2 Samba Unix/Linux SMB client utility editreg.c
3 Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program; if not, write to the Free Software
17 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19 /*************************************************************************
21 A utility to edit a Windows NT/2K etc registry file.
23 Many of the ideas in here come from other people and software.
24 I first looked in Wine in misc/registry.c and was also influenced by
25 http://www.wednesday.demon.co.uk/dosreg.html
27 Which seems to contain comments from someone else. I reproduce them here
28 incase the site above disappears. It actually comes from
29 http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
31 The goal here is to read the registry into memory, manipulate it, and then
32 write it out if it was changed by any actions of the user.
34 The windows NT registry has 2 different blocks, where one can occur many
40 "regf" is obviosly the abbreviation for "Registry file". "regf" is the
41 signature of the header-block which is always 4kb in size, although only
42 the first 64 bytes seem to be used and a checksum is calculated over
43 the first 0x200 bytes only!
46 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572
47 0x00000004 D-Word ???? //see struct REGF
48 0x00000008 D-Word ???? Always the same value as at 0x00000004
49 0x0000000C Q-Word last modify date in WinNT date-format
54 0x00000024 D-Word Offset of 1st key record
55 0x00000028 D-Word Size of the data-blocks (Filesize-4kb)
57 0x000001FC D-Word Sum of all D-Words from 0x00000000 to
58 0x000001FB //XOR of all words. Nigel
60 I have analyzed more registry files (from multiple machines running
61 NT 4.0 german version) and could not find an explanation for the values
62 marked with ???? the rest of the first 4kb page is not important...
66 I don't know what "hbin" stands for, but this block is always a multiple
69 Inside these hbin-blocks the different records are placed. The memory-
70 management looks like a C-compiler heap management to me...
75 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268
76 0x0004 D-Word Offset from the 1st hbin-Block
77 0x0008 D-Word Offset to the next hbin-Block
78 0x001C D-Word Block-size
80 The values in 0x0008 and 0x001C should be the same, so I don't know
81 if they are correct or swapped...
83 From offset 0x0020 inside a hbin-block data is stored with the following
87 0x0000 D-Word Data-block size //this size must be a
91 If the size field is negative (bit 31 set), the corresponding block
92 is free and has a size of -blocksize!
94 That does not seem to be true. All block lengths seem to be negative! (Richard Sharpe)
96 The data is stored as one record per block. Block size is a multiple
97 of 4 and the last block reaches the next hbin-block, leaving no room.
99 Records in the hbin-blocks
100 ==========================
104 The nk-record can be treated as a kombination of tree-record and
105 key-record of the win 95 registry.
109 The lf-record is the counterpart to the RGKN-record (the
114 The vk-record consists information to a single value.
118 sk (? Security Key ?) is the ACL of the registry.
122 The value-lists contain information about which values are inside a
123 sub-key and don't have a header.
127 The datas of the registry are (like the value-list) stored without a
130 All offset-values are relative to the first hbin-block and point to the
131 block-size field of the record-entry. to get the file offset, you have to add
132 the header size (4kb) and the size field (4 bytes)...
137 0x0000 Word ID: ASCII-"nk" = 0x6B6E
138 0x0002 Word for the root-key: 0x2C, otherwise 0x20 //key symbolic links 0x10. Nigel
139 0x0004 Q-Word write-date/time in windows nt notation
140 0x0010 D-Word Offset of Owner/Parent key
141 0x0014 D-Word number of sub-Keys
142 0x001C D-Word Offset of the sub-key lf-Records
143 0x0024 D-Word number of values
144 0x0028 D-Word Offset of the Value-List
145 0x002C D-Word Offset of the sk-Record
147 0x0030 D-Word Offset of the Class-Name //see NK structure for the use of these fields. Nigel
148 0x0044 D-Word Unused (data-trash) //some kind of run time index. Does not appear to be important. Nigel
149 0x0048 Word name-length
150 0x004A Word class-name length
156 0x0000 D-Word Offset 1st Value
157 0x0004 D-Word Offset 2nd Value
158 0x???? D-Word Offset nth Value
160 To determine the number of values, you have to look at the owner-nk-record!
165 0x0000 Word ID: ASCII-"vk" = 0x6B76
166 0x0002 Word name length
167 0x0004 D-Word length of the data //if top bit is set when offset contains data. Nigel
168 0x0008 D-Word Offset of Data
169 0x000C D-Word Type of value
171 0x0012 Word Unused (data-trash)
174 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
176 If the data-size is lower 5, the data-offset value is used to store the data itself!
181 0x0001 RegSZ: character string (in UNICODE!)
182 0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!)
183 0x0003 RegBin: raw-binary value
184 0x0004 RegDWord: Dword
185 0x0007 RegMultiSZ: multiple strings, seperated with 0
191 0x0000 Word ID: ASCII-"lf" = 0x666C
192 0x0002 Word number of keys
193 0x0004 ???? Hash-Records
198 0x0000 D-Word Offset of corresponding "nk"-Record
199 0x0004 D-Word ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
201 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
202 key-name you have to change the hash-value too!
204 //These hashrecords must be sorted low to high within the lf record. Nigel.
208 (due to the complexity of the SAM-info, not clear jet)
209 (This is just a security descriptor in the data. R Sharpe.)
213 0x0000 Word ID: ASCII-"sk" = 0x6B73
215 0x0004 D-Word Offset of previous "sk"-Record
216 0x0008 D-Word Offset of next "sk"-Record
217 0x000C D-Word usage-counter
218 0x0010 D-Word Size of "sk"-record in bytes
220 relative security desciptor. Nigel
221 ???? ???? Security and auditing settings...
224 The usage counter counts the number of references to this
225 "sk"-record. You can use one "sk"-record for the entire registry!
227 Windows nt date/time format
228 ===========================
229 The time-format is a 64-bit integer which is incremented every
230 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
231 It starts with 0 at the 1st of january 1601 0:00! All values are
232 stored in GMT time! The time-zone is important to get the real
235 Common values for win95 and win-nt
236 ==================================
237 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
238 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
240 If a value has no data (length=0), it is displayed as empty.
242 simplyfied win-3.?? registry:
243 =============================
246 | next rec. |---+ +----->+------------+
247 | first sub | | | | Usage cnt. |
248 | name | | +-->+------------+ | | length |
249 | value | | | | next rec. | | | text |------->+-------+
250 +-----------+ | | | name rec. |--+ +------------+ | xxxxx |
251 +------------+ | | value rec. |-------->+------------+ +-------+
252 v | +------------+ | Usage cnt. |
253 +-----------+ | | length |
254 | next rec. | | | text |------->+-------+
255 | first sub |------+ +------------+ | xxxxx |
260 Greatly simplyfied structure of the nt-registry:
261 ================================================
263 +---------------------------------------------------------------+
266 +---------+ +---------->+-----------+ +----->+---------+ |
267 | "nk" | | | lf-rec. | | | nk-rec. | |
268 | ID | | | # of keys | | | parent |---+
269 | Date | | | 1st key |--+ | .... |
270 | parent | | +-----------+ +---------+
272 | values |--------------------->+----------+
273 | SK-rec. |---------------+ | 1. value |--> +----------+
274 | class |--+ | +----------+ | vk-rec. |
275 +---------+ | | | .... |
276 v | | data |--> +-------+
277 +------------+ | +----------+ | xxxxx |
278 | Class name | | +-------+
281 +---------+ +---------+
282 +----->| next sk |--->| Next sk |--+
283 | +---| prev sk |<---| prev sk | |
284 | | | .... | | ... | |
285 | | +---------+ +---------+ |
288 | +--------------------+ |
289 +----------------------------------+
291 ---------------------------------------------------------------------------
293 Hope this helps.... (Although it was "fun" for me to uncover this things,
294 it took me several sleepless nights ;)
298 *************************************************************************/
304 #include <sys/types.h>
305 #include <sys/stat.h>
307 #include <sys/mman.h>
313 #define REG_KEY_LIST_SIZE 10
316 * Structures for dealing with the on-disk format of the registry
319 #define IVAL(buf) ((unsigned int) \
320 (unsigned int)*((unsigned char *)(buf)+3)<<24| \
321 (unsigned int)*((unsigned char *)(buf)+2)<<16| \
322 (unsigned int)*((unsigned char *)(buf)+1)<<8| \
323 (unsigned int)*((unsigned char *)(buf)+0))
325 #define SVAL(buf) ((unsigned short) \
326 (unsigned short)*((unsigned char *)(buf)+1)<<8| \
327 (unsigned short)*((unsigned char *)(buf)+0))
329 #define CVAL(buf) ((unsigned char)*((unsigned char *)(buf)))
331 static int verbose
= 0;
332 static int print_security
= 0;
333 static int full_print
= 0;
336 * These definitions are for the in-memory registry structure.
337 * It is a tree structure that mimics what you see with tools like regedit
341 * DateTime struct for Windows
344 typedef struct date_time_s
{
345 unsigned int low
, high
;
349 * Definition of a Key. It has a name, classname, date/time last modified,
350 * sub-keys, values, and a security descriptor
353 #define REG_ROOT_KEY 1
354 #define REG_SUB_KEY 2
355 #define REG_SYM_LINK 3
357 typedef struct key_sec_desc_s KEY_SEC_DESC
;
359 typedef struct reg_key_s
{
360 char *name
; /* Name of the key */
362 int type
; /* One of REG_ROOT_KEY or REG_SUB_KEY */
363 NTTIME last_mod
; /* Time last modified */
364 struct reg_key_s
*owner
;
365 struct key_list_s
*sub_keys
;
366 struct val_list_s
*values
;
367 KEY_SEC_DESC
*security
;
371 * The KEY_LIST struct lists sub-keys.
