source3/utils/editreg.c

   1 /*
   2    Samba Unix/Linux SMB client utility editreg.c
   3    Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 2 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program; if not, write to the Free Software
  17    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
  18
  19 /*************************************************************************
  20
  21  A utility to edit a Windows NT/2K etc registry file.
  22
  23  Many of the ideas in here come from other people and software.
  24  I first looked in Wine in misc/registry.c and was also influenced by
  25  http://www.wednesday.demon.co.uk/dosreg.html
  26
  27  Which seems to contain comments from someone else. I reproduce them here
  28  incase the site above disappears. It actually comes from
  29  http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
  30
  31  The goal here is to read the registry into memory, manipulate it, and then
  32  write it out if it was changed by any actions of the user.
  33
  34 The windows NT registry has 2 different blocks, where one can occur many
  35 times...
  36
  37 the "regf"-Block
  38 ================
  39
  40 "regf" is obviosly the abbreviation for "Registry file". "regf" is the
  41 signature of the header-block which is always 4kb in size, although only
  42 the first 64 bytes seem to be used and a checksum is calculated over
  43 the first 0x200 bytes only!
  44
  45 Offset            Size      Contents
  46 0x00000000      D-Word      ID: ASCII-"regf" = 0x66676572
  47 0x00000004      D-Word      ???? //see struct REGF
  48 0x00000008      D-Word      ???? Always the same value as at 0x00000004
  49 0x0000000C      Q-Word      last modify date in WinNT date-format
  50 0x00000014      D-Word      1
  51 0x00000018      D-Word      3
  52 0x0000001C      D-Word      0
  53 0x00000020      D-Word      1
  54 0x00000024      D-Word      Offset of 1st key record
  55 0x00000028      D-Word      Size of the data-blocks (Filesize-4kb)
  56 0x0000002C      D-Word      1
  57 0x000001FC      D-Word      Sum of all D-Words from 0x00000000 to
  58 0x000001FB  //XOR of all words. Nigel
  59
  60 I have analyzed more registry files (from multiple machines running
  61 NT 4.0 german version) and could not find an explanation for the values
  62 marked with ???? the rest of the first 4kb page is not important...
  63
  64 the "hbin"-Block
  65 ================
  66 I don't know what "hbin" stands for, but this block is always a multiple
  67 of 4kb in size.
  68
  69 Inside these hbin-blocks the different records are placed. The memory-
  70 management looks like a C-compiler heap management to me...
  71
  72 hbin-Header
  73 ===========
  74 Offset      Size      Contents
  75 0x0000      D-Word      ID: ASCII-"hbin" = 0x6E696268
  76 0x0004      D-Word      Offset from the 1st hbin-Block
  77 0x0008      D-Word      Offset to the next hbin-Block
  78 0x001C      D-Word      Block-size
  79
  80 The values in 0x0008 and 0x001C should be the same, so I don't know
  81 if they are correct or swapped...
  82
  83 From offset 0x0020 inside a hbin-block data is stored with the following
  84 format:
  85
  86 Offset      Size      Contents
  87 0x0000      D-Word      Data-block size    //this size must be a
  88 multiple of 8. Nigel
  89 0x0004      ????      Data
  90
  91 If the size field is negative (bit 31 set), the corresponding block
  92 is free and has a size of -blocksize!
  93
  94 That does not seem to be true. All block lengths seem to be negative! (Richard Sharpe)
  95
  96 The data is stored as one record per block. Block size is a multiple
  97 of 4 and the last block reaches the next hbin-block, leaving no room.
  98
  99 Records in the hbin-blocks
 100 ==========================
 101
 102 nk-Record
 103
 104       The nk-record can be treated as a kombination of tree-record and
 105       key-record of the win 95 registry.
 106
 107 lf-Record
 108
 109       The lf-record is the counterpart to the RGKN-record (the
 110       hash-function)
 111
 112 vk-Record
 113
 114       The vk-record consists information to a single value.
 115
 116 sk-Record
 117
 118       sk (? Security Key ?) is the ACL of the registry.
 119
 120 Value-Lists
 121
 122       The value-lists contain information about which values are inside a
 123       sub-key and don't have a header.
 124
 125 Datas
 126
 127       The datas of the registry are (like the value-list) stored without a
 128       header.
