2 * Unix SMB/CIFS implementation.
3 * Windows NT registry I/O library
4 * Copyright (c) Gerald (Jerry) Carter 2005
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #define DBGC_CLASS DBGC_REGISTRY
26 /*******************************************************************
28 * TODO : Right now this code basically ignores classnames.
30 ******************************************************************/
33 /*******************************************************************
34 *******************************************************************/
36 static int write_block( REGF_FILE
*file
, prs_struct
*ps
, uint32 offset
)
38 int bytes_written
, returned
;
39 char *buffer
= prs_data_p( ps
);
40 uint32 buffer_size
= prs_data_size( ps
);
46 /* check for end of file */
48 if ( sys_fstat( file
->fd
, &sbuf
) ) {
49 DEBUG(0,("write_block: stat() failed! (%s)\n", strerror(errno
)));
53 if ( lseek( file
->fd
, offset
, SEEK_SET
) == -1 ) {
54 DEBUG(0,("write_block: lseek() failed! (%s)\n", strerror(errno
) ));
58 bytes_written
= returned
= 0;
59 while ( bytes_written
< buffer_size
) {
60 if ( (returned
= write( file
->fd
, buffer
+bytes_written
, buffer_size
-bytes_written
)) == -1 ) {
61 DEBUG(0,("write_block: write() failed! (%s)\n", strerror(errno
) ));
65 bytes_written
+= returned
;
71 /*******************************************************************
72 *******************************************************************/
74 static int read_block( REGF_FILE
*file
, prs_struct
*ps
, uint32 file_offset
, uint32 block_size
)
76 int bytes_read
, returned
;
80 /* check for end of file */
82 if ( sys_fstat( file
->fd
, &sbuf
) ) {
83 DEBUG(0,("read_block: stat() failed! (%s)\n", strerror(errno
)));
87 if ( (size_t)file_offset
>= sbuf
.st_size
)
90 /* if block_size == 0, we are parsing HBIN records and need
91 to read some of the header to get the block_size from there */
93 if ( block_size
== 0 ) {
96 if ( lseek( file
->fd
, file_offset
, SEEK_SET
) == -1 ) {
97 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno
) ));
101 returned
= read( file
->fd
, hdr
, 0x20 );
102 if ( (returned
== -1) || (returned
< 0x20) ) {
103 DEBUG(0,("read_block: failed to read in HBIN header. Is the file corrupt?\n"));
107 /* make sure this is an hbin header */
109 if ( strncmp( hdr
, "hbin", HBIN_HDR_SIZE
) != 0 ) {
110 DEBUG(0,("read_block: invalid block header!\n"));
114 block_size
= IVAL( hdr
, 0x08 );
117 DEBUG(10,("read_block: block_size == 0x%x\n", block_size
));
119 /* set the offset, initialize the buffer, and read the block from disk */
121 if ( lseek( file
->fd
, file_offset
, SEEK_SET
) == -1 ) {
122 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno
) ));
126 if (!prs_init( ps
, block_size
, file
->mem_ctx
, UNMARSHALL
)) {
127 DEBUG(0,("read_block: prs_init() failed! (%s)\n", strerror(errno
) ));
130 buffer
= prs_data_p( ps
);
131 bytes_read
= returned
= 0;
133 while ( bytes_read
< block_size
) {
134 if ( (returned
= read( file
->fd
, buffer
+bytes_read
, block_size
-bytes_read
)) == -1 ) {
135 DEBUG(0,("read_block: read() failed (%s)\n", strerror(errno
) ));
138 if ( (returned
== 0) && (bytes_read
< block_size
) ) {
139 DEBUG(0,("read_block: not a vald registry file ?\n" ));
143 bytes_read
+= returned
;
149 /*******************************************************************
150 *******************************************************************/
152 static bool write_hbin_block( REGF_FILE
*file
, REGF_HBIN
*hbin
)
157 /* write free space record if any is available */
159 if ( hbin
->free_off
!= REGF_OFFSET_NONE
) {
160 uint32 header
= 0xffffffff;
162 if ( !prs_set_offset( &hbin
->ps
, hbin
->free_off
-sizeof(uint32
) ) )
164 if ( !prs_uint32( "free_size", &hbin
->ps
, 0, &hbin
->free_size
) )
166 if ( !prs_uint32( "free_header", &hbin
->ps
, 0, &header
) )
170 hbin
->dirty
= (write_block( file
, &hbin
->ps
, hbin
->file_off
) != -1);
175 /*******************************************************************
176 *******************************************************************/
178 static bool hbin_block_close( REGF_FILE
*file
, REGF_HBIN
*hbin
)
182 /* remove the block from the open list and flush it to disk */
184 for ( p
=file
->block_list
; p
&& p
!=hbin
; p
=p
->next
)
188 DLIST_REMOVE( file
->block_list
, hbin
);
191 DEBUG(0,("hbin_block_close: block not in open list!\n"));
193 if ( !write_hbin_block( file
, hbin
) )
199 /*******************************************************************
200 *******************************************************************/
202 static bool prs_regf_block( const char *desc
, prs_struct
*ps
, int depth
, REGF_FILE
*file
)
204 prs_debug(ps
, depth
, desc
, "prs_regf_block");
207 if ( !prs_uint8s( True
, "header", ps
, depth
, (uint8
*)file
->header
, sizeof( file
->header
)) )
210 /* yes, these values are always identical so store them only once */
212 if ( !prs_uint32( "unknown1", ps
, depth
, &file
->unknown1
))
214 if ( !prs_uint32( "unknown1 (again)", ps
, depth
, &file
->unknown1
))
217 /* get the modtime */
219 if ( !prs_set_offset( ps
, 0x0c ) )
221 if ( !smb_io_time( "modtime", &file
->mtime
, ps
, depth
) )
226 if ( !prs_uint32( "unknown2", ps
, depth
, &file
->unknown2
))
228 if ( !prs_uint32( "unknown3", ps
, depth
, &file
->unknown3
))
230 if ( !prs_uint32( "unknown4", ps
, depth
, &file
->unknown4
))
232 if ( !prs_uint32( "unknown5", ps
, depth
, &file
->unknown5
))
235 /* get file offsets */
237 if ( !prs_set_offset( ps
, 0x24 ) )
239 if ( !prs_uint32( "data_offset", ps
, depth
, &file
->data_offset
))
241 if ( !prs_uint32( "last_block", ps
, depth
, &file
->last_block
))
244 /* one more constant */
246 if ( !prs_uint32( "unknown6", ps
, depth
, &file
->unknown6
))
249 /* get the checksum */
251 if ( !prs_set_offset( ps
, 0x01fc ) )
253 if ( !prs_uint32( "checksum", ps
, depth
, &file
->checksum
))
259 /*******************************************************************
260 *******************************************************************/
262 static bool prs_hbin_block( const char *desc
, prs_struct
*ps
, int depth
, REGF_HBIN
*hbin
)
266 prs_debug(ps
, depth
, desc
, "prs_regf_block");
269 if ( !prs_uint8s( True
, "header", ps
, depth
, (uint8
*)hbin
->header
, sizeof( hbin
->header
)) )
272 if ( !prs_uint32( "first_hbin_off", ps
, depth
, &hbin
->first_hbin_off
))
275 /* The dosreg.cpp comments say that the block size is at 0x1c.