374 typedef struct key_list_s
{
380 typedef struct val_key_s
{
385 void *data_blk
; /* Might want a separate block */
388 typedef struct val_list_s
{
395 #define MAXSUBAUTHS 15
398 typedef struct dom_sid_s
{
399 unsigned char ver
, auths
;
400 unsigned char auth
[6];
401 unsigned int sub_auths
[MAXSUBAUTHS
];
404 typedef struct ace_struct_s
{
405 unsigned char type
, flags
;
406 unsigned int perms
; /* Perhaps a better def is in order */
410 typedef struct acl_struct_s
{
411 unsigned short rev
, refcnt
;
412 unsigned short num_aces
;
416 typedef struct sec_desc_s
{
417 unsigned int rev
, type
;
418 DOM_SID
*owner
, *group
;
422 #define SEC_DESC_NON 0
423 #define SEC_DESC_RES 1
424 #define SEC_DESC_OCU 2
425 #define SEC_DESC_NBK 3
426 struct key_sec_desc_s
{
427 struct key_sec_desc_s
*prev
, *next
;
434 * All of the structures below actually have a four-byte lenght before them
435 * which always seems to be negative. The following macro retrieves that
439 #define BLK_SIZE(b) ((int)*(int *)(((int *)b)-1))
441 typedef unsigned int DWORD
;
442 typedef unsigned short WORD
;
444 #define REG_REGF_ID 0x66676572
446 typedef struct regf_block
{
447 DWORD REGF_ID
; /* regf */
455 DWORD first_key
; /* offset */
456 unsigned int dblk_size
;
457 DWORD uk7
[116]; /* 1 */
461 typedef struct hbin_sub_struct
{
466 #define REG_HBIN_ID 0x6E696268
468 typedef struct hbin_struct
{
469 DWORD HBIN_ID
; /* hbin */
477 HBIN_SUB_HDR hbin_sub_hdr
;
480 #define REG_NK_ID 0x6B6E
482 typedef struct nk_struct
{
500 char key_nam
[1]; /* Actual length determined by nam_len */
503 #define REG_SK_ID 0x6B73
505 typedef struct sk_struct
{
515 typedef struct ace_struct
{
518 unsigned short length
;
523 typedef struct acl_struct
{
527 REG_ACE
*aces
; /* One or more ACEs */
530 typedef struct sec_desc_rec
{
539 typedef struct hash_struct
{
544 #define REG_LF_ID 0x666C
546 typedef struct lf_struct
{
549 struct hash_struct hr
[1]; /* Array of hash records, depending on key_count */
552 typedef DWORD VL_TYPE
[1]; /* Value list is an array of vk rec offsets */
554 #define REG_VK_ID 0x6B76
556 typedef struct vk_struct
{
559 DWORD dat_len
; /* If top-bit set, offset contains the data */
562 WORD flag
; /* =1, has name, else no name (=Default). */
564 char dat_name
[1]; /* Name starts here ... */
567 #define REG_TYPE_DELETE -1
568 #define REG_TYPE_NONE 0
569 #define REG_TYPE_REGSZ 1
570 #define REG_TYPE_EXPANDSZ 2
571 #define REG_TYPE_BIN 3
572 #define REG_TYPE_DWORD 4
573 #define REG_TYPE_MULTISZ 7
575 typedef struct _val_str
{
580 /* A map of sk offsets in the regf to KEY_SEC_DESCs for quick lookup etc */
581 typedef struct sk_map_s
{
583 KEY_SEC_DESC
*key_sec_desc
;
586 struct regf_struct_s
{
588 char *regfile_name
, *outfile_name
;
593 NTTIME last_mod_time
;
594 REG_KEY
*root
; /* Root of the tree for this file */
595 int sk_count
, sk_map_size
;
597 SEC_DESC
*def_sec_desc
;
600 typedef struct regf_struct_s REGF
;
603 * An API for accessing/creating/destroying items above
607 * Iterate over the keys, depth first, calling a function for each key
608 * and indicating if it is terminal or non-terminal and if it has values.
610 * In addition, for each value in the list, call a value list function
613 typedef int (*key_print_f
)(const char *path
, char *key_name
, char *class_name
,
614 int root
, int terminal
, int values
);
616 typedef int (*val_print_f
)(const char *path
, char *val_name
, int val_type
,
617 int data_len
, void *data_blk
, int terminal
,
618 int first
, int last
);
620 typedef int (*sec_print_f
)(SEC_DESC
*sec_desc
);
622 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, const char *path
,
623 key_print_f key_print
, sec_print_f sec_print
,
624 val_print_f val_print
);
626 int nt_val_list_iterator(REGF
*regf
, VAL_LIST
*val_list
, int bf
, char *path
,
627 int terminal
, val_print_f val_print
)
631 if (!val_list
) return 1;
633 if (!val_print
) return 1;
635 for (i
=0; i
<val_list
->val_count
; i
++) {
636 if (!val_print(path
, val_list
->vals
[i
]->name
, val_list
->vals
[i
]->data_type
,
637 val_list
->vals
[i
]->data_len
, val_list
->vals
[i
]->data_blk
,
640 (i
== val_list
->val_count
))) {
650 int nt_key_list_iterator(REGF
*regf
, KEY_LIST
*key_list
, int bf
,
652 key_print_f key_print
, sec_print_f sec_print
,
653 val_print_f val_print
)
657 if (!key_list
) return 1;
659 for (i
=0; i
< key_list
->key_count
; i
++) {
660 if (!nt_key_iterator(regf
, key_list
->keys
[i
], bf
, path
, key_print
,
661 sec_print
, val_print
)) {
668 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, const char *path
,
669 key_print_f key_print
, sec_print_f sec_print
,
670 val_print_f val_print
)
672 int path_len
= strlen(path
);
675 if (!regf
|| !key_tree
)
678 /* List the key first, then the values, then the sub-keys */
682 if (!(*key_print
)(path
, key_tree
->name
,
683 key_tree
->class_name
,
684 (key_tree
->type
== REG_ROOT_KEY
),
685 (key_tree
->sub_keys
== NULL
),
686 (key_tree
->values
?(key_tree
->values
->val_count
):0)))
691 * If we have a security print routine, call it
692 * If the security print routine returns false, stop.
695 if (key_tree
->security
&& !(*sec_print
)(key_tree
->security
->sec_desc
))
699 new_path
= (char *)malloc(path_len
+ 1 + strlen(key_tree
->name
) + 1);
700 if (!new_path
) return 0; /* Errors? */
702 strcat(new_path
, path
);
703 strcat(new_path
, key_tree
->name
);
704 strcat(new_path
, "\\");
707 * Now, iterate through the values in the val_list
710 if (key_tree
->values
&&
711 !nt_val_list_iterator(regf
, key_tree
->values
, bf
, new_path
,
712 (key_tree
->values
!=NULL
),
720 * Now, iterate through the keys in the key list
723 if (key_tree
->sub_keys
&&
724 !nt_key_list_iterator(regf
, key_tree
->sub_keys
, bf
, new_path
, key_print
,
725 sec_print
, val_print
)) {
734 REG_KEY
*nt_find_key_by_name(REG_KEY
*tree
, char *key
);
737 * Find key by name in a list ...
738 * Take the first component and search for that in the list
740 REG_KEY
*nt_find_key_in_list_by_name(KEY_LIST
*list
, char *key
)
745 if (!list
|| !key
|| !*key
) return NULL
;
747 for (i
= 0; i
< list
->key_count
; i
++)
748 if ((res
= nt_find_key_by_name(list
->keys
[i
], key
)))
755 * Find key by name in a tree ... We will assume absolute names here, but we
756 * need the root of the tree ...
758 REG_KEY
*nt_find_key_by_name(REG_KEY
*tree
, char *key
)
760 char *lname
= NULL
, *c1
, *c2
;
763 if (!tree
|| !key
|| !*key
) return NULL
;
766 if (!lname
) return NULL
;
769 * Make sure that the first component is correct ...
772 c2
= strchr(c1
, '\\');
773 if (c2
) { /* Split here ... */
777 if (strcmp(c1
, tree
->name
) != 0) goto error
;
780 tmp
= nt_find_key_in_list_by_name(tree
->sub_keys
, c2
);
785 if (lname
) free(lname
);
789 if (lname
) free(lname
);
793 /* Make, delete keys */
795 int nt_delete_val_key(VAL_KEY
*val_key
)
799 if (val_key
->name
) free(val_key
->name
);
800 if (val_key
->data_blk
) free(val_key
->data_blk
);
806 int nt_delete_val_list(VAL_LIST
*vl
)
811 for (i
=0; i
<vl
->val_count
; i
++)
812 nt_delete_val_key(vl
->vals
[i
]);
818 int nt_delete_reg_key(REG_KEY
*key
, int delete_name
);
819 int nt_delete_key_list(KEY_LIST
*key_list
, int delete_name
)
824 for (i
=0; i
<key_list
->key_count
; i
++)
825 nt_delete_reg_key(key_list
->keys
[i
], False
);
832 * Find the key, and if it exists, delete it ...
834 int nt_delete_key_by_name(REGF
*regf
, char *name
)
838 if (!name
|| !*name
) return 0;
840 key
= nt_find_key_by_name(regf
->root
, name
);
843 if (key
== regf
->root
) regf
->root
= NULL
;
844 return nt_delete_reg_key(key
, True
);
851 int nt_delete_sid(DOM_SID
*sid
)
859 int nt_delete_ace(ACE
*ace
)
863 nt_delete_sid(ace
->trustee
);
870 int nt_delete_acl(ACL
*acl
)
876 for (i
=0; i
<acl
->num_aces
; i
++)
877 nt_delete_ace(acl
->aces
[i
]);
884 int nt_delete_sec_desc(SEC_DESC
*sec_desc
)
889 nt_delete_sid(sec_desc
->owner
);
890 nt_delete_sid(sec_desc
->group
);
891 nt_delete_acl(sec_desc
->sacl
);
892 nt_delete_acl(sec_desc
->dacl
);
899 int nt_delete_key_sec_desc(KEY_SEC_DESC
*key_sec_desc
)
903 key_sec_desc
->ref_cnt
--;
904 if (key_sec_desc
->ref_cnt
<=0) {
906 * There should always be a next and prev, even if they point to us
908 key_sec_desc
->next
->prev
= key_sec_desc
->prev
;
909 key_sec_desc
->prev
->next
= key_sec_desc
->next
;
910 nt_delete_sec_desc(key_sec_desc
->sec_desc
);
916 int nt_delete_reg_key(REG_KEY
*key
, int delete_name
)
920 if (key
->name
) free(key
->name
);
921 if (key
->class_name
) free(key
->class_name
);
924 * We will delete the owner if we are not the root and told to ...
927 if (key
->owner
&& key
->owner
->sub_keys
&& delete_name
) {
931 /* Find our owner, look in keylist for us and shuffle up */
932 /* Perhaps should be a function */
937 for (i
=0; i
< kl
->key_count
&& kl
->keys
[i
] != key
; i
++) {
938 /* Just find the entry ... */
941 if (i
== kl
->key_count
) {
942 fprintf(stderr
, "Bad data structure. Key not found in key list of owner\n");
948 * Shuffle up. Works for the last one also
950 for (j
= i
+ 1; j
< kl
->key_count
; j
++) {
951 kl
->keys
[j
- 1] = kl
->keys
[j
];
958 if (key
->sub_keys
) nt_delete_key_list(key
->sub_keys
, False
);
959 if (key
->values
) nt_delete_val_list(key
->values
);
960 if (key
->security
) nt_delete_key_sec_desc(key
->security
);
967 * Convert a string to a value ...
