source3/utils/editreg.c

   1 /*
   2    Samba Unix/Linux SMB client utility editreg.c
   3    Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 2 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program; if not, write to the Free Software
  17    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
  18
  19 /*************************************************************************
  20
  21  A utility to edit a Windows NT/2K etc registry file.
  22
  23  Many of the ideas in here come from other people and software.
  24  I first looked in Wine in misc/registry.c and was also influenced by
  25  http://www.wednesday.demon.co.uk/dosreg.html
  26
  27  Which seems to contain comments from someone else. I reproduce them here
  28  incase the site above disappears. It actually comes from
  29  http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
  30
  31  The goal here is to read the registry into memory, manipulate it, and then
  32  write it out if it was changed by any actions of the user.
  33
  34 The windows NT registry has 2 different blocks, where one can occur many
  35 times...
  36
  37 the "regf"-Block
  38 ================
  39
  40 "regf" is obviosly the abbreviation for "Registry file". "regf" is the
  41 signature of the header-block which is always 4kb in size, although only
  42 the first 64 bytes seem to be used and a checksum is calculated over
  43 the first 0x200 bytes only!
  44
  45 Offset            Size      Contents
  46 0x00000000      D-Word      ID: ASCII-"regf" = 0x66676572
  47 0x00000004      D-Word      ???? //see struct REGF
  48 0x00000008      D-Word      ???? Always the same value as at 0x00000004
  49 0x0000000C      Q-Word      last modify date in WinNT date-format
  50 0x00000014      D-Word      1
  51 0x00000018      D-Word      3
  52 0x0000001C      D-Word      0
  53 0x00000020      D-Word      1
  54 0x00000024      D-Word      Offset of 1st key record
  55 0x00000028      D-Word      Size of the data-blocks (Filesize-4kb)
  56 0x0000002C      D-Word      1
  57 0x000001FC      D-Word      Sum of all D-Words from 0x00000000 to
  58 0x000001FB  //XOR of all words. Nigel
  59
  60 I have analyzed more registry files (from multiple machines running
  61 NT 4.0 german version) and could not find an explanation for the values
  62 marked with ???? the rest of the first 4kb page is not important...
  63
  64 the "hbin"-Block
  65 ================
  66 I don't know what "hbin" stands for, but this block is always a multiple
  67 of 4kb in size.
  68
  69 Inside these hbin-blocks the different records are placed. The memory-
  70 management looks like a C-compiler heap management to me...
  71
  72 hbin-Header
  73 ===========
  74 Offset      Size      Contents
  75 0x0000      D-Word      ID: ASCII-"hbin" = 0x6E696268
  76 0x0004      D-Word      Offset from the 1st hbin-Block
  77 0x0008      D-Word      Offset to the next hbin-Block
  78 0x001C      D-Word      Block-size
  79
  80 The values in 0x0008 and 0x001C should be the same, so I don't know
  81 if they are correct or swapped...
  82
  83 From offset 0x0020 inside a hbin-block data is stored with the following
  84 format:
  85
  86 Offset      Size      Contents
  87 0x0000      D-Word      Data-block size    //this size must be a
  88 multiple of 8. Nigel
  89 0x0004      ????      Data
  90
  91 If the size field is negative (bit 31 set), the corresponding block
  92 is free and has a size of -blocksize!
  93
  94 That does not seem to be true. All block lengths seem to be negative! (Richard Sharpe)
  95
  96 The data is stored as one record per block. Block size is a multiple
  97 of 4 and the last block reaches the next hbin-block, leaving no room.
  98
  99 Records in the hbin-blocks
 100 ==========================
 101
 102 nk-Record
 103
 104       The nk-record can be treated as a kombination of tree-record and
 105       key-record of the win 95 registry.
 106
 107 lf-Record
 108
 109       The lf-record is the counterpart to the RGKN-record (the
 110       hash-function)
 111
 112 vk-Record
 113
 114       The vk-record consists information to a single value.
 115
 116 sk-Record
 117
 118       sk (? Security Key ?) is the ACL of the registry.
 119
 120 Value-Lists
 121
 122       The value-lists contain information about which values are inside a
 123       sub-key and don't have a header.
 124
 125 Datas
 126
 127       The datas of the registry are (like the value-list) stored without a
 128       header.
 129
 130 All offset-values are relative to the first hbin-block and point to the
 131 block-size field of the record-entry. to get the file offset, you have to add
 132 the header size (4kb) and the size field (4 bytes)...
