2 Samba Unix/Linux SMB client utility editreg.c
3 Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program; if not, write to the Free Software
17 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19 /*************************************************************************
21 A utility to edit a Windows NT/2K etc registry file.
23 Many of the ideas in here come from other people and software.
24 I first looked in Wine in misc/registry.c and was also influenced by
25 http://www.wednesday.demon.co.uk/dosreg.html
27 Which seems to contain comments from someone else. I reproduce them here
28 incase the site above disappears. It actually comes from
29 http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
31 The goal here is to read the registry into memory, manipulate it, and then
32 write it out if it was changed by any actions of the user.
34 The windows NT registry has 2 different blocks, where one can occur many
40 "regf" is obviosly the abbreviation for "Registry file". "regf" is the
41 signature of the header-block which is always 4kb in size, although only
42 the first 64 bytes seem to be used and a checksum is calculated over
43 the first 0x200 bytes only!
46 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572
47 0x00000004 D-Word ???? //see struct REGF
48 0x00000008 D-Word ???? Always the same value as at 0x00000004
49 0x0000000C Q-Word last modify date in WinNT date-format
54 0x00000024 D-Word Offset of 1st key record
55 0x00000028 D-Word Size of the data-blocks (Filesize-4kb)
57 0x000001FC D-Word Sum of all D-Words from 0x00000000 to
58 0x000001FB //XOR of all words. Nigel
60 I have analyzed more registry files (from multiple machines running
61 NT 4.0 german version) and could not find an explanation for the values
62 marked with ???? the rest of the first 4kb page is not important...
66 I don't know what "hbin" stands for, but this block is always a multiple
69 Inside these hbin-blocks the different records are placed. The memory-
70 management looks like a C-compiler heap management to me...
75 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268
76 0x0004 D-Word Offset from the 1st hbin-Block
77 0x0008 D-Word Offset to the next hbin-Block
78 0x001C D-Word Block-size
80 The values in 0x0008 and 0x001C should be the same, so I don't know
81 if they are correct or swapped...
83 From offset 0x0020 inside a hbin-block data is stored with the following
87 0x0000 D-Word Data-block size //this size must be a
91 If the size field is negative (bit 31 set), the corresponding block
92 is free and has a size of -blocksize!
94 That does not seem to be true. All block lengths seem to be negative! (Richard Sharpe)
96 The data is stored as one record per block. Block size is a multiple
97 of 4 and the last block reaches the next hbin-block, leaving no room.
99 Records in the hbin-blocks
100 ==========================
104 The nk-record can be treated as a kombination of tree-record and
105 key-record of the win 95 registry.
109 The lf-record is the counterpart to the RGKN-record (the
114 The vk-record consists information to a single value.
118 sk (? Security Key ?) is the ACL of the registry.
122 The value-lists contain information about which values are inside a
123 sub-key and don't have a header.
127 The datas of the registry are (like the value-list) stored without a
130 All offset-values are relative to the first hbin-block and point to the
131 block-size field of the record-entry. to get the file offset, you have to add
132 the header size (4kb) and the size field (4 bytes)...
137 0x0000 Word ID: ASCII-"nk" = 0x6B6E
138 0x0002 Word for the root-key: 0x2C, otherwise 0x20 //key symbolic links 0x10. Nigel
139 0x0004 Q-Word write-date/time in windows nt notation
140 0x0010 D-Word Offset of Owner/Parent key
141 0x0014 D-Word number of sub-Keys
142 0x001C D-Word Offset of the sub-key lf-Records
143 0x0024 D-Word number of values
144 0x0028 D-Word Offset of the Value-List
145 0x002C D-Word Offset of the sk-Record
147 0x0030 D-Word Offset of the Class-Name //see NK structure for the use of these fields. Nigel
148 0x0044 D-Word Unused (data-trash) //some kind of run time index. Does not appear to be important. Nigel
149 0x0048 Word name-length
150 0x004A Word class-name length
156 0x0000 D-Word Offset 1st Value
157 0x0004 D-Word Offset 2nd Value
158 0x???? D-Word Offset nth Value
160 To determine the number of values, you have to look at the owner-nk-record!
165 0x0000 Word ID: ASCII-"vk" = 0x6B76
166 0x0002 Word name length
167 0x0004 D-Word length of the data //if top bit is set when offset contains data. Nigel
168 0x0008 D-Word Offset of Data
169 0x000C D-Word Type of value
171 0x0012 Word Unused (data-trash)
174 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
176 If the data-size is lower 5, the data-offset value is used to store the data itself!
181 0x0001 RegSZ: character string (in UNICODE!)
182 0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!)
183 0x0003 RegBin: raw-binary value
184 0x0004 RegDWord: Dword
185 0x0007 RegMultiSZ: multiple strings, seperated with 0
191 0x0000 Word ID: ASCII-"lf" = 0x666C
192 0x0002 Word number of keys
193 0x0004 ???? Hash-Records
198 0x0000 D-Word Offset of corresponding "nk"-Record
199 0x0004 D-Word ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
201 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
202 key-name you have to change the hash-value too!
204 //These hashrecords must be sorted low to high within the lf record. Nigel.
208 (due to the complexity of the SAM-info, not clear jet)
209 (This is just a security descriptor in the data. R Sharpe.)
213 0x0000 Word ID: ASCII-"sk" = 0x6B73
215 0x0004 D-Word Offset of previous "sk"-Record
216 0x0008 D-Word Offset of next "sk"-Record
217 0x000C D-Word usage-counter
218 0x0010 D-Word Size of "sk"-record in bytes
220 relative security desciptor. Nigel
221 ???? ???? Security and auditing settings...
224 The usage counter counts the number of references to this
225 "sk"-record. You can use one "sk"-record for the entire registry!