968 * FIXME: Error handling and convert this at command parse time ...
970 void *str_to_val(int type
, char *val
, int *len
)
972 unsigned int *dwordp
= NULL
;
974 if (!len
|| !val
) return NULL
;
982 dwordp
= (unsigned int *)malloc(sizeof(unsigned int));
983 if (!dwordp
) return NULL
;
984 /* Allow for ddddd and 0xhhhhh and 0ooooo */
985 if (strncmp(val
, "0x", 2) == 0 || strncmp(val
, "0X", 2) == 0) {
986 sscanf(&val
[2], "%X", dwordp
);
988 else if (*val
== '0') {
989 sscanf(&val
[1], "%o", dwordp
);
992 sscanf(val
, "%d", dwordp
);
994 *len
= sizeof(unsigned int);
995 return (void *)dwordp
;
997 /* FIXME: Implement more of these */
1008 * Add a value to the key specified ... We have to parse the value some more
1009 * based on the type to get it in the correct internal form
1010 * An empty name will be converted to "<No Name>" before here
1011 * Hmmm, maybe not. has_name is for that
1013 VAL_KEY
*nt_add_reg_value(REG_KEY
*key
, char *name
, int type
, char *value
)
1016 VAL_KEY
*tmp
= NULL
;
1018 if (!key
|| !key
->values
|| !name
|| !*name
) return NULL
;
1020 assert(type
!= REG_TYPE_DELETE
); /* We never process deletes here */
1022 for (i
= 0; i
< key
->values
->val_count
; i
++) {
1023 if ((!key
->values
->vals
[i
]->has_name
&& !*name
) ||
1024 (key
->values
->vals
[i
]->has_name
&&
1025 strcmp(name
, key
->values
->vals
[i
]->name
) == 0)){ /* Change the value */
1026 free(key
->values
->vals
[i
]->data_blk
);
1027 key
->values
->vals
[i
]->data_blk
= str_to_val(type
, value
, &
1028 key
->values
->vals
[i
]->data_len
);
1029 return key
->values
->vals
[i
];
1034 * If we get here, the name was not found, so insert it
1037 tmp
= (VAL_KEY
*)malloc(sizeof(VAL_KEY
));
1038 if (!tmp
) goto error
;
1040 bzero(tmp
, sizeof(VAL_KEY
));
1041 tmp
->name
= strdup(name
);
1042 tmp
->has_name
= True
;
1043 if (!tmp
->name
) goto error
;
1044 tmp
->data_type
= type
;
1045 tmp
->data_blk
= str_to_val(type
, value
, &tmp
->data_len
);
1047 /* Now, add to val list */
1049 if (key
->values
->val_count
>= key
->values
->max_vals
) {
1051 * Allocate some more space
1054 if ((key
->values
= (VAL_LIST
*)realloc(key
->values
, sizeof(VAL_LIST
) +
1055 key
->values
->val_count
- 1 +
1056 REG_KEY_LIST_SIZE
))) {
1057 key
->values
->max_vals
+= REG_KEY_LIST_SIZE
;
1062 i
= key
->values
->val_count
;
1063 key
->values
->val_count
++;
1064 key
->values
->vals
[i
] = tmp
;
1068 if (tmp
) nt_delete_val_key(tmp
);
1073 * Delete a value. We return the value and let the caller deal with it.
1075 VAL_KEY
*nt_delete_reg_value(REG_KEY
*key
, char *name
)
1079 if (!key
|| !key
->values
|| !name
|| !*name
) return NULL
;
1081 /* FIXME: Allow empty value name */
1082 for (i
= 0; i
< key
->values
->val_count
; i
++) {
1083 if ((!key
->values
->vals
[i
]->has_name
&& !*name
) ||
1084 (key
->values
->vals
[i
]->has_name
&&
1085 strcmp(name
, key
->values
->vals
[i
]->name
) == 0)) {
1088 val
= key
->values
->vals
[i
];
1091 for (j
= i
+ 1; j
< key
->values
->val_count
; j
++)
1092 key
->values
->vals
[j
- 1] = key
->values
->vals
[j
];
1094 key
->values
->val_count
--;
1103 * Add a key to the tree ... We walk down the components matching until
1104 * we don't find any. There must be a match on the first component ...
1105 * We return the key structure for the final component as that is
1106 * often where we want to add values ...
1110 * Create a 1 component key name and set its parent to parent
1112 REG_KEY
*nt_create_reg_key1(char *name
, REG_KEY
*parent
)
1116 if (!name
|| !*name
) return NULL
; /* A key's name cannot be empty */
1118 /* There should not be more than one component */
1119 if (strchr(name
, '\\')) return NULL
;
1121 if (!(tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
)))) return NULL
;
1123 bzero(tmp
, sizeof(REG_KEY
));
1125 if (!(tmp
->name
= strdup(name
))) goto error
;
1133 * Convert a string of the form S-1-5-x[-y-z-r] to a SID
1135 int string_to_sid(DOM_SID
**sid
, char *sid_str
)
1140 *sid
= (DOM_SID
*)malloc(sizeof(DOM_SID
));
1141 if (!*sid
) return 0;
1143 bzero(*sid
, sizeof(DOM_SID
));
1145 if (strncmp(sid_str
, "S-1-5", 5)) {
1146 fprintf(stderr
, "Does not conform to S-1-5...: %s\n", sid_str
);
1150 /* We only allow strings of form S-1-5... */
1153 (*sid
)->auth
[5] = 5;
1158 if (!lstr
|| !lstr
[0] || sscanf(lstr
, "-%u", &auth
) == 0) {
1160 fprintf(stderr
, "Not of form -d-d...: %s, %u\n", lstr
, i
);
1167 (*sid
)->sub_auths
[i
] = auth
;
1169 lstr
= strchr(lstr
+ 1, '-');
1176 * Create a default ACL
1178 ACL
*nt_create_default_acl(REGF
*regf
)
1182 acl
= (ACL
*)malloc(sizeof(ACL
));
1183 if (!acl
) goto error
;
1188 if (acl
) nt_delete_acl(acl
);
1192 * Create a default security descriptor. We pull in things from env
1195 SEC_DESC
*nt_create_def_sec_desc(REGF
*regf
)
1199 tmp
= (SEC_DESC
*)malloc(sizeof(SEC_DESC
));
1200 if (!tmp
) return NULL
;
1204 if (!string_to_sid(&tmp
->owner
, "S-1-5-32-544")) goto error
;
1205 if (!string_to_sid(&tmp
->group
, "S-1-5-18")) goto error
;
1207 tmp
->dacl
= nt_create_default_acl(regf
);
1212 if (tmp
) nt_delete_sec_desc(tmp
);
1217 * We will implement inheritence that is based on what the parent's SEC_DESC
1218 * says, but the Owner and Group SIDs can be overwridden from the command line
1219 * and additional ACEs can be applied from the command line etc.
1221 KEY_SEC_DESC
*nt_inherit_security(REG_KEY
*key
)
1224 if (!key
) return NULL
;
1225 return key
->security
;
1229 * Create an initial security descriptor and init other structures, if needed
1230 * We assume that the initial security stuff is empty ...
1232 KEY_SEC_DESC
*nt_create_init_sec(REGF
*regf
)
1234 KEY_SEC_DESC
*tsec
= NULL
;
1236 tsec
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1237 if (!tsec
) return NULL
;
1240 tsec
->state
= SEC_DESC_NBK
;
1242 tsec
->sec_desc
= regf
->def_sec_desc
;
1250 REG_KEY
*nt_add_reg_key_list(REGF
*regf
, REG_KEY
*key
, char * name
, int create
)
1253 REG_KEY
*ret
= NULL
, *tmp
= NULL
;
1255 char *lname
, *c1
, *c2
;
1257 if (!key
|| !name
|| !*name
) return NULL
;
1259 list
= key
->sub_keys
;
1260 if (!list
) { /* Create an empty list */
1262 list
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (REG_KEY_LIST_SIZE
- 1) * sizeof(REG_KEY
*));
1263 list
->key_count
= 0;
1264 list
->max_keys
= REG_KEY_LIST_SIZE
;
1268 lname
= strdup(name
);
1269 if (!lname
) return NULL
;
1272 c2
= strchr(c1
, '\\');
1273 if (c2
) { /* Split here ... */
1278 for (i
= 0; i
< list
->key_count
; i
++) {
1279 if (strcmp(list
->keys
[i
]->name
, c1
) == 0) {
1280 ret
= nt_add_reg_key_list(regf
, list
->keys
[i
], c2
, create
);
1287 * If we reach here we could not find the the first component
1291 if (list
->key_count
< list
->max_keys
){
1294 else { /* Create more space in the list ... */
1295 if (!(list
= (KEY_LIST
*)realloc(list
, sizeof(KEY_LIST
) +
1296 (list
->max_keys
+ REG_KEY_LIST_SIZE
- 1)
1297 * sizeof(REG_KEY
*))));
1300 list
->max_keys
+= REG_KEY_LIST_SIZE
;
1305 * add the new key at the new slot
1306 * FIXME: Sort the list someday
1310 * We want to create the key, and then do the rest
1313 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1315 bzero(tmp
, sizeof(REG_KEY
));
1317 tmp
->name
= strdup(c1
);
1318 if (!tmp
->name
) goto error
;
1320 tmp
->type
= REG_SUB_KEY
;
1322 * Next, pull security from the parent, but override with
1323 * anything passed in on the command line
1325 tmp
->security
= nt_inherit_security(key
);
1327 list
->keys
[list
->key_count
- 1] = tmp
;
1330 ret
= nt_add_reg_key_list(regf
, key
, c2
, True
);
1333 if (lname
) free(lname
);
1339 if (lname
) free(lname
);
1344 * This routine only adds a key from the root down.
1345 * It calls helper functions to handle sub-key lists and sub-keys
1347 REG_KEY
*nt_add_reg_key(REGF
*regf
, char *name
, int create
)
1349 char *lname
= NULL
, *c1
, *c2
;
1350 REG_KEY
* tmp
= NULL
;
1353 * Look until we hit the first component that does not exist, and
1354 * then add from there. However, if the first component does not
1355 * match and the path we are given is the root, then it must match
1357 if (!regf
|| !name
|| !*name
) return NULL
;
1359 lname
= strdup(name
);
1360 if (!lname
) return NULL
;
1363 c2
= strchr(c1
, '\\');
1364 if (c2
) { /* Split here ... */
1370 * If the root does not exist, create it and make it equal to the
1371 * first component ...