276 According to a WINXP NTUSER.dat file, this is wrong. The block_size
279 if ( !prs_uint32( "block_size", ps
, depth
, &hbin
->block_size
))
282 block_size2
= hbin
->block_size
;
283 prs_set_offset( ps
, 0x1c );
284 if ( !prs_uint32( "block_size2", ps
, depth
, &block_size2
))
287 if ( MARSHALLING(ps
) )
294 /*******************************************************************
295 *******************************************************************/
297 static bool prs_nk_rec( const char *desc
, prs_struct
*ps
, int depth
, REGF_NK_REC
*nk
)
299 uint16 class_length
, name_length
;
301 uint32 data_size
, start_off
, end_off
;
302 uint32 unknown_off
= REGF_OFFSET_NONE
;
304 nk
->hbin_off
= prs_offset( ps
);
305 start
= nk
->hbin_off
;
307 prs_debug(ps
, depth
, desc
, "prs_nk_rec");
310 /* back up and get the data_size */
312 if ( !prs_set_offset( ps
, prs_offset(ps
)-sizeof(uint32
)) )
314 start_off
= prs_offset( ps
);
315 if ( !prs_uint32( "rec_size", ps
, depth
, &nk
->rec_size
))
318 if ( !prs_uint8s( True
, "header", ps
, depth
, (uint8
*)nk
->header
, sizeof( nk
->header
)) )
321 if ( !prs_uint16( "key_type", ps
, depth
, &nk
->key_type
))
323 if ( !smb_io_time( "mtime", &nk
->mtime
, ps
, depth
))
326 if ( !prs_set_offset( ps
, start
+0x0010 ) )
328 if ( !prs_uint32( "parent_off", ps
, depth
, &nk
->parent_off
))
330 if ( !prs_uint32( "num_subkeys", ps
, depth
, &nk
->num_subkeys
))
333 if ( !prs_set_offset( ps
, start
+0x001c ) )
335 if ( !prs_uint32( "subkeys_off", ps
, depth
, &nk
->subkeys_off
))
337 if ( !prs_uint32( "unknown_off", ps
, depth
, &unknown_off
) )
340 if ( !prs_set_offset( ps
, start
+0x0024 ) )
342 if ( !prs_uint32( "num_values", ps
, depth
, &nk
->num_values
))
344 if ( !prs_uint32( "values_off", ps
, depth
, &nk
->values_off
))
346 if ( !prs_uint32( "sk_off", ps
, depth
, &nk
->sk_off
))
348 if ( !prs_uint32( "classname_off", ps
, depth
, &nk
->classname_off
))
351 if ( !prs_uint32( "max_bytes_subkeyname", ps
, depth
, &nk
->max_bytes_subkeyname
))
353 if ( !prs_uint32( "max_bytes_subkeyclassname", ps
, depth
, &nk
->max_bytes_subkeyclassname
))
355 if ( !prs_uint32( "max_bytes_valuename", ps
, depth
, &nk
->max_bytes_valuename
))
357 if ( !prs_uint32( "max_bytes_value", ps
, depth
, &nk
->max_bytes_value
))
359 if ( !prs_uint32( "unknown index", ps
, depth
, &nk
->unk_index
))
362 name_length
= nk
->keyname
? strlen(nk
->keyname
) : 0 ;
363 class_length
= nk
->classname
? strlen(nk
->classname
) : 0 ;
364 if ( !prs_uint16( "name_length", ps
, depth
, &name_length
))
366 if ( !prs_uint16( "class_length", ps
, depth
, &class_length
))
369 if ( class_length
) {
374 if ( UNMARSHALLING(ps
) ) {
375 if ( !(nk
->keyname
= PRS_ALLOC_MEM( ps
, char, name_length
+1 )) )
379 if ( !prs_uint8s( True
, "name", ps
, depth
, (uint8
*)nk
->keyname
, name_length
) )
382 if ( UNMARSHALLING(ps
) )
383 nk
->keyname
[name_length
] = '\0';
386 end_off
= prs_offset( ps
);
388 /* data_size must be divisible by 8 and large enough to hold the original record */
390 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
391 if ( data_size
> nk
->rec_size
)
392 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size
, nk
->rec_size
));
394 if ( MARSHALLING(ps
) )
395 nk
->hbin
->dirty
= True
;
400 /*******************************************************************
401 *******************************************************************/
403 static uint32
regf_block_checksum( prs_struct
*ps
)
405 char *buffer
= prs_data_p( ps
);
409 /* XOR of all bytes 0x0000 - 0x01FB */
413 for ( i
=0; i
<0x01FB; i
+=4 ) {
414 x
= IVAL(buffer
, i
);
421 /*******************************************************************
422 *******************************************************************/
424 static bool read_regf_block( REGF_FILE
*file
)
429 /* grab the first block from the file */
431 if ( read_block( file
, &ps
, 0, REGF_BLOCKSIZE
) == -1 )
434 /* parse the block and verify the checksum */
436 if ( !prs_regf_block( "regf_header", &ps
, 0, file
) )
439 checksum
= regf_block_checksum( &ps
);
443 if ( file
->checksum
!= checksum
) {
444 DEBUG(0,("read_regf_block: invalid checksum\n" ));
451 /*******************************************************************
452 *******************************************************************/
454 static REGF_HBIN
* read_hbin_block( REGF_FILE
*file
, off_t offset
)
457 uint32 record_size
, curr_off
, block_size
, header
;
459 if ( !(hbin
= TALLOC_ZERO_P(file
->mem_ctx
, REGF_HBIN
)) )
461 hbin
->file_off
= offset
;
464 if ( read_block( file
, &hbin
->ps
, offset
, 0 ) == -1 )
467 if ( !prs_hbin_block( "hbin", &hbin
->ps
, 0, hbin
) )
470 /* this should be the same thing as hbin->block_size but just in case */
472 block_size
= prs_data_size( &hbin
->ps
);
474 /* Find the available free space offset. Always at the end,
475 so walk the record list and stop when you get to the end.
