2 Samba Unix/Linux SMB client utility editreg.c
3 Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program; if not, write to the Free Software
17 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19 /*************************************************************************
21 A utility to edit a Windows NT/2K etc registry file.
23 Many of the ideas in here come from other people and software.
24 I first looked in Wine in misc/registry.c and was also influenced by
25 http://www.wednesday.demon.co.uk/dosreg.html
27 Which seems to contain comments from someone else. I reproduce them here
28 incase the site above disappears. It actually comes from
29 http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
31 The goal here is to read the registry into memory, manipulate it, and then
32 write it out if it was changed by any actions of the user.
34 The windows NT registry has 2 different blocks, where one can occur many
40 "regf" is obviosly the abbreviation for "Registry file". "regf" is the
41 signature of the header-block which is always 4kb in size, although only
42 the first 64 bytes seem to be used and a checksum is calculated over
43 the first 0x200 bytes only!
46 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572
47 0x00000004 D-Word ???? //see struct REGF
48 0x00000008 D-Word ???? Always the same value as at 0x00000004
49 0x0000000C Q-Word last modify date in WinNT date-format
54 0x00000024 D-Word Offset of 1st key record
55 0x00000028 D-Word Size of the data-blocks (Filesize-4kb)
57 0x000001FC D-Word Sum of all D-Words from 0x00000000 to
58 0x000001FB //XOR of all words. Nigel
60 I have analyzed more registry files (from multiple machines running
61 NT 4.0 german version) and could not find an explanation for the values
62 marked with ???? the rest of the first 4kb page is not important...
66 I don't know what "hbin" stands for, but this block is always a multiple
69 Inside these hbin-blocks the different records are placed. The memory-
70 management looks like a C-compiler heap management to me...
75 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268
76 0x0004 D-Word Offset from the 1st hbin-Block
77 0x0008 D-Word Offset to the next hbin-Block
78 0x001C D-Word Block-size
80 The values in 0x0008 and 0x001C should be the same, so I don't know
81 if they are correct or swapped...
83 From offset 0x0020 inside a hbin-block data is stored with the following
87 0x0000 D-Word Data-block size //this size must be a
91 If the size field is negative (bit 31 set), the corresponding block
92 is free and has a size of -blocksize!
94 That does not seem to be true. All block lengths seem to be negative! (Richard Sharpe)
96 The data is stored as one record per block. Block size is a multiple
97 of 4 and the last block reaches the next hbin-block, leaving no room.
99 Records in the hbin-blocks
100 ==========================
104 The nk-record can be treated as a kombination of tree-record and
105 key-record of the win 95 registry.
109 The lf-record is the counterpart to the RGKN-record (the
114 The vk-record consists information to a single value.
118 sk (? Security Key ?) is the ACL of the registry.
122 The value-lists contain information about which values are inside a
123 sub-key and don't have a header.
127 The datas of the registry are (like the value-list) stored without a
130 All offset-values are relative to the first hbin-block and point to the
131 block-size field of the record-entry. to get the file offset, you have to add
132 the header size (4kb) and the size field (4 bytes)...
137 0x0000 Word ID: ASCII-"nk" = 0x6B6E
138 0x0002 Word for the root-key: 0x2C, otherwise 0x20 //key symbolic links 0x10. Nigel
139 0x0004 Q-Word write-date/time in windows nt notation
140 0x0010 D-Word Offset of Owner/Parent key
141 0x0014 D-Word number of sub-Keys
142 0x001C D-Word Offset of the sub-key lf-Records
143 0x0024 D-Word number of values
144 0x0028 D-Word Offset of the Value-List
145 0x002C D-Word Offset of the sk-Record
147 0x0030 D-Word Offset of the Class-Name //see NK structure for the use of these fields. Nigel
148 0x0044 D-Word Unused (data-trash) //some kind of run time index. Does not appear to be important. Nigel
149 0x0048 Word name-length
150 0x004A Word class-name length
156 0x0000 D-Word Offset 1st Value
157 0x0004 D-Word Offset 2nd Value
158 0x???? D-Word Offset nth Value
160 To determine the number of values, you have to look at the owner-nk-record!
165 0x0000 Word ID: ASCII-"vk" = 0x6B76
166 0x0002 Word name length
167 0x0004 D-Word length of the data //if top bit is set when offset contains data. Nigel
168 0x0008 D-Word Offset of Data
169 0x000C D-Word Type of value
171 0x0012 Word Unused (data-trash)
174 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
176 If the data-size is lower 5, the data-offset value is used to store the data itself!
181 0x0001 RegSZ: character string (in UNICODE!)