1376 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1377 if (!tmp
) goto error
;
1378 bzero(tmp
, sizeof(REG_KEY
));
1379 tmp
->name
= strdup(c1
);
1380 if (!tmp
->name
) goto error
;
1381 tmp
->security
= nt_create_init_sec(regf
);
1382 if (!tmp
->security
) goto error
;
1388 * If we don't match, then we have to return error ...
1389 * If we do match on this component, check the next one in the
1390 * list, and if not found, add it ... short circuit, add all the
1394 if (strcmp(c1
, regf
->root
->name
) != 0)
1398 tmp
= nt_add_reg_key_list(regf
, regf
->root
, c2
, True
);
1404 if (lname
) free(lname
);
1409 * Load and unload a registry file.
1411 * Load, loads it into memory as a tree, while unload sealizes/flattens it
1415 * Get the starting record for NT Registry file
1419 * Where we keep all the regf stuff for one registry.
1420 * This is the structure that we use to tie the in memory tree etc
1421 * together. By keeping separate structs, we can operate on different
1422 * registries at the same time.
1423 * Currently, the SK_MAP is an array of mapping structure.
1424 * Since we only need this on input and output, we fill in the structure
1425 * as we go on input. On output, we know how many SK items we have, so
1426 * we can allocate the structure as we need to.
1427 * If you add stuff here that is dynamically allocated, add the
1428 * appropriate free statements below.
1431 #define REGF_REGTYPE_NONE 0
1432 #define REGF_REGTYPE_NT 1
1433 #define REGF_REGTYPE_W9X 2
1435 #define TTTONTTIME(r, t1, t2) (r)->last_mod_time.low = (t1); \
1436 (r)->last_mod_time.high = (t2);
1438 #define REGF_HDR_BLKSIZ 0x1000
1440 #define OFF(f) ((f) + REGF_HDR_BLKSIZ + 4)
1441 #define LOCN(base, f) ((base) + OFF(f))
1443 const VAL_STR reg_type_names
[] = {
1444 { REG_TYPE_REGSZ
, "REG_SZ" },
1445 { REG_TYPE_EXPANDSZ
, "REG_EXPAND_SZ" },
1446 { REG_TYPE_BIN
, "REG_BIN" },
1447 { REG_TYPE_DWORD
, "REG_DWORD" },
1448 { REG_TYPE_MULTISZ
, "REG_MULTI_SZ" },
1452 const char *val_to_str(unsigned int val
, const VAL_STR
*val_array
)
1456 if (!val_array
) return NULL
;
1458 while (val_array
[i
].val
&& val_array
[i
].str
) {
1460 if (val_array
[i
].val
== val
) return val_array
[i
].str
;
1470 * Convert from UniCode to Ascii ... Does not take into account other lang
1471 * Restrict by ascii_max if > 0
1473 int uni_to_ascii(unsigned char *uni
, unsigned char *ascii
, int ascii_max
,
1478 while (i
< ascii_max
&& !(!uni
[i
*2] && !uni
[i
*2+1])) {
1479 if (uni_max
> 0 && (i
*2) >= uni_max
) break;
1480 ascii
[i
] = uni
[i
*2];
1491 * Convert a data value to a string for display
1493 int data_to_ascii(unsigned char *datap
, int len
, int type
, char *ascii
, int ascii_max
)
1495 unsigned char *asciip
;
1499 case REG_TYPE_REGSZ
:
1500 if (verbose
) fprintf(stderr
, "Len: %d\n", len
);
1501 return uni_to_ascii(datap
, ascii
, len
, ascii_max
);
1504 case REG_TYPE_EXPANDSZ
:
1505 return uni_to_ascii(datap
, ascii
, len
, ascii_max
);
1510 for (i
=0; (i
<len
)&&(i
+1)*3<ascii_max
; i
++) {
1511 int str_rem
= ascii_max
- ((int)asciip
- (int)ascii
);
1512 asciip
+= snprintf(asciip
, str_rem
, "%02x", *(unsigned char *)(datap
+i
));
1513 if (i
< len
&& str_rem
> 0)
1514 *asciip
= ' '; asciip
++;
1517 return ((int)asciip
- (int)ascii
);
1520 case REG_TYPE_DWORD
:
1521 if (*(int *)datap
== 0)
1522 return snprintf(ascii
, ascii_max
, "0");
1524 return snprintf(ascii
, ascii_max
, "0x%x", *(int *)datap
);
1527 case REG_TYPE_MULTISZ
:
1540 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
, REG_KEY
*parent
);
1542 int nt_set_regf_input_file(REGF
*regf
, char *filename
)
1544 return ((regf
->regfile_name
= strdup(filename
)) != NULL
);
1547 int nt_set_regf_output_file(REGF
*regf
, char *filename
)
1549 return ((regf
->outfile_name
= strdup(filename
)) != NULL
);
1552 /* Create a regf structure and init it */
1554 REGF
*nt_create_regf(void)
1556 REGF
*tmp
= (REGF
*)malloc(sizeof(REGF
));
1557 if (!tmp
) return tmp
;
1558 bzero(tmp
, sizeof(REGF
));
1562 /* Free all the bits and pieces ... Assumes regf was malloc'd */
1563 /* If you add stuff to REGF, add the relevant free bits here */
1564 int nt_free_regf(REGF
*regf
)
1566 if (!regf
) return 0;
1568 if (regf
->regfile_name
) free(regf
->regfile_name
);
1569 if (regf
->outfile_name
) free(regf
->outfile_name
);
1571 nt_delete_reg_key(regf
->root
, False
); /* Free the tree */
1573 regf
->sk_count
= regf
->sk_map_size
= 0;
1580 /* Get the header of the registry. Return a pointer to the structure
1581 * If the mmap'd area has not been allocated, then mmap the input file
1583 REGF_HDR
*nt_get_regf_hdr(REGF
*regf
)
1586 return NULL
; /* What about errors */
1588 if (!regf
->regfile_name
)
1589 return NULL
; /* What about errors */
1591 if (!regf
->base
) { /* Try to mmap etc the file */
1593 if ((regf
->fd
= open(regf
->regfile_name
, O_RDONLY
, 0000)) <0) {
1594 return NULL
; /* What about errors? */
1597 if (fstat(regf
->fd
, ®f
->sbuf
) < 0) {
1601 regf
->base
= mmap(0, regf
->sbuf
.st_size
, PROT_READ
, MAP_SHARED
, regf
->fd
, 0);
1603 if ((int)regf
->base
== 1) {
1604 fprintf(stderr
, "Could not mmap file: %s, %s\n", regf
->regfile_name
,
1611 * At this point, regf->base != NULL, and we should be able to read the
1615 assert(regf
->base
!= NULL
);
1617 return (REGF_HDR
*)regf
->base
;
1621 * Validate a regf header
1622 * For now, do nothing, but we should check the checksum
1624 int valid_regf_hdr(REGF_HDR
*regf_hdr
)
1626 if (!regf_hdr
) return 0;
1632 * Process an SK header ...
1633 * Every time we see a new one, add it to the map. Otherwise, just look it up.
1634 * We will do a simple linear search for the moment, since many KEYs have the
1635 * same security descriptor.
1636 * We allocate the map in increments of 10 entries.
1640 * Create a new entry in the map, and increase the size of the map if needed
1643 SK_MAP
*alloc_sk_map_entry(REGF
*regf
, KEY_SEC_DESC
*tmp
, int sk_off
)
1645 if (!regf
->sk_map
) { /* Allocate a block of 10 */
1646 regf
->sk_map
= (SK_MAP
*)malloc(sizeof(SK_MAP
) * 10);
1647 if (!regf
->sk_map
) {
1651 regf
->sk_map_size
= 10;
1653 (regf
->sk_map
)[0].sk_off
= sk_off
;
1654 (regf
->sk_map
)[0].key_sec_desc
= tmp
;
1656 else { /* Simply allocate a new slot, unless we have to expand the list */
1657 int ndx
= regf
->sk_count
;
1658 if (regf
->sk_count
>= regf
->sk_map_size
) {
1659 regf
->sk_map
= (SK_MAP
*)realloc(regf
->sk_map
,
1660 (regf
->sk_map_size
+ 10)*sizeof(SK_MAP
));
1661 if (!regf
->sk_map
) {
1666 * ndx already points at the first entry of the new block
1668 regf
->sk_map_size
+= 10;
1670 (regf
->sk_map
)[ndx
].sk_off
= sk_off
;
1671 (regf
->sk_map
)[ndx
].key_sec_desc
= tmp
;
1674 return regf
->sk_map
;
1678 * Search for a KEY_SEC_DESC in the sk_map, but don't create one if not
1682 KEY_SEC_DESC
*lookup_sec_key(SK_MAP
*sk_map
, int count
, int sk_off
)
1686 if (!sk_map
) return NULL
;
1688 for (i
= 0; i
< count
; i
++) {
1690 if (sk_map
[i
].sk_off
== sk_off
)
1691 return sk_map
[i
].key_sec_desc
;
1700 * Allocate a KEY_SEC_DESC if we can't find one in the map
1703 KEY_SEC_DESC
*lookup_create_sec_key(REGF
*regf
, SK_MAP
*sk_map
, int sk_off
)
1705 KEY_SEC_DESC
*tmp
= lookup_sec_key(regf
->sk_map
, regf
->sk_count
, sk_off
);
1710 else { /* Allocate a new one */
1711 tmp
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1715 tmp
->state
= SEC_DESC_RES
;
1716 if (!alloc_sk_map_entry(regf
, tmp
, sk_off
)) {
1724 * Allocate storage and duplicate a SID
1725 * We could allocate the SID to be only the size needed, but I am too lazy.
