source3/utils/profiles.c

   1 /*
   2    Samba Unix/Linux SMB client utility profiles.c
   3    Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
   4    Copyright (C) 2003 Jelmer Vernooij (conversion to popt)
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
  19
  20 /*************************************************************************
  21
  22  A utility to report and change SIDs in registry files
  23
  24  Many of the ideas in here come from other people and software.
  25  I first looked in Wine in misc/registry.c and was also influenced by
  26  http://www.wednesday.demon.co.uk/dosreg.html
  27
  28  Which seems to contain comments from someone else. I reproduce them here
  29  incase the site above disappears. It actually comes from
  30  http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
  31
  32 The windows NT registry has 2 different blocks, where one can occure many
  33 times...
  34
  35 the "regf"-Block
  36 ================
  37
  38 "regf" is obviously the abbreviation for "Registry file". "regf" is the
  39 signature of the header-block which is always 4kb in size, although only
  40 the first 64 bytes seem to be used and a checksum is calculated over
  41 the first 0x200 bytes only!
  42
  43 Offset            Size      Contents
  44 0x00000000      D-Word      ID: ASCII-"regf" = 0x66676572
  45 0x00000004      D-Word      ???? //see struct REGF
  46 0x00000008      D-Word      ???? Always the same value as at 0x00000004
  47 0x0000000C      Q-Word      last modify date in WinNT date-format
  48 0x00000014      D-Word      1
  49 0x00000018      D-Word      3
  50 0x0000001C      D-Word      0
  51 0x00000020      D-Word      1
  52 0x00000024      D-Word      Offset of 1st key record
  53 0x00000028      D-Word      Size of the data-blocks (Filesize-4kb)
  54 0x0000002C      D-Word      1
  55 0x000001FC      D-Word      Sum of all D-Words from 0x00000000 to
  56 0x000001FB  //XOR of all words. Nigel
  57
  58 I have analyzed more registry files (from multiple machines running
  59 NT 4.0 german version) and could not find an explanation for the values
  60 marked with ???? the rest of the first 4kb page is not important...
  61
  62 the "hbin"-Block
  63 ================
  64 I don't know what "hbin" stands for, but this block is always a multiple
  65 of 4kb in size.
  66
  67 Inside these hbin-blocks the different records are placed. The memory-
  68 management looks like a C-compiler heap management to me...
  69
  70 hbin-Header
  71 ===========
  72 Offset      Size      Contents
  73 0x0000      D-Word      ID: ASCII-"hbin" = 0x6E696268
  74 0x0004      D-Word      Offset from the 1st hbin-Block
  75 0x0008      D-Word      Offset to the next hbin-Block
  76 0x001C      D-Word      Block-size
  77
  78 The values in 0x0008 and 0x001C should be the same, so I don't know
  79 if they are correct or swapped...
  80
  81 From offset 0x0020 inside a hbin-block data is stored with the following
  82 format:
  83
  84 Offset      Size      Contents
  85 0x0000      D-Word      Data-block size    //this size must be a
  86 multiple of 8. Nigel
  87 0x0004      ????      Data
  88
  89 If the size field is negative (bit 31 set), the corresponding block
  90 is free and has a size of -blocksize!
  91
  92 The data is stored as one record per block. Block size is a multiple
  93 of 4 and the last block reaches the next hbin-block, leaving no room.
  94
  95 Records in the hbin-blocks
  96 ==========================
  97
  98 nk-Record
  99
 100       The nk-record can be treated as a kombination of tree-record and
 101       key-record of the win 95 registry.
 102
 103 lf-Record
 104
 105       The lf-record is the counterpart to the RGKN-record (the
 106       hash-function)
 107
 108 vk-Record
 109
 110       The vk-record consists information to a single value.
 111
 112 sk-Record
 113
 114       sk (? Security Key ?) is the ACL of the registry.
 115
 116 Value-Lists
 117
 118       The value-lists contain information about which values are inside a
 119       sub-key and don't have a header.
 120
 121 Datas
 122
 123       The datas of the registry are (like the value-list) stored without a
 124       header.