182 0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!)
183 0x0003 RegBin: raw-binary value
184 0x0004 RegDWord: Dword
185 0x0007 RegMultiSZ: multiple strings, seperated with 0
191 0x0000 Word ID: ASCII-"lf" = 0x666C
192 0x0002 Word number of keys
193 0x0004 ???? Hash-Records
198 0x0000 D-Word Offset of corresponding "nk"-Record
199 0x0004 D-Word ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
201 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
202 key-name you have to change the hash-value too!
204 //These hashrecords must be sorted low to high within the lf record. Nigel.
208 (due to the complexity of the SAM-info, not clear jet)
209 (This is just a security descriptor in the data. R Sharpe.)
213 0x0000 Word ID: ASCII-"sk" = 0x6B73
215 0x0004 D-Word Offset of previous "sk"-Record
216 0x0008 D-Word Offset of next "sk"-Record
217 0x000C D-Word usage-counter
218 0x0010 D-Word Size of "sk"-record in bytes
220 relative security desciptor. Nigel
221 ???? ???? Security and auditing settings...
224 The usage counter counts the number of references to this
225 "sk"-record. You can use one "sk"-record for the entire registry!
227 Windows nt date/time format
228 ===========================
229 The time-format is a 64-bit integer which is incremented every
230 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
231 It starts with 0 at the 1st of january 1601 0:00! All values are
232 stored in GMT time! The time-zone is important to get the real
235 Common values for win95 and win-nt
236 ==================================
237 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
238 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
240 If a value has no data (length=0), it is displayed as empty.
242 simplyfied win-3.?? registry:
243 =============================
246 | next rec. |---+ +----->+------------+
247 | first sub | | | | Usage cnt. |
248 | name | | +-->+------------+ | | length |
249 | value | | | | next rec. | | | text |------->+-------+
250 +-----------+ | | | name rec. |--+ +------------+ | xxxxx |
251 +------------+ | | value rec. |-------->+------------+ +-------+
252 v | +------------+ | Usage cnt. |
253 +-----------+ | | length |
254 | next rec. | | | text |------->+-------+
255 | first sub |------+ +------------+ | xxxxx |
260 Greatly simplyfied structure of the nt-registry:
261 ================================================
263 +---------------------------------------------------------------+
266 +---------+ +---------->+-----------+ +----->+---------+ |
267 | "nk" | | | lf-rec. | | | nk-rec. | |
268 | ID | | | # of keys | | | parent |---+
269 | Date | | | 1st key |--+ | .... |
270 | parent | | +-----------+ +---------+
272 | values |--------------------->+----------+
273 | SK-rec. |---------------+ | 1. value |--> +----------+
274 | class |--+ | +----------+ | vk-rec. |
275 +---------+ | | | .... |
276 v | | data |--> +-------+
277 +------------+ | +----------+ | xxxxx |
278 | Class name | | +-------+
281 +---------+ +---------+
282 +----->| next sk |--->| Next sk |--+
283 | +---| prev sk |<---| prev sk | |
284 | | | .... | | ... | |
285 | | +---------+ +---------+ |
288 | +--------------------+ |
289 +----------------------------------+
291 ---------------------------------------------------------------------------
293 Hope this helps.... (Although it was "fun" for me to uncover this things,
294 it took me several sleepless nights ;)
298 *************************************************************************/
303 #include <sys/types.h>
304 #include <sys/stat.h>
306 #include <sys/mman.h>
310 static int verbose
= 0;
313 * These definitions are for the in-memory registry structure.