1727 DOM_SID
*dup_sid(DOM_SID
*sid
)
1729 DOM_SID
*tmp
= (DOM_SID
*)malloc(sizeof(DOM_SID
));
1732 if (!tmp
) return NULL
;
1733 tmp
->ver
= sid
->ver
;
1734 tmp
->auths
= sid
->auths
;
1735 for (i
=0; i
<6; i
++) {
1736 tmp
->auth
[i
] = sid
->auth
[i
];
1738 for (i
=0; i
<tmp
->auths
&&i
<MAXSUBAUTHS
; i
++) {
1739 tmp
->sub_auths
[i
] = sid
->sub_auths
[i
];
1745 * Allocate space for an ACE and duplicate the registry encoded one passed in
1747 ACE
*dup_ace(REG_ACE
*ace
)
1751 tmp
= (ACE
*)malloc(sizeof(ACE
));
1753 if (!tmp
) return NULL
;
1755 tmp
->type
= CVAL(&ace
->type
);
1756 tmp
->flags
= CVAL(&ace
->flags
);
1757 tmp
->perms
= IVAL(&ace
->perms
);
1758 tmp
->trustee
= dup_sid(&ace
->trustee
);
1763 * Allocate space for an ACL and duplicate the registry encoded one passed in
1765 ACL
*dup_acl(REG_ACL
*acl
)
1771 num_aces
= IVAL(&acl
->num_aces
);
1773 tmp
= (ACL
*)malloc(sizeof(ACL
) + (num_aces
- 1)*sizeof(ACE
*));
1774 if (!tmp
) return NULL
;
1776 tmp
->num_aces
= num_aces
;
1778 tmp
->rev
= SVAL(&acl
->rev
);
1779 if (verbose
) fprintf(stdout
, "ACL: refcnt: %u, rev: %u\n", tmp
->refcnt
,
1781 ace
= (REG_ACE
*)&acl
->aces
;
1782 for (i
=0; i
<num_aces
; i
++) {
1783 tmp
->aces
[i
] = dup_ace(ace
);
1784 ace
= (REG_ACE
*)((char *)ace
+ SVAL(&ace
->length
));
1785 /* XXX: FIXME, should handle malloc errors */
1791 SEC_DESC
*process_sec_desc(REGF
*regf
, REG_SEC_DESC
*sec_desc
)
1793 SEC_DESC
*tmp
= NULL
;
1795 tmp
= (SEC_DESC
*)malloc(sizeof(SEC_DESC
));
1801 tmp
->rev
= SVAL(&sec_desc
->rev
);
1802 tmp
->type
= SVAL(&sec_desc
->type
);
1803 if (verbose
) fprintf(stdout
, "SEC_DESC Rev: %0X, Type: %0X\n",
1804 tmp
->rev
, tmp
->type
);
1805 tmp
->owner
= dup_sid((DOM_SID
*)((char *)sec_desc
+ IVAL(&sec_desc
->owner_off
)));
1810 tmp
->group
= dup_sid((DOM_SID
*)((char *)sec_desc
+ IVAL(&sec_desc
->group_off
)));
1816 /* Now pick up the SACL and DACL */
1818 if (sec_desc
->sacl_off
)
1819 tmp
->sacl
= dup_acl((REG_ACL
*)((char *)sec_desc
+ IVAL(&sec_desc
->sacl_off
)));
1823 if (sec_desc
->dacl_off
)
1824 tmp
->dacl
= dup_acl((REG_ACL
*)((char *)sec_desc
+ IVAL(&sec_desc
->dacl_off
)));
1831 KEY_SEC_DESC
*process_sk(REGF
*regf
, SK_HDR
*sk_hdr
, int sk_off
, int size
)
1833 KEY_SEC_DESC
*tmp
= NULL
;
1834 int sk_next_off
, sk_prev_off
, sk_size
;
1835 REG_SEC_DESC
*sec_desc
;
1837 if (!sk_hdr
) return NULL
;
1839 if (SVAL(&sk_hdr
->SK_ID
) != REG_SK_ID
) {
1840 fprintf(stderr
, "Unrecognized SK Header ID: %08X, %s\n", (int)sk_hdr
,
1841 regf
->regfile_name
);
1845 if (-size
< (sk_size
= IVAL(&sk_hdr
->rec_size
))) {
1846 fprintf(stderr
, "Incorrect SK record size: %d vs %d. %s\n",
1847 -size
, sk_size
, regf
->regfile_name
);
1852 * Now, we need to look up the SK Record in the map, and return it
1853 * Since the map contains the SK_OFF mapped to KEY_SEC_DESC, we can
1858 ((tmp
= lookup_sec_key(regf
->sk_map
, regf
->sk_count
, sk_off
)) != NULL
)
1859 && (tmp
->state
== SEC_DESC_OCU
)) {
1864 /* Here, we have an item in the map that has been reserved, or tmp==NULL. */
1866 assert(tmp
== NULL
|| (tmp
&& tmp
->state
!= SEC_DESC_NON
));
1869 * Now, allocate a KEY_SEC_DESC, and parse the structure here, and add the
1870 * new KEY_SEC_DESC to the mapping structure, since the offset supplied is
1871 * the actual offset of structure. The same offset will be used by
1872 * all future references to this structure
1873 * We could put all this unpleasantness in a function.
1877 tmp
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1878 if (!tmp
) return NULL
;
1879 bzero(tmp
, sizeof(KEY_SEC_DESC
));
1882 * Allocate an entry in the SK_MAP ...
1883 * We don't need to free tmp, because that is done for us if the
1884 * sm_map entry can't be expanded when we need more space in the map.
1887 if (!alloc_sk_map_entry(regf
, tmp
, sk_off
)) {
1893 tmp
->state
= SEC_DESC_OCU
;
1896 * Now, process the actual sec desc and plug the values in
1899 sec_desc
= (REG_SEC_DESC
*)&sk_hdr
->sec_desc
[0];
1900 tmp
->sec_desc
= process_sec_desc(regf
, sec_desc
);
1903 * Now forward and back links. Here we allocate an entry in the sk_map
1904 * if it does not exist, and mark it reserved
1907 sk_prev_off
= IVAL(&sk_hdr
->prev_off
);
1908 tmp
->prev
= lookup_create_sec_key(regf
, regf
->sk_map
, sk_prev_off
);
1909 assert(tmp
->prev
!= NULL
);
1910 sk_next_off
= IVAL(&sk_hdr
->next_off
);
1911 tmp
->next
= lookup_create_sec_key(regf
, regf
->sk_map
, sk_next_off
);
1912 assert(tmp
->next
!= NULL
);
1918 * Process a VK header and return a value
1920 VAL_KEY
*process_vk(REGF
*regf
, VK_HDR
*vk_hdr
, int size
)
1922 char val_name
[1024];
1923 int nam_len
, dat_len
, flag
, dat_type
, dat_off
, vk_id
;
1924 const char *val_type
;
1925 VAL_KEY
*tmp
= NULL
;
1927 if (!vk_hdr
) return NULL
;
1929 if ((vk_id
= SVAL(&vk_hdr
->VK_ID
)) != REG_VK_ID
) {
1930 fprintf(stderr
, "Unrecognized VK header ID: %0X, block: %0X, %s\n",
1931 vk_id
, (int)vk_hdr
, regf
->regfile_name
);
1935 nam_len
= SVAL(&vk_hdr
->nam_len
);
1936 val_name
[nam_len
] = '\0';
1937 flag
= SVAL(&vk_hdr
->flag
);
1938 dat_type
= IVAL(&vk_hdr
->dat_type
);
1939 dat_len
= IVAL(&vk_hdr
->dat_len
); /* If top bit, offset contains data */
1940 dat_off
= IVAL(&vk_hdr
->dat_off
);
1942 tmp
= (VAL_KEY
*)malloc(sizeof(VAL_KEY
));
1946 bzero(tmp
, sizeof(VAL_KEY
));
1947 tmp
->has_name
= flag
;
1948 tmp
->data_type
= dat_type
;
1951 strncpy(val_name
, vk_hdr
->dat_name
, nam_len
);
1952 tmp
->name
= strdup(val_name
);
1958 strncpy(val_name
, "<No Name>", 10);
1961 * Allocate space and copy the data as a BLOB
1966 char *dtmp
= (char *)malloc(dat_len
&0x7FFFFFFF);
1972 tmp
->data_blk
= dtmp
;
1974 if ((dat_len
&0x80000000) == 0) { /* The data is pointed to by the offset */
1975 char *dat_ptr
= LOCN(regf
->base
, dat_off
);
1976 bcopy(dat_ptr
, dtmp
, dat_len
);
1978 else { /* The data is in the offset */
1979 dat_len
= dat_len
& 0x7FFFFFFF;
1980 bcopy(&dat_off
, dtmp
, dat_len
);
1983 tmp
->data_len
= dat_len
;
1986 val_type
= val_to_str(dat_type
, reg_type_names
);
1989 * We need to save the data area as well
1992 if (verbose
) fprintf(stdout
, " %s : %s : \n", val_name
, val_type
);
1997 if (tmp
) nt_delete_val_key(tmp
);
2003 * Process a VL Header and return a list of values
2005 VAL_LIST
*process_vl(REGF
*regf
, VL_TYPE vl
, int count
, int size
)
2009 VAL_LIST
*tmp
= NULL
;
2011 if (!vl
) return NULL
;
2013 if (-size
< (count
+1)*sizeof(int)){
2014 fprintf(stderr
, "Error in VL header format. Size less than space required. %d\n", -size
);
2018 tmp
= (VAL_LIST
*)malloc(sizeof(VAL_LIST
) + (count
- 1) * sizeof(VAL_KEY
*));
2023 for (i
=0; i
<count
; i
++) {
2024 vk_off
= IVAL(&vl
[i
]);
2025 vk_hdr
= (VK_HDR
*)LOCN(regf
->base
, vk_off
);
2026 tmp
->vals
[i
] = process_vk(regf
, vk_hdr
, BLK_SIZE(vk_hdr
));
2032 tmp
->val_count
= count
;
2033 tmp
->max_vals
= count
;
2038 /* XXX: FIXME, free the partially allocated structure */
2043 * Process an LF Header and return a list of sub-keys
2045 KEY_LIST
*process_lf(REGF
*regf
, LF_HDR
*lf_hdr
, int size
, REG_KEY
*parent
)
2047 int count
, i
, nk_off
;
2051 if (!lf_hdr
) return NULL
;
2053 if ((lf_id
= SVAL(&lf_hdr
->LF_ID
)) != REG_LF_ID
) {
2054 fprintf(stderr
, "Unrecognized LF Header format: %0X, Block: %0X, %s.\n",
2055 lf_id
, (int)lf_hdr
, regf
->regfile_name
);
2061 count
= SVAL(&lf_hdr
->key_count
);
2062 if (verbose
) fprintf(stdout
, "Key Count: %u\n", count
);
2063 if (count
<= 0) return NULL
;
2065 /* Now, we should allocate a KEY_LIST struct and fill it in ... */
2067 tmp
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (count
- 1) * sizeof(REG_KEY
*));
2072 tmp
->key_count
= count
;
2073 tmp
->max_keys
= count
;
2075 for (i
=0; i
<count
; i
++) {
2078 nk_off
= IVAL(&lf_hdr
->hr
[i
].nk_off
);
2079 if (verbose
) fprintf(stdout
, "NK Offset: %0X\n", nk_off
);
2080 nk_hdr
= (NK_HDR
*)LOCN(regf
->base
, nk_off
);
2081 tmp
->keys
[i
] = nt_get_key_tree(regf
, nk_hdr
, BLK_SIZE(nk_hdr
), parent
);
2082 if (!tmp
->keys
[i
]) {
2090 if (tmp
) nt_delete_key_list(tmp
, False
);
2095 * This routine is passed an NK_HDR pointer and retrieves the entire tree
2096 * from there down. It returns a REG_KEY *.