 133
 134 the nk-Record
 135 =============
 136 Offset      Size      Contents
 137 0x0000      Word      ID: ASCII-"nk" = 0x6B6E
 138 0x0002      Word      for the root-key: 0x2C, otherwise 0x20  //key symbolic links 0x10. Nigel
 139 0x0004      Q-Word      write-date/time in windows nt notation
 140 0x0010      D-Word      Offset of Owner/Parent key
 141 0x0014      D-Word      number of sub-Keys
 142 0x001C      D-Word      Offset of the sub-key lf-Records
 143 0x0024      D-Word      number of values
 144 0x0028      D-Word      Offset of the Value-List
 145 0x002C      D-Word      Offset of the sk-Record
 146
 147 0x0030      D-Word      Offset of the Class-Name //see NK structure for the use of these fields. Nigel
 148 0x0044      D-Word      Unused (data-trash)  //some kind of run time index. Does not appear to be important. Nigel
 149 0x0048      Word      name-length
 150 0x004A      Word      class-name length
 151 0x004C      ????      key-name
 152
 153 the Value-List
 154 ==============
 155 Offset      Size      Contents
 156 0x0000      D-Word      Offset 1st Value
 157 0x0004      D-Word      Offset 2nd Value
 158 0x????      D-Word      Offset nth Value
 159
 160 To determine the number of values, you have to look at the owner-nk-record!
 161
 162 Der vk-Record
 163 =============
 164 Offset      Size      Contents
 165 0x0000      Word      ID: ASCII-"vk" = 0x6B76
 166 0x0002      Word      name length
 167 0x0004      D-Word      length of the data   //if top bit is set when offset contains data. Nigel
 168 0x0008      D-Word      Offset of Data
 169 0x000C      D-Word      Type of value
 170 0x0010      Word      Flag
 171 0x0012      Word      Unused (data-trash)
 172 0x0014      ????      Name
 173
 174 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
 175
 176 If the data-size is lower 5, the data-offset value is used to store the data itself!
 177
 178 The data-types
 179 ==============
 180 Wert      Beteutung
 181 0x0001      RegSZ:             character string (in UNICODE!)
 182 0x0002      ExpandSZ:   string with "%var%" expanding (UNICODE!)
 183 0x0003      RegBin:           raw-binary value
 184 0x0004      RegDWord:   Dword
 185 0x0007      RegMultiSZ:      multiple strings, seperated with 0
 186                   (UNICODE!)
 187
 188 The "lf"-record
 189 ===============
 190 Offset      Size      Contents
 191 0x0000      Word      ID: ASCII-"lf" = 0x666C
 192 0x0002      Word      number of keys
 193 0x0004      ????      Hash-Records
 194
 195 Hash-Record
 196 ===========
 197 Offset      Size      Contents
 198 0x0000      D-Word      Offset of corresponding "nk"-Record
 199 0x0004      D-Word      ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
 200
 201 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
 202 key-name you have to change the hash-value too!
 203
 204 //These hashrecords must be sorted low to high within the lf record. Nigel.
 205
 206 The "sk"-block
 207 ==============
 208 (due to the complexity of the SAM-info, not clear jet)
 209 (This is just a security descriptor in the data. R Sharpe.)
 210
 211
 212 Offset      Size      Contents
 213 0x0000      Word      ID: ASCII-"sk" = 0x6B73
 214 0x0002      Word      Unused
 215 0x0004      D-Word      Offset of previous "sk"-Record
 216 0x0008      D-Word      Offset of next "sk"-Record
 217 0x000C      D-Word      usage-counter
 218 0x0010      D-Word      Size of "sk"-record in bytes
 219 ????                                             //standard self
 220 relative security desciptor. Nigel
 221 ????  ????      Security and auditing settings...
 222 ????
 223
 224 The usage counter counts the number of references to this
 225 "sk"-record. You can use one "sk"-record for the entire registry!
 226
 227 Windows nt date/time format
 228 ===========================
 229 The time-format is a 64-bit integer which is incremented every
 230 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
 231 It starts with 0 at the 1st of january 1601 0:00! All values are
 232 stored in GMT time! The time-zone is important to get the real
 233 time!
 234
 235 Common values for win95 and win-nt
 236 ==================================
 237 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
 238 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
 239 "Default" entry...