 125
 126 All offset-values are relative to the first hbin-block and point to the
 127 block-size field of the record-entry. to get the file offset, you have to add
 128 the header size (4kb) and the size field (4 bytes)...
 129
 130 the nk-Record
 131 =============
 132 Offset      Size      Contents
 133 0x0000      Word      ID: ASCII-"nk" = 0x6B6E
 134 0x0002      Word      for the root-key: 0x2C, otherwise 0x20  //key symbolic links 0x10. Nigel
 135 0x0004      Q-Word      write-date/time in windows nt notation
 136 0x0010      D-Word      Offset of Owner/Parent key
 137 0x0014      D-Word      number of sub-Keys
 138 0x001C      D-Word      Offset of the sub-key lf-Records
 139 0x0024      D-Word      number of values
 140 0x0028      D-Word      Offset of the Value-List
 141 0x002C      D-Word      Offset of the sk-Record
 142
 143 0x0030      D-Word      Offset of the Class-Name //see NK structure for the use of these fields. Nigel
 144 0x0044      D-Word      Unused (data-trash)  //some kind of run time index. Does not appear to be important. Nigel
 145 0x0048      Word      name-length
 146 0x004A      Word      class-name length
 147 0x004C      ????      key-name
 148
 149 the Value-List
 150 ==============
 151 Offset      Size      Contents
 152 0x0000      D-Word      Offset 1st Value
 153 0x0004      D-Word      Offset 2nd Value
 154 0x????      D-Word      Offset nth Value
 155
 156 To determine the number of values, you have to look at the owner-nk-record!
 157
 158 Der vk-Record
 159 =============
 160 Offset      Size      Contents
 161 0x0000      Word      ID: ASCII-"vk" = 0x6B76
 162 0x0002      Word      name length
 163 0x0004      D-Word      length of the data   //if top bit is set when offset contains data. Nigel
 164 0x0008      D-Word      Offset of Data
 165 0x000C      D-Word      Type of value
 166 0x0010      Word      Flag
 167 0x0012      Word      Unused (data-trash)
 168 0x0014      ????      Name
 169
 170 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
 171
 172 If the data-size is lower 5, the data-offset value is used to store the data itself!
 173
 174 The data-types
 175 ==============
 176 Wert      Beteutung
 177 0x0001      RegSZ:             character string (in UNICODE!)
 178 0x0002      ExpandSZ:   string with "%var%" expanding (UNICODE!)
 179 0x0003      RegBin:           raw-binary value
 180 0x0004      RegDWord:   Dword
 181 0x0007      RegMultiSZ:      multiple strings, separated with 0
 182                   (UNICODE!)
 183
 184 The "lf"-record
 185 ===============
 186 Offset      Size      Contents
 187 0x0000      Word      ID: ASCII-"lf" = 0x666C
 188 0x0002      Word      number of keys
 189 0x0004      ????      Hash-Records
 190
 191 Hash-Record
 192 ===========
 193 Offset      Size      Contents
 194 0x0000      D-Word      Offset of corresponding "nk"-Record
 195 0x0004      D-Word      ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
 196
 197 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
 198 key-name you have to change the hash-value too!
 199
 200 //These hashrecords must be sorted low to high within the lf record. Nigel.
 201
 202 The "sk"-block
 203 ==============
 204 (due to the complexity of the SAM-info, not clear jet)
 205
 206 Offset      Size      Contents
 207 0x0000      Word      ID: ASCII-"sk" = 0x6B73
 208 0x0002      Word      Unused
 209 0x0004      D-Word      Offset of previous "sk"-Record
 210 0x0008      D-Word      Offset of next "sk"-Record
 211 0x000C      D-Word      usage-counter
 212 0x0010      D-Word      Size of "sk"-record in bytes
 213 ????                                             //standard self
 214 relative security desciptor. Nigel
 215 ????  ????      Security and auditing settings...
 216 ????
 217
 218 The usage counter counts the number of references to this
 219 "sk"-record. You can use one "sk"-record for the entire registry!