2098 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
, REG_KEY
*parent
)
2100 REG_KEY
*tmp
= NULL
, *own
;
2101 int name_len
, clsname_len
, lf_off
, val_off
, val_count
, sk_off
, own_off
;
2106 char key_name
[1024], cls_name
[1024];
2108 if (!nk_hdr
) return NULL
;
2110 if ((nk_id
= SVAL(&nk_hdr
->NK_ID
)) != REG_NK_ID
) {
2111 fprintf(stderr
, "Unrecognized NK Header format: %08X, Block: %0X. %s\n",
2112 nk_id
, (int)nk_hdr
, regf
->regfile_name
);
2118 name_len
= SVAL(&nk_hdr
->nam_len
);
2119 clsname_len
= SVAL(&nk_hdr
->clsnam_len
);
2122 * The value of -size should be ge
2123 * (sizeof(NK_HDR) - 1 + name_len)
2124 * The -1 accounts for the fact that we included the first byte of
2125 * the name in the structure. clsname_len is the length of the thing
2126 * pointed to by clsnam_off
2129 if (-size
< (sizeof(NK_HDR
) - 1 + name_len
)) {
2130 fprintf(stderr
, "Incorrect NK_HDR size: %d, %0X\n", -size
, (int)nk_hdr
);
2131 fprintf(stderr
, "Sizeof NK_HDR: %d, name_len %d, clsname_len %d\n",
2132 sizeof(NK_HDR
), name_len
, clsname_len
);
2136 if (verbose
) fprintf(stdout
, "NK HDR: Name len: %d, class name len: %d\n",
2137 name_len
, clsname_len
);
2139 /* Fish out the key name and process the LF list */
2141 assert(name_len
< sizeof(key_name
));
2143 /* Allocate the key struct now */
2144 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
2145 if (!tmp
) return tmp
;
2146 bzero(tmp
, sizeof(REG_KEY
));
2148 tmp
->type
= (SVAL(&nk_hdr
->type
)==0x2C?REG_ROOT_KEY
:REG_SUB_KEY
);
2150 strncpy(key_name
, nk_hdr
->key_nam
, name_len
);
2151 key_name
[name_len
] = '\0';
2153 if (verbose
) fprintf(stdout
, "Key name: %s\n", key_name
);
2155 tmp
->name
= strdup(key_name
);
2161 * Fish out the class name, it is in UNICODE, while the key name is
2165 if (clsname_len
) { /* Just print in Ascii for now */
2169 clsnam_off
= IVAL(&nk_hdr
->clsnam_off
);
2170 clsnamep
= LOCN(regf
->base
, clsnam_off
);
2171 if (verbose
) fprintf(stdout
, "Class Name Offset: %0X\n", clsnam_off
);
2173 bzero(cls_name
, clsname_len
);
2174 uni_to_ascii(clsnamep
, cls_name
, sizeof(cls_name
), clsname_len
);
2177 * I am keeping class name as an ascii string for the moment.
2178 * That means it needs to be converted on output.
2179 * It will also piss off people who need Unicode/UTF-8 strings. Sorry.
2183 tmp
->class_name
= strdup(cls_name
);
2184 if (!tmp
->class_name
) {
2188 if (verbose
) fprintf(stdout
, " Class Name: %s\n", cls_name
);
2193 * Process the owner offset ...
2196 own_off
= IVAL(&nk_hdr
->own_off
);
2197 own
= (REG_KEY
*)LOCN(regf
->base
, own_off
);
2198 if (verbose
) fprintf(stdout
, "Owner Offset: %0X\n", own_off
);
2200 if (verbose
) fprintf(stdout
, " Owner locn: %0X, Our locn: %0X\n",
2201 (unsigned int)own
, (unsigned int)nk_hdr
);
2204 * We should verify that the owner field is correct ...
2205 * for now, we don't worry ...
2208 tmp
->owner
= parent
;
2211 * If there are any values, process them here
2214 val_count
= IVAL(&nk_hdr
->val_cnt
);
2215 if (verbose
) fprintf(stdout
, "Val Count: %d\n", val_count
);
2218 val_off
= IVAL(&nk_hdr
->val_off
);
2219 vl
= (VL_TYPE
*)LOCN(regf
->base
, val_off
);
2220 if (verbose
) fprintf(stdout
, "Val List Offset: %0X\n", val_off
);
2222 tmp
->values
= process_vl(regf
, *vl
, val_count
, BLK_SIZE(vl
));
2230 * Also handle the SK header ...
2233 sk_off
= IVAL(&nk_hdr
->sk_off
);
2234 sk_hdr
= (SK_HDR
*)LOCN(regf
->base
, sk_off
);
2235 if (verbose
) fprintf(stdout
, "SK Offset: %0X\n", sk_off
);
2239 tmp
->security
= process_sk(regf
, sk_hdr
, sk_off
, BLK_SIZE(sk_hdr
));
2243 lf_off
= IVAL(&nk_hdr
->lf_off
);
2244 if (verbose
) fprintf(stdout
, "SubKey list offset: %0X\n", lf_off
);
2247 * No more subkeys if lf_off == -1
2252 lf_hdr
= (LF_HDR
*)LOCN(regf
->base
, lf_off
);
2254 tmp
->sub_keys
= process_lf(regf
, lf_hdr
, BLK_SIZE(lf_hdr
), tmp
);
2255 if (!tmp
->sub_keys
){
2264 if (tmp
) nt_delete_reg_key(tmp
, False
);
2268 int nt_load_registry(REGF
*regf
)
2271 unsigned int regf_id
, hbin_id
;
2275 /* Get the header */
2277 if ((regf_hdr
= nt_get_regf_hdr(regf
)) == NULL
) {
2281 /* Now process that header and start to read the rest in */
2283 if ((regf_id
= IVAL(®f_hdr
->REGF_ID
)) != REG_REGF_ID
) {
2284 fprintf(stderr
, "Unrecognized NT registry header id: %0X, %s\n",
2285 regf_id
, regf
->regfile_name
);
2290 * Validate the header ...
2292 if (!valid_regf_hdr(regf_hdr
)) {
2293 fprintf(stderr
, "Registry file header does not validate: %s\n",
2294 regf
->regfile_name
);
2298 /* Update the last mod date, and then go get the first NK record and on */
2300 TTTONTTIME(regf
, IVAL(®f_hdr
->tim1
), IVAL(®f_hdr
->tim2
));
2303 * The hbin hdr seems to be just uninteresting garbage. Check that
2304 * it is there, but that is all.
2307 hbin_hdr
= (HBIN_HDR
*)(regf
->base
+ REGF_HDR_BLKSIZ
);
2309 if ((hbin_id
= IVAL(&hbin_hdr
->HBIN_ID
)) != REG_HBIN_ID
) {
2310 fprintf(stderr
, "Unrecognized registry hbin hdr ID: %0X, %s\n",
2311 hbin_id
, regf
->regfile_name
);
2316 * Get a pointer to the first key from the hreg_hdr
2319 if (verbose
) fprintf(stdout
, "First Key: %0X\n",
2320 IVAL(®f_hdr
->first_key
));
2322 first_key
= (NK_HDR
*)LOCN(regf
->base
, IVAL(®f_hdr
->first_key
));
2323 if (verbose
) fprintf(stdout
, "First Key Offset: %0X\n",
2324 IVAL(®f_hdr
->first_key
));
2326 if (verbose
) fprintf(stdout
, "Data Block Size: %d\n",
2327 IVAL(®f_hdr
->dblk_size
));
2329 if (verbose
) fprintf(stdout
, "Offset to next hbin block: %0X\n",
2330 IVAL(&hbin_hdr
->next_off
));
2332 if (verbose
) fprintf(stdout
, "HBIN block size: %0X\n",
2333 IVAL(&hbin_hdr
->blk_size
));
2336 * Now, get the registry tree by processing that NK recursively
2339 regf
->root
= nt_get_key_tree(regf
, first_key
, BLK_SIZE(first_key
), NULL
);
2341 assert(regf
->root
!= NULL
);
2344 * Unmap the registry file, as we might want to read in another
2348 if (regf
->base
) munmap(regf
->base
, regf
->sbuf
.st_size
);
2350 close(regf
->fd
); /* Ignore the error :-) */
2356 * Store the registry in the output file
2357 * We write out the header and then each of the keys etc into the file
2358 * We have to flatten the data structure ...
2360 * The structures are stored in a breadth-first fashion, with all records
2361 * aligned on 8-byte boundaries, with sub-keys and values layed down before
2362 * the lists that contain them. SK records are layed down first, however.
2364 int nt_store_registry(REGF
*regf
)
2371 * Routines to parse a REGEDIT4 file
2373 * The file consists of:
2380 * [cmd:]name=type:value
2382 * cmd = a|d|c|add|delete|change|as|ds|cs
2384 * There can be more than one key-path and value-spec.
2386 * Since we want to support more than one type of file format, we
2387 * construct a command-file structure that keeps info about the command file
2390 #define FMT_UNREC -1
2391 #define FMT_REGEDIT4 0
2392 #define FMT_EDITREG1_1 1
2394 #define FMT_STRING_REGEDIT4 "REGEDIT4"
2395 #define FMT_STRING_EDITREG1_0 "EDITREG1.0"
2398 #define CMD_ADD_KEY 1
2399 #define CMD_DEL_KEY 2
2404 typedef struct val_spec_list
{
2405 struct val_spec_list
*next
;
2408 char *val
; /* Kept as a char string, really? */
2411 typedef struct command_s
{
2415 VAL_SPEC_LIST
*val_spec_list
, *val_spec_last
;
2418 typedef struct cmd_line
{
2423 void free_val_spec_list(VAL_SPEC_LIST
*vl
)
2426 if (vl
->name
) free(vl
->name
);
2427 if (vl
->val
) free(vl
->val
);
2433 * Some routines to handle lines of info in the command files
2435 void skip_to_eol(int fd
)
2440 while ((rc
= read(fd
, &ch
, 1)) == 1) {
2441 if (ch
== 0x0A) return;
2444 fprintf(stderr
, "Could not read file descriptor: %d, %s\n",
2445 fd
, strerror(errno
));
2450 void free_cmd(CMD
*cmd
)
2454 while (cmd
->val_spec_list
) {
2457 tmp
= cmd
->val_spec_list
;
2458 cmd
->val_spec_list
= tmp
->next
;
2466 void free_cmd_line(CMD_LINE
*cmd_line
)
2469 if (cmd_line
->line
) free(cmd_line
->line
);
2474 void print_line(struct cmd_line
*cl
)
2480 if ((pl
= malloc(cl
->line_len
+ 1)) == NULL
) {
2481 fprintf(stderr
, "Unable to allocate space to print line: %s\n",
2486 strncpy(pl
, cl
->line
, cl
->line_len
);
2487 pl
[cl
->line_len
] = 0;
2489 fprintf(stdout
, "%s\n", pl
);
2493 #define INIT_ALLOC 10
2496 * Read a line from the input file.