 240 If a value has no data (length=0), it is displayed as empty.
 241
 242 simplyfied win-3.?? registry:
 243 =============================
 244
 245 +-----------+
 246 | next rec. |---+                      +----->+------------+
 247 | first sub |   |                      |      | Usage cnt. |
 248 | name      |   |  +-->+------------+  |      | length     |
 249 | value     |   |  |   | next rec.  |  |      | text       |------->+-------+
 250 +-----------+   |  |   | name rec.  |--+      +------------+        | xxxxx |
 251    +------------+  |   | value rec. |-------->+------------+        +-------+
 252    v               |   +------------+         | Usage cnt. |
 253 +-----------+      |                          | length     |
 254 | next rec. |      |                          | text       |------->+-------+
 255 | first sub |------+                          +------------+        | xxxxx |
 256 | name      |                                                       +-------+
 257 | value     |
 258 +-----------+
 259
 260 Greatly simplyfied structure of the nt-registry:
 261 ================================================
 262
 263 +---------------------------------------------------------------+
 264 |                                                               |
 265 v                                                               |
 266 +---------+     +---------->+-----------+  +----->+---------+   |
 267 | "nk"    |     |           | lf-rec.   |  |      | nk-rec. |   |
 268 | ID      |     |           | # of keys |  |      | parent  |---+
 269 | Date    |     |           | 1st key   |--+      | ....    |
 270 | parent  |     |           +-----------+         +---------+
 271 | suk-keys|-----+
 272 | values  |--------------------->+----------+
 273 | SK-rec. |---------------+      | 1. value |--> +----------+
 274 | class   |--+            |      +----------+    | vk-rec.  |
 275 +---------+  |            |                      | ....     |
 276              v            |                      | data     |--> +-------+
 277       +------------+      |                      +----------+    | xxxxx |
 278       | Class name |      |                                      +-------+
 279       +------------+      |
 280                           v
 281           +---------+    +---------+
 282    +----->| next sk |--->| Next sk |--+
 283    |  +---| prev sk |<---| prev sk |  |
 284    |  |   | ....    |    | ...     |  |
 285    |  |   +---------+    +---------+  |
 286    |  |                    ^          |
 287    |  |                    |          |
 288    |  +--------------------+          |
 289    +----------------------------------+
 290
 291 ---------------------------------------------------------------------------
 292
 293 Hope this helps....  (Although it was "fun" for me to uncover this things,
 294                   it took me several sleepless nights ;)
 295
 296             B.D.
 297
 298 *************************************************************************/
 299
 300 #include <stdio.h>
 301 #include <errno.h>
 302 #include <assert.h>
 303 #include <sys/types.h>
 304 #include <sys/stat.h>
 305 #include <unistd.h>
 306 #include <sys/mman.h>
 307 #include <string.h>
 308 #include <fcntl.h>
 309 /*
 310  * These definitions are for the in-memory registry structure.
 311  * It is a tree structure that mimics what you see with tools like regedit
 312  */
 313
 314 /*
 315  * DateTime struct for Windows
 316  */
 317
 318 typedef struct date_time_s {
 319   unsigned int low, high;
 320 } NTTIME;
 321
 322 /*
 323  * Definition of a Key. It has a name, classname, date/time last modified,
 324  * sub-keys, values, and a security descriptor
 325  */
 326
 327 #define REG_ROOT_KEY 1
 328 #define REG_SUB_KEY 2
 329
 330 typedef struct reg_key_s {
 331   char *name;         /* Name of the key                    */
 332   char *class_name;
 333   int type;           /* One of REG_ROOT_KEY or REG_SUB_KEY */
 334   NTTIME last_mod; /* Time last modified                 */
 335   struct reg_key_s *owner;
 336   struct key_list_s *sub_keys;
 337   struct val_list_s *values;
 338   struct key_sec_desc_s *security;
 339 } REG_KEY;
 340
 341 /*
 342  * The KEY_LIST struct lists sub-keys.