476 The end is defined by a record header of 0xffffffff. The
477 previous 4 bytes contains the amount of free space remaining
478 in the hbin block. */
480 /* remember that the record_size is in the 4 bytes preceeding the record itself */
482 if ( !prs_set_offset( &hbin
->ps
, file
->data_offset
+HBIN_HDR_SIZE
-sizeof(uint32
) ) )
487 curr_off
= prs_offset( &hbin
->ps
);
488 while ( header
!= 0xffffffff ) {
489 /* not done yet so reset the current offset to the
490 next record_size field */
492 curr_off
= curr_off
+record_size
;
494 /* for some reason the record_size of the last record in
495 an hbin block can extend past the end of the block
496 even though the record fits within the remaining
497 space....aaarrrgggghhhhhh */
499 if ( curr_off
>= block_size
) {
505 if ( !prs_set_offset( &hbin
->ps
, curr_off
) )
508 if ( !prs_uint32( "rec_size", &hbin
->ps
, 0, &record_size
) )
510 if ( !prs_uint32( "header", &hbin
->ps
, 0, &header
) )
513 SMB_ASSERT( record_size
!= 0 );
515 if ( record_size
& 0x80000000 ) {
516 /* absolute_value(record_size) */
517 record_size
= (record_size
^ 0xffffffff) + 1;
521 /* save the free space offset */
523 if ( header
== 0xffffffff ) {
525 /* account for the fact that the curr_off is 4 bytes behind the actual
528 hbin
->free_off
= curr_off
+ sizeof(uint32
);
529 hbin
->free_size
= record_size
;
532 DEBUG(10,("read_hbin_block: free space offset == 0x%x\n", hbin
->free_off
));
534 if ( !prs_set_offset( &hbin
->ps
, file
->data_offset
+HBIN_HDR_SIZE
) )
540 /*******************************************************************
541 Input a random offset and receive the corresponding HBIN
543 *******************************************************************/
545 static bool hbin_contains_offset( REGF_HBIN
*hbin
, uint32 offset
)
550 if ( (offset
> hbin
->first_hbin_off
) && (offset
< (hbin
->first_hbin_off
+hbin
->block_size
)) )
556 /*******************************************************************
557 Input a random offset and receive the corresponding HBIN
559 *******************************************************************/
561 static REGF_HBIN
* lookup_hbin_block( REGF_FILE
*file
, uint32 offset
)
563 REGF_HBIN
*hbin
= NULL
;
566 /* start with the open list */
568 for ( hbin
=file
->block_list
; hbin
; hbin
=hbin
->next
) {
569 DEBUG(10,("lookup_hbin_block: address = 0x%x [0x%lx]\n", hbin
->file_off
, (unsigned long)hbin
));
570 if ( hbin_contains_offset( hbin
, offset
) )
575 /* start at the beginning */
577 block_off
= REGF_BLOCKSIZE
;
579 /* cleanup before the next round */
581 prs_mem_free( &hbin
->ps
);
583 hbin
= read_hbin_block( file
, block_off
);
586 block_off
= hbin
->file_off
+ hbin
->block_size
;
588 } while ( hbin
&& !hbin_contains_offset( hbin
, offset
) );
592 DLIST_ADD( file
->block_list
, hbin
);
597 /*******************************************************************
598 *******************************************************************/
600 static bool prs_hash_rec( const char *desc
, prs_struct
*ps
, int depth
, REGF_HASH_REC
*hash
)
602 prs_debug(ps
, depth
, desc
, "prs_hash_rec");
605 if ( !prs_uint32( "nk_off", ps
, depth
, &hash
->nk_off
))
607 if ( !prs_uint8s( True
, "keycheck", ps
, depth
, hash
->keycheck
, sizeof( hash
->keycheck
)) )
613 /*******************************************************************
614 *******************************************************************/
616 static bool hbin_prs_lf_records( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_NK_REC
*nk
)
619 REGF_LF_REC
*lf
= &nk
->subkeys
;
620 uint32 data_size
, start_off
, end_off
;
622 prs_debug(&hbin
->ps
, depth
, desc
, "prs_lf_records");
625 /* check if we have anything to do first */
627 if ( nk
->num_subkeys
== 0 )
630 /* move to the LF record */
632 if ( !prs_set_offset( &hbin
->ps
, nk
->subkeys_off
+ HBIN_HDR_SIZE
- hbin
->first_hbin_off
) )
635 /* backup and get the data_size */
637 if ( !prs_set_offset( &hbin
->ps
, prs_offset(&hbin
->ps
)-sizeof(uint32
)) )
639 start_off
= prs_offset( &hbin
->ps
);
640 if ( !prs_uint32( "rec_size", &hbin
->ps
, depth
, &lf
->rec_size
))
643 if ( !prs_uint8s( True
, "header", &hbin
->ps
, depth
, (uint8
*)lf
->header
, sizeof( lf
->header
)) )
646 if ( !prs_uint16( "num_keys", &hbin
->ps
, depth
, &lf
->num_keys
))
649 if ( UNMARSHALLING(&hbin
->ps
) ) {
651 if ( !(lf
->hashes
= PRS_ALLOC_MEM( &hbin
->ps
, REGF_HASH_REC
, lf
->num_keys
)) )
658 for ( i
=0; i
<lf
->num_keys
; i
++ ) {
659 if ( !prs_hash_rec( "hash_rec", &hbin
->ps
, depth
, &lf
->hashes
[i
] ) )
663 end_off
= prs_offset( &hbin
->ps
);
665 /* data_size must be divisible by 8 and large enough to hold the original record */
667 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
668 if ( data_size
> lf
->rec_size
)
669 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size
, lf
->rec_size
));
671 if ( MARSHALLING(&hbin
->ps
) )
677 /*******************************************************************
678 *******************************************************************/
680 static bool hbin_prs_sk_rec( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_SK_REC
*sk
)
682 prs_struct
*ps
= &hbin
->ps
;
684 uint32 data_size
, start_off
, end_off
;
687 prs_debug(ps
, depth
, desc
, "hbin_prs_sk_rec");
690 if ( !prs_set_offset( &hbin
->ps
, sk
->sk_off
+ HBIN_HDR_SIZE
- hbin
->first_hbin_off
) )
693 /* backup and get the data_size */
695 if ( !prs_set_offset( &hbin
->ps
, prs_offset(&hbin
->ps
)-sizeof(uint32
)) )
697 start_off
= prs_offset( &hbin
->ps
);
698 if ( !prs_uint32( "rec_size", &hbin
->ps
, depth
, &sk
->rec_size
))
701 if ( !prs_uint8s( True
, "header", ps
, depth
, (uint8
*)sk
->header
, sizeof( sk
->header
)) )
703 if ( !prs_uint16( "tag", ps
, depth
, &tag
))
706 if ( !prs_uint32( "prev_sk_off", ps
, depth
, &sk
->prev_sk_off
))
708 if ( !prs_uint32( "next_sk_off", ps
, depth
, &sk
->next_sk_off
))
710 if ( !prs_uint32( "ref_count", ps
, depth
, &sk
->ref_count
))
712 if ( !prs_uint32( "size", ps
, depth
, &sk
->size
))
715 if ( !sec_io_desc( "sec_desc", &sk
->sec_desc
, ps
, depth
))
718 end_off
= prs_offset( &hbin
->ps
);
720 /* data_size must be divisible by 8 and large enough to hold the original record */
722 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
723 if ( data_size
> sk
->rec_size
)
724 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size
, sk
->rec_size
));
726 if ( MARSHALLING(&hbin
->ps
) )
732 /*******************************************************************
733 *******************************************************************/
735 static bool hbin_prs_vk_rec( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_VK_REC
*vk
, REGF_FILE
*file
)
739 prs_struct
*ps
= &hbin
->ps
;
740 uint32 data_size
, start_off
, end_off
;
742 prs_debug(ps
, depth
, desc
, "prs_vk_rec");