 220
 221 Windows nt date/time format
 222 ===========================
 223 The time-format is a 64-bit integer which is incremented every
 224 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
 225 It starts with 0 at the 1st of january 1601 0:00! All values are
 226 stored in GMT time! The time-zone is important to get the real
 227 time!
 228
 229 Common values for win95 and win-nt
 230 ==================================
 231 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
 232 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
 233 "Default" entry...
 234 If a value has no data (length=0), it is displayed as empty.
 235
 236 simplyfied win-3.?? registry:
 237 =============================
 238
 239 +-----------+
 240 | next rec. |---+                      +----->+------------+
 241 | first sub |   |                      |      | Usage cnt. |
 242 | name      |   |  +-->+------------+  |      | length     |
 243 | value     |   |  |   | next rec.  |  |      | text       |------->+-------+
 244 +-----------+   |  |   | name rec.  |--+      +------------+        | xxxxx |
 245    +------------+  |   | value rec. |-------->+------------+        +-------+
 246    v               |   +------------+         | Usage cnt. |
 247 +-----------+      |                          | length     |
 248 | next rec. |      |                          | text       |------->+-------+
 249 | first sub |------+                          +------------+        | xxxxx |
 250 | name      |                                                       +-------+
 251 | value     |
 252 +-----------+
 253
 254 Greatly simplyfied structure of the nt-registry:
 255 ================================================
 256
 257 +---------------------------------------------------------------+
 258 |                                                               |
 259 v                                                               |
 260 +---------+     +---------->+-----------+  +----->+---------+   |
 261 | "nk"    |     |           | lf-rec.   |  |      | nk-rec. |   |
 262 | ID      |     |           | # of keys |  |      | parent  |---+
 263 | Date    |     |           | 1st key   |--+      | ....    |
 264 | parent  |     |           +-----------+         +---------+
 265 | suk-keys|-----+
 266 | values  |--------------------->+----------+
 267 | SK-rec. |---------------+      | 1. value |--> +----------+
 268 | class   |--+            |      +----------+    | vk-rec.  |
 269 +---------+  |            |                      | ....     |
 270              v            |                      | data     |--> +-------+
 271       +------------+      |                      +----------+    | xxxxx |
 272       | Class name |      |                                      +-------+
 273       +------------+      |
 274                           v
 275           +---------+    +---------+
 276    +----->| next sk |--->| Next sk |--+
 277    |  +---| prev sk |<---| prev sk |  |
 278    |  |   | ....    |    | ...     |  |
 279    |  |   +---------+    +---------+  |
 280    |  |         ^          |          |
 281       |         +----------+          |
 282       +-------------------------------+
 283
 284 ---------------------------------------------------------------------------
 285
 286 Hope this helps....  (Although it was "fun" for me to uncover this things,
 287                   it took me several sleepless nights ;)