 129
 130 All offset-values are relative to the first hbin-block and point to the
 131 block-size field of the record-entry. to get the file offset, you have to add
 132 the header size (4kb) and the size field (4 bytes)...
 133
 134 the nk-Record
 135 =============
 136 Offset      Size      Contents
 137 0x0000      Word      ID: ASCII-"nk" = 0x6B6E
 138 0x0002      Word      for the root-key: 0x2C, otherwise 0x20  //key symbolic links 0x10. Nigel
 139 0x0004      Q-Word      write-date/time in windows nt notation
 140 0x0010      D-Word      Offset of Owner/Parent key
 141 0x0014      D-Word      number of sub-Keys
 142 0x001C      D-Word      Offset of the sub-key lf-Records
 143 0x0024      D-Word      number of values
 144 0x0028      D-Word      Offset of the Value-List
 145 0x002C      D-Word      Offset of the sk-Record
 146
 147 0x0030      D-Word      Offset of the Class-Name //see NK structure for the use of these fields. Nigel
 148 0x0044      D-Word      Unused (data-trash)  //some kind of run time index. Does not appear to be important. Nigel
 149 0x0048      Word      name-length
 150 0x004A      Word      class-name length
 151 0x004C      ????      key-name
 152
 153 the Value-List
 154 ==============
 155 Offset      Size      Contents
 156 0x0000      D-Word      Offset 1st Value
 157 0x0004      D-Word      Offset 2nd Value
 158 0x????      D-Word      Offset nth Value
 159
 160 To determine the number of values, you have to look at the owner-nk-record!
 161
 162 Der vk-Record
 163 =============
 164 Offset      Size      Contents
 165 0x0000      Word      ID: ASCII-"vk" = 0x6B76
 166 0x0002      Word      name length
 167 0x0004      D-Word      length of the data   //if top bit is set when offset contains data. Nigel
 168 0x0008      D-Word      Offset of Data
 169 0x000C      D-Word      Type of value
 170 0x0010      Word      Flag
 171 0x0012      Word      Unused (data-trash)
 172 0x0014      ????      Name
 173
 174 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
 175
 176 If the data-size is lower 5, the data-offset value is used to store the data itself!
 177
 178 The data-types
 179 ==============
 180 Wert      Beteutung
 181 0x0001      RegSZ:             character string (in UNICODE!)
 182 0x0002      ExpandSZ:   string with "%var%" expanding (UNICODE!)
 183 0x0003      RegBin:           raw-binary value
 184 0x0004      RegDWord:   Dword
 185 0x0007      RegMultiSZ:      multiple strings, seperated with 0
 186                   (UNICODE!)
 187
 188 The "lf"-record
 189 ===============
 190 Offset      Size      Contents
 191 0x0000      Word      ID: ASCII-"lf" = 0x666C
 192 0x0002      Word      number of keys
 193 0x0004      ????      Hash-Records
 194
 195 Hash-Record
 196 ===========
 197 Offset      Size      Contents
 198 0x0000      D-Word      Offset of corresponding "nk"-Record
 199 0x0004      D-Word      ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
 200
 201 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
 202 key-name you have to change the hash-value too!
 203
 204 //These hashrecords must be sorted low to high within the lf record. Nigel.
 205
 206 The "sk"-block
 207 ==============
 208 (due to the complexity of the SAM-info, not clear jet)
 209 (This is just a security descriptor in the data. R Sharpe.)
 210
 211
 212 Offset      Size      Contents
 213 0x0000      Word      ID: ASCII-"sk" = 0x6B73
 214 0x0002      Word      Unused
 215 0x0004      D-Word      Offset of previous "sk"-Record
 216 0x0008      D-Word      Offset of next "sk"-Record
 217 0x000C      D-Word      usage-counter
 218 0x0010      D-Word      Size of "sk"-record in bytes
 219 ????                                             //standard self
 220 relative security desciptor. Nigel
 221 ????  ????      Security and auditing settings...
 222 ????
 223
 224 The usage counter counts the number of references to this
 225 "sk"-record. You can use one "sk"-record for the entire registry!