745 /* backup and get the data_size */
747 if ( !prs_set_offset( &hbin
->ps
, prs_offset(&hbin
->ps
)-sizeof(uint32
)) )
749 start_off
= prs_offset( &hbin
->ps
);
750 if ( !prs_uint32( "rec_size", &hbin
->ps
, depth
, &vk
->rec_size
))
753 if ( !prs_uint8s( True
, "header", ps
, depth
, (uint8
*)vk
->header
, sizeof( vk
->header
)) )
756 if ( MARSHALLING(&hbin
->ps
) )
757 name_length
= strlen(vk
->valuename
);
759 if ( !prs_uint16( "name_length", ps
, depth
, &name_length
))
761 if ( !prs_uint32( "data_size", ps
, depth
, &vk
->data_size
))
763 if ( !prs_uint32( "data_off", ps
, depth
, &vk
->data_off
))
765 if ( !prs_uint32( "type", ps
, depth
, &vk
->type
))
767 if ( !prs_uint16( "flag", ps
, depth
, &vk
->flag
))
770 offset
= prs_offset( ps
);
771 offset
+= 2; /* skip 2 bytes */
772 prs_set_offset( ps
, offset
);
776 if ( vk
->flag
&VK_FLAG_NAME_PRESENT
) {
778 if ( UNMARSHALLING(&hbin
->ps
) ) {
779 if ( !(vk
->valuename
= PRS_ALLOC_MEM( ps
, char, name_length
+1 )))
782 if ( !prs_uint8s( True
, "name", ps
, depth
, (uint8
*)vk
->valuename
, name_length
) )
786 end_off
= prs_offset( &hbin
->ps
);
788 /* get the data if necessary */
790 if ( vk
->data_size
!= 0 ) {
791 bool charmode
= False
;
793 if ( (vk
->type
== REG_SZ
) || (vk
->type
== REG_MULTI_SZ
) )
796 /* the data is stored in the offset if the size <= 4 */
798 if ( !(vk
->data_size
& VK_DATA_IN_OFFSET
) ) {
799 REGF_HBIN
*hblock
= hbin
;
800 uint32 data_rec_size
;
802 if ( UNMARSHALLING(&hbin
->ps
) ) {
803 if ( !(vk
->data
= PRS_ALLOC_MEM( ps
, uint8
, vk
->data_size
) ) )
807 /* this data can be in another hbin */
808 if ( !hbin_contains_offset( hbin
, vk
->data_off
) ) {
809 if ( !(hblock
= lookup_hbin_block( file
, vk
->data_off
)) )
812 if ( !(prs_set_offset( &hblock
->ps
, (vk
->data_off
+HBIN_HDR_SIZE
-hblock
->first_hbin_off
)-sizeof(uint32
) )) )
815 if ( MARSHALLING(&hblock
->ps
) ) {
816 data_rec_size
= ( (vk
->data_size
+sizeof(uint32
)) & 0xfffffff8 ) + 8;
817 data_rec_size
= ( data_rec_size
- 1 ) ^ 0xFFFFFFFF;
819 if ( !prs_uint32( "data_rec_size", &hblock
->ps
, depth
, &data_rec_size
))
821 if ( !prs_uint8s( charmode
, "data", &hblock
->ps
, depth
, vk
->data
, vk
->data_size
) )
824 if ( MARSHALLING(&hblock
->ps
) )
825 hblock
->dirty
= True
;
828 if ( !(vk
->data
= PRS_ALLOC_MEM( ps
, uint8
, 4 ) ) )
830 SIVAL( vk
->data
, 0, vk
->data_off
);
835 /* data_size must be divisible by 8 and large enough to hold the original record */
837 data_size
= ((start_off
- end_off
) & 0xfffffff8 );
838 if ( data_size
!= vk
->rec_size
)
839 DEBUG(10,("prs_vk_rec: data_size check failed (0x%x < 0x%x)\n", data_size
, vk
->rec_size
));
841 if ( MARSHALLING(&hbin
->ps
) )
847 /*******************************************************************
848 read a VK record which is contained in the HBIN block stored
849 in the prs_struct *ps.
850 *******************************************************************/
852 static bool hbin_prs_vk_records( const char *desc
, REGF_HBIN
*hbin
, int depth
, REGF_NK_REC
*nk
, REGF_FILE
*file
)
857 prs_debug(&hbin
->ps
, depth
, desc
, "prs_vk_records");
860 /* check if we have anything to do first */
862 if ( nk
->num_values
== 0 )
865 if ( UNMARSHALLING(&hbin
->ps
) ) {
866 if ( !(nk
->values
= PRS_ALLOC_MEM( &hbin
->ps
, REGF_VK_REC
, nk
->num_values
) ) )
870 /* convert the offset to something relative to this HBIN block */
872 if ( !prs_set_offset( &hbin
->ps
, nk
->values_off
+HBIN_HDR_SIZE
-hbin
->first_hbin_off
-sizeof(uint32
)) )
875 if ( MARSHALLING( &hbin
->ps
) ) {
876 record_size
= ( ( nk
->num_values
* sizeof(uint32
) ) & 0xfffffff8 ) + 8;
877 record_size
= (record_size
- 1) ^ 0xFFFFFFFF;
880 if ( !prs_uint32( "record_size", &hbin
->ps
, depth
, &record_size
) )
883 for ( i
=0; i
<nk
->num_values
; i
++ ) {
884 if ( !prs_uint32( "vk_off", &hbin
->ps
, depth
, &nk
->values
[i
].rec_off
) )
888 for ( i
=0; i
<nk
->num_values
; i
++ ) {
889 REGF_HBIN
*sub_hbin
= hbin
;
892 if ( !hbin_contains_offset( hbin
, nk
->values
[i
].rec_off
) ) {
893 sub_hbin
= lookup_hbin_block( file
, nk
->values
[i
].rec_off
);
895 DEBUG(0,("hbin_prs_vk_records: Failed to find HBIN block containing offset [0x%x]\n",
896 nk
->values
[i
].hbin_off
));
901 new_offset
= nk
->values
[i
].rec_off
+ HBIN_HDR_SIZE
- sub_hbin
->first_hbin_off
;
902 if ( !prs_set_offset( &sub_hbin
->ps
, new_offset
) )
904 if ( !hbin_prs_vk_rec( "vk_rec", sub_hbin
, depth
, &nk
->values
[i
], file
) )
908 if ( MARSHALLING(&hbin
->ps
) )
916 /*******************************************************************
917 *******************************************************************/
919 static REGF_SK_REC
* find_sk_record_by_offset( REGF_FILE
*file
, uint32 offset
)
923 for ( p_sk
=file
->sec_desc_list
; p_sk
; p_sk
=p_sk
->next
) {
924 if ( p_sk
->sk_off
== offset
)
931 /*******************************************************************
932 *******************************************************************/
934 static REGF_SK_REC
* find_sk_record_by_sec_desc( REGF_FILE
*file
, SEC_DESC
*sd
)
938 for ( p
=file
->sec_desc_list
; p
; p
=p
->next
) {
939 if ( sec_desc_equal( p
->sec_desc
, sd
) )
948 /*******************************************************************
949 *******************************************************************/
951 static bool hbin_prs_key( REGF_FILE
*file
, REGF_HBIN
*hbin
, REGF_NK_REC
*nk
)
956 prs_debug(&hbin
->ps
, depth
, "", "fetch_key");
959 /* get the initial nk record */
961 if ( !prs_nk_rec( "nk_rec", &hbin
->ps
, depth
, nk
))
966 if ( nk
->num_values
&& (nk
->values_off
!=REGF_OFFSET_NONE
) ) {
968 if ( !hbin_contains_offset( hbin
, nk
->values_off
) ) {
969 sub_hbin
= lookup_hbin_block( file
, nk
->values_off
);
971 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing value_list_offset [0x%x]\n",
977 if ( !hbin_prs_vk_records( "vk_rec", sub_hbin
, depth
, nk
, file
))
981 /* now get subkeys */
983 if ( nk
->num_subkeys
&& (nk
->subkeys_off
!=REGF_OFFSET_NONE
) ) {
985 if ( !hbin_contains_offset( hbin
, nk
->subkeys_off
) ) {
986 sub_hbin
= lookup_hbin_block( file
, nk
->subkeys_off
);
988 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing subkey_offset [0x%x]\n",
994 if ( !hbin_prs_lf_records( "lf_rec", sub_hbin
, depth
, nk
))
998 /* get the to the security descriptor. First look if we have already parsed it */
1000 if ( (nk
->sk_off
!=REGF_OFFSET_NONE
) && !( nk
->sec_desc
= find_sk_record_by_offset( file
, nk
->sk_off
)) ) {
1003 if ( !hbin_contains_offset( hbin
, nk
->sk_off
) ) {
1004 sub_hbin
= lookup_hbin_block( file
, nk
->sk_off
);
1006 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing sk_offset [0x%x]\n",
1012 if ( !(nk
->sec_desc
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_SK_REC
)) )
1014 nk
->sec_desc
->sk_off
= nk
->sk_off
;