227 Windows nt date/time format
228 ===========================
229 The time-format is a 64-bit integer which is incremented every
230 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
231 It starts with 0 at the 1st of january 1601 0:00! All values are
232 stored in GMT time! The time-zone is important to get the real
235 Common values for win95 and win-nt
236 ==================================
237 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
238 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
240 If a value has no data (length=0), it is displayed as empty.
242 simplyfied win-3.?? registry:
243 =============================
246 | next rec. |---+ +----->+------------+
247 | first sub | | | | Usage cnt. |
248 | name | | +-->+------------+ | | length |
249 | value | | | | next rec. | | | text |------->+-------+
250 +-----------+ | | | name rec. |--+ +------------+ | xxxxx |
251 +------------+ | | value rec. |-------->+------------+ +-------+
252 v | +------------+ | Usage cnt. |
253 +-----------+ | | length |
254 | next rec. | | | text |------->+-------+
255 | first sub |------+ +------------+ | xxxxx |
260 Greatly simplyfied structure of the nt-registry:
261 ================================================
263 +---------------------------------------------------------------+
266 +---------+ +---------->+-----------+ +----->+---------+ |
267 | "nk" | | | lf-rec. | | | nk-rec. | |
268 | ID | | | # of keys | | | parent |---+
269 | Date | | | 1st key |--+ | .... |
270 | parent | | +-----------+ +---------+
272 | values |--------------------->+----------+
273 | SK-rec. |---------------+ | 1. value |--> +----------+
274 | class |--+ | +----------+ | vk-rec. |
275 +---------+ | | | .... |
276 v | | data |--> +-------+
277 +------------+ | +----------+ | xxxxx |
278 | Class name | | +-------+
281 +---------+ +---------+
282 +----->| next sk |--->| Next sk |--+
283 | +---| prev sk |<---| prev sk | |
284 | | | .... | | ... | |
285 | | +---------+ +---------+ |
288 | +--------------------+ |
289 +----------------------------------+
291 ---------------------------------------------------------------------------
293 Hope this helps.... (Although it was "fun" for me to uncover this things,
294 it took me several sleepless nights ;)
298 *************************************************************************/
304 #include <sys/types.h>
305 #include <sys/stat.h>
307 #include <sys/mman.h>
313 #define REG_KEY_LIST_SIZE 10
315 static int verbose
= 0;
316 static int print_security
= 0;
319 * These definitions are for the in-memory registry structure.
320 * It is a tree structure that mimics what you see with tools like regedit
324 * DateTime struct for Windows
327 typedef struct date_time_s
{
328 unsigned int low
, high
;
332 * Definition of a Key. It has a name, classname, date/time last modified,
333 * sub-keys, values, and a security descriptor
336 #define REG_ROOT_KEY 1
337 #define REG_SUB_KEY 2
338 #define REG_SYM_LINK 3
340 typedef struct reg_key_s
{
341 char *name
; /* Name of the key */
343 int type
; /* One of REG_ROOT_KEY or REG_SUB_KEY */
344 NTTIME last_mod
; /* Time last modified */
345 struct reg_key_s
*owner
;
346 struct key_list_s
*sub_keys
;
347 struct val_list_s
*values
;
348 struct key_sec_desc_s
*security
;
352 * The KEY_LIST struct lists sub-keys.
355 typedef struct key_list_s
{
361 typedef struct val_key_s
{
366 void *data_blk
; /* Might want a separate block */
369 typedef struct val_list_s
{
375 #define MAXSUBAUTHS 15
378 typedef struct dom_sid_s
{
379 unsigned char ver
, auths
;
380 unsigned char auth
[6];
381 unsigned int sub_auths
[MAXSUBAUTHS
];
384 typedef struct ace_struct_s
{
385 unsigned char type
, flags
;
386 unsigned int perms
; /* Perhaps a better def is in order */
390 typedef struct acl_struct_s
{
391 unsigned short rev
, refcnt
;
392 unsigned short num_aces
;
396 typedef struct sec_desc_s
{
397 unsigned int rev
, type
;
398 DOM_SID
*owner
, *group
;
402 #define SEC_DESC_NON 0
403 #define SEC_DESC_RES 1
404 #define SEC_DESC_OCU 2
406 typedef struct key_sec_desc_s
{
407 struct key_sec_desc_s
*prev
, *next
;
414 * All of the structures below actually have a four-byte lenght before them
415 * which always seems to be negative. The following macro retrieves that
419 #define BLK_SIZE(b) ((int)*(int *)(((int *)b)-1))
421 typedef unsigned int DWORD
;
422 typedef unsigned short WORD
;
424 #define REG_REGF_ID 0x66676572
426 typedef struct regf_block
{
427 DWORD REGF_ID
; /* regf */
435 DWORD first_key
; /* offset */
436 unsigned int dblk_size
;
437 DWORD uk7
[116]; /* 1 */
441 typedef struct hbin_sub_struct
{
446 #define REG_HBIN_ID 0x6E696268
448 typedef struct hbin_struct
{
449 DWORD HBIN_ID
; /* hbin */
457 HBIN_SUB_HDR hbin_sub_hdr
;
460 #define REG_NK_ID 0x6B6E
462 typedef struct nk_struct
{
480 char key_nam
[1]; /* Actual length determined by nam_len */
483 #define REG_SK_ID 0x6B73
485 typedef struct sk_struct
{
495 typedef struct ace_struct
{
498 unsigned short length
;
503 typedef struct acl_struct
{
507 REG_ACE
*aces
; /* One or more ACEs */
510 typedef struct sec_desc_rec
{
519 typedef struct hash_struct
{
524 #define REG_LF_ID 0x666C
526 typedef struct lf_struct
{
529 struct hash_struct hr
[1]; /* Array of hash records, depending on key_count */
532 typedef DWORD VL_TYPE
[1]; /* Value list is an array of vk rec offsets */
534 #define REG_VK_ID 0x6B76
536 typedef struct vk_struct
{
539 DWORD dat_len
; /* If top-bit set, offset contains the data */
542 WORD flag
; /* =1, has name, else no name (=Default). */
544 char dat_name
[1]; /* Name starts here ... */
547 #define REG_TYPE_NONE 0
548 #define REG_TYPE_REGSZ 1
549 #define REG_TYPE_EXPANDSZ 2
550 #define REG_TYPE_BIN 3
551 #define REG_TYPE_DWORD 4
552 #define REG_TYPE_MULTISZ 7
554 typedef struct _val_str
{
559 /* A map of sk offsets in the regf to KEY_SEC_DESCs for quick lookup etc */
560 typedef struct sk_map_s
{
562 KEY_SEC_DESC
*key_sec_desc
;
565 struct regf_struct_s
{
567 char *regfile_name
, *outfile_name
;
572 NTTIME last_mod_time
;
573 REG_KEY
*root
; /* Root of the tree for this file */
574 int sk_count
, sk_map_size
;
578 typedef struct regf_struct_s REGF
;
581 * An API for accessing/creating/destroying items above
585 * Iterate over the keys, depth first, calling a function for each key
586 * and indicating if it is terminal or non-terminal and if it has values.