 343  */
 344
 345 typedef struct key_list_s {
 346   int key_count;
 347   REG_KEY keys[1];
 348 } KEY_LIST;
 349
 350 typedef struct val_key_s {
 351   char *name;
 352   int has_name;
 353   int data_type;
 354   int data_len;
 355   void *data_blk;    /* Might want a separate block */
 356 } VAL_KEY;
 357
 358 typedef struct val_list_s {
 359   int val_count;
 360   VAL_KEY vals[1];
 361 } VAL_LIST;
 362
 363 #ifndef MAXSUBAUTHS
 364 #define MAXSUBAUTHS 15
 365 #endif
 366
 367 typedef struct dom_sid_s {
 368   unsigned char ver, auths;
 369   unsigned char auth[6];
 370   unsigned int sub_auths[MAXSUBAUTHS];
 371 } DOM_SID;
 372
 373 typedef struct ace_struct_s {
 374   unsigned char type, flags;
 375   unsigned int perms;   /* Perhaps a better def is in order */
 376   DOM_SID trustee;
 377 } ACE;
 378
 379 typedef struct acl_struct_s {
 380   unsigned short rev, refcnt;
 381   unsigned short num_aces;
 382   ACE *aces[1];
 383 } ACL;
 384
 385 typedef struct sec_desc_s {
 386   unsigned int rev, type;
 387   DOM_SID *owner, *group;
 388   ACL *sacl, *dacl;
 389 } SEC_DESC;
 390
 391 typedef struct key_sec_desc_s {
 392   struct key_sec_desc_s *prev, *next;
 393   int ref_cnt;
 394   SEC_DESC *sec_desc;
 395 } KEY_SEC_DESC;
 396
 397
 398 /*
 399  * An API for accessing/creating/destroying items above
 400  */
 401
 402 /* Make, delete keys */
 403
 404 int nt_delete_reg_key(REG_KEY *key)
 405 {
 406
 407   return 1;
 408 }
 409
 410 /*
 411  * Create/delete key lists and add delete keys to/from a list, count the keys
 412  */
 413
 414
 415 /*
 416  * Create/delete value lists, add/delete values, count them
 417  */
 418
 419
 420 /*
 421  * Create/delete security descriptors, add/delete SIDS, count SIDS, etc.
 422  * We reference count the security descriptors. Any new reference increments
 423  * the ref count. If we modify an SD, we copy the old one, dec the ref count
 424  * and make the change. We also want to be able to check for equality so
 425  * we can reduce the number of SDs in use.
 426  */
 427
 428
 429 /*
 430  * Load and unload a registry file.
 431  *
 432  * Load, loads it into memory as a tree, while unload sealizes/flattens it
 433  */
 434
 435 /*
 436  * Get the starting record for NT Registry file
 437  */
 438
 439 /* A map of sk offsets in the regf to KEY_SEC_DESCs for quick lookup etc */
 440 typedef struct sk_map_s {
 441   int sk_off;
 442   KEY_SEC_DESC *key_sec_desc;
 443 } SK_MAP;
 444
 445 /*
 446  * Where we keep all the regf stuff for one registry.
 447  * This is the structure that we use to tie the in memory tree etc
 448  * together. By keeping separate structs, we can operate on different
 449  * registries at the same time.
 450  * Currently, the SK_MAP is an array of mapping structure.
 451  * Since we only need this on input and output, we fill in the structure
 452  * as we go on input. On output, we know how many SK items we have, so
 453  * we can allocate the structure as we need to.
 454  * If you add stuff here that is dynamically allocated, add the
 455  * appropriate free statements below.
 456  */
 457
 458 #define REGF_REGTYPE_NONE 0
 459 #define REGF_REGTYPE_NT   1
 460 #define REGF_REGTYPE_W9X  2
 461
 462 #define TTTONTTIME(r, t1, t2) (r)->last_mod_time.low = (t1); \
 463                               (r)->last_mod_time.high = (t2);
 464
 465 #define REGF_HDR_BLKSIZ 0x1000
 466
 467 typedef struct regf_struct_s {
 468   int reg_type;
 469   char *regfile_name, *outfile_name;
 470   int fd;
 471   struct stat sbuf;
 472   char *base;
 473   int modified;
 474   NTTIME last_mod_time;
 475   REG_KEY *root;  /* Root of the tree for this file */
 476   int sk_count, sk_map_size;
 477   SK_MAP **sk_map;
 478 } REGF;
 479
 480 /*