1015 if ( !hbin_prs_sk_rec( "sk_rec", sub_hbin
, depth
, nk
->sec_desc
))
1018 /* add to the list of security descriptors (ref_count has been read from the files) */
1020 nk
->sec_desc
->sk_off
= nk
->sk_off
;
1021 DLIST_ADD( file
->sec_desc_list
, nk
->sec_desc
);
1027 /*******************************************************************
1028 *******************************************************************/
1030 static bool next_record( REGF_HBIN
*hbin
, const char *hdr
, bool *eob
)
1032 uint8 header
[REC_HDR_SIZE
];
1034 uint32 curr_off
, block_size
;
1036 prs_struct
*ps
= &hbin
->ps
;
1038 curr_off
= prs_offset( ps
);
1039 if ( curr_off
== 0 )
1040 prs_set_offset( ps
, HBIN_HEADER_REC_SIZE
);
1042 /* assume that the current offset is at the record header
1043 and we need to backup to read the record size */
1045 curr_off
-= sizeof(uint32
);
1047 block_size
= prs_data_size( ps
);
1049 memset( header
, 0x0, sizeof(uint8
)*REC_HDR_SIZE
);
1052 curr_off
= curr_off
+record_size
;
1053 if ( curr_off
>= block_size
)
1056 if ( !prs_set_offset( &hbin
->ps
, curr_off
) )
1059 if ( !prs_uint32( "record_size", ps
, 0, &record_size
) )
1061 if ( !prs_uint8s( True
, "header", ps
, 0, header
, REC_HDR_SIZE
) )
1064 if ( record_size
& 0x80000000 ) {
1065 /* absolute_value(record_size) */
1066 record_size
= (record_size
^ 0xffffffff) + 1;
1069 if ( memcmp( header
, hdr
, REC_HDR_SIZE
) == 0 ) {
1071 curr_off
+= sizeof(uint32
);
1075 /* mark prs_struct as done ( at end ) if no more SK records */
1076 /* mark end-of-block as True */
1079 prs_set_offset( &hbin
->ps
, prs_data_size(&hbin
->ps
) );
1084 if ( !prs_set_offset( ps
, curr_off
) )
1090 /*******************************************************************
1091 *******************************************************************/
1093 static bool next_nk_record( REGF_FILE
*file
, REGF_HBIN
*hbin
, REGF_NK_REC
*nk
, bool *eob
)
1095 if ( next_record( hbin
, "nk", eob
) && hbin_prs_key( file
, hbin
, nk
) )
1101 /*******************************************************************
1102 Intialize the newly created REGF_BLOCK in *file and write the
1103 block header to disk
1104 *******************************************************************/
1106 static bool init_regf_block( REGF_FILE
*file
)
1111 if ( !prs_init( &ps
, REGF_BLOCKSIZE
, file
->mem_ctx
, MARSHALL
) )
1114 memcpy( file
->header
, "regf", REGF_HDR_SIZE
);
1115 file
->data_offset
= 0x20;
1116 file
->last_block
= 0x1000;
1120 unix_to_nt_time( &file
->mtime
, time(NULL
) );
1122 /* hard coded values...no diea what these are ... maybe in time */
1124 file
->unknown1
= 0x2;
1125 file
->unknown2
= 0x1;
1126 file
->unknown3
= 0x3;
1127 file
->unknown4
= 0x0;
1128 file
->unknown5
= 0x1;
1129 file
->unknown6
= 0x1;
1131 /* write header to the buffer */
1133 if ( !prs_regf_block( "regf_header", &ps
, 0, file
) ) {
1138 /* calculate the checksum, re-marshall data (to include the checksum)
1139 and write to disk */
1141 file
->checksum
= regf_block_checksum( &ps
);
1142 prs_set_offset( &ps
, 0 );
1143 if ( !prs_regf_block( "regf_header", &ps
, 0, file
) ) {
1148 if ( write_block( file
, &ps
, 0 ) == -1 ) {
1149 DEBUG(0,("init_regf_block: Failed to initialize registry header block!\n"));
1155 prs_mem_free( &ps
);
1159 /*******************************************************************
1160 Open the registry file and then read in the REGF block to get the
1162 *******************************************************************/
1164 REGF_FILE
* regfio_open( const char *filename
, int flags
, int mode
)
1168 if ( !(rb
= SMB_MALLOC_P(REGF_FILE
)) ) {
1169 DEBUG(0,("ERROR allocating memory\n"));
1175 if ( !(rb
->mem_ctx
= talloc_init( "read_regf_block" )) ) {
1180 rb
->open_flags
= flags
;
1182 /* open and existing file */
1184 if ( (rb
->fd
= open(filename
, flags
, mode
)) == -1 ) {
1185 DEBUG(0,("regfio_open: failure to open %s (%s)\n", filename
, strerror(errno
)));
1190 /* check if we are creating a new file or overwriting an existing one */
1192 if ( flags
& (O_CREAT
|O_TRUNC
) ) {
1193 if ( !init_regf_block( rb
) ) {
1194 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1203 /* read in an existing file */
1205 if ( !read_regf_block( rb
) ) {
1206 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1216 /*******************************************************************
1217 *******************************************************************/
1219 static void regfio_mem_free( REGF_FILE
*file
)
1221 /* free any talloc()'d memory */
1223 if ( file
&& file
->mem_ctx
)
1224 talloc_destroy( file
->mem_ctx
);
1227 /*******************************************************************
1228 *******************************************************************/
1230 int regfio_close( REGF_FILE
*file
)
1234 /* cleanup for a file opened for write */
1236 if ((file
->fd
!= -1) && (file
->open_flags
& (O_WRONLY
|O_RDWR
))) {
1240 /* write of sd list */
1242 for ( sk
=file
->sec_desc_list
; sk
; sk
=sk
->next
) {
1243 hbin_prs_sk_rec( "sk_rec", sk
->hbin
, 0, sk
);
1246 /* flush any dirty blocks */
1248 while ( file
->block_list
) {
1249 hbin_block_close( file
, file
->block_list
);
1254 unix_to_nt_time( &file
->mtime
, time(NULL
) );
1256 if ( read_block( file
, &ps
, 0, REGF_BLOCKSIZE
) != -1 ) {
1257 /* now use for writing */
1258 prs_switch_type( &ps
, MARSHALL
);
1260 /* stream the block once, generate the checksum,
1261 and stream it again */
1262 prs_set_offset( &ps
, 0 );
1263 prs_regf_block( "regf_blocK", &ps
, 0, file
);
1264 file
->checksum
= regf_block_checksum( &ps
);
1265 prs_set_offset( &ps
, 0 );
1266 prs_regf_block( "regf_blocK", &ps
, 0, file
);
1268 /* now we are ready to write it to disk */
1269 if ( write_block( file
, &ps
, 0 ) == -1 )
1270 DEBUG(0,("regfio_close: failed to update the regf header block!\n"));
1273 prs_mem_free( &ps
);
1276 regfio_mem_free( file
);
1278 /* nothing tdo do if there is no open file */
1290 /*******************************************************************
1291 *******************************************************************/
1293 static void regfio_flush( REGF_FILE
*file
)
1297 for ( hbin
=file
->block_list
; hbin
; hbin
=hbin
->next
) {
1298 write_hbin_block( file
, hbin
);
1302 /*******************************************************************
1303 There should be only *one* root key in the registry file based
1304 on my experience. --jerry
1305 *******************************************************************/
1307 REGF_NK_REC
* regfio_rootkey( REGF_FILE
*file
)
1311 uint32 offset
= REGF_BLOCKSIZE
;
1318 if ( !(nk
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_NK_REC
)) ) {
1319 DEBUG(0,("regfio_rootkey: talloc() failed!\n"));
1323 /* scan through the file on HBIN block at a time looking
1324 for an NK record with a type == 0x002c.
