572 size_mod8
= size
& 0xfffffff8;
1573 if ( size_mod8
< size
)
1579 /*******************************************************************
1580 *******************************************************************/
1582 static uint32
lf_record_data_size( uint32 num_keys
)
1584 uint32 size
, size_mod8
;
1588 /* the record size is sizeof(hdr) + num_keys + sizeof of hash_array + data_size_uint32 */
1590 size
= REC_HDR_SIZE
+ sizeof(uint16
) + (sizeof(REGF_HASH_REC
) * num_keys
) + sizeof(uint32
);
1593 size_mod8
= size
& 0xfffffff8;
1594 if ( size_mod8
< size
)
1600 /*******************************************************************
1601 *******************************************************************/
1603 static uint32
nk_record_data_size( REGF_NK_REC
*nk
)
1605 uint32 size
, size_mod8
;
1609 /* the record size is static + length_of_keyname + length_of_classname + data_size_uint32 */
1611 size
= 0x4c + strlen(nk
->keyname
) + sizeof(uint32
);
1613 if ( nk
->classname
)
1614 size
+= strlen( nk
->classname
);
1617 size_mod8
= size
& 0xfffffff8;
1618 if ( size_mod8
< size
)
1624 /*******************************************************************
1625 *******************************************************************/
1627 static BOOL
create_vk_record( REGF_FILE
*file
, REGF_VK_REC
*vk
, REGISTRY_VALUE
*value
)
1629 char *name
= regval_name(value
);
1630 REGF_HBIN
*data_hbin
;
1634 memcpy( vk
->header
, "vk", REC_HDR_SIZE
);
1637 vk
->valuename
= talloc_strdup( file
->mem_ctx
, regval_name(value
) );
1638 vk
->flag
= VK_FLAG_NAME_PRESENT
;
1641 vk
->data_size
= regval_size( value
);
1642 vk
->type
= regval_type( value
);
1644 if ( vk
->data_size
> sizeof(uint32
) ) {
1645 uint32 data_size
= ( (vk
->data_size
+sizeof(uint32
)) & 0xfffffff8 ) + 8;
1647 vk
->data
= TALLOC_MEMDUP( file
->mem_ctx
, regval_data_p(value
), vk
->data_size
);
1649 /* go ahead and store the offset....we'll pick this hbin block back up when
1650 we stream the data */
1652 data_hbin
= find_free_space(file
, data_size
);
1653 vk
->data_off
= prs_offset( &data_hbin
->ps
) + data_hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1656 /* make sure we don't try to copy from a NULL value pointer */
1658 if ( vk
->data_size
!= 0 )
1659 memcpy( &vk
->data_off
, regval_data_p(value
), sizeof(uint32
) );
1660 vk
->data_size
|= VK_DATA_IN_OFFSET
;
1666 /*******************************************************************
1667 *******************************************************************/
1669 static int hashrec_cmp( REGF_HASH_REC
*h1
, REGF_HASH_REC
*h2
)
1671 return StrnCaseCmp( h1
->keycheck
, h2
->keycheck
, sizeof(uint32
) );
1674 /*******************************************************************
1675 *******************************************************************/
1677 REGF_NK_REC
* regfio_write_key( REGF_FILE
*file
, const char *name
,
1678 REGVAL_CTR
*values
, REGSUBKEY_CTR
*subkeys
,
1679 SEC_DESC
*sec_desc
, REGF_NK_REC
*parent
)
1682 REGF_HBIN