314 * It is a tree structure that mimics what you see with tools like regedit
318 * DateTime struct for Windows
321 typedef struct date_time_s
{
322 unsigned int low
, high
;
326 * Definition of a Key. It has a name, classname, date/time last modified,
327 * sub-keys, values, and a security descriptor
330 #define REG_ROOT_KEY 1
331 #define REG_SUB_KEY 2
332 #define REG_SYM_LINK 3
334 typedef struct reg_key_s
{
335 char *name
; /* Name of the key */
337 int type
; /* One of REG_ROOT_KEY or REG_SUB_KEY */
338 NTTIME last_mod
; /* Time last modified */
339 struct reg_key_s
*owner
;
340 struct key_list_s
*sub_keys
;
341 struct val_list_s
*values
;
342 struct key_sec_desc_s
*security
;
346 * The KEY_LIST struct lists sub-keys.
349 typedef struct key_list_s
{
354 typedef struct val_key_s
{
359 void *data_blk
; /* Might want a separate block */
362 typedef struct val_list_s
{
368 #define MAXSUBAUTHS 15
371 typedef struct dom_sid_s
{
372 unsigned char ver
, auths
;
373 unsigned char auth
[6];
374 unsigned int sub_auths
[MAXSUBAUTHS
];
377 typedef struct ace_struct_s
{
378 unsigned char type
, flags
;
379 unsigned int perms
; /* Perhaps a better def is in order */
383 typedef struct acl_struct_s
{
384 unsigned short rev
, refcnt
;
385 unsigned short num_aces
;
389 typedef struct sec_desc_s
{
390 unsigned int rev
, type
;
391 DOM_SID
*owner
, *group
;
395 typedef struct key_sec_desc_s
{
396 struct key_sec_desc_s
*prev
, *next
;
403 * An API for accessing/creating/destroying items above
407 * Iterate over the keys, depth first, calling a function for each key
408 * and indicating if it is terminal or non-terminal and if it has values.
410 * In addition, for each value in the list, call a value list function
414 * There should eventually be one to deal with security keys as well
417 typedef int (*key_print_f
)(char *path
, char *key_name
, char *class_name
,
418 int root
, int terminal
, int values
);
420 typedef int (*val_print_f
)(char *path
, char *val_name
, int val_type
,
421 int data_len
, void *data_blk
, int last
);
422 typedef struct regf_struct_s REGF
;
424 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, char *path
,
425 key_print_f key_print
, val_print_f val_print
);
427 int nt_key_list_iterator(REGF
*regf
, KEY_LIST
*key_list
, int bf
, char *path
,
428 key_print_f key_print
, val_print_f val_print
)
432 if (!key_list
) return 1;
434 for (i
=0; i
< key_list
->key_count
; i
++) {
435 if (!nt_key_iterator(regf
, key_list
->keys
[i
], bf
, path
, key_print
,
442 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, char *path
,
443 key_print_f key_print
, val_print_f val_print
)
445 int pathlen
= strlen(path
);
447 if (!regf
|| !key_tree
)
450 /* List the key first, then the values, then the sub-keys */
454 if (!(*key_print
)(path
, key_tree
->name
,
455 key_tree
->class_name
,
456 (key_tree
->type
== REG_ROOT_KEY
),
457 (key_tree
->sub_keys
== NULL
),
458 (key_tree
->values
?(key_tree
->values
->val_count
):0)))
463 * Now, iterate through the keys in the key list
466 if (key_tree
->sub_keys
&&
467 !nt_key_list_iterator(regf
, key_tree
->sub_keys
, bf
, path
, key_print
,
475 /* Make, delete keys */
477 int nt_delete_val_list(VAL_LIST
*vl
)
483 int nt_delete_reg_key(REG_KEY
*key
)
490 * Create/delete key lists and add delete keys to/from a list, count the keys
495 * Create/delete value lists, add/delete values, count them
500 * Create/delete security descriptors, add/delete SIDS, count SIDS, etc.