 226
 227 Windows nt date/time format
 228 ===========================
 229 The time-format is a 64-bit integer which is incremented every
 230 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
 231 It starts with 0 at the 1st of january 1601 0:00! All values are
 232 stored in GMT time! The time-zone is important to get the real
 233 time!
 234
 235 Common values for win95 and win-nt
 236 ==================================
 237 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
 238 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
 239 "Default" entry...
 240 If a value has no data (length=0), it is displayed as empty.
 241
 242 simplyfied win-3.?? registry:
 243 =============================
 244
 245 +-----------+
 246 | next rec. |---+                      +----->+------------+
 247 | first sub |   |                      |      | Usage cnt. |
 248 | name      |   |  +-->+------------+  |      | length     |
 249 | value     |   |  |   | next rec.  |  |      | text       |------->+-------+
 250 +-----------+   |  |   | name rec.  |--+      +------------+        | xxxxx |
 251    +------------+  |   | value rec. |-------->+------------+        +-------+
 252    v               |   +------------+         | Usage cnt. |
 253 +-----------+      |                          | length     |
 254 | next rec. |      |                          | text       |------->+-------+
 255 | first sub |------+                          +------------+        | xxxxx |
 256 | name      |                                                       +-------+
 257 | value     |
 258 +-----------+
 259
 260 Greatly simplyfied structure of the nt-registry:
 261 ================================================
 262
 263 +---------------------------------------------------------------+
 264 |                                                               |
 265 v                                                               |
 266 +---------+     +---------->+-----------+  +----->+---------+   |
 267 | "nk"    |     |           | lf-rec.   |  |      | nk-rec. |   |
 268 | ID      |     |           | # of keys |  |      | parent  |---+
 269 | Date    |     |           | 1st key   |--+      | ....    |
 270 | parent  |     |           +-----------+         +---------+
 271 | suk-keys|-----+
 272 | values  |--------------------->+----------+
 273 | SK-rec. |---------------+      | 1. value |--> +----------+
 274 | class   |--+            |      +----------+    | vk-rec.  |
 275 +---------+  |            |                      | ....     |
 276              v            |                      | data     |--> +-------+
 277       +------------+      |                      +----------+    | xxxxx |
 278       | Class name |      |                                      +-------+
 279       +------------+      |
 280                           v
 281           +---------+    +---------+
 282    +----->| next sk |--->| Next sk |--+
 283    |  +---| prev sk |<---| prev sk |  |
 284    |  |   | ....    |    | ...     |  |
 285    |  |   +---------+    +---------+  |
 286    |  |                    ^          |
 287    |  |                    |          |
 288    |  +--------------------+          |
 289    +----------------------------------+
 290
 291 ---------------------------------------------------------------------------
 292
 293 Hope this helps....  (Although it was "fun" for me to uncover this things,
 294                   it took me several sleepless nights ;)
 295
 296             B.D.
 297
 298 *************************************************************************/
 299
 300 #include <stdio.h>
 301 #include <errno.h>
 302 #include <assert.h>
 303 #include <sys/types.h>
 304 #include <sys/stat.h>
 305 #include <unistd.h>
 306 #include <sys/mman.h>
 307 #include <string.h>
 308 #include <fcntl.h>
 309 /*
 310  * These definitions are for the in-memory registry structure.
 311  * It is a tree structure that mimics what you see with tools like regedit
 312  */
 313
 314 /*
 315  * DateTime struct for Windows
 316  */
 317
 318 typedef struct date_time_s {
 319   unsigned int low, high;
 320 } NTTIME;
 321
 322 /*
 323  * Definition of a Key. It has a name, classname, date/time last modified,
 324  * sub-keys, values, and a security descriptor
 325  */
 326
 327 #define REG_ROOT_KEY 1
 328 #define REG_SUB_KEY 2
 329
 330 typedef struct reg_key_s {
 331   char *name;         /* Name of the key                    */
 332   char *class_name;
 333   int type;           /* One of REG_ROOT_KEY or REG_SUB_KEY */
 334   NTTIME last_mod; /* Time last modified                 */
 335   struct reg_key_s *owner;
 336   struct key_list_s *sub_keys;
 337   struct val_list_s *values;
 338   struct key_sec_desc_s *security;
 339 } REG_KEY;
 340
 341 /*
 342  * The KEY_LIST struct lists sub-keys.