*vlist_hbin
= NULL
;
1685 if ( !(nk
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_NK_REC
)) )
1688 memcpy( nk
->header
, "nk", REC_HDR_SIZE
);
1691 nk
->key_type
= NK_TYPE_ROOTKEY
;
1693 nk
->key_type
= NK_TYPE_NORMALKEY
;
1695 /* store the parent offset (or -1 if a the root key */
1697 nk
->parent_off
= parent
? (parent
->hbin_off
+ parent
->hbin
->file_off
- REGF_BLOCKSIZE
- HBIN_HDR_SIZE
) : REGF_OFFSET_NONE
;
1699 /* no classname currently */
1701 nk
->classname_off
= REGF_OFFSET_NONE
;
1702 nk
->classname
= NULL
;
1703 nk
->keyname
= talloc_strdup( file
->mem_ctx
, name
);
1705 /* current modification time */
1707 unix_to_nt_time( &nk
->mtime
, time(NULL
) );
1709 /* allocate the record on disk */
1711 size
= nk_record_data_size( nk
);
1712 nk
->rec_size
= ( size
- 1 ) ^ 0XFFFFFFFF;
1713 nk
->hbin
= find_free_space( file
, size
);
1714 nk
->hbin_off
= prs_offset( &nk
->hbin
->ps
);
1716 /* Update the hash record in the parent */
1719 REGF_HASH_REC
*hash
= &parent
->subkeys
.hashes
[parent
->subkey_index
];
1721 hash
->nk_off
= prs_offset( &nk
->hbin
->ps
) + nk
->hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1722 memcpy( hash
->keycheck
, name
, sizeof(uint32
) );
1723 parent
->subkey_index
++;
1725 /* sort the list by keyname */
1727 qsort( parent
->subkeys
.hashes
, parent
->subkey_index
, sizeof(REGF_HASH_REC
), QSORT_CAST hashrec_cmp
);
1729 if ( !hbin_prs_lf_records( "lf_rec", parent
->subkeys
.hbin
, 0, parent
) )
1733 /* write the security descriptor */
1735 nk
->sk_off
= REGF_OFFSET_NONE
;
1737 uint32 sk_size
= sk_record_data_size( sec_desc
);
1739 REGF_SK_REC
*tmp
= NULL
;
1741 /* search for it in the existing list of sd's */
1743 if ( (nk
->sec_desc
= find_sk_record_by_sec_desc( file
, sec_desc
)) == NULL
) {
1744 /* not found so add it to the list */
1746 sk_hbin
= find_free_space( file
, sk_size
);
1748 if ( !(nk
->sec_desc
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_SK_REC
)) )
1751 /* now we have to store the security descriptor in the list and
1752 update the offsets */
1754 memcpy( nk
->sec_desc
->header
, "sk", REC_HDR_SIZE
);
1755 nk
->sec_desc
->hbin
= sk_hbin
;
1756 nk
->sec_desc
->hbin_off
= prs_offset( &sk_hbin
->ps
);
1757 nk
->sec_desc
->sk_off
= prs_offset( &sk_hbin
->ps
) + sk_hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1758 nk
->sec_desc
->rec_size
= (sk_size
-1) ^ 0xFFFFFFFF;
1760 nk
->sec_desc
->sec_desc
= sec_desc
;
1761 nk
->sec_desc
->ref_count
= 0;
1763 /* size value must be self-inclusive */
1764 nk
->sec_desc
->size
= sec_desc_size(sec_desc
) + sizeof(uint32
);
1766 DLIST_ADD_END( file
->sec_desc_list
, nk
->sec_desc
, tmp
);
1768 /* initialize offsets */
1770 nk
->sec_desc
->prev_sk_off
= nk
->sec_desc
->sk_off
;
1771 nk
->sec_desc
->next_sk_off
= nk
->sec_desc
->sk_off
;
1773 /* now update the offsets for us and the previous sd in the list */
1775 if ( nk
->sec_desc
->prev
) {
1776 REGF_SK_REC
*prev
= nk
->sec_desc
->prev
;
1778 nk
->sec_desc