501 * We reference count the security descriptors. Any new reference increments
502 * the ref count. If we modify an SD, we copy the old one, dec the ref count
503 * and make the change. We also want to be able to check for equality so
504 * we can reduce the number of SDs in use.
509 * Load and unload a registry file.
511 * Load, loads it into memory as a tree, while unload sealizes/flattens it
515 * Get the starting record for NT Registry file
518 /* A map of sk offsets in the regf to KEY_SEC_DESCs for quick lookup etc */
519 typedef struct sk_map_s
{
521 KEY_SEC_DESC
*key_sec_desc
;
525 * Where we keep all the regf stuff for one registry.
526 * This is the structure that we use to tie the in memory tree etc
527 * together. By keeping separate structs, we can operate on different
528 * registries at the same time.
529 * Currently, the SK_MAP is an array of mapping structure.
530 * Since we only need this on input and output, we fill in the structure
531 * as we go on input. On output, we know how many SK items we have, so
532 * we can allocate the structure as we need to.
533 * If you add stuff here that is dynamically allocated, add the
534 * appropriate free statements below.
537 #define REGF_REGTYPE_NONE 0
538 #define REGF_REGTYPE_NT 1
539 #define REGF_REGTYPE_W9X 2
541 #define TTTONTTIME(r, t1, t2) (r)->last_mod_time.low = (t1); \
542 (r)->last_mod_time.high = (t2);
544 #define REGF_HDR_BLKSIZ 0x1000
546 struct regf_struct_s
{
548 char *regfile_name
, *outfile_name
;
553 NTTIME last_mod_time
;
554 REG_KEY
*root
; /* Root of the tree for this file */
555 int sk_count
, sk_map_size
;
560 * Structures for dealing with the on-disk format of the registry
563 #define IVAL(buf) ((unsigned int) \
564 (unsigned int)*((unsigned char *)(buf)+3)<<24| \
565 (unsigned int)*((unsigned char *)(buf)+2)<<16| \
566 (unsigned int)*((unsigned char *)(buf)+1)<<8| \
567 (unsigned int)*((unsigned char *)(buf)+0))
569 #define SVAL(buf) ((unsigned short) \
570 (unsigned short)*((unsigned char *)(buf)+1)<<8| \
571 (unsigned short)*((unsigned char *)(buf)+0))
573 #define OFF(f) ((f) + REGF_HDR_BLKSIZ + 4)
574 #define LOCN(base, f) ((base) + OFF(f))
577 * All of the structures below actually have a four-byte lenght before them
578 * which always seems to be negative. The following macro retrieves that
582 #define BLK_SIZE(b) ((int)*(int *)(((int *)b)-1))
584 typedef unsigned int DWORD
;
585 typedef unsigned short WORD
;
587 #define REG_REGF_ID 0x66676572
589 typedef struct regf_block
{
590 DWORD REGF_ID
; /* regf */
598 DWORD first_key
; /* offset */
599 unsigned int dblk_size
;
600 DWORD uk7
[116]; /* 1 */
604 typedef struct hbin_sub_struct
{
609 #define REG_HBIN_ID 0x6E696268
611 typedef struct hbin_struct
{
612 DWORD HBIN_ID
; /* hbin */
620 HBIN_SUB_HDR hbin_sub_hdr
;
623 #define REG_NK_ID 0x6B6E
625 typedef struct nk_struct
{
643 char key_nam
[1]; /* Actual length determined by nam_len */
646 #define REG_SK_ID 0x6B73
648 typedef struct sk_struct
{
658 typedef struct hash_struct
{
663 #define REG_LF_ID 0x666C
665 typedef struct lf_struct
{
668 struct hash_struct hr
[1]; /* Array of hash records, depending on key_count */
671 typedef DWORD VL_TYPE