588 * In addition, for each value in the list, call a value list function
591 typedef int (*key_print_f
)(const char *path
, char *key_name
, char *class_name
,
592 int root
, int terminal
, int values
);
594 typedef int (*val_print_f
)(const char *path
, char *val_name
, int val_type
,
595 int data_len
, void *data_blk
, int terminal
,
596 int first
, int last
);
598 typedef int (*sec_print_f
)(SEC_DESC
*sec_desc
);
600 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, const char *path
,
601 key_print_f key_print
, sec_print_f sec_print
,
602 val_print_f val_print
);
604 int nt_val_list_iterator(REGF
*regf
, VAL_LIST
*val_list
, int bf
, char *path
,
605 int terminal
, val_print_f val_print
)
609 if (!val_list
) return 1;
611 if (!val_print
) return 1;
613 for (i
=0; i
<val_list
->val_count
; i
++) {
614 if (!val_print(path
, val_list
->vals
[i
]->name
, val_list
->vals
[i
]->data_type
,
615 val_list
->vals
[i
]->data_len
, val_list
->vals
[i
]->data_blk
,
618 (i
== val_list
->val_count
))) {
628 int nt_key_list_iterator(REGF
*regf
, KEY_LIST
*key_list
, int bf
,
630 key_print_f key_print
, sec_print_f sec_print
,
631 val_print_f val_print
)
635 if (!key_list
) return 1;
637 for (i
=0; i
< key_list
->key_count
; i
++) {
638 if (!nt_key_iterator(regf
, key_list
->keys
[i
], bf
, path
, key_print
,
639 sec_print
, val_print
)) {
646 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, const char *path
,
647 key_print_f key_print
, sec_print_f sec_print
,
648 val_print_f val_print
)
650 int path_len
= strlen(path
);
653 if (!regf
|| !key_tree
)
656 /* List the key first, then the values, then the sub-keys */
660 if (!(*key_print
)(path
, key_tree
->name
,
661 key_tree
->class_name
,
662 (key_tree
->type
== REG_ROOT_KEY
),
663 (key_tree
->sub_keys
== NULL
),
664 (key_tree
->values
?(key_tree
->values
->val_count
):0)))
669 * If we have a security print routine, call it
670 * If the security print routine returns false, stop.
673 if (key_tree
->security
&& !(*sec_print
)(key_tree
->security
->sec_desc
))
677 new_path
= (char *)malloc(path_len
+ 1 + strlen(key_tree
->name
) + 1);
678 if (!new_path
) return 0; /* Errors? */
680 strcat(new_path
, path
);
681 strcat(new_path
, key_tree
->name
);
682 strcat(new_path
, "\\");
685 * Now, iterate through the values in the val_list
688 if (key_tree
->values
&&
689 !nt_val_list_iterator(regf
, key_tree
->values
, bf
, new_path
,
690 (key_tree
->values
!=NULL
),
698 * Now, iterate through the keys in the key list
701 if (key_tree
->sub_keys
&&
702 !nt_key_list_iterator(regf
, key_tree
->sub_keys
, bf
, new_path
, key_print
,
703 sec_print
, val_print
)) {
712 REG_KEY
*nt_find_key_by_name(REG_KEY
*tree
, char *key
);
715 * Find key by name in a list ...
716 * Take the first component and search for that in the list
718 REG_KEY
*nt_find_key_in_list_by_name(KEY_LIST
*list
, char *key
)
723 if (!list
|| !key
|| !*key
) return NULL
;
725 for (i
= 0; i
<= list
->key_count
; i
++)
726 if ((res
= nt_find_key_by_name(list
->keys
[i
], key
)))
733 * Find key by name in a tree ... We will assume absolute names here, but we
734 * need the root of the tree ...
736 REG_KEY
*nt_find_key_by_name(REG_KEY
*tree
, char *key
)
738 char *lname
= NULL
, *c1
, *c2
;
741 if (!tree
|| !key
|| !*key
) return NULL
;
744 if (!lname
) return NULL
;
747 * Make sure that the first component is correct ...
750 c2
= strchr(c1
, '\\');
751 if (c2
) { /* Split here ... */
755 if (strcmp(c1
, tree
->name
) != 0) goto error
;
758 tmp
= nt_find_key_in_list_by_name(tree
->sub_keys
, c2
);
763 if (lname
) free(lname
);
767 if (lname
) free(lname
);
771 /* Make, delete keys */
773 int nt_delete_val_key(VAL_KEY
*val_key
)
777 if (val_key
->data_blk
) free(val_key
->data_blk
);
783 int nt_delete_val_list(VAL_LIST
*vl
)
788 for (i
=0; i
<vl
->val_count
; i
++)
789 nt_delete_val_key(vl
->vals
[i
]);
795 int nt_delete_reg_key(REG_KEY
*key
, int delete_name
);
796 int nt_delete_key_list(KEY_LIST
*key_list
, int delete_name
)
801 for (i
=0; i
<key_list
->key_count
; i
++)
802 nt_delete_reg_key(key_list
->keys
[i
], False
);
809 * Find the key, and if it exists, delete it ...
811 int nt_delete_key_by_name(REGF
*regf
, char *name
)
815 if (!name
|| !*name
) return 0;
817 key
= nt_find_key_by_name(regf
->root
, name
);
820 return nt_delete_reg_key(key
, True
);
827 int nt_delete_sid(DOM_SID
*sid
)
835 int nt_delete_ace(ACE
*ace
)
839 nt_delete_sid(ace
->trustee
);
846 int nt_delete_acl(ACL
*acl
)
852 for (i
=0; i
<acl
->num_aces
; i
++)
853 nt_delete_ace(acl
->aces
[i
]);
860 int nt_delete_sec_desc(SEC_DESC
*sec_desc
)
865 nt_delete_sid(sec_desc
->owner
);
866 nt_delete_sid(sec_desc
->group
);
867 nt_delete_acl(sec_desc
->sacl
);
868 nt_delete_acl(sec_desc
->dacl
);
875 int nt_delete_key_sec_desc(KEY_SEC_DESC
*key_sec_desc
)
879 key_sec_desc
->ref_cnt
--;
880 if (key_sec_desc
->ref_cnt
<=0) {
882 * There should always be a next and prev, even if they point to us
884 key_sec_desc
->next
->prev
= key_sec_desc
->prev
;
885 key_sec_desc
->prev
->next
= key_sec_desc
->next
;
886 nt_delete_sec_desc(key_sec_desc
->sec_desc
);
892 int nt_delete_reg_key(REG_KEY
*key
, int delete_name
)
896 if (key
->name
) free(key
->name
);
897 if (key
->class_name
) free(key
->class_name
);
900 * We will delete the owner if we are not the root and told to ...
903 if (key
->owner
&& key
->owner
->sub_keys
&& delete_name
) {
907 /* Find our owner, look in keylist for us and shuffle up */
908 /* Perhaps should be a function */
913 for (i
=0; i
< kl
->key_count
&& kl
->keys
[i
] != key
; i
++) {
914 /* Just find the entry ... */
917 if (i
== kl
->key_count
) {
918 fprintf(stderr
, "Bad data structure. Key not found in key list of owner\n");
924 * Shuffle up. Works for the last one also
926 for (j
= i
+ 1; j
< kl
->key_count
; j
++) {
927 kl
->keys
[j
- 1] = kl
->keys
[j
];
934 if (key
->sub_keys
) nt_delete_key_list(key
->sub_keys
, False
);
935 if (key
->values
) nt_delete_val_list(key
->values
);
936 if (key
->security
) nt_delete_key_sec_desc(key
->security
);
943 * Add a value to the key specified ...