1325 Normally this is the first nk record in the first hbin
1326 block (but I'm not assuming that for now) */
1328 while ( (hbin
= read_hbin_block( file
, offset
)) ) {
1332 if ( next_nk_record( file
, hbin
, nk
, &eob
) ) {
1333 if ( nk
->key_type
== NK_TYPE_ROOTKEY
) {
1338 prs_mem_free( &hbin
->ps
);
1344 offset
+= hbin
->block_size
;
1348 DEBUG(0,("regfio_rootkey: corrupt registry file ? No root key record located\n"));
1352 DLIST_ADD( file
->block_list
, hbin
);
1357 /*******************************************************************
1358 This acts as an interator over the subkeys defined for a given
1359 NK record. Remember that offsets are from the *first* HBIN block.
1360 *******************************************************************/
1362 REGF_NK_REC
* regfio_fetch_subkey( REGF_FILE
*file
, REGF_NK_REC
*nk
)
1364 REGF_NK_REC
*subkey
;
1368 /* see if there is anything left to report */
1370 if ( !nk
|| (nk
->subkeys_off
==REGF_OFFSET_NONE
) || (nk
->subkey_index
>= nk
->num_subkeys
) )
1373 /* find the HBIN block which should contain the nk record */
1375 if ( !(hbin
= lookup_hbin_block( file
, nk
->subkeys
.hashes
[nk
->subkey_index
].nk_off
)) ) {
1376 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing offset [0x%x]\n",
1377 nk
->subkeys
.hashes
[nk
->subkey_index
].nk_off
));
1381 nk_offset
= nk
->subkeys
.hashes
[nk
->subkey_index
].nk_off
;
1382 if ( !prs_set_offset( &hbin
->ps
, (HBIN_HDR_SIZE
+ nk_offset
- hbin
->first_hbin_off
) ) )
1386 if ( !(subkey
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_NK_REC
)) )
1389 if ( !hbin_prs_key( file
, hbin
, subkey
) )
1396 /*******************************************************************
1397 *******************************************************************/
1399 static REGF_HBIN
* regf_hbin_allocate( REGF_FILE
*file
, uint32 block_size
)
1402 SMB_STRUCT_STAT sbuf
;
1404 if ( !(hbin
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_HBIN
)) )
1407 memcpy( hbin
->header
, "hbin", sizeof(HBIN_HDR_SIZE
) );
1410 if ( sys_fstat( file
->fd
, &sbuf
) ) {
1411 DEBUG(0,("regf_hbin_allocate: stat() failed! (%s)\n", strerror(errno
)));
1415 hbin
->file_off
= sbuf
.st_size
;
1417 hbin
->free_off
= HBIN_HEADER_REC_SIZE
;
1418 hbin
->free_size
= block_size
- hbin
->free_off
+ sizeof(uint32
);;
1420 hbin
->block_size
= block_size
;
1421 hbin
->first_hbin_off
= hbin
->file_off
- REGF_BLOCKSIZE
;
1423 if ( !prs_init( &hbin
->ps
, block_size
, file
->mem_ctx
, MARSHALL
) )
1426 if ( !prs_hbin_block( "new_hbin", &hbin
->ps
, 0, hbin
) )
1429 if ( !write_hbin_block( file
, hbin
) )
1432 file
->last_block
= hbin
->file_off
;
1437 /*******************************************************************
1438 *******************************************************************/
1440 static void update_free_space( REGF_HBIN
*hbin
, uint32 size_used
)
1442 hbin
->free_off
+= size_used
;
1443 hbin
->free_size
-= size_used
;
1445 if ( hbin
->free_off
>= hbin
->block_size
) {
1446 hbin
->free_off
= REGF_OFFSET_NONE
;
1452 /*******************************************************************
1453 *******************************************************************/
1455 static REGF_HBIN
* find_free_space( REGF_FILE
*file
, uint32 size
)
1457 REGF_HBIN
*hbin
, *p_hbin
;
1461 /* check open block list */
1463 for ( hbin
=file
->block_list
; hbin
!=NULL
; hbin
=hbin
->next
) {
1464 /* only check blocks that actually have available space */
1466 if ( hbin
->free_off
== REGF_OFFSET_NONE
)
1469 /* check for a large enough available chunk */
1471 if ( (hbin
->block_size
- hbin
->free_off
) >= size
) {
1472 DLIST_PROMOTE( file
->block_list
, hbin
);
1477 /* parse the file until we find a block with
1478 enough free space; save the last non-filled hbin */
1480 block_off
= REGF_BLOCKSIZE
;
1482 /* cleanup before the next round */
1485 prs_mem_free( &hbin
->ps
);
1487 hbin
= read_hbin_block( file
, block_off
);
1491 /* make sure that we don't already have this block in memory */
1493 for ( p_hbin
=file
->block_list
; p_hbin
!=NULL
; p_hbin
=p_hbin
->next
) {
1494 if ( p_hbin
->file_off
== hbin
->file_off
) {
1500 block_off
= hbin
->file_off
+ hbin
->block_size
;
1503 prs_mem_free( &hbin
->ps
);
1508 /* if (cached block or (new block and not enough free space)) then continue looping */
1509 } while ( cached
|| (hbin
&& (hbin
->free_size
< size
)) );
1511 /* no free space; allocate a new one */
1516 /* allocate in multiples of REGF_ALLOC_BLOCK; make sure (size + hbin_header) fits */
1518 alloc_size
= (((size
+HBIN_HEADER_REC_SIZE
) / REGF_ALLOC_BLOCK
) + 1 ) * REGF_ALLOC_BLOCK
;
1520 if ( !(hbin
= regf_hbin_allocate( file
, alloc_size
)) ) {
1521 DEBUG(0,("find_free_space: regf_hbin_allocate() failed!\n"));
1524 DLIST_ADD( file
->block_list
, hbin
);
1528 /* set the offset to be ready to write */
1530 if ( !prs_set_offset( &hbin
->ps
, hbin
->free_off
-sizeof(uint32
) ) )
1533 /* write the record size as a placeholder for now, it should be
1534 probably updated by the caller once it all of the data necessary
1537 if ( !prs_uint32("allocated_size", &hbin
->ps
, 0, &size
) )
1540 update_free_space( hbin
, size
);
1545 /*******************************************************************
1546 *******************************************************************/
1548 static uint32
sk_record_data_size( SEC_DESC
* sd
)
1550 uint32 size
, size_mod8
;
1554 /* the record size is sizeof(hdr) + name + static members + data_size_field */
1556 size
= sizeof(uint32
)*5 + ndr_size_security_descriptor(sd
, 0) + sizeof(uint32
);
1559 size_mod8
= size
& 0xfffffff8;
1560 if ( size_mod8
< size
)
1566 /*******************************************************************
1567 *******************************************************************/
1569 static uint32
vk_record_data_size( REGF_VK_REC
*vk
)
1571 uint32 size
, size_mod8
;
1575 /* the record size is sizeof(hdr) + name + static members + data_size_field */