[1]; /* Value list is an array of vk rec offsets */
673 #define REG_VK_ID 0x6B76
675 typedef struct vk_struct
{
678 DWORD dat_len
; /* If top-bit set, offset contains the data */
681 WORD flag
; /* =1, has name, else no name (=Default). */
683 char dat_name
[1]; /* Name starts here ... */
686 #define REG_TYPE_REGSZ 1
687 #define REG_TYPE_EXPANDSZ 2
688 #define REG_TYPE_BIN 3
689 #define REG_TYPE_DWORD 4
690 #define REG_TYPE_MULTISZ 7
692 typedef struct _val_str
{
697 VAL_STR reg_type_names
[] = {
699 { 2, "REG_EXPAND_SZ" },
702 { 7, "REG_MULTI_SZ" },
706 char *val_to_str(unsigned int val
, VAL_STR
*val_array
)
710 if (!val_array
) return NULL
;
712 while (val_array
[i
].val
&& val_array
[i
].str
) {
714 if (val_array
[i
].val
== val
) return val_array
[i
].str
;
723 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
);
725 int nt_set_regf_input_file(REGF
*regf
, char *filename
)
727 return ((regf
->regfile_name
= strdup(filename
)) != NULL
);
730 int nt_set_regf_output_file(REGF
*regf
, char *filename
)
732 return ((regf
->outfile_name
= strdup(filename
)) != NULL
);
735 /* Create a regf structure and init it */
737 REGF
*nt_create_regf()
739 REGF
*tmp
= (REGF
*)malloc(sizeof(REGF
));
740 if (!tmp
) return tmp
;
741 bzero(tmp
, sizeof(REGF
));
745 /* Free all the bits and pieces ... Assumes regf was malloc'd */
746 /* If you add stuff to REGF, add the relevant free bits here */
747 int nt_free_regf(REGF
*regf
)
751 if (regf
->regfile_name
) free(regf
->regfile_name
);
752 if (regf
->outfile_name
) free(regf
->outfile_name
);
754 /* Free the mmap'd area */
756 if (regf
->base
) munmap(regf
->base
, regf
->sbuf
.st_size
);
758 close(regf
->fd
); /* Ignore the error :-) */
760 nt_delete_reg_key(regf
->root
); /* Free the tree */
762 regf
->sk_count
= regf
->sk_map_size
= 0;
769 * Convert from UniCode to Ascii ... Does not take into account other lang
770 * Restrict by ascii_max if > 0
772 int uni_to_ascii(unsigned char *uni
, unsigned char *ascii
, int ascii_max
,
777 while (i
< ascii_max
&& !(!uni
[i
*2] && !uni
[i
*2+1])) {
778 if (uni_max
> 0 && (i
*2) >= uni_max
) break;
789 /* Get the header of the registry. Return a pointer to the structure
790 * If the mmap'd area has not been allocated, then mmap the input file
792 REGF_HDR
*nt_get_regf_hdr(REGF
*regf
)
795 return NULL
; /* What about errors */
797 if (!regf
->regfile_name
)
798 return NULL
; /* What about errors */
800 if (!regf
->base
) { /* Try to mmap etc the file */
802 if ((regf
->fd
= open(regf
->regfile_name
, O_RDONLY
, 0000)) <0) {
803 return NULL
; /* What about errors? */
806 if (fstat(regf
->fd
, ®f
->sbuf
) < 0) {
810 regf
->base
= mmap(0, regf
->sbuf
.st_size
, PROT_READ
, MAP_SHARED
, regf
->fd
, 0);
812 if ((int)regf
->base
== 1) {
813 fprintf(stderr
, "Could not mmap file: %s, %s\n", regf
->regfile_name
,
820 * At this point, regf->base != NULL, and we should be able to read the
824 assert(regf
->base
!= NULL
);
826 return (REGF_HDR
*)regf
->base
;
830 * Validate a regf header
831 * For now, do nothing, but we should check the checksum
833 int valid_regf_hdr(REGF_HDR
*regf_hdr
)
835 if (!regf_hdr
) return 0;
841 * Process a VK header and return a value
843 VAL_KEY
*process_vk(REGF