945 REG_KEY
*nt_add_reg_value(REG_KEY
*key
, char *name
, int type
, char *value
)
952 * Delete a value. Should perhaps return the value ...
954 REG_KEY
*nt_delete_reg_valye(REG_KEY
*key
, char *name
)
961 * Add a key to the tree ... We walk down the components matching until
962 * we don't find any. There must be a match on the first component ...
963 * We return the key structure for the final component as that is
964 * often where we want to add values ...
968 * Create a 1 component key name and set its parent to parent
970 REG_KEY
*nt_create_reg_key1(char *name
, REG_KEY
*parent
)
974 if (!name
|| !*name
) return NULL
; /* A key's name cannot be empty */
976 /* There should not be more than one component */
977 if (strchr(name
, '\\')) return NULL
;
979 if (!(tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
)))) return NULL
;
981 bzero(tmp
, sizeof(REG_KEY
));
983 if (!(tmp
->name
= strdup(name
))) goto error
;
992 REG_KEY
*nt_add_reg_key(REG_KEY
*key
, char *name
, int create
);
993 REG_KEY
*nt_add_reg_key_list(REG_KEY
*key
, char * name
, int create
)
996 REG_KEY
*ret
= NULL
, *tmp
= NULL
;
998 char *lname
, *c1
, *c2
;
1000 if (!key
|| !name
|| !*name
) return NULL
;
1002 list
= key
->sub_keys
;
1003 if (!list
) { /* Create an empty list */
1005 list
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (REG_KEY_LIST_SIZE
- 1) * sizeof(REG_KEY
*));
1006 list
->key_count
= 0;
1007 list
->max_keys
= REG_KEY_LIST_SIZE
;
1011 for (i
= 0; i
< list
->key_count
; i
++) {
1012 if ((ret
= nt_add_reg_key(list
->keys
[i
], name
, create
)))
1017 * If we reach here we could not find the the first component
1021 lname
= strdup(name
);
1022 if (!lname
) return NULL
;
1025 c2
= strchr(c1
, '\\');
1026 if (c2
) { /* Split here ... */
1031 if (list
->key_count
< list
->max_keys
){
1034 else { /* Create more space in the list ... */
1035 if (!(list
= (KEY_LIST
*)realloc(list
, sizeof(KEY_LIST
) +
1036 (list
->max_keys
+ REG_KEY_LIST_SIZE
- 1)
1037 * sizeof(REG_KEY
*))));
1040 list
->max_keys
+= REG_KEY_LIST_SIZE
;
1045 * add the new key at the new slot
1046 * FIXME: Sort the list someday
1050 * We want to create the key, and then do the rest
1053 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1055 bzero(tmp
, sizeof(REG_KEY
));
1057 list
->keys
[list
->key_count
- 1] = tmp
;
1060 ret
= nt_add_reg_key(key
, name
, True
);
1065 if (lname
) free(lname
);
1069 REG_KEY
*nt_add_reg_key(REG_KEY
*key
, char *name
, int create
)
1071 char *lname
= NULL
, *c1
, *c2
;
1075 * Look until we hit the first component that does not exist, and
1076 * then add from there. However, if the first component does not
1077 * match and the path we are given is the root, then it must match
1079 if (!key
|| !name
|| !*name
) return NULL
;
1081 lname
= strdup(name
);
1082 if (!lname
) return NULL
;
1085 c2
= strchr(c1
, '\\');
1086 if (c2
) { /* Split here ... */
1092 * If we don't match, then we have to return error ...
1093 * If we do match on this component, check the next one in the
1094 * list, and if not found, add it ... short circuit, add all the
1098 if (strcmp(c1
, key
->name
) != 0)
1101 tmp
= nt_add_reg_key_list(key
, c2
, True
);
1106 if (lname
) free(lname
);
1111 * Create/delete value lists, add/delete values, count them
1116 * Create/delete security descriptors, add/delete SIDS, count SIDS, etc.
1117 * We reference count the security descriptors. Any new reference increments
1118 * the ref count. If we modify an SD, we copy the old one, dec the ref count
1119 * and make the change. We also want to be able to check for equality so
1120 * we can reduce the number of SDs in use.
1124 * Load and unload a registry file.
1126 * Load, loads it into memory as a tree, while unload sealizes/flattens it
1130 * Get the starting record for NT Registry file
1134 * Where we keep all the regf stuff for one registry.
1135 * This is the structure that we use to tie the in memory tree etc
1136 * together. By keeping separate structs, we can operate on different
1137 * registries at the same time.
1138 * Currently, the SK_MAP is an array of mapping structure.
1139 * Since we only need this on input and output, we fill in the structure
1140 * as we go on input. On output, we know how many SK items we have, so
1141 * we can allocate the structure as we need to.
1142 * If you add stuff here that is dynamically allocated, add the
1143 * appropriate free statements below.