 481  * Structures for dealing with the on-disk format of the registry
 482  */
 483
 484 #define IVAL(buf) ((unsigned int) \
 485                    (unsigned int)*((unsigned char *)(buf)+3)<<24| \
 486                    (unsigned int)*((unsigned char *)(buf)+2)<<16| \
 487                    (unsigned int)*((unsigned char *)(buf)+1)<<8| \
 488                    (unsigned int)*((unsigned char *)(buf)+0))
 489
 490 #define SVAL(buf) ((unsigned short) \
 491                    (unsigned short)*((unsigned char *)(buf)+1)<<8| \
 492                    (unsigned short)*((unsigned char *)(buf)+0))
 493
 494 typedef unsigned int DWORD;
 495 typedef unsigned short WORD;
 496
 497 #define REG_REGF_ID 0x66676572
 498
 499 typedef struct regf_block {
 500   DWORD REGF_ID;     /* regf */
 501   DWORD uk1;
 502   DWORD uk2;
 503   DWORD tim1, tim2;
 504   DWORD uk3;             /* 1 */
 505   DWORD uk4;             /* 3 */
 506   DWORD uk5;             /* 0 */
 507   DWORD uk6;             /* 1 */
 508   DWORD first_key;       /* offset */
 509   unsigned int dblk_size;
 510   DWORD uk7[116];        /* 1 */
 511   DWORD chksum;
 512 } REGF_HDR;
 513
 514 typedef struct hbin_sub_struct {
 515   DWORD dblocksize;
 516   char data[1];
 517 } HBIN_SUB_HDR;
 518
 519 #define REG_HBIN_ID 0x6E696268
 520
 521 typedef struct hbin_struct {
 522   DWORD HBIN_ID; /* hbin */
 523   DWORD next_off;
 524   DWORD prev_off;
 525   DWORD uk1;
 526   DWORD uk2;
 527   DWORD uk3;
 528   DWORD uk4;
 529   DWORD blk_size;
 530   HBIN_SUB_HDR hbin_sub_hdr;
 531 } HBIN_HDR;
 532
 533 #define REG_NK_ID 0x6B6E
 534
 535 typedef struct nk_struct {
 536   WORD NK_ID;
 537   WORD type;
 538   DWORD t1, t2;
 539   DWORD uk1;
 540   DWORD own_off;
 541   DWORD subk_num;
 542   DWORD uk2;
 543   DWORD lf_off;
 544   DWORD uk3;
 545   DWORD val_cnt;
 546   DWORD val_off;
 547   DWORD sk_off;
 548   DWORD clsnam_off;
 549   DWORD unk4[4];
 550   DWORD unk5;
 551   WORD nam_len;
 552   WORD clsnam_len;
 553   char key_nam[1];  /* Actual length determined by nam_len */
 554 } NK_HDR;
 555
 556 #define REG_SK_ID 0x6B73
 557
 558 typedef struct sk_struct {
 559   WORD SK_ID;
 560   WORD uk1;
 561   DWORD prev_off;
 562   DWORD next_off;
 563   DWORD ref_cnt;
 564   DWORD rec_size;
 565   char sec_desc[1];
 566 } SK_HDR;
 567
 568 #define OFF(f) ((f) + 0x1000 + 4)
 569 #define LOCN(f) (base + OFF(f))
 570
 571 typedef struct hash_struct {
 572   DWORD nk_off;
 573   char hash[4];
 574 } HASH_REC;
 575
 576 #define REG_LF_ID 0x666C
 577
 578 typedef struct lf_struct {
 579   WORD LF_ID;
 580   WORD key_count;
 581   struct hash_struct hr[1];  /* Array of hash records, depending on key_count */
 582 } LF_HDR;
 583
 584 typedef DWORD VL_TYPE[1];  /* Value list is an array of vk rec offsets */
 585
 586 #define REG_VK_ID 0x6B76
 587
 588 typedef struct vk_struct {
 589   WORD VK_ID;
 590   WORD nam_len;
 591   DWORD dat_len;    /* If top-bit set, offset contains the data */
 592   DWORD dat_off;
 593   DWORD dat_type;
 594   WORD flag;        /* =1, has name, else no name (=Default). */
 595   WORD unk1;
 596   char dat_name[1]; /* Name starts here ... */
 597 } VK_HDR;
 598
 599 #define REG_TYPE_REGSZ     1
 600 #define REG_TYPE_EXPANDSZ  2
 601 #define REG_TYPE_BIN       3
 602 #define REG_TYPE_DWORD     4
 603 #define REG_TYPE_MULTISZ   7
 604
 605 #define OFF(f) ((f) + REGF_HDR_BLKSIZ + 4)
 606 #define LOCN(base, f) ((base) + OFF(f))
 607
 608 int nt_set_regf_input_file(REGF *regf, char *filename)
 609 {
 610   return ((regf->regfile_name = strdup(filename)) != NULL);
 611 }
 612
 613 int nt_set_regf_output_file(REGF *regf, char *filename)
 614 {
 615   return ((regf->outfile_name = strdup(filename)) != NULL);
 616 }
 617
 618 /* Create a regf structure and init it */