 288
 289             B.D.
 290
 291 *************************************************************************/
 292 #include "includes.h"
 293 #include <stdio.h>
 294 #include <errno.h>
 295 #include <sys/types.h>
 296 #include <sys/stat.h>
 297 #include <unistd.h>
 298 #include <sys/mman.h>
 299
 300 typedef unsigned int DWORD;
 301 typedef unsigned short WORD;
 302
 303 #define REG_REGF_ID 0x66676572
 304
 305 typedef struct regf_block {
 306   DWORD REGF_ID;     /* regf */
 307   DWORD uk1;
 308   DWORD uk2;
 309   DWORD tim1, tim2;
 310   DWORD uk3;             /* 1 */
 311   DWORD uk4;             /* 3 */
 312   DWORD uk5;             /* 0 */
 313   DWORD uk6;             /* 1 */
 314   DWORD first_key;       /* offset */
 315   unsigned int dblk_size;
 316   DWORD uk7[116];        /* 1 */
 317   DWORD chksum;
 318 } REGF_HDR;
 319
 320 typedef struct hbin_sub_struct {
 321   DWORD dblocksize;
 322   char data[1];
 323 } HBIN_SUB_HDR;
 324
 325 #define REG_HBIN_ID 0x6E696268
 326
 327 typedef struct hbin_struct {
 328   DWORD HBIN_ID; /* hbin */
 329   DWORD next_off;
 330   DWORD prev_off;
 331   DWORD uk1;
 332   DWORD uk2;
 333   DWORD uk3;
 334   DWORD uk4;
 335   DWORD blk_size;
 336   HBIN_SUB_HDR hbin_sub_hdr;
 337 } HBIN_HDR;
 338
 339 #define REG_NK_ID 0x6B6E
 340
 341 typedef struct nk_struct {
 342   WORD NK_ID;
 343   WORD type;
 344   DWORD t1, t2;
 345   DWORD uk1;
 346   DWORD own_off;
 347   DWORD subk_num;
 348   DWORD uk2;
 349   DWORD lf_off;
 350   DWORD uk3;
 351   DWORD val_cnt;
 352   DWORD val_off;
 353   DWORD sk_off;
 354   DWORD clsnam_off;
 355 } NK_HDR;
 356
 357 #define REG_SK_ID 0x6B73
 358
 359 typedef struct sk_struct {
 360   WORD SK_ID;
 361   WORD uk1;
 362   DWORD prev_off;
 363   DWORD next_off;
 364   DWORD ref_cnt;
 365   DWORD rec_size;
 366   char sec_desc[1];
 367 } SK_HDR;
 368
 369 typedef struct sec_desc_rec {
 370   WORD rev;
 371   WORD type;
 372   DWORD owner_off;
 373   DWORD group_off;
 374   DWORD sacl_off;
 375   DWORD dacl_off;
 376 } MY_SEC_DESC;
 377
 378 typedef struct ace_struct {
 379     unsigned char type;
 380     unsigned char flags;
 381     unsigned short length;
 382     unsigned int perms;
 383     DOM_SID trustee;
 384 } ACE;
 385
 386 typedef struct acl_struct {
 387   WORD rev;
 388   WORD size;
 389   DWORD num_aces;
 390   ACE *aces;   /* One or more ACEs */
 391 } ACL;
 392
 393 #define OFF(f) (0x1000 + (f) + 4)
 394
 395 static void print_sid(DOM_SID *sid);
 396
 397 int verbose = 1;
 398 DOM_SID old_sid, new_sid;
 399 int change = 0, new = 0;
 400
 401 /* Compare two SIDs for equality */
 402 static int my_sid_equal(DOM_SID *s1, DOM_SID *s2)
 403 {
 404   int sa1, sa2;
 405
 406   if (s1->sid_rev_num != s2->sid_rev_num) return 0;
 407
 408   sa1 = s1->num_auths; sa2 = s2->num_auths;
 409
 410   if (sa1 != sa2) return 0;
 411
 412   return !memcmp((char *)&s1->id_auth, (char *)&s2->id_auth,
 413                 6 + sa1 * 4);
 414
 415 }
 416
 417 /*
 418  * Quick and dirty to read a SID in S-1-5-21-x-y-z-rid format and
 419  * construct a DOM_SID
 420  */
 421 static int get_sid(DOM_SID *sid, const unsigned char *sid_str)
 422 {
 423   int i = 0, auth;
 424   const unsigned char *lstr;
 425
 426   if (strncmp(sid_str, "S-1-5", 5)) {
 427     fprintf(stderr, "Does not conform to S-1-5...: %s\n", sid_str);
 428     return 0;
 429   }
 430
 431   /* We only allow strings of form S-1-5... */
 432
 433   sid->sid_rev_num = 1;
 434   sid->id_auth[5] = 5;
 435
 436   lstr = sid_str + 5;
 437
 438   while (1) {
 439     if (!lstr || !lstr[0] || sscanf(lstr, "-%u", &auth) == 0) {
 440       if (i < 4) {
 441         fprintf(stderr, "Not of form -d-d...: %s, %u\n", lstr, i);
 442         return 0;
 443       }
 444       sid->num_auths=i;
 445       print_sid(sid);
 446       return 1;
 447     }
 448
 449     SIVAL(&sid->sub_auths[i], 0, auth);
 450     i++;
 451     lstr = strchr(lstr + 1, '-');
 452   }
 453
 454   return 1;
 455 }
 456
 457 #if 0
 458
 459 /*
 460  * Replace SID1, component by component with SID2
 461  * Assumes will never be called with unequal length SIDS
 462  * so only touches 21-x-y-z-rid portion
 463  * This routine does not need to deal with endianism as
 464  * long as the incoming SIDs are both in the same (LE) format.