 343  */
 344
 345 typedef struct key_list_s {
 346   int key_count;
 347   REG_KEY keys[1];
 348 } KEY_LIST;
 349
 350 typedef struct val_key_s {
 351   char *name;
 352   int has_name;
 353   int data_type;
 354   int data_len;
 355   void *data_blk;    /* Might want a separate block */
 356 } VAL_KEY;
 357
 358 typedef struct val_list_s {
 359   int val_count;
 360   VAL_KEY vals[1];
 361 } VAL_LIST;
 362
 363 #ifndef MAXSUBAUTHS
 364 #define MAXSUBAUTHS 15
 365 #endif
 366
 367 typedef struct dom_sid_s {
 368   unsigned char ver, auths;
 369   unsigned char auth[6];
 370   unsigned int sub_auths[MAXSUBAUTHS];
 371 } DOM_SID;
 372
 373 typedef struct ace_struct_s {
 374   unsigned char type, flags;
 375   unsigned int perms;   /* Perhaps a better def is in order */
 376   DOM_SID trustee;
 377 } ACE;
 378
 379 typedef struct acl_struct_s {
 380   unsigned short rev, refcnt;
 381   unsigned short num_aces;
 382   ACE *aces[1];
 383 } ACL;
 384
 385 typedef struct sec_desc_s {
 386   unsigned int rev, type;
 387   DOM_SID *owner, *group;
 388   ACL *sacl, *dacl;
 389 } SEC_DESC;
 390
 391 typedef struct key_sec_desc_s {
 392   struct key_sec_desc_s *prev, *next;
 393   int ref_cnt;
 394   SEC_DESC *sec_desc;
 395 } KEY_SEC_DESC;
 396
 397
 398 /*
 399  * An API for accessing/creating/destroying items above
 400  */
 401
 402 /* Make, delete keys */
 403
 404 int nt_delete_reg_key(REG_KEY *key)
 405 {
 406
 407   return 1;
 408 }
 409
 410 /*
 411  * Create/delete key lists and add delete keys to/from a list, count the keys
 412  */
 413
 414
 415 /*
 416  * Create/delete value lists, add/delete values, count them
 417  */
 418
 419
 420 /*
 421  * Create/delete security descriptors, add/delete SIDS, count SIDS, etc.
 422  * We reference count the security descriptors. Any new reference increments
 423  * the ref count. If we modify an SD, we copy the old one, dec the ref count
 424  * and make the change. We also want to be able to check for equality so
 425  * we can reduce the number of SDs in use.
 426  */
 427
 428
 429 /*
 430  * Load and unload a registry file.
 431  *
 432  * Load, loads it into memory as a tree, while unload sealizes/flattens it
 433  */
 434
 435 /*
 436  * Get the starting record for NT Registry file
 437  */
 438
 439 /* A map of sk offsets in the regf to KEY_SEC_DESCs for quick lookup etc */
 440 typedef struct sk_map_s {
 441   int sk_off;
 442   KEY_SEC_DESC *key_sec_desc;
 443 } SK_MAP;
 444
 445 /*
 446  * Where we keep all the regf stuff for one registry.
 447  * This is the structure that we use to tie the in memory tree etc
 448  * together. By keeping separate structs, we can operate on different
 449  * registries at the same time.
 450  * Currently, the SK_MAP is an array of mapping structure.
 451  * Since we only need this on input and output, we fill in the structure
 452  * as we go on input. On output, we know how many SK items we have, so
 453  * we can allocate the structure as we need to.
 454  * If you add stuff here that is dynamically allocated, add the
 455  * appropriate free statements below.