*regf
, VK_HDR
*vk_hdr
, int size
)
845 char val_name
[1024], data_value
[1024];
846 int nam_len
, dat_len
, flag
, dat_type
, dat_off
, vk_id
;
850 if (!vk_hdr
) return NULL
;
852 if ((vk_id
= SVAL(&vk_hdr
->VK_ID
)) != REG_VK_ID
) {
853 fprintf(stderr
, "Unrecognized VK header ID: %0X, block: %0X, %s\n",
854 vk_id
, vk_hdr
, regf
->regfile_name
);
858 nam_len
= SVAL(&vk_hdr
->nam_len
);
859 val_name
[nam_len
] = '\0';
860 flag
= SVAL(&vk_hdr
->flag
);
861 dat_type
= IVAL(&vk_hdr
->dat_type
);
862 dat_len
= IVAL(&vk_hdr
->dat_len
); /* If top bit, offset contains data */
863 dat_off
= IVAL(&vk_hdr
->dat_off
);
865 tmp
= (VAL_KEY
*)malloc(sizeof(VAL_KEY
));
869 bzero(tmp
, sizeof(VAL_KEY
));
870 tmp
->has_name
= flag
;
871 tmp
->data_type
= dat_type
;
874 strncpy(val_name
, vk_hdr
->dat_name
, nam_len
);
875 tmp
->name
= strdup(val_name
);
881 strncpy(val_name
, "<No Name>", 10);
884 * Allocate space and copy the data as a BLOB
889 char *dtmp
= (char *)malloc(dat_len
&0x7FFFFFFF);
895 tmp
->data_blk
= dtmp
;
897 if (dat_len
&0x80000000 == 0 ) { /* The data is pointed to by the offset */
898 char *dat_ptr
= LOCN(regf
->base
, dat_off
);
899 bcopy(dat_ptr
, dtmp
, dat_len
);
901 else { /* The data is in the offset */
902 dat_len
= dat_len
& 0x7FFFFFFF;
903 bcopy(&dat_off
, dtmp
, dat_len
);
908 val_type
= val_to_str(dat_type
, reg_type_names
);
911 * We need to save the data area as well
914 if (verbose
) fprintf(stdout
, " %s : %s : \n", val_name
, val_type
);
919 /* XXX: FIXME, free the partially allocated struct */
925 * Process a VL Header and return a list of values
927 VAL_LIST
*process_vl(REGF
*regf
, VL_TYPE vl
, int count
, int size
)
931 VAL_LIST
*tmp
= NULL
;
933 if (-size
< (count
+1)*sizeof(int)){
934 fprintf(stderr
, "Error in VL header format. Size less than space required. %d\n", -size
);
938 tmp
= (VAL_LIST
*)malloc(sizeof(VAL_LIST
) + (count
- 1) * sizeof(VAL_KEY
*));
943 for (i
=0; i
<count
; i
++) {
944 vk_off
= IVAL(&vl
[i
]);
945 vk_hdr
= (VK_HDR
*)LOCN(regf
->base
, vk_off
);
946 tmp
->vals
[i
] = process_vk(regf
, vk_hdr
, BLK_SIZE(vk_hdr
));
955 /* XXX: FIXME, free the partially allocated structure */
960 * Process an LF Header and return a list of sub-keys
962 KEY_LIST
*process_lf(REGF
*regf
, LF_HDR
*lf_hdr
, int size
)
964 int count
, i
, nk_off
;
968 if (!lf_hdr
) return NULL
;
970 if ((lf_id
= SVAL(&lf_hdr
->LF_ID
)) != REG_LF_ID
) {
971 fprintf(stderr
, "Unrecognized LF Header format: %0X, Block: %0X, %s.\n",
972 lf_id
, lf_hdr
, regf
->regfile_name
);
978 count
= SVAL(&lf_hdr
->key_count
);
980 if (count
<= 0) return NULL
;
982 /* Now, we should allocate a KEY_LIST struct and fill it in ... */
984 tmp
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (count
- 1) * sizeof(REG_KEY
*));
989 tmp
->key_count
= count
;
991 for (i
=0; i
<count
; i
++) {
995 nk_off
= IVAL(&lf_hdr
->hr
[i
].nk_off
);
996 nk_hdr
= (NK_HDR
*)LOCN(regf
->base
, nk_off
);
997 tmp
->keys
[i
] = nt_get_key_tree(regf
, nk_hdr
, BLK_SIZE(nk_hdr
));
1006 /* XXX: FIXME, free the partially allocated structure */
1011 * This routine is passed a NK_HDR pointer and retrieves the entire tree
1012 * from there down. It return a REG_KEY *.