1146 #define REGF_REGTYPE_NONE 0
1147 #define REGF_REGTYPE_NT 1
1148 #define REGF_REGTYPE_W9X 2
1150 #define TTTONTTIME(r, t1, t2) (r)->last_mod_time.low = (t1); \
1151 (r)->last_mod_time.high = (t2);
1153 #define REGF_HDR_BLKSIZ 0x1000
1156 * Structures for dealing with the on-disk format of the registry
1159 #define IVAL(buf) ((unsigned int) \
1160 (unsigned int)*((unsigned char *)(buf)+3)<<24| \
1161 (unsigned int)*((unsigned char *)(buf)+2)<<16| \
1162 (unsigned int)*((unsigned char *)(buf)+1)<<8| \
1163 (unsigned int)*((unsigned char *)(buf)+0))
1165 #define SVAL(buf) ((unsigned short) \
1166 (unsigned short)*((unsigned char *)(buf)+1)<<8| \
1167 (unsigned short)*((unsigned char *)(buf)+0))
1169 #define CVAL(buf) ((unsigned char)*((unsigned char *)(buf)))
1171 #define OFF(f) ((f) + REGF_HDR_BLKSIZ + 4)
1172 #define LOCN(base, f) ((base) + OFF(f))
1174 const VAL_STR reg_type_names
[] = {
1175 { REG_TYPE_REGSZ
, "REG_SZ" },
1176 { REG_TYPE_EXPANDSZ
, "REG_EXPAND_SZ" },
1177 { REG_TYPE_BIN
, "REG_BIN" },
1178 { REG_TYPE_DWORD
, "REG_DWORD" },
1179 { REG_TYPE_MULTISZ
, "REG_MULTI_SZ" },
1183 const char *val_to_str(unsigned int val
, const VAL_STR
*val_array
)
1187 if (!val_array
) return NULL
;
1189 while (val_array
[i
].val
&& val_array
[i
].str
) {
1191 if (val_array
[i
].val
== val
) return val_array
[i
].str
;
1201 * Convert from UniCode to Ascii ... Does not take into account other lang
1202 * Restrict by ascii_max if > 0
1204 int uni_to_ascii(unsigned char *uni
, unsigned char *ascii
, int ascii_max
,
1209 while (i
< ascii_max
&& !(!uni
[i
*2] && !uni
[i
*2+1])) {
1210 if (uni_max
> 0 && (i
*2) >= uni_max
) break;
1211 ascii
[i
] = uni
[i
*2];
1222 * Convert a data value to a string for display
1224 int data_to_ascii(unsigned char *datap
, int len
, int type
, char *ascii
, int ascii_max
)
1226 unsigned char *asciip
;
1230 case REG_TYPE_REGSZ
:
1231 if (verbose
) fprintf(stderr
, "Len: %d\n", len
);
1232 return uni_to_ascii(datap
, ascii
, len
, ascii_max
);
1235 case REG_TYPE_EXPANDSZ
:
1236 return uni_to_ascii(datap
, ascii
, len
, ascii_max
);
1241 for (i
=0; (i
<len
)&&(i
+1)*3<ascii_max
; i
++) {
1242 int str_rem
= ascii_max
- ((int)asciip
- (int)ascii
);
1243 asciip
+= snprintf(asciip
, str_rem
, "%02x", *(unsigned char *)(datap
+i
));
1244 if (i
< len
&& str_rem
> 0)
1245 *asciip
= ' '; asciip
++;
1248 return ((int)asciip
- (int)ascii
);
1251 case REG_TYPE_DWORD
:
1252 if (*(int *)datap
== 0)
1253 return snprintf(ascii
, ascii_max
, "0");
1255 return snprintf(ascii
, ascii_max
, "0x%x", *(int *)datap
);
1258 case REG_TYPE_MULTISZ
:
1271 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
, REG_KEY
*parent
);
1273 int nt_set_regf_input_file(REGF
*regf
, char *filename
)
1275 return ((regf
->regfile_name
= strdup(filename
)) != NULL
);
1278 int nt_set_regf_output_file(REGF
*regf
, char *filename
)
1280 return ((regf
->outfile_name
= strdup(filename
)) != NULL
);
1283 /* Create a regf structure and init it */
1285 REGF
*nt_create_regf(void)
1287 REGF
*tmp
= (REGF
*)malloc(sizeof(REGF
));
1288 if (!tmp
) return tmp
;
1289 bzero(tmp
, sizeof(REGF
));
1293 /* Free all the bits and pieces ... Assumes regf was malloc'd */
1294 /* If you add stuff to REGF, add the relevant free bits here */
1295 int nt_free_regf(REGF
*regf
)
1297 if (!regf
) return 0;
1299 if (regf
->regfile_name
) free(regf
->regfile_name
);
1300 if (regf
->outfile_name
) free(regf
->outfile_name
);
1302 nt_delete_reg_key(regf
->root
, False
); /* Free the tree */
1304 regf
->sk_count
= regf
->sk_map_size
= 0;
1311 /* Get the header of the registry. Return a pointer to the structure
1312 * If the mmap'd area has not been allocated, then mmap the input file
1314 REGF_HDR
*nt_get_regf_hdr(REGF
*regf
)
1317 return NULL
; /* What about errors */
1319 if (!regf
->regfile_name
)
1320 return NULL
; /* What about errors */
1322 if (!regf
->base
) { /* Try to mmap etc the file */
1324 if ((regf
->fd
= open(regf
->regfile_name
, O_RDONLY
, 0000)) <0) {
1325 return NULL
; /* What about errors? */
1328 if (fstat(regf
->fd
, ®f
->sbuf
) < 0) {
1332 regf
->base
= mmap(0, regf
->sbuf
.st_size
, PROT_READ
, MAP_SHARED
, regf
->fd
, 0);
1334 if ((int)regf
->base
== 1) {
1335 fprintf(stderr
, "Could not mmap file: %s, %s\n", regf
->regfile_name
,
1342 * At this point, regf->base != NULL, and we should be able to read the
1346 assert(regf
->base
!= NULL
);
1348 return (REGF_HDR
*)regf
->base
;
1352 * Validate a regf header
1353 * For now, do nothing, but we should check the checksum
1355 int valid_regf_hdr(REGF_HDR
*regf_hdr
)
1357 if (!regf_hdr
) return 0;
1363 * Process an SK header ...
1364 * Every time we see a new one, add it to the map. Otherwise, just look it up.
1365 * We will do a simple linear search for the moment, since many KEYs have the
1366 * same security descriptor.
1367 * We allocate the map in increments of 10 entries.
1371 * Create a new entry in the map, and increase the size of the map if needed
1374 SK_MAP
*alloc_sk_map_entry(REGF
*regf
, KEY_SEC_DESC
*tmp
, int sk_off
)
1376 if (!regf
->sk_map
) { /* Allocate a block of 10 */
1377 regf
->sk_map
= (SK_MAP
*)malloc(sizeof(SK_MAP
) * 10);
1378 if (!regf
->sk_map
) {
1382 regf
->sk_map_size
= 10;
1384 (regf
->sk_map
)[0].sk_off
= sk_off
;
1385 (regf
->sk_map
)[0].key_sec_desc
= tmp
;
1387 else { /* Simply allocate a new slot, unless we have to expand the list */
1388 int ndx
= regf
->sk_count
;
1389 if (regf
->sk_count
>= regf
->sk_map_size
) {
1390 regf
->sk_map
= (SK_MAP
*)realloc(regf
->sk_map
,
1391 (regf
->sk_map_size
+ 10)*sizeof(SK_MAP
));
1392 if (!regf
->sk_map
) {
1397 * ndx already points at the first entry of the new block
1399 regf
->sk_map_size
+= 10;
1401 (regf
->sk_map
)[ndx
].sk_off
= sk_off
;
1402 (regf
->sk_map
)[ndx
].key_sec_desc
= tmp
;
1405 return regf
->sk_map
;
1409 * Search for a KEY_SEC_DESC in the sk_map, but don't create one if not
1413 KEY_SEC_DESC
*lookup_sec_key(SK_MAP
*sk_map
, int count
, int sk_off
)
1417 if (!sk_map
) return NULL
;
1419 for (i
= 0; i
< count
; i
++) {
1421 if (sk_map
[i
].sk_off
== sk_off
)
1422 return sk_map
[i
].key_sec_desc
;
1431 * Allocate a KEY_SEC_DESC if we can't find one in the map
1434 KEY_SEC_DESC
*lookup_create_sec_key(REGF
*regf
, SK_MAP
*sk_map
, int sk_off
)
1436 KEY_SEC_DESC
*tmp
= lookup_sec_key(regf
->sk_map
, regf
->sk_count
, sk_off
);
1441 else { /* Allocate a new one */
1442 tmp
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1446 tmp
->state
= SEC_DESC_RES
;
1447 if (!alloc_sk_map_entry(regf
, tmp
, sk_off
)) {
1455 * Allocate storage and duplicate a SID
1456 * We could allocate the SID to be only the size needed, but I am too lazy.