2497 * NULL returned when EOF and no chars read
2498 * Otherwise we return a cmd_line *
2499 * Exit if other errors
2501 struct cmd_line
*get_cmd_line(int fd
)
2503 struct cmd_line
*cl
= (CMD_LINE
*)malloc(sizeof(CMD_LINE
));
2508 fprintf(stderr
, "Unable to allocate structure for command line: %s\n",
2513 cl
->len
= INIT_ALLOC
;
2516 * Allocate some space for the line. We extend later if needed.
2519 if ((cl
->line
= (char *)malloc(INIT_ALLOC
)) == NULL
) {
2520 fprintf(stderr
, "Unable to allocate initial space for line: %s\n",
2526 * Now read in the chars to EOL. Don't store the EOL in the
2527 * line. What about CR?
2530 while ((rc
= read(fd
, &ch
, 1)) == 1 && ch
!= '\n') {
2531 if (ch
== '\r') continue; /* skip CR */
2534 * Allocate some more memory
2536 if ((cl
->line
= realloc(cl
->line
, cl
->len
+ INIT_ALLOC
)) == NULL
) {
2537 fprintf(stderr
, "Unable to realloc space for line: %s\n",
2541 cl
->len
+= INIT_ALLOC
;
2547 /* read 0 and we were at loc'n 0, return NULL */
2548 if (rc
== 0 && i
== 0) {
2560 * parse_value: parse out a value. We pull it apart as:
2562 * <value> ::= <value-name>=<type>:<value-string>
2564 * <value-name> ::= char-string-without-spaces | '"' char-string '"'
2566 * If it parsed OK, return the <value-name> as a string, and the
2567 * value type and value-string in parameters.
2569 * The value name can be empty. There can only be one empty name in
2570 * a list of values. A value of - removes the value entirely.
2573 char *dup_str(char *s
, int len
)
2576 nstr
= (char *)malloc(len
+ 1);
2578 memcpy(nstr
, s
, len
);
2584 char *parse_name(char *nstr
)
2586 int len
= 0, start
= 0;
2587 if (!nstr
) return NULL
;
2591 while (len
&& nstr
[len
- 1] == ' ') len
--;
2593 nstr
[len
] = 0; /* Trim any spaces ... if there were none, doesn't matter */
2596 * Beginning and end should be '"' or neither should be so
2598 if ((nstr
[0] == '"' && nstr
[len
- 1] != '"') ||
2599 (nstr
[0] != '"' && nstr
[len
- 1] == '"'))
2602 if (nstr
[0] == '"') {
2607 return dup_str(&nstr
[start
], len
);
2610 int parse_value_type(char *tstr
)
2612 int len
= strlen(tstr
);
2614 while (len
&& tstr
[len
- 1] == ' ') len
--;
2617 if (strcmp(tstr
, "REG_DWORD") == 0)
2618 return REG_TYPE_DWORD
;
2619 else if (strcmp(tstr
, "dword") == 0)
2620 return REG_TYPE_DWORD
;
2621 else if (strcmp(tstr
, "REG_EXPAND_SZ") == 0)
2622 return REG_TYPE_EXPANDSZ
;
2623 else if (strcmp(tstr
, "REG_BIN") == 0)
2624 return REG_TYPE_BIN
;
2625 else if (strcmp(tstr
, "REG_SZ") == 0)
2626 return REG_TYPE_REGSZ
;
2627 else if (strcmp(tstr
, "REG_MULTI_SZ") == 0)
2628 return REG_TYPE_MULTISZ
;
2629 else if (strcmp(tstr
, "-") == 0)
2630 return REG_TYPE_DELETE
;
2635 char *parse_val_str(char *vstr
)
2638 return dup_str(vstr
, strlen(vstr
));
2642 char *parse_value(struct cmd_line
*cl
, int *vtype
, char **val
)
2644 char *p1
= NULL
, *p2
= NULL
, *nstr
= NULL
, *tstr
= NULL
, *vstr
= NULL
;
2646 if (!cl
|| !vtype
|| !val
) return NULL
;
2647 if (!cl
->line_len
) return NULL
;
2649 p1
= dup_str(cl
->line
, cl
->line_len
);
2650 /* FIXME: Better return codes etc ... */
2651 if (!p1
) return NULL
;
2652 p2
= strchr(p1
, '=');
2653 if (!p2
) return NULL
;
2655 *p2
= 0; p2
++; /* Split into two strings at p2 */
2657 /* Now, parse the name ... */
2659 nstr
= parse_name(p1
);
2660 if (!nstr
) goto error
;
2662 /* Now, split the remainder and parse on type and val ... */
2665 while (*tstr
== ' ') tstr
++; /* Skip leading white space */
2666 p2
= strchr(p2
, ':');
2669 *p2
= 0; p2
++; /* split on the : */
2672 *vtype
= parse_value_type(tstr
);
2674 if (!vtype
) goto error
;
2676 if (!p2
|| !*p2
) return nstr
;
2678 /* Now, parse the value string. It should return a newly malloc'd string */
2680 while (*p2
== ' ') p2
++; /* Skip leading space */
2681 vstr
= parse_val_str(p2
);
2683 if (!vstr
) goto error
;
2691 if (nstr
) free(nstr
);
2692 if (vstr
) free(vstr
);
2697 * Parse out a key. Look for a correctly formatted key [...]
2698 * and whether it is a delete or add? A delete is signalled
2699 * by a - in front of the key.
2700 * Assumes that there are no leading and trailing spaces
2703 char *parse_key(struct cmd_line
*cl
, int *cmd
)
2708 if (cl
->line
[0] != '[' ||
2709 cl
->line
[cl
->line_len
- 1] != ']') return NULL
;
2710 if (cl
->line_len
== 2) return NULL
;
2712 if (cl
->line
[1] == '-') {
2713 if (cl
->line_len
== 3) return NULL
;
2717 tmp
= malloc(cl
->line_len
- 1 - start
+ 1);
2718 if (!tmp
) return tmp
; /* Bail out on no mem ... FIXME */
2719 strncpy(tmp
, &cl
->line
[start
], cl
->line_len
- 1 - start
);
2720 tmp
[cl
->line_len
- 1 - start
] = 0;
2725 * Parse a line to determine if we have a key or a value
2726 * We only check for key or val ...
2729 int parse_line(struct cmd_line
*cl
)
2732 if (!cl
|| cl
->len
== 0) return 0;
2734 if (cl
->line
[0] == '[') /* No further checking for now */
2741 * We seek to offset 0, read in the required number of bytes,
2742 * and compare to the correct value.
2743 * We then seek back to the original location
2745 int regedit4_file_type(int fd
)
2750 cur_ofs
= lseek(fd
, 0, SEEK_CUR
); /* Get current offset */
2752 fprintf(stderr
, "Unable to get current offset: %s\n", strerror(errno
));
2753 exit(1); /* FIXME */
2757 lseek(fd
, 0, SEEK_SET
);
2760 if (read(fd
, desc
, 8) < 8) {
2761 fprintf(stderr
, "Unable to read command file format\n");
2762 exit(2); /* FIXME */
2767 if (strcmp(desc
, FMT_STRING_REGEDIT4
) == 0) {
2769 lseek(fd
, cur_ofs
, SEEK_SET
);
2774 return FMT_REGEDIT4
;
2781 * Run though the data in the line and strip anything after a comment
2784 void strip_comment(struct cmd_line
*cl
)
2790 for (i
= 0; i
< cl
->line_len
; i
++) {
2791 if (cl
->line
[i
] == ';') {
2799 * trim leading space
2802 void trim_leading_spaces(struct cmd_line
*cl
)
2808 for (i
= 0; i
< cl
->line_len
; i
++) {
2809 if (cl
->line
[i
] != ' '){
2810 if (i
) memcpy(cl
->line
, &cl
->line
[i
], cl
->line_len
- i
);
2817 * trim trailing spaces
2819 void trim_trailing_spaces(struct cmd_line
*cl
)
2825 for (i
= cl
->line_len
; i
== 0; i
--) {
2826 if (cl
->line
[i
-1] != ' ' &&
2827 cl
->line
[i
-1] != '\t') {
2834 * Get a command ... This consists of possibly multiple lines:
2837 * possibly Empty line
2839 * value ::= <value-name>=<value-type>':'<value-string>
2840 * <value-name> is some path, possibly enclosed in quotes ...
2841 * We alctually look for the next key to terminate a previous key
2842 * if <value-type> == '-', then it is a delete type.
2844 CMD
*regedit4_get_cmd(int fd
)
2846 struct command_s
*cmd
= NULL
;
2847 struct cmd_line
*cl
= NULL
;
2848 struct val_spec_list
*vl
= NULL
;
2850 if ((cmd
= (struct command_s
*)malloc(sizeof(struct command_s
))) == NULL
) {
2851 fprintf(stderr
, "Unable to malloc space for command: %s\n",
2856 cmd
->cmd
= CMD_NONE
;
2859 cmd
->val_spec_list
= cmd
->val_spec_last
= NULL
;
2860 while ((cl
= get_cmd_line(fd
))) {
2863 * If it is an empty command line, and we already have a key
2864 * then exit from here ... FIXME: Clean up the parser
2867 if (cl
->line_len
== 0 && cmd
->key
) {
2872 strip_comment(cl
); /* remove anything beyond a comment char */
2873 trim_trailing_spaces(cl
);
2874 trim_leading_spaces(cl
);
2876 if (cl
->line_len
== 0) { /* An empty line */
2879 else { /* Else, non-empty ... */
2881 * Parse out the bits ...