1577 size
= REC_HDR_SIZE
+ (sizeof(uint16
)*3) + (sizeof(uint32
)*3) + sizeof(uint32
);
1579 if ( vk
->valuename
)
1580 size
+= strlen(vk
->valuename
);
1583 size_mod8
= size
& 0xfffffff8;
1584 if ( size_mod8
< size
)
1590 /*******************************************************************
1591 *******************************************************************/
1593 static uint32
lf_record_data_size( uint32 num_keys
)
1595 uint32 size
, size_mod8
;
1599 /* the record size is sizeof(hdr) + num_keys + sizeof of hash_array + data_size_uint32 */
1601 size
= REC_HDR_SIZE
+ sizeof(uint16
) + (sizeof(REGF_HASH_REC
) * num_keys
) + sizeof(uint32
);
1604 size_mod8
= size
& 0xfffffff8;
1605 if ( size_mod8
< size
)
1611 /*******************************************************************
1612 *******************************************************************/
1614 static uint32
nk_record_data_size( REGF_NK_REC
*nk
)
1616 uint32 size
, size_mod8
;
1620 /* the record size is static + length_of_keyname + length_of_classname + data_size_uint32 */
1622 size
= 0x4c + strlen(nk
->keyname
) + sizeof(uint32
);
1624 if ( nk
->classname
)
1625 size
+= strlen( nk
->classname
);
1628 size_mod8
= size
& 0xfffffff8;
1629 if ( size_mod8
< size
)
1635 /*******************************************************************
1636 *******************************************************************/
1638 static bool create_vk_record( REGF_FILE
*file
, REGF_VK_REC
*vk
, REGISTRY_VALUE
*value
)
1640 char *name
= regval_name(value
);
1641 REGF_HBIN
*data_hbin
;
1645 memcpy( vk
->header
, "vk", REC_HDR_SIZE
);
1648 vk
->valuename
= talloc_strdup( file
->mem_ctx
, regval_name(value
) );
1649 vk
->flag
= VK_FLAG_NAME_PRESENT
;
1652 vk
->data_size
= regval_size( value
);
1653 vk
->type
= regval_type( value
);
1655 if ( vk
->data_size
> sizeof(uint32
) ) {
1656 uint32 data_size
= ( (vk
->data_size
+sizeof(uint32
)) & 0xfffffff8 ) + 8;
1658 vk
->data
= (uint8
*)TALLOC_MEMDUP( file
->mem_ctx
,
1659 regval_data_p(value
),
1661 if (vk
->data
== NULL
) {
1665 /* go ahead and store the offset....we'll pick this hbin block back up when
1666 we stream the data */
1668 if ((data_hbin
= find_free_space(file
, data_size
)) == NULL
) {
1671 vk
->data_off
= prs_offset( &data_hbin
->ps
) + data_hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1674 /* make sure we don't try to copy from a NULL value pointer */
1676 if ( vk
->data_size
!= 0 )
1677 memcpy( &vk
->data_off
, regval_data_p(value
), sizeof(uint32
) );
1678 vk
->data_size
|= VK_DATA_IN_OFFSET
;
1684 /*******************************************************************
1685 *******************************************************************/
1687 static int hashrec_cmp( REGF_HASH_REC
*h1
, REGF_HASH_REC
*h2
)
1689 return StrCaseCmp( h1
->fullname
, h2
->fullname
);
1692 /*******************************************************************
1693 *******************************************************************/
1695 REGF_NK_REC
* regfio_write_key( REGF_FILE
*file
, const char *name
,
1696 REGVAL_CTR
*values
, REGSUBKEY_CTR
*subkeys
,
1697 SEC_DESC
*sec_desc
, REGF_NK_REC
*parent
)
1700 REGF_HBIN
*vlist_hbin
= NULL
;
1703 if ( !(nk
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_NK_REC
)) )
1706 memcpy( nk
->header
, "nk", REC_HDR_SIZE
);
1709 nk
->key_type
= NK_TYPE_ROOTKEY
;
1711 nk
->key_type
= NK_TYPE_NORMALKEY
;
1713 /* store the parent offset (or -1 if a the root key */
1715 nk
->parent_off
= parent
? (parent
->hbin_off
+ parent
->hbin
->file_off
- REGF_BLOCKSIZE
- HBIN_HDR_SIZE
) : REGF_OFFSET_NONE
;
1717 /* no classname currently */
1719 nk
->classname_off
= REGF_OFFSET_NONE
;
1720 nk
->classname
= NULL
;
1721 nk
->keyname
= talloc_strdup( file
->mem_ctx
, name
);
1723 /* current modification time */
1725 unix_to_nt_time( &nk
->mtime
, time(NULL
) );
1727 /* allocate the record on disk */
1729 size
= nk_record_data_size( nk
);
1730 nk
->rec_size
= ( size
- 1 ) ^ 0XFFFFFFFF;
1731 if ((nk
->hbin
= find_free_space( file
, size
)) == NULL
) {
1734 nk
->hbin_off
= prs_offset( &nk
->hbin
->ps
);
1736 /* Update the hash record in the parent */
1739 REGF_HASH_REC
*hash
= &parent
->subkeys
.hashes
[parent
->subkey_index
];
1741 hash
->nk_off
= prs_offset( &nk
->hbin
->ps
) + nk
->hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1742 memcpy( hash
->keycheck
, name
, sizeof(uint32
) );
1743 hash
->fullname
= talloc_strdup( file
->mem_ctx
, name
);
1744 parent
->subkey_index
++;
1746 /* sort the list by keyname */
1748 qsort( parent
->subkeys
.hashes
, parent
->subkey_index
, sizeof(REGF_HASH_REC
), QSORT_CAST hashrec_cmp
);
1750 if ( !hbin_prs_lf_records( "lf_rec", parent
->subkeys
.hbin
, 0, parent
) )
1754 /* write the security descriptor */
1756 nk
->sk_off
= REGF_OFFSET_NONE
;
1758 uint32 sk_size
= sk_record_data_size( sec_desc
);
1761 /* search for it in the existing list of sd's */
1763 if ( (nk
->sec_desc
= find_sk_record_by_sec_desc( file
, sec_desc
)) == NULL
) {
1764 /* not found so add it to the list */
1766 if (!(sk_hbin
= find_free_space( file
, sk_size
))) {
1770 if ( !(nk
->sec_desc
= TALLOC_ZERO_P( file
->mem_ctx
, REGF_SK_REC
)) )
1773 /* now we have to store the security descriptor in the list and
1774 update the offsets */
1776 memcpy( nk
->sec_desc
->header
, "sk", REC_HDR_SIZE
);
1777 nk
->sec_desc
->hbin
= sk_hbin
;
1778 nk
->sec_desc
->hbin_off
= prs_offset( &sk_hbin
->ps
);
1779 nk
->sec_desc
->sk_off
= prs_offset( &sk_hbin
->ps
) + sk_hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1780 nk
->sec_desc
->rec_size
= (sk_size
-1) ^ 0xFFFFFFFF;
1782 nk
->sec_desc
->sec_desc
= sec_desc
;
1783 nk
->sec_desc
->ref_count
= 0;
1785 /* size value must be self-inclusive */
1786 nk
->sec_desc
->size
= ndr_size_security_descriptor(sec_desc
, 0)
1789 DLIST_ADD_END( file
->sec_desc_list
, nk
->sec_desc
, REGF_SK_REC
*);
1791 /* update the offsets for us and the previous sd in the list.