1458 DOM_SID
*dup_sid(DOM_SID
*sid
)
1460 DOM_SID
*tmp
= (DOM_SID
*)malloc(sizeof(DOM_SID
));
1463 if (!tmp
) return NULL
;
1464 tmp
->ver
= sid
->ver
;
1465 tmp
->auths
= sid
->auths
;
1466 for (i
=0; i
<6; i
++) {
1467 tmp
->auth
[i
] = sid
->auth
[i
];
1469 for (i
=0; i
<tmp
->auths
&&i
<MAXSUBAUTHS
; i
++) {
1470 tmp
->sub_auths
[i
] = sid
->sub_auths
[i
];
1476 * Allocate space for an ACE and duplicate the registry encoded one passed in
1478 ACE
*dup_ace(REG_ACE
*ace
)
1482 tmp
= (ACE
*)malloc(sizeof(ACE
));
1484 if (!tmp
) return NULL
;
1486 tmp
->type
= CVAL(&ace
->type
);
1487 tmp
->flags
= CVAL(&ace
->flags
);
1488 tmp
->perms
= IVAL(&ace
->perms
);
1489 tmp
->trustee
= dup_sid(&ace
->trustee
);
1494 * Allocate space for an ACL and duplicate the registry encoded one passed in
1496 ACL
*dup_acl(REG_ACL
*acl
)
1502 num_aces
= IVAL(&acl
->num_aces
);
1504 tmp
= (ACL
*)malloc(sizeof(ACL
) + (num_aces
- 1)*sizeof(ACE
*));
1505 if (!tmp
) return NULL
;
1507 tmp
->num_aces
= num_aces
;
1509 tmp
->rev
= SVAL(&acl
->rev
);
1510 ace
= (REG_ACE
*)&acl
->aces
;
1511 for (i
=0; i
<num_aces
; i
++) {
1512 tmp
->aces
[i
] = dup_ace(ace
);
1513 ace
= (REG_ACE
*)((char *)ace
+ SVAL(&ace
->length
));
1514 /* XXX: FIXME, should handle malloc errors */
1520 SEC_DESC
*process_sec_desc(REGF
*regf
, REG_SEC_DESC
*sec_desc
)
1522 SEC_DESC
*tmp
= NULL
;
1524 tmp
= (SEC_DESC
*)malloc(sizeof(SEC_DESC
));
1530 tmp
->rev
= SVAL(&sec_desc
->rev
);
1531 tmp
->type
= SVAL(&sec_desc
->type
);
1532 tmp
->owner
= dup_sid((DOM_SID
*)((char *)sec_desc
+ IVAL(&sec_desc
->owner_off
)));
1537 tmp
->group
= dup_sid((DOM_SID
*)((char *)sec_desc
+ IVAL(&sec_desc
->group_off
)));
1543 /* Now pick up the SACL and DACL */
1545 if (sec_desc
->sacl_off
)
1546 tmp
->sacl
= dup_acl((REG_ACL
*)((char *)sec_desc
+ IVAL(&sec_desc
->sacl_off
)));
1550 if (sec_desc
->dacl_off
)
1551 tmp
->dacl
= dup_acl((REG_ACL
*)((char *)sec_desc
+ IVAL(&sec_desc
->dacl_off
)));
1558 KEY_SEC_DESC
*process_sk(REGF
*regf
, SK_HDR
*sk_hdr
, int sk_off
, int size
)
1560 KEY_SEC_DESC
*tmp
= NULL
;
1561 int sk_next_off
, sk_prev_off
, sk_size
;
1562 REG_SEC_DESC
*sec_desc
;
1564 if (!sk_hdr
) return NULL
;
1566 if (SVAL(&sk_hdr
->SK_ID
) != REG_SK_ID
) {
1567 fprintf(stderr
, "Unrecognized SK Header ID: %08X, %s\n", (int)sk_hdr
,
1568 regf
->regfile_name
);
1572 if (-size
< (sk_size
= IVAL(&sk_hdr
->rec_size
))) {
1573 fprintf(stderr
, "Incorrect SK record size: %d vs %d. %s\n",
1574 -size
, sk_size
, regf
->regfile_name
);
1579 * Now, we need to look up the SK Record in the map, and return it
1580 * Since the map contains the SK_OFF mapped to KEY_SEC_DESC, we can
1585 ((tmp
= lookup_sec_key(regf
->sk_map
, regf
->sk_count
, sk_off
)) != NULL
)
1586 && (tmp
->state
== SEC_DESC_OCU
)) {
1591 /* Here, we have an item in the map that has been reserved, or tmp==NULL. */
1593 assert(tmp
== NULL
|| (tmp
&& tmp
->state
!= SEC_DESC_NON
));
1596 * Now, allocate a KEY_SEC_DESC, and parse the structure here, and add the
1597 * new KEY_SEC_DESC to the mapping structure, since the offset supplied is
1598 * the actual offset of structure. The same offset will be used by
1599 * all future references to this structure
1600 * We could put all this unpleasantness in a function.
1604 tmp
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1605 if (!tmp
) return NULL
;
1606 bzero(tmp
, sizeof(KEY_SEC_DESC
));
1609 * Allocate an entry in the SK_MAP ...
1610 * We don't need to free tmp, because that is done for us if the
1611 * sm_map entry can't be expanded when we need more space in the map.
