2 * Unix SMB/CIFS implementation.
3 * Windows NT registry I/O library
4 * Copyright (c) Gerald (Jerry) Carter 2005
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 /************************************************************
21 * Most of this information was obtained from
22 * http://www.wednesday.demon.co.uk/dosreg.html
24 ***********************************************************/
26 #include "registry/reg_parse_prs.h"
35 #define REGF_BLOCKSIZE 0x1000
36 #define REGF_ALLOC_BLOCK 0x1000
38 /* header sizes for various records */
40 #define REGF_HDR_SIZE 4
41 #define HBIN_HDR_SIZE 4
42 #define HBIN_HEADER_REC_SIZE 0x24
43 #define REC_HDR_SIZE 2
45 #define REGF_OFFSET_NONE 0xffffffff
47 /* Flags for the vk records */
49 #define VK_FLAG_NAME_PRESENT 0x0001
50 #define VK_DATA_IN_OFFSET 0x80000000
52 /* NK record macros */
54 #define NK_TYPE_LINKKEY 0x0010
55 #define NK_TYPE_NORMALKEY 0x0020
56 #define NK_TYPE_ROOTKEY 0x002c
58 #define HBIN_STORE_REF(x, y) { x->hbin = y; y->ref_count++ };
59 #define HBIN_REMOVE_REF(x, y) { x->hbin = NULL; y->ref_count-- /* if the count == 0; we can clean up */ };
64 typedef struct regf_hbin
{
65 struct regf_hbin
*prev
, *next
;
66 uint32 file_off
; /* my offset in the registry file */
67 uint32 free_off
; /* offset to free space within the hbin record */
68 uint32 free_size
; /* amount of data left in the block */
69 int ref_count
; /* how many active records are pointing to this block (not used currently) */
71 char header
[HBIN_HDR_SIZE
]; /* "hbin" */
72 uint32 first_hbin_off
; /* offset from first hbin block */
73 uint32 block_size
; /* block size of this blockually a multiple of 4096Kb) */
75 prs_struct ps
; /* data */
77 bool dirty
; /* has this hbin block been modified? */
80 /* ??? List -- list of key offsets and hashed names for consistency */
84 uint8 keycheck
[sizeof(uint32
)];
89 REGF_HBIN
*hbin
; /* pointer to HBIN record (in memory) containing this nk record */
90 uint32 hbin_off
; /* offset from beginning of this hbin block */
91 uint32 rec_size
; /* ((start_offset - end_offset) & 0xfffffff8) */
93 char header
[REC_HDR_SIZE
];
95 REGF_HASH_REC
*hashes
;
101 REGF_HBIN
*hbin
; /* pointer to HBIN record (in memory) containing this nk record */
102 uint32 hbin_off
; /* offset from beginning of this hbin block */
103 uint32 rec_size
; /* ((start_offset - end_offset) & 0xfffffff8) */
104 uint32 rec_off
; /* offset stored in the value list */
106 char header
[REC_HDR_SIZE
];
119 typedef struct _regf_sk_rec
{
120 struct _regf_sk_rec
*next
, *prev
;
121 REGF_HBIN
*hbin
; /* pointer to HBIN record (in memory) containing this nk record */
122 uint32 hbin_off
; /* offset from beginning of this hbin block */
123 uint32 rec_size
; /* ((start_offset - end_offset) & 0xfffffff8) */
125 uint32 sk_off
; /* offset parsed from NK record used as a key
126 to lookup reference to this SK record */
128 char header
[REC_HDR_SIZE
];
133 struct security_descriptor
*sec_desc
;
139 REGF_HBIN
*hbin
; /* pointer to HBIN record (in memory) containing this nk record */
140 uint32 hbin_off
; /* offset from beginning of this hbin block */
141 uint32 subkey_index
; /* index to next subkey record to return */
142 uint32 rec_size
; /* ((start_offset - end_offset) & 0xfffffff8) */
144 /* header information */
146 char header
[REC_HDR_SIZE
];
149 uint32 parent_off
; /* back pointer in registry hive */
150 uint32 classname_off
;
156 uint32 max_bytes_subkeyname
; /* max subkey name * 2 */
157 uint32 max_bytes_subkeyclassname
; /* max subkey classname length (as if) */
158 uint32 max_bytes_valuename
; /* max valuename * 2 */
159 uint32 max_bytes_value
; /* max value data size */
163 uint32 unk_index
; /* nigel says run time index ? */
168 uint32 subkeys_off
; /* hash records that point to NK records */
170 uint32 values_off
; /* value lists which point to VK records */
171 uint32 sk_off
; /* offset to SK record */
173 /* link in the other records here */
177 REGF_SK_REC
*sec_desc
;
184 /* run time information */
186 int fd
; /* file descriptor */
187 int open_flags
; /* flags passed to the open() call */
188 TALLOC_CTX
*mem_ctx
; /* memory context for run-time file access information */
189 REGF_HBIN
*block_list
; /* list of open hbin blocks */
191 /* file format information */
193 char header
[REGF_HDR_SIZE
]; /* "regf" */
194 uint32 data_offset
; /* offset to record in the first (or any?) hbin block */
195 uint32 last_block
; /* offset to last hbin block in file */
196 uint32 checksum
; /* XOR of bytes 0x0000 - 0x01FB */
199 REGF_SK_REC
*sec_desc_list
; /* list of security descriptors referenced by NK records */
201 /* unknowns used to simply writing */
212 /* Function Declarations */
214 REGF_FILE
* regfio_open( const char *filename
, int flags
, int mode
);
215 int regfio_close( REGF_FILE
*r
);
217 REGF_NK_REC
* regfio_rootkey( REGF_FILE
*file
);
218 REGF_NK_REC
* regfio_fetch_subkey( REGF_FILE
*file
, REGF_NK_REC
*nk
);
219 REGF_NK_REC
* regfio_write_key ( REGF_FILE
*file
, const char *name
,
220 struct regval_ctr
*values
, struct regsubkey_ctr
*subkeys
,
221 struct security_descriptor
*sec_desc
, REGF_NK_REC
*parent
);
224 #endif /* _REGFIO_H */