 465  */
 466 static void change_sid(DOM_SID *s1, DOM_SID *s2)
 467 {
 468   int i;
 469
 470   for (i=0; i<s1->num_auths; i++) {
 471     s1->sub_auths[i] = s2->sub_auths[i];
 472   }
 473 }
 474
 475 #endif
 476
 477 static void print_sid(DOM_SID *sid)
 478 {
 479   int i, comps = sid->num_auths;
 480   fprintf(stdout, "S-%u-%u", sid->sid_rev_num, sid->id_auth[5]);
 481
 482   for (i = 0; i < comps; i++) {
 483
 484     fprintf(stdout, "-%u", IVAL(&sid->sub_auths[i],0));
 485
 486   }
 487   fprintf(stdout, "\n");
 488 }
 489
 490 static void process_sid(DOM_SID *sid, DOM_SID *o_sid, DOM_SID *n_sid)
 491 {
 492   int i;
 493   if (my_sid_equal(sid, o_sid)) {
 494
 495     for (i=0; i<sid->num_auths; i++) {
 496       sid->sub_auths[i] = n_sid->sub_auths[i];
 497
 498     }
 499
 500   }
 501
 502 }
 503
 504 static void process_acl(ACL *acl, const char *prefix)
 505 {
 506   int ace_cnt, i;
 507   ACE *ace;
 508
 509   ace_cnt = IVAL(&acl->num_aces, 0);
 510   ace = (ACE *)&acl->aces;
 511   if (verbose) fprintf(stdout, "%sACEs: %u\n", prefix, ace_cnt);
 512   for (i=0; i<ace_cnt; i++) {
 513     if (verbose) fprintf(stdout, "%s  Perms: %08X, SID: ", prefix,
 514                          IVAL(&ace->perms, 0));
 515     if (change)
 516       process_sid(&ace->trustee, &old_sid, &new_sid);
 517     print_sid(&ace->trustee);
 518     ace = (ACE *)((char *)ace + SVAL(&ace->length, 0));
 519   }
 520 }
 521
 522 int main(int argc, char *argv[])
 523 {
 524   int opt;
 525   int fd, start = 0;
 526   char *base;
 527   struct stat sbuf;
 528   REGF_HDR *regf_hdr;
 529   HBIN_HDR *hbin_hdr;
 530   NK_HDR *nk_hdr;
 531   SK_HDR *sk_hdr;
 532   DWORD first_sk_off, sk_off;
 533   MY_SEC_DESC *sec_desc;
 534   int *ptr;
 535   struct poptOption long_options[] = {
 536           POPT_AUTOHELP
 537           { "verbose", 'v', POPT_ARG_NONE, NULL, 'v', "Sets verbose mode" },
 538           { "change-sid", 'c', POPT_ARG_STRING, NULL, 'c', "Provides SID to change" },
 539           { "new-sid", 'n', POPT_ARG_STRING, NULL, 'n', "Provides SID to change to" },
 540           { 0, 0, 0, 0 }
 541   };
 542
 543   poptContext pc;
 544
 545   pc = poptGetContext("profiles", argc, (const char **)argv, long_options,
 546                                           POPT_CONTEXT_KEEP_FIRST);
 547
 548   poptSetOtherOptionHelp(pc, "<profilefile>");
 549
 550   /*
 551    * Now, process the arguments
 552    */
 553
 554   while ((opt = poptGetNextOpt(pc)) != -1) {
 555     switch (opt) {
 556         case 'c':
 557                 change = 1;
 558                 if (!get_sid(&old_sid, poptGetOptArg(pc))) {
 559                         fprintf(stderr, "Argument to -c should be a SID in form of S-1-5-...\n");