1614 if (!alloc_sk_map_entry(regf
, tmp
, sk_off
)) {
1620 tmp
->state
= SEC_DESC_OCU
;
1623 * Now, process the actual sec desc and plug the values in
1626 sec_desc
= (REG_SEC_DESC
*)&sk_hdr
->sec_desc
[0];
1627 tmp
->sec_desc
= process_sec_desc(regf
, sec_desc
);
1630 * Now forward and back links. Here we allocate an entry in the sk_map
1631 * if it does not exist, and mark it reserved
1634 sk_prev_off
= IVAL(&sk_hdr
->prev_off
);
1635 tmp
->prev
= lookup_create_sec_key(regf
, regf
->sk_map
, sk_prev_off
);
1636 assert(tmp
->prev
!= NULL
);
1637 sk_next_off
= IVAL(&sk_hdr
->next_off
);
1638 tmp
->next
= lookup_create_sec_key(regf
, regf
->sk_map
, sk_next_off
);
1639 assert(tmp
->next
!= NULL
);
1645 * Process a VK header and return a value
1647 VAL_KEY
*process_vk(REGF
*regf
, VK_HDR
*vk_hdr
, int size
)
1649 char val_name
[1024];
1650 int nam_len
, dat_len
, flag
, dat_type
, dat_off
, vk_id
;
1651 const char *val_type
;
1652 VAL_KEY
*tmp
= NULL
;
1654 if (!vk_hdr
) return NULL
;
1656 if ((vk_id
= SVAL(&vk_hdr
->VK_ID
)) != REG_VK_ID
) {
1657 fprintf(stderr
, "Unrecognized VK header ID: %0X, block: %0X, %s\n",
1658 vk_id
, (int)vk_hdr
, regf
->regfile_name
);
1662 nam_len
= SVAL(&vk_hdr
->nam_len
);
1663 val_name
[nam_len
] = '\0';
1664 flag
= SVAL(&vk_hdr
->flag
);
1665 dat_type
= IVAL(&vk_hdr
->dat_type
);
1666 dat_len
= IVAL(&vk_hdr
->dat_len
); /* If top bit, offset contains data */
1667 dat_off
= IVAL(&vk_hdr
->dat_off
);
1669 tmp
= (VAL_KEY
*)malloc(sizeof(VAL_KEY
));
1673 bzero(tmp
, sizeof(VAL_KEY
));
1674 tmp
->has_name
= flag
;
1675 tmp
->data_type
= dat_type
;
1678 strncpy(val_name
, vk_hdr
->dat_name
, nam_len
);
1679 tmp
->name
= strdup(val_name
);
1685 strncpy(val_name
, "<No Name>", 10);
1688 * Allocate space and copy the data as a BLOB
1693 char *dtmp
= (char *)malloc(dat_len
&0x7FFFFFFF);
1699 tmp
->data_blk
= dtmp
;
1701 if ((dat_len
&0x80000000) == 0) { /* The data is pointed to by the offset */
1702 char *dat_ptr
= LOCN(regf
->base
, dat_off
);
1703 bcopy(dat_ptr
, dtmp
, dat_len
);
1705 else { /* The data is in the offset */
1706 dat_len
= dat_len
& 0x7FFFFFFF;
1707 bcopy(&dat_off
, dtmp
, dat_len
);
1710 tmp
->data_len
= dat_len
;
1713 val_type
= val_to_str(dat_type
, reg_type_names
);
1716 * We need to save the data area as well
1719 if (verbose
) fprintf(stdout
, " %s : %s : \n", val_name
, val_type
);
1724 /* XXX: FIXME, free the partially allocated struct */
1730 * Process a VL Header and return a list of values
1732 VAL_LIST
*process_vl(REGF
*regf
, VL_TYPE vl
, int count
, int size
)
1736 VAL_LIST
*tmp
= NULL
;
1738 if (!vl
) return NULL
;
1740 if (-size
< (count
+1)*sizeof(int)){
1741 fprintf(stderr
, "Error in VL header format. Size less than space required. %d\n", -size
);
1745 tmp
= (VAL_LIST
*)malloc(sizeof(VAL_LIST
) + (count
- 1) * sizeof(VAL_KEY
*));
1750 for (i
=0; i
<count
; i
++) {
1751 vk_off
= IVAL(&vl
[i
]);
1752 vk_hdr
= (VK_HDR
*)LOCN(regf
->base
, vk_off
);
1753 tmp
->vals
[i
] = process_vk(regf
, vk_hdr
, BLK_SIZE(vk_hdr
));
1759 tmp
->val_count
= count
;
1764 /* XXX: FIXME, free the partially allocated structure */
1769 * Process an LF Header and return a list of sub-keys
1771 KEY_LIST
*process_lf(REGF
*regf
, LF_HDR
*lf_hdr
, int size
, REG_KEY
*parent
)
1773 int count
, i
, nk_off
;
1777 if (!lf_hdr
) return NULL
;
1779 if ((lf_id
= SVAL(&lf_hdr
->LF_ID
)) != REG_LF_ID
) {
1780 fprintf(stderr
, "Unrecognized LF Header format: %0X, Block: %0X, %s.\n",
1781 lf_id
, (int)lf_hdr
, regf
->regfile_name
);
1787 count
= SVAL(&lf_hdr
->key_count
);
1789 if (count
<= 0) return NULL
;
1791 /* Now, we should allocate a KEY_LIST struct and fill it in ... */
1793 tmp
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (count
- 1) * sizeof(REG_KEY
*));
1798 tmp
->key_count
= count
;
1799 tmp
->max_keys
= count
;
1801 for (i
=0; i
<count
; i
++) {
1804 nk_off
= IVAL(&lf_hdr
->hr
[i
].nk_off
);
1805 nk_hdr
= (NK_HDR
*)LOCN(regf
->base
, nk_off
);
1806 tmp
->keys
[i
] = nt_get_key_tree(regf
, nk_hdr
, BLK_SIZE(nk_hdr
), parent
);
1807 if (!tmp
->keys
[i
]) {
1815 if (tmp
) nt_delete_key_list(tmp
, False
);
1820 * This routine is passed an NK_HDR pointer and retrieves the entire tree
1821 * from there down. It returns a REG_KEY *.