1014 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
)
1016 REG_KEY
*tmp
= NULL
;
1018 int rec_size
, name_len
, clsname_len
, lf_off
, val_off
, val_count
, sk_off
;
1023 char key_name
[1024], cls_name
[1024];
1025 if (!nk_hdr
) return NULL
;
1027 if ((nk_id
= SVAL(&nk_hdr
->NK_ID
)) != REG_NK_ID
) {
1028 fprintf(stderr
, "Unrecognized NK Header format: %08X, Block: %0X. %s\n",
1029 nk_id
, nk_hdr
, regf
->regfile_name
);
1035 name_len
= SVAL(&nk_hdr
->nam_len
);
1036 clsname_len
= SVAL(&nk_hdr
->clsnam_len
);
1039 * The value of -size should be ge
1040 * (sizeof(NK_HDR) - 1 + name_len)
1041 * The -1 accounts for the fact that we included the first byte of
1042 * the name in the structure. clsname_len is the length of the thing
1043 * pointed to by clsnam_off
1046 if (-size
< (sizeof(NK_HDR
) - 1 + name_len
)) {
1047 fprintf(stderr
, "Incorrect NK_HDR size: %d, %0X\n", -size
, nk_hdr
);
1048 fprintf(stderr
, "Sizeof NK_HDR: %d, name_len %d, clsname_len %d\n",
1049 sizeof(NK_HDR
), name_len
, clsname_len
);
1053 if (verbose
) fprintf(stdout
, "NK HDR: Name len: %d, class name len: %d\n",
1054 name_len
, clsname_len
);
1056 /* Fish out the key name and process the LF list */
1058 assert(name_len
< sizeof(key_name
));
1060 /* Allocate the key struct now */
1061 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1062 if (!tmp
) return tmp
;
1063 bzero(tmp
, sizeof(REG_KEY
));
1065 tmp
->type
= (SVAL(&nk_hdr
->type
)==0x2C?REG_ROOT_KEY
:REG_SUB_KEY
);
1067 strncpy(key_name
, nk_hdr
->key_nam
, name_len
);
1068 key_name
[name_len
] = '\0';
1070 if (verbose
) fprintf(stdout
, "Key name: %s\n", key_name
);
1072 tmp
->name
= strdup(key_name
);
1078 * Fish out the class name, it is in UNICODE, while the key name is
1082 if (clsname_len
) { /* Just print in Ascii for now */
1086 clsnam_off
= IVAL(&nk_hdr
->clsnam_off
);
1087 clsnamep
= LOCN(regf
->base
, clsnam_off
);
1089 bzero(cls_name
, clsname_len
);
1090 uni_to_ascii(clsnamep
, cls_name
, sizeof(cls_name
), clsname_len
);
1093 * I am keeping class name as an ascii string for the moment.
1094 * That means it needs to be converted on output.
1098 tmp
->class_name
= strdup(cls_name
);
1099 if (!tmp
->class_name
) {
1103 if (verbose
) fprintf(stdout
, " Class Name: %s\n", cls_name
);
1108 * If there are any values, process them here
1111 val_count
= IVAL(&nk_hdr
->val_cnt
);
1116 val_off
= IVAL(&nk_hdr
->val_off
);
1117 vl
= (VL_TYPE
*)LOCN(regf
->base
, val_off
);
1119 tmp
->values
= process_vl(regf
, *vl
, val_count
, BLK_SIZE(vl
));
1127 * Also handle the SK header ...