 560                         poptPrintUsage(pc, stderr, 0);
 561                         exit(254);
 562                 }
 563                 break;
 564
 565         case 'n':
 566                 new = 1;
 567                 if (!get_sid(&new_sid, poptGetOptArg(pc))) {
 568                         fprintf(stderr, "Argument to -n should be a SID in form of S-1-5-...\n");
 569                         poptPrintUsage(pc, stderr, 0);
 570                         exit(253);
 571                 }
 572
 573                 break;
 574
 575         case 'v':
 576                 verbose++;
 577                 break;
 578         }
 579   }
 580
 581   if (!poptPeekArg(pc)) {
 582           poptPrintUsage(pc, stderr, 0);
 583           exit(1);
 584   }
 585
 586   if ((!change & new) || (change & !new)) {
 587           fprintf(stderr, "You must specify both -c and -n if one or the other is set!\n");
 588           poptPrintUsage(pc, stderr, 0);
 589           exit(252);
 590   }
 591
 592   poptGetArg(pc); /* To get argv[0] */
 593
 594   fd = open(poptPeekArg(pc), O_RDWR, 0000);
 595
 596   if (fd < 0) {
 597     fprintf(stderr, "Could not open %s: %s\n", poptPeekArg(pc),
 598         strerror(errno));
 599     exit(2);
 600   }
 601
 602   if (fstat(fd, &sbuf) < 0) {
 603     fprintf(stderr, "Could not stat file %s, %s\n", poptPeekArg(pc),
 604         strerror(errno));
 605     exit(3);
 606   }
 607
 608   /*
 609    * Now, mmap the file into memory, check the header and start
 610    * dealing with the records. We are interested in the sk record
 611    */
 612   start = 0;
 613   base = mmap(&start, sbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
 614
 615   if ((int)base == -1) {
 616     fprintf(stderr, "Could not mmap file: %s, %s\n", poptPeekArg(pc),
 617         strerror(errno));
 618     exit(4);
 619   }
 620
 621   /*
 622    * In what follows, and in places above, in order to work on both LE and
 623    * BE platforms, we have to use the Samba macros to extract SHORT, LONG
 624    * and associated UNSIGNED quantities from the data in the mmap'd file.
 625    * NOTE, however, that we do not need to do anything with memory
 626    * addresses that we construct from pointers in our address space.
 627    * For example,
 628    *
 629    *    sec_desc = (MY_SEC_DESC *)&(sk_hdr->sec_desc[0]);
 630    *
 631    * is simply taking the address of a structure we already have the address
 632    * of in our address space, while, the fields within it, will have to
 633    * be accessed with the macros:
 634    *
 635    * owner_sid = (DOM_SID *)(&sk_hdr->sec_desc[0] +
 636    *                         IVAL(&sec_desc->owner_off, 0));
 637    *
 638    * Which is pulling out an offset and adding it to an existing pointer.