 456  */
 457
 458 #define REGF_REGTYPE_NONE 0
 459 #define REGF_REGTYPE_NT   1
 460 #define REGF_REGTYPE_W9X  2
 461
 462 typedef struct regf_struct_s {
 463   int reg_type;
 464   char *regfile_name, *outfile_name;
 465   int fd;
 466   struct stat sbuf;
 467   char *base;
 468   int modified;
 469   REG_KEY *root;  /* Root of the tree for this file */
 470   int sk_count, sk_map_size;
 471   SK_MAP **sk_map;
 472 } REGF;
 473
 474 /*
 475  * Structures for dealing with the on-disk format of the registry
 476  */
 477
 478 typedef unsigned int DWORD;
 479 typedef unsigned short WORD;
 480
 481 #define REG_REGF_ID 0x66676572
 482
 483 typedef struct regf_block {
 484   DWORD REGF_ID;     /* regf */
 485   DWORD uk1;
 486   DWORD uk2;
 487   DWORD tim1, tim2;
 488   DWORD uk3;             /* 1 */
 489   DWORD uk4;             /* 3 */
 490   DWORD uk5;             /* 0 */
 491   DWORD uk6;             /* 1 */
 492   DWORD first_key;       /* offset */
 493   unsigned int dblk_size;
 494   DWORD uk7[116];        /* 1 */
 495   DWORD chksum;
 496 } REGF_HDR;
 497
 498 typedef struct hbin_sub_struct {
 499   DWORD dblocksize;
 500   char data[1];
 501 } HBIN_SUB_HDR;
 502
 503 #define REG_HBIN_ID 0x6E696268
 504
 505 typedef struct hbin_struct {
 506   DWORD HBIN_ID; /* hbin */
 507   DWORD next_off;
 508   DWORD prev_off;
 509   DWORD uk1;
 510   DWORD uk2;
 511   DWORD uk3;
 512   DWORD uk4;
 513   DWORD blk_size;
 514   HBIN_SUB_HDR hbin_sub_hdr;
 515 } HBIN_HDR;
 516
 517 #define REG_NK_ID 0x6B6E
 518
 519 typedef struct nk_struct {
 520   WORD NK_ID;
 521   WORD type;
 522   DWORD t1, t2;
 523   DWORD uk1;
 524   DWORD own_off;
 525   DWORD subk_num;
 526   DWORD uk2;
 527   DWORD lf_off;
 528   DWORD uk3;
 529   DWORD val_cnt;
 530   DWORD val_off;
 531   DWORD sk_off;
 532   DWORD clsnam_off;
 533   DWORD unk4[4];
 534   DWORD unk5;
 535   WORD nam_len;
 536   WORD clsnam_len;
 537   char key_nam[1];  /* Actual length determined by nam_len */
 538 } NK_HDR;
 539
 540 #define REG_SK_ID 0x6B73
 541
 542 typedef struct sk_struct {
 543   WORD SK_ID;
 544   WORD uk1;
 545   DWORD prev_off;
 546   DWORD next_off;
 547   DWORD ref_cnt;
 548   DWORD rec_size;
 549   char sec_desc[1];
 550 } SK_HDR;
 551
 552 #define OFF(f) ((f) + 0x1000 + 4)
 553 #define LOCN(f) (base + OFF(f))
 554
 555 typedef struct hash_struct {
 556   DWORD nk_off;
 557   char hash[4];
 558 } HASH_REC;
 559
 560 #define REG_LF_ID 0x666C
 561
 562 typedef struct lf_struct {
 563   WORD LF_ID;
 564   WORD key_count;
 565   struct hash_struct hr[1];  /* Array of hash records, depending on key_count */
 566 } LF_HDR;
 567
 568 typedef DWORD VL_TYPE[1];  /* Value list is an array of vk rec offsets */
 569
 570 #define REG_VK_ID 0x6B76
 571
 572 typedef struct vk_struct {
 573   WORD VK_ID;
 574   WORD nam_len;
 575   DWORD dat_len;    /* If top-bit set, offset contains the data */
 576   DWORD dat_off;
 577   DWORD dat_type;
 578   WORD flag;        /* =1, has name, else no name (=Default). */
 579   WORD unk1;
 580   char dat_name[1]; /* Name starts here ... */
 581 } VK_HDR;
 582
 583 #define REG_TYPE_REGSZ     1
 584 #define REG_TYPE_EXPANDSZ  2
 585 #define REG_TYPE_BIN       3
 586 #define REG_TYPE_DWORD     4
 587 #define REG_TYPE_MULTISZ   7
 588
 589 #define OFF(f) ((f) + 0x1000 + 4)
 590 #define LOCN(f) (base + OFF(f))
 591
 592 int nt_set_regf_input_file(REGF *regf, char *filename)
 593 {