1130 sk_off
= IVAL(&nk_hdr
->sk_off
);
1131 sk_hdr
= (SK_HDR
*)LOCN(regf
->base
, sk_off
);
1139 lf_off
= IVAL(&nk_hdr
->lf_off
);
1142 * No more subkeys if lf_off == -1
1147 lf_hdr
= (LF_HDR
*)LOCN(regf
->base
, lf_off
);
1149 tmp
->sub_keys
= process_lf(regf
, lf_hdr
, BLK_SIZE(lf_hdr
));
1150 if (!tmp
->sub_keys
){
1159 if (tmp
) nt_delete_reg_key(tmp
);
1163 int nt_load_registry(REGF
*regf
)
1166 unsigned int regf_id
, hbin_id
;
1167 unsigned int hbin_off
;
1171 /* Get the header */
1173 if ((regf_hdr
= nt_get_regf_hdr(regf
)) == NULL
) {
1177 /* Now process that header and start to read the rest in */
1179 if ((regf_id
= IVAL(®f_hdr
->REGF_ID
)) != REG_REGF_ID
) {
1180 fprintf(stderr
, "Unrecognized NT registry header id: %0X, %s\n",
1181 regf_id
, regf
->regfile_name
);
1186 * Validate the header ...
1188 if (!valid_regf_hdr(regf_hdr
)) {
1189 fprintf(stderr
, "Registry file header does not validate: %s\n",
1190 regf
->regfile_name
);
1194 /* Update the last mod date, and then go get the first NK record and on */
1196 TTTONTTIME(regf
, IVAL(®f_hdr
->tim1
), IVAL(®f_hdr
->tim2
));
1199 * The hbin hdr seems to be just uninteresting garbage. Check that
1200 * it is there, but that is all.
1203 hbin_hdr
= (HBIN_HDR
*)(regf
->base
+ REGF_HDR_BLKSIZ
);
1205 if ((hbin_id
= IVAL(&hbin_hdr
->HBIN_ID
)) != REG_HBIN_ID
) {
1206 fprintf(stderr
, "Unrecognized registry hbin hdr ID: %0X, %s\n",
1207 hbin_id
, regf
->regfile_name
);
1212 * Get a pointer to the first key from the hreg_hdr
1215 first_key
= (NK_HDR
*)LOCN(regf
->base
, IVAL(®f_hdr
->first_key
));
1218 * Now, get the registry tree by processing that NK recursively
1221 regf
->root
= nt_get_key_tree(regf
, first_key
, BLK_SIZE(first_key
));
1223 assert(regf
->root
!= NULL
);
1229 * Main code from here on ...
1233 * key print function here ...
1236 int print_key(char *path
, char *name
, char *class_name
, int root
,
1237 int terminal
, int vals
)
1240 if (terminal
) fprintf(stdout
, "%s\\%s\n", path
, name
);
1247 fprintf(stderr
, "Usage: editreg [-v] [-k] <registryfile>\n");
1248 fprintf(stderr
, "Version: 0.1\n\n");
1249 fprintf(stderr
, "\n\t-v\t sets verbose mode");
1252 int main(int argc
, char *argv
[])
1255 extern char *optarg
;
1265 * Now, process the arguments
1268 while ((opt
= getopt(argc
, argv
, "vk")) != EOF
) {
1284 if ((regf
= nt_create_regf()) == NULL
) {
1285 fprintf(stderr
, "Could not create registry object: %s\n", strerror(errno
));
1289 if (!nt_set_regf_input_file(regf
, argv
[optind
])) {
1290 fprintf(stderr
, "Could not set name of registry file: %s, %s\n",
1291 argv
[1], strerror(errno
));
1295 /* Now, open it, and bring it into memory :-) */
1297 if (nt_load_registry(regf
) < 0) {
1298 fprintf(stderr
, "Could not load registry: %s\n", argv
[1]);
1303 * At this point, we should have a registry in memory and should be able
1304 * to iterate over it.
1307 nt_key_iterator(regf
, regf
->root
, 0, "\\", print_key
, NULL
);