2883 switch (parse_line(cl
)) {
2885 if ((cmd
->key
= parse_key(cl
, &cmd
->cmd
)) == NULL
) {
2886 fprintf(stderr
, "Error parsing key from line: ");
2888 fprintf(stderr
, "\n");
2894 * We need to add the value stuff to the list
2895 * There could be a \ on the end which we need to
2896 * handle at some time
2898 vl
= (struct val_spec_list
*)malloc(sizeof(struct val_spec_list
));
2899 if (!vl
) goto error
;
2902 vl
->name
= parse_value(cl
, &vl
->type
, &vl
->val
);
2903 if (!vl
->name
) goto error
;
2904 if (cmd
->val_spec_list
== NULL
) {
2905 cmd
->val_spec_list
= cmd
->val_spec_last
= vl
;
2908 cmd
->val_spec_last
->next
= vl
;
2909 cmd
->val_spec_last
= vl
;
2915 fprintf(stderr
, "Unrecognized line in command file: \n");
2922 if (!cmd
->cmd
) goto error
; /* End of file ... */
2928 if (cmd
) free_cmd(cmd
);
2932 int regedit4_exec_cmd(CMD
*cmd
)
2938 int editreg_1_0_file_type(int fd
)
2943 cur_ofs
= lseek(fd
, 0, SEEK_CUR
); /* Get current offset */
2945 fprintf(stderr
, "Unable to get current offset: %s\n", strerror(errno
));
2946 exit(1); /* FIXME */
2950 lseek(fd
, 0, SEEK_SET
);
2953 if (read(fd
, desc
, 10) < 10) {
2954 fprintf(stderr
, "Unable to read command file format\n");
2955 exit(2); /* FIXME */
2960 if (strcmp(desc
, FMT_STRING_EDITREG1_0
) == 0) {
2961 lseek(fd
, cur_ofs
, SEEK_SET
);
2962 return FMT_REGEDIT4
;
2968 CMD
*editreg_1_0_get_cmd(int fd
)
2973 int editreg_1_0_exec_cmd(CMD
*cmd
)
2979 typedef struct command_ops_s
{
2981 int (*file_type
)(int fd
);
2982 CMD
*(*get_cmd
)(int fd
);
2983 int (*exec_cmd
)(CMD
*cmd
);
2986 CMD_OPS default_cmd_ops
[] = {
2987 {0, regedit4_file_type
, regedit4_get_cmd
, regedit4_exec_cmd
},
2988 {1, editreg_1_0_file_type
, editreg_1_0_get_cmd
, editreg_1_0_exec_cmd
},
2989 {-1, NULL
, NULL
, NULL
}
2992 typedef struct command_file_s
{
2999 * Create a new command file structure
3002 CMD_FILE
*cmd_file_create(char *file
)
3009 * Let's check if the file exists ...
3010 * No use creating the cmd_file structure if the file does not exist
3013 if (stat(file
, &sbuf
) < 0) { /* Not able to access file */
3018 tmp
= (CMD_FILE
*)malloc(sizeof(CMD_FILE
));
3024 * Let's fill in some of the fields;
3027 tmp
->name
= strdup(file
);
3029 if ((tmp
->fd
= open(file
, O_RDONLY
, 666)) < 0) {
3035 * Now, try to find the format by indexing through the table
3037 while (default_cmd_ops
[i
].type
!= -1) {
3038 if ((tmp
->type
= default_cmd_ops
[i
].file_type(tmp
->fd
)) >= 0) {
3039 tmp
->cmd_ops
= default_cmd_ops
[i
];
3046 * If we got here, return NULL, as we could not figure out the type
3049 * What about errors?
3057 * Extract commands from the command file, and execute them.
3058 * We pass a table of command callbacks for that
3062 * Main code from here on ...
3066 * key print function here ...
3069 int print_key(const char *path
, char *name
, char *class_name
, int root
,
3070 int terminal
, int vals
)
3073 if (full_print
|| terminal
) fprintf(stdout
, "[%s%s]\n", path
, name
);
3079 * Sec Desc print functions
3082 void print_type(unsigned char type
)
3086 fprintf(stdout
, " ALLOW");
3089 fprintf(stdout
, " DENY");
3092 fprintf(stdout
, " AUDIT");
3095 fprintf(stdout
, " ALARM");
3098 fprintf(stdout
, "ALLOW CPD");
3101 fprintf(stdout
, "OBJ ALLOW");
3104 fprintf(stdout
, " OBJ DENY");
3106 fprintf(stdout
, " UNKNOWN");
3111 void print_flags(unsigned char flags
)
3113 char flg_output
[21];
3118 fprintf(stdout
, " ");
3122 if (some
) strcat(flg_output
, ",");
3124 strcat(flg_output
, "OI");
3127 if (some
) strcat(flg_output
, ",");
3129 strcat(flg_output
, "CI");
3132 if (some
) strcat(flg_output
, ",");
3134 strcat(flg_output
, "NP");
3137 if (some
) strcat(flg_output
, ",");
3139 strcat(flg_output
, "IO");
3142 if (some
) strcat(flg_output
, ",");
3144 strcat(flg_output
, "IA");
3147 if (some
) strcat(flg_output
, ",");
3149 strcat(flg_output
, "VI");
3151 fprintf(stdout
, " %s", flg_output
);
3154 void print_perms(int perms
)
3156 fprintf(stdout
, " %8X", perms
);
3159 void print_sid(DOM_SID
*sid
)
3161 int i
, comps
= sid
->auths
;
3162 fprintf(stdout
, "S-%u-%u", sid
->ver
, sid
->auth
[5]);
3164 for (i
= 0; i
< comps
; i
++) {
3166 fprintf(stdout
, "-%u", sid
->sub_auths
[i
]);
3169 fprintf(stdout
, "\n");
3172 void print_acl(ACL
*acl
, char *prefix
)
3176 for (i
= 0; i
< acl
->num_aces
; i
++) {
3177 fprintf(stdout
, ";;%s", prefix
);
3178 print_type(acl
->aces
[i
]->type
);
3179 print_flags(acl
->aces
[i
]->flags
);
3180 print_perms(acl
->aces
[i
]->perms
);
3181 fprintf(stdout
, " ");
3182 print_sid(acl
->aces
[i
]->trustee
);
3186 int print_sec(SEC_DESC
*sec_desc
)
3188 if (!print_security
) return 1;
3189 fprintf(stdout
, ";; SECURITY\n");
3190 fprintf(stdout
, ";; Owner: ");
3191 print_sid(sec_desc
->owner
);
3192 fprintf(stdout
, ";; Group: ");
3193 print_sid(sec_desc
->group
);
3194 if (sec_desc
->sacl
) {
3195 fprintf(stdout
, ";; SACL:\n");
3196 print_acl(sec_desc
->sacl
, " ");
3198 if (sec_desc
->dacl
) {
3199 fprintf(stdout
, ";; DACL:\n");
3200 print_acl(sec_desc
->dacl
, " ");
3206 * Value print function here ...
3208 int print_val(const char *path
, char *val_name
, int val_type
, int data_len
,
3209 void *data_blk
, int terminal
, int first
, int last
)
3211 char data_asc
[1024];
3213 bzero(data_asc
, sizeof(data_asc
));
3214 if (!terminal
&& first
)
3215 fprintf(stdout
, "%s\n", path
);
3216 data_to_ascii((unsigned char *)data_blk
, data_len
, val_type
, data_asc
,
3217 sizeof(data_asc
) - 1);
3218 fprintf(stdout
, " %s = %s : %s\n", (val_name
?val_name
:"<No Name>"),
3219 val_to_str(val_type
, reg_type_names
), data_asc
);
3225 fprintf(stderr
, "Usage: editreg [-f] [-v] [-p] [-k] [-s] [-c <command-file>] <registryfile>\n");
3226 fprintf(stderr
, "Version: 0.1\n\n");
3227 fprintf(stderr
, "\n\t-v\t sets verbose mode");
3228 fprintf(stderr
, "\n\t-f\t sets full print mode where non-terminals are printed");
3229 fprintf(stderr
, "\n\t-p\t prints the registry");
3230 fprintf(stderr
, "\n\t-s\t prints security descriptors");
3231 fprintf(stderr
, "\n\t-c <command-file>\t specifies a command file");
3232 fprintf(stderr
, "\n");
3235 int main(int argc
, char *argv
[])
3238 extern char *optarg
;
3240 int opt
, print_keys
= 0;
3241 int regf_opt
= 1; /* Command name */
3243 char *cmd_file_name
= NULL
;
3244 char *out_file_name
= NULL
;
3245 CMD_FILE
*cmd_file
= NULL
;
3253 * Now, process the arguments
3256 while ((opt
= getopt(argc
, argv
, "fspvko:c:")) != EOF
) {
3260 cmd_file_name
= optarg
;
3270 out_file_name
= optarg
;
3301 if ((regf
= nt_create_regf()) == NULL
) {
3302 fprintf(stderr
, "Could not create registry object: %s\n", strerror(errno
));
3306 if (regf_opt
< argc
) { /* We have a registry file */
3307 if (!nt_set_regf_input_file(regf
, argv
[regf_opt
])) {
3308 fprintf(stderr
, "Could not set name of registry file: %s, %s\n",
3309 argv
[regf_opt
], strerror(errno
));
3313 /* Now, open it, and bring it into memory :-) */
3315 if (nt_load_registry(regf
) < 0) {
3316 fprintf(stderr
, "Could not load registry: %s\n", argv
[1]);
3321 if (out_file_name
) {
3322 if (!nt_set_regf_output_file(regf
, out_file_name
)) {
3323 fprintf(stderr
, "Could not set name of output registry file: %s, %s\n",
3324 out_file_name
, strerror(errno
));
3333 cmd_file
= cmd_file_create(cmd_file_name
);
3335 while ((cmd
= cmd_file
->cmd_ops
.get_cmd(cmd_file
->fd
)) != NULL
) {
3338 * Now, apply the requests to the tree ...
3342 REG_KEY
*tmp
= NULL
;
3344 tmp
= nt_find_key_by_name(regf
->root
, cmd
->key
);
3346 /* If we found it, apply the other bits, else create such a key */
3349 tmp
= nt_add_reg_key(regf
, cmd
->key
, True
);
3355 while (cmd
->val_count
) {
3356 VAL_SPEC_LIST
*val
= cmd
->val_spec_list
;
3357 VAL_KEY
*reg_val
= NULL
;
3359 if (val
->type
== REG_TYPE_DELETE
) {
3360 reg_val
= nt_delete_reg_value(tmp
, val
-> name
);
3361 if (reg_val
) nt_delete_val_key(reg_val
);
3364 reg_val
= nt_add_reg_value(tmp
, val
->name
, val
->type
,
3368 cmd
->val_spec_list
= val
->next
;
3369 free_val_spec_list(val
);
3378 * Any value does not matter ...
3379 * Find the key if it exists, and delete it ...
3382 nt_delete_key_by_name(regf
, cmd
->key
);
3390 * At this point, we should have a registry in memory and should be able
3391 * to iterate over it.
3395 nt_key_iterator(regf
, regf
->root
, 0, "", print_key
, print_sec
, print_val
);