 594   return ((regf->regfile_name = strdup(filename)) != NULL);
 595 }
 596
 597 int nt_set_regf_output_file(REGF *regf, char *filename)
 598 {
 599   return ((regf->outfile_name = strdup(filename)) != NULL);
 600 }
 601
 602 /* Create a regf structure and init it */
 603
 604 REGF *nt_create_regf()
 605 {
 606   REGF *tmp = (REGF *)malloc(sizeof(REGF));
 607   if (!tmp) return tmp;
 608   bzero(tmp, sizeof(REGF));
 609   return tmp;
 610 }
 611
 612 /* Free all the bits and pieces ... Assumes regf was malloc'd */
 613 /* If you add stuff to REGF, add the relevant free bits here  */
 614 int nt_free_regf(REGF *regf)
 615 {
 616   if (!regf) return;
 617
 618   if (regf->regfile_name) free(regf->regfile_name);
 619   if (regf->outfile_name) free(regf->outfile_name);
 620
 621   /* Free the mmap'd area */
 622
 623   if (regf->base) munmap(regf->base, regf->sbuf.st_size);
 624   regf->base = NULL;
 625   close(regf->fd);    /* Ignore the error :-) */
 626
 627   nt_delete_reg_key(regf->root); /* Free the tree */
 628   free(regf->sk_map);
 629   regf->sk_count = regf->sk_map_size = 0;
 630
 631   free(regf);
 632
 633 }
 634
 635 /* Get the header of the registry
 636    If the mmap'd area has not been allocated, then mmap the input file
 637 */
 638 int nt_get_regf_hdr(REGF *regf)
 639 {
 640   if (!regf)
 641     return -1; /* What about errors */
 642
 643   if (!regf->regfile_name)
 644     return -1; /* What about errors */
 645
 646   if (!regf->base) { /* Try to mmap etc the file */
 647
 648     if ((regf->fd = open(regf->regfile_name, O_RDONLY, 0000)) <0) {
 649       return regf->fd; /* What about errors */
 650     }
 651
 652     if (fstat(regf->fd, &regf->sbuf) < 0) {
 653       return -1;
 654     }
 655
 656     regf->base = mmap(0, regf->sbuf.st_size, PROT_READ, MAP_SHARED, regf->fd, 0);
 657
 658     if ((int)regf->base == 1) {
 659       fprintf(stderr, "Could not mmap file: %s, %s\n", regf->regfile_name,
 660               strerror(errno));
 661       return -1;
 662     }
 663   }
 664
 665   /*
 666    * At this point, regf->base != NULL, and we should be able to read the
 667    * header
 668    */
 669
 670   assert(regf->base != NULL);
 671
 672
 673
 674   return 1;
 675 }
 676
 677 int nt_get_hbin_hdr(REGF *regf, int hbin_offs)
 678 {
 679
 680   return 1;
 681 }
 682
 683 int nt_load_registry(REGF *regf)
 684 {
 685   int rc;
 686
 687   /* Get the header */
 688
 689   if ((rc = nt_get_regf_hdr(regf)) < 0) {
 690     return rc;
 691   }
 692
 693   /* Now what? */
 694
 695   return 1;
 696 }
 697
 698 /*
 699  * Main code from here on ...
 700  */
 701
 702 void usage(void)
 703 {
 704   fprintf(stderr, "Usage: editreg <registryfile>\n");
 705   fprintf(stderr, "Version: 0.1\n\n");
 706 }
 707
 708 int main(int argc, char *argv[])
 709 {
 710   REGF *regf;
 711
 712   if (argc < 2) {
 713     usage();
 714     exit(1);
 715   }
 716
 717   if ((regf = nt_create_regf()) == NULL) {
 718     fprintf(stderr, "Could not create registry object: %s\n", strerror(errno));
 719     exit(2);
 720   }
 721
 722   if (!nt_set_regf_input_file(regf, argv[1])) {
 723     fprintf(stderr, "Could not set name of registry file: %s, %s\n",
 724             argv[1], strerror(errno));
 725     exit(3);
 726   }
 727
 728   /* Now, open it, and bring it into memory :-) */
 729
 730   if (nt_load_registry(regf) < 0) {
 731     fprintf(stderr, "Could not load registry: %s\n", argv[1]);
 732     exit(4);
 733   }
 734 }