1792 if this is the first record, then just set the next and prev
1793 offsets to ourself. */
1795 if ( nk
->sec_desc
->prev
) {
1796 REGF_SK_REC
*prev
= nk
->sec_desc
->prev
;
1798 nk
->sec_desc
->prev_sk_off
= prev
->hbin_off
+ prev
->hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1799 prev
->next_sk_off
= nk
->sec_desc
->sk_off
;
1801 /* the end must loop around to the front */
1802 nk
->sec_desc
->next_sk_off
= file
->sec_desc_list
->sk_off
;
1804 /* and first must loop around to the tail */
1805 file
->sec_desc_list
->prev_sk_off
= nk
->sec_desc
->sk_off
;
1807 nk
->sec_desc
->prev_sk_off
= nk
->sec_desc
->sk_off
;
1808 nk
->sec_desc
->next_sk_off
= nk
->sec_desc
->sk_off
;
1812 /* bump the reference count +1 */
1814 nk
->sk_off
= nk
->sec_desc
->sk_off
;
1815 nk
->sec_desc
->ref_count
++;
1818 /* write the subkeys */
1820 nk
->subkeys_off
= REGF_OFFSET_NONE
;
1821 if ( (nk
->num_subkeys
= regsubkey_ctr_numkeys( subkeys
)) != 0 ) {
1822 uint32 lf_size
= lf_record_data_size( nk
->num_subkeys
);
1826 if (!(nk
->subkeys
.hbin
= find_free_space( file
, lf_size
))) {
1829 nk
->subkeys
.hbin_off
= prs_offset( &nk
->subkeys
.hbin
->ps
);
1830 nk
->subkeys
.rec_size
= (lf_size
-1) ^ 0xFFFFFFFF;
1831 nk
->subkeys_off
= prs_offset( &nk
->subkeys
.hbin
->ps
) + nk
->subkeys
.hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1833 memcpy( nk
->subkeys
.header
, "lf", REC_HDR_SIZE
);
1835 nk
->subkeys
.num_keys
= nk
->num_subkeys
;
1836 if (nk
->subkeys
.num_keys
) {
1837 if ( !(nk
->subkeys
.hashes
= TALLOC_ZERO_ARRAY( file
->mem_ctx
, REGF_HASH_REC
, nk
->subkeys
.num_keys
)) )
1840 nk
->subkeys
.hashes
= NULL
;
1842 nk
->subkey_index
= 0;
1844 /* update the max_bytes_subkey{name,classname} fields */
1845 for ( i
=0; i
<nk
->num_subkeys
; i
++ ) {
1846 namelen
= strlen( regsubkey_ctr_specific_key(subkeys
, i
) );
1847 if ( namelen
*2 > nk
->max_bytes_subkeyname
)
1848 nk
->max_bytes_subkeyname
= namelen
* 2;
1852 /* write the values */
1854 nk
->values_off
= REGF_OFFSET_NONE
;
1855 if ( (nk
->num_values
= regval_ctr_numvals( values
)) != 0 ) {
1856 uint32 vlist_size
= ( ( nk
->num_values
* sizeof(uint32
) ) & 0xfffffff8 ) + 8;
1859 if (!(vlist_hbin
= find_free_space( file
, vlist_size
))) {
1862 nk
->values_off
= prs_offset( &vlist_hbin
->ps
) + vlist_hbin
->first_hbin_off
- HBIN_HDR_SIZE
;
1864 if (nk
->num_values
) {
1865 if ( !(nk
->values
= TALLOC_ARRAY( file
->mem_ctx
, REGF_VK_REC
, nk
->num_values
)) )
1871 /* create the vk records */
1873 for ( i
=0; i
<nk
->num_values
; i
++ ) {
1874 uint32 vk_size
, namelen
, datalen
;
1877 r
= regval_ctr_specific_value( values
, i
);
1878 create_vk_record( file
, &nk
->values
[i
], r
);
1879 vk_size
= vk_record_data_size( &nk
->values
[i
] );
1880 nk
->values
[i
].hbin
= find_free_space( file
, vk_size
);
1881 nk
->values
[i
].hbin_off
= prs_offset( &nk
->values
[i
].hbin
->ps
);
1882 nk
->values
[i
].rec_size
= ( vk_size
- 1 ) ^ 0xFFFFFFFF;
1883 nk
->values
[i
].rec_off
= prs_offset( &nk
->values
[i
].hbin
->ps
)
1884 + nk
->values
[i
].hbin
->first_hbin_off
1887 /* update the max bytes fields if necessary */
1889 namelen
= strlen( regval_name(r
) );
1890 if ( namelen
*2 > nk
->max_bytes_valuename
)
1891 nk
->max_bytes_valuename
= namelen
* 2;
1893 datalen
= regval_size( r
);
1894 if ( datalen
> nk
->max_bytes_value
)
1895 nk
->max_bytes_value
= datalen
;
1899 /* stream the records */
1901 prs_set_offset( &nk
->hbin
->ps
, nk
->hbin_off
);
1902 if ( !prs_nk_rec( "nk_rec", &nk
->hbin
->ps
, 0, nk
) )
1905 if ( nk
->num_values
) {
1906 if ( !hbin_prs_vk_records( "vk_records", vlist_hbin
, 0, nk
, file
) )
1911 regfio_flush( file
);