 639    *
 640    */
 641
 642   regf_hdr = (REGF_HDR *)base;
 643
 644   if (verbose) fprintf(stdout, "Registry file size: %u\n", (unsigned int)sbuf.st_size);
 645
 646   if (IVAL(&regf_hdr->REGF_ID, 0) != REG_REGF_ID) {
 647     fprintf(stderr, "Incorrect Registry file (doesn't have header ID): %s\n", poptPeekArg(pc));
 648     exit(5);
 649   }
 650
 651   if (verbose) fprintf(stdout, "First Key Off: %u, Data Block Size: %u\n",
 652                        IVAL(&regf_hdr->first_key, 0),
 653                        IVAL(&regf_hdr->dblk_size, 0));
 654
 655   hbin_hdr = (HBIN_HDR *)(base + 0x1000); /* No need for Endian stuff */
 656
 657   /*
 658    * This should be the hbin_hdr
 659    */
 660
 661   if (IVAL(&hbin_hdr->HBIN_ID, 0) != REG_HBIN_ID) {
 662     fprintf(stderr, "Incorrect hbin hdr: %s\n", poptPeekArg(pc));
 663     exit(6);
 664   }
 665
 666   if (verbose) fprintf(stdout, "Next Off: %u, Prev Off: %u\n",
 667                        IVAL(&hbin_hdr->next_off, 0),
 668                        IVAL(&hbin_hdr->prev_off, 0));
 669
 670   nk_hdr = (NK_HDR *)(base + 0x1000 + IVAL(&regf_hdr->first_key, 0) + 4);
 671
 672   if (SVAL(&nk_hdr->NK_ID, 0) != REG_NK_ID) {
 673     fprintf(stderr, "Incorrect NK Header: %s\n", poptPeekArg(pc));
 674     exit(7);
 675   }
 676
 677   sk_off = first_sk_off = IVAL(&nk_hdr->sk_off, 0);
 678   if (verbose) {
 679     fprintf(stdout, "Type: %0x\n", SVAL(&nk_hdr->type, 0));
 680     fprintf(stdout, "SK Off    : %o\n", (0x1000 + sk_off + 4));
 681   }
 682
 683   sk_hdr = (SK_HDR *)(base + 0x1000 + sk_off + 4);
 684
 685   do {
 686     DOM_SID *owner_sid, *group_sid;
 687     ACL *sacl, *dacl;
 688     if (SVAL(&sk_hdr->SK_ID, 0) != REG_SK_ID) {
 689       fprintf(stderr, "Incorrect SK Header format: %08X\n",
 690               (0x1000 + sk_off + 4));
 691       exit(8);
 692     }
 693     ptr = (int *)sk_hdr;
 694     if (verbose) fprintf(stdout, "Off: %08X, Refs: %u, Size: %u\n",
 695                          sk_off, IVAL(&sk_hdr->ref_cnt, 0),
 696                          IVAL(&sk_hdr->rec_size, 0));
 697
 698     sec_desc = (MY_SEC_DESC *)&(sk_hdr->sec_desc[0]);
 699     owner_sid = (DOM_SID *)(&sk_hdr->sec_desc[0] +
 700                             IVAL(&sec_desc->owner_off, 0));
 701     group_sid = (DOM_SID *)(&sk_hdr->sec_desc[0] +
 702                             IVAL(&sec_desc->group_off, 0));
 703     sacl = (ACL *)(&sk_hdr->sec_desc[0] +
 704                    IVAL(&sec_desc->sacl_off, 0));
 705     dacl = (ACL *)(&sk_hdr->sec_desc[0] +
 706                    IVAL(&sec_desc->dacl_off, 0));
 707     if (verbose)fprintf(stdout, "  Owner SID: ");
 708     if (change) process_sid(owner_sid, &old_sid, &new_sid);
 709     if (verbose) print_sid(owner_sid);
 710     if (verbose) fprintf(stdout, "  Group SID: ");
 711     if (change) process_sid(group_sid, &old_sid, &new_sid);
 712     if (verbose) print_sid(group_sid);
 713     fprintf(stdout, "  SACL: ");
 714     if (!sec_desc->sacl_off) { /* LE zero == BE zero */
 715       if (verbose) fprintf(stdout, "NONE\n");
 716     }
 717     else
 718       process_acl(sacl, "    ");
 719     if (verbose) fprintf(stdout, "  DACL: ");
 720     if (!sec_desc->dacl_off) {
 721       if (verbose) fprintf(stdout, "NONE\n");
 722     }
 723     else
 724       process_acl(dacl, "    ");
 725     sk_off = IVAL(&sk_hdr->prev_off, 0);
 726     sk_hdr = (SK_HDR *)(base + OFF(IVAL(&sk_hdr->prev_off, 0)));
 727   } while (sk_off != first_sk_off);
 728
 729   munmap(base, sbuf.st_size);
 730
 731   poptFreeContext(pc);
 732
 733   close(fd);
 734   return 0;
 735 }