 619
 620 REGF *nt_create_regf()
 621 {
 622   REGF *tmp = (REGF *)malloc(sizeof(REGF));
 623   if (!tmp) return tmp;
 624   bzero(tmp, sizeof(REGF));
 625   return tmp;
 626 }
 627
 628 /* Free all the bits and pieces ... Assumes regf was malloc'd */
 629 /* If you add stuff to REGF, add the relevant free bits here  */
 630 int nt_free_regf(REGF *regf)
 631 {
 632   if (!regf) return;
 633
 634   if (regf->regfile_name) free(regf->regfile_name);
 635   if (regf->outfile_name) free(regf->outfile_name);
 636
 637   /* Free the mmap'd area */
 638
 639   if (regf->base) munmap(regf->base, regf->sbuf.st_size);
 640   regf->base = NULL;
 641   close(regf->fd);    /* Ignore the error :-) */
 642
 643   nt_delete_reg_key(regf->root); /* Free the tree */
 644   free(regf->sk_map);
 645   regf->sk_count = regf->sk_map_size = 0;
 646
 647   free(regf);
 648
 649 }
 650
 651 /* Get the header of the registry. Return a pointer to the structure
 652  * If the mmap'd area has not been allocated, then mmap the input file
 653  */
 654 REGF_HDR *nt_get_regf_hdr(REGF *regf)
 655 {
 656   if (!regf)
 657     return NULL; /* What about errors */
 658
 659   if (!regf->regfile_name)
 660     return NULL; /* What about errors */
 661
 662   if (!regf->base) { /* Try to mmap etc the file */
 663
 664     if ((regf->fd = open(regf->regfile_name, O_RDONLY, 0000)) <0) {
 665       return NULL; /* What about errors? */
 666     }
 667
 668     if (fstat(regf->fd, &regf->sbuf) < 0) {
 669       return NULL;
 670     }
 671
 672     regf->base = mmap(0, regf->sbuf.st_size, PROT_READ, MAP_SHARED, regf->fd, 0);
 673
 674     if ((int)regf->base == 1) {
 675       fprintf(stderr, "Could not mmap file: %s, %s\n", regf->regfile_name,
 676               strerror(errno));
 677       return NULL;
 678     }
 679   }
 680
 681   /*
 682    * At this point, regf->base != NULL, and we should be able to read the
 683    * header
 684    */
 685
 686   assert(regf->base != NULL);
 687
 688   return (REGF_HDR *)regf->base;
 689 }
 690
 691 int nt_get_hbin_hdr(REGF *regf, int hbin_offs)
 692 {
 693
 694   return 1;
 695 }
 696
 697 int nt_load_registry(REGF *regf)
 698 {
 699   REGF_HDR *regf_hdr;
 700   unsigned int regf_id;
 701
 702   /* Get the header */
 703
 704   if ((regf_hdr = nt_get_regf_hdr(regf)) == NULL) {
 705     return -1;
 706   }
 707
 708   /* Now process that header and start to read the rest in */
 709
 710   if ((regf_id = IVAL(&regf_hdr->REGF_ID)) != REG_REGF_ID) {
 711     fprintf(stderr, "Unrecognized NT registry header id: %0X, %s\n",
 712             regf_id, regf->regfile_name);
 713     return -1;
 714   }
 715
 716   /* Update the last mod date, and then go get the first NK record and on */
 717
 718   TTTONTTIME(regf, IVAL(&regf_hdr->tim1), IVAL(&regf_hdr->tim2));
 719
 720
 721
 722   return 1;
 723 }
 724
 725 /*
 726  * Main code from here on ...
 727  */
 728
 729 void usage(void)
 730 {
 731   fprintf(stderr, "Usage: editreg <registryfile>\n");
 732   fprintf(stderr, "Version: 0.1\n\n");
 733 }
 734
 735 int main(int argc, char *argv[])
 736 {
 737   REGF *regf;
 738
 739   if (argc < 2) {
 740     usage();
 741     exit(1);
 742   }
 743
 744   if ((regf = nt_create_regf()) == NULL) {
 745     fprintf(stderr, "Could not create registry object: %s\n", strerror(errno));
 746     exit(2);
 747   }
 748
 749   if (!nt_set_regf_input_file(regf, argv[1])) {
 750     fprintf(stderr, "Could not set name of registry file: %s, %s\n",
 751             argv[1], strerror(errno));
 752     exit(3);
 753   }
 754
 755   /* Now, open it, and bring it into memory :-) */
 756
 757   if (nt_load_registry(regf) < 0) {
 758     fprintf(stderr, "Could not load registry: %s\n", argv[1]);
 759     exit(4);
 760   }
 761 }