->prev_sk_off
= prev
->hbin_off
+ prev
->hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1779 prev
->next_sk_off
= nk
->sk_off
;
1783 /* dump the reference count */
1785 nk
->sk_off
= nk
->sec_desc
->sk_off
;
1786 nk
->sec_desc
->ref_count
++;
1789 /* write the subkeys */
1791 nk
->subkeys_off
= REGF_OFFSET_NONE
;
1792 if ( (nk
->num_subkeys
= regsubkey_ctr_numkeys( subkeys
)) != 0 ) {
1793 uint32 lf_size
= lf_record_data_size( nk
->num_subkeys
);
1797 nk
->subkeys
.hbin
= find_free_space( file
, lf_size
);
1798 nk
->subkeys
.hbin_off
= prs_offset( &nk
->subkeys
.hbin
->ps
);
1799 nk
->subkeys
.rec_size
= (lf_size
-1) ^ 0xFFFFFFFF;
1800 nk
->subkeys_off
= prs_offset( &nk
->subkeys
.hbin
->ps
) + nk
->subkeys
.hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1802 memcpy( nk
->subkeys
.header
, "lf", REC_HDR_SIZE
);
1804 nk
->subkeys
.num_keys
= nk
->num_subkeys
;
1805 if ( !(nk
->subkeys
.hashes
= TALLOC_ZERO_ARRAY( file
->mem_ctx
, REGF_HASH_REC
, nk
->subkeys
.num_keys
)) )
1807 nk
->subkey_index
= 0;
1809 /* update the max_bytes_subkey{name,classname} fields */
1810 for ( i
=0; i
<nk
->num_subkeys
; i
++ ) {
1811 namelen
= strlen( regsubkey_ctr_specific_key(subkeys
, i
) );
1812 if ( namelen
*2 > nk
->max_bytes_subkeyname
)
1813 nk
->max_bytes_subkeyname
= namelen
* 2;
1817 /* write the values */
1819 nk
->values_off
= REGF_OFFSET_NONE
;
1820 if ( (nk
->num_values
= regval_ctr_numvals( values
)) != 0 ) {
1821 uint32 vlist_size
= ( ( nk
->num_values
* sizeof(uint32
) ) & 0xfffffff8 ) + 8;
1824 vlist_hbin
= find_free_space( file
, vlist_size
);
1825 nk
->values_off
= prs_offset( &vlist_hbin
->ps
) + vlist_hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1827 if ( !(nk
->values
= TALLOC_ARRAY( file
->mem_ctx
, REGF_VK_REC
, nk
->num_values
)) )
1830 /* create the vk records */
1832 for ( i
=0; i
<nk
->num_values
; i
++ ) {
1833 uint32 vk_size
, namelen
, datalen
;
1836 r
= regval_ctr_specific_value( values
, i
);
1837 create_vk_record( file
, &nk
->values
[i
], r
);
1838 vk_size
= vk_record_data_size( &nk
->values
[i
] );
1839 nk
->values
[i
].hbin
= find_free_space( file
, vk_size
);
1840 nk
->values
[i
].hbin_off
= prs_offset( &nk
->values
[i
].hbin
->ps
);
1841 nk
->values
[i
].rec_size
= ( vk_size
- 1 ) ^ 0xFFFFFFFF;
1842 nk
->values
[i
].rec_off
= prs_offset( &nk
->values
[i
].hbin
->ps
)
1843 + nk
->values
[i
].hbin
->first_hbin_off
1846 /* update the max bytes fields if necessary */
1848 namelen
= strlen( regval_name(r
) );
1849 if ( namelen
*2 > nk
->max_bytes_valuename
)
1850 nk
->max_bytes_valuename
= namelen
* 2;
1852 datalen
= regval_size( r
);
1853 if ( datalen
*2 > nk
->max_bytes_value
)
1854 nk
->max_bytes_value
= datalen
* 2;
1858 /* stream the records */
1860 prs_set_offset( &nk
->hbin
->ps
, nk
->hbin_off
);
1861 if ( !prs_nk_rec( "nk_rec", &nk
->hbin
->ps
, 0, nk
) )
1864 if ( nk
->num_values
) {
1865 if ( !hbin_prs_vk_records( "vk_records", vlist_hbin
, 0, nk
, file
) )
1870 regfio_flush( file
);