1823 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
, REG_KEY
*parent
)
1825 REG_KEY
*tmp
= NULL
, *own
;
1826 int name_len
, clsname_len
, lf_off
, val_off
, val_count
, sk_off
, own_off
;
1831 char key_name
[1024], cls_name
[1024];
1833 if (!nk_hdr
) return NULL
;
1835 if ((nk_id
= SVAL(&nk_hdr
->NK_ID
)) != REG_NK_ID
) {
1836 fprintf(stderr
, "Unrecognized NK Header format: %08X, Block: %0X. %s\n",
1837 nk_id
, (int)nk_hdr
, regf
->regfile_name
);
1843 name_len
= SVAL(&nk_hdr
->nam_len
);
1844 clsname_len
= SVAL(&nk_hdr
->clsnam_len
);
1847 * The value of -size should be ge
1848 * (sizeof(NK_HDR) - 1 + name_len)
1849 * The -1 accounts for the fact that we included the first byte of
1850 * the name in the structure. clsname_len is the length of the thing
1851 * pointed to by clsnam_off
1854 if (-size
< (sizeof(NK_HDR
) - 1 + name_len
)) {
1855 fprintf(stderr
, "Incorrect NK_HDR size: %d, %0X\n", -size
, (int)nk_hdr
);
1856 fprintf(stderr
, "Sizeof NK_HDR: %d, name_len %d, clsname_len %d\n",
1857 sizeof(NK_HDR
), name_len
, clsname_len
);
1861 if (verbose
) fprintf(stdout
, "NK HDR: Name len: %d, class name len: %d\n",
1862 name_len
, clsname_len
);
1864 /* Fish out the key name and process the LF list */
1866 assert(name_len
< sizeof(key_name
));
1868 /* Allocate the key struct now */
1869 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1870 if (!tmp
) return tmp
;
1871 bzero(tmp
, sizeof(REG_KEY
));
1873 tmp
->type
= (SVAL(&nk_hdr
->type
)==0x2C?REG_ROOT_KEY
:REG_SUB_KEY
);
1875 strncpy(key_name
, nk_hdr
->key_nam
, name_len
);
1876 key_name
[name_len
] = '\0';
1878 if (verbose
) fprintf(stdout
, "Key name: %s\n", key_name
);
1880 tmp
->name
= strdup(key_name
);
1886 * Fish out the class name, it is in UNICODE, while the key name is
1890 if (clsname_len
) { /* Just print in Ascii for now */
1894 clsnam_off
= IVAL(&nk_hdr
->clsnam_off
);
1895 clsnamep
= LOCN(regf
->base
, clsnam_off
);
1897 bzero(cls_name
, clsname_len
);
1898 uni_to_ascii(clsnamep
, cls_name
, sizeof(cls_name
), clsname_len
);
1901 * I am keeping class name as an ascii string for the moment.
1902 * That means it needs to be converted on output.
1903 * It will also piss off people who need Unicode/UTF-8 strings. Sorry.
1907 tmp
->class_name
= strdup(cls_name
);
1908 if (!tmp
->class_name
) {
1912 if (verbose
) fprintf(stdout
, " Class Name: %s\n", cls_name
);
1917 * Process the owner offset ...
1920 own_off
= IVAL(&nk_hdr
->own_off
);
1921 own
= (REG_KEY
*)LOCN(regf
->base
, own_off
);
1923 if (verbose
) fprintf(stdout
, " Owner offset: %0X, Our Offset: %0X\n",
1924 (unsigned int)own
, (unsigned int)nk_hdr
);
1927 * We should verify that the owner field is correct ...
1928 * for now, we don't worry ...
1931 tmp
->owner
= parent
;
1934 * If there are any values, process them here
1937 val_count
= IVAL(&nk_hdr
->val_cnt
);
1941 val_off
= IVAL(&nk_hdr
->val_off
);
1942 vl
= (VL_TYPE
*)LOCN(regf
->base
, val_off
);
1944 tmp
->values
= process_vl(regf
, *vl
, val_count
, BLK_SIZE(vl
));
1952 * Also handle the SK header ...
1955 sk_off
= IVAL(&nk_hdr
->sk_off
);
1956 sk_hdr
= (SK_HDR
*)LOCN(regf
->base
, sk_off
);
1960 tmp
->security
= process_sk(regf
, sk_hdr
, sk_off
, BLK_SIZE(sk_hdr
));
1964 lf_off
= IVAL(&nk_hdr
->lf_off
);
1967 * No more subkeys if lf_off == -1
1972 lf_hdr
= (LF_HDR
*)LOCN(regf
->base
, lf_off
);
1974 tmp
->sub_keys
= process_lf(regf
, lf_hdr
, BLK_SIZE(lf_hdr
), tmp
);
1975 if (!tmp
->sub_keys
){
1984 if (tmp
) nt_delete_reg_key(tmp
, False
);
1988 int nt_load_registry(REGF
*regf
)
1991 unsigned int regf_id
, hbin_id
;
1995 /* Get the header */
1997 if ((regf_hdr
= nt_get_regf_hdr(regf
)) == NULL
) {
2001 /* Now process that header and start to read the rest in */
2003 if ((regf_id
= IVAL(®f_hdr
->REGF_ID
)) != REG_REGF_ID
) {
2004 fprintf(stderr
, "Unrecognized NT registry header id: %0X, %s\n",
2005 regf_id
, regf
->regfile_name
);
2010 * Validate the header ...
2012 if (!valid_regf_hdr(regf_hdr
)) {
2013 fprintf(stderr
, "Registry file header does not validate: %s\n",
2014 regf
->regfile_name
);
2018 /* Update the last mod date, and then go get the first NK record and on */
2020 TTTONTTIME(regf
, IVAL(®f_hdr
->tim1
), IVAL(®f_hdr
->tim2
));
2023 * The hbin hdr seems to be just uninteresting garbage. Check that
2024 * it is there, but that is all.
2027 hbin_hdr
= (HBIN_HDR
*)(regf
->base
+ REGF_HDR_BLKSIZ
);
2029 if ((hbin_id
= IVAL(&hbin_hdr
->HBIN_ID
)) != REG_HBIN_ID
) {
2030 fprintf(stderr
, "Unrecognized registry hbin hdr ID: %0X, %s\n",
2031 hbin_id
, regf
->regfile_name
);
2036 * Get a pointer to the first key from the hreg_hdr
2039 first_key
= (NK_HDR
*)LOCN(regf
->base
, IVAL(®f_hdr
->first_key
));
2042 * Now, get the registry tree by processing that NK recursively
2045 regf
->root
= nt_get_key_tree(regf
, first_key
, BLK_SIZE(first_key
), NULL
);
2047 assert(regf
->root
!= NULL
);
2050 * Unmap the registry file, as we might want to read in another
2054 if (regf
->base
) munmap(regf
->base
, regf
->sbuf
.st_size
);
2056 close(regf
->fd
); /* Ignore the error :-) */
2062 * Story the registry in the output file
2064 int nt_store_registry(REGF
*regf
)
2071 * Routines to parse a REGEDIT4 file
2073 * The file consists of:
2080 * [cmd:]name=type:value
2082 * cmd = a|d|c|add|delete|change|as|ds|cs
2084 * There can be more than one key-path and value-spec.
2086 * Since we want to support more than one type of file format, we
2087 * construct a command-file structure that keeps info about the command file
2090 #define FMT_UNREC -1
2091 #define FMT_REGEDIT4 0
2092 #define FMT_EDITREG1_1 1
2094 #define FMT_STRING_REGEDIT4 "REGEDIT4"
2095 #define FMT_STRING_EDITREG1_0 "EDITREG1.0"
2098 #define CMD_ADD_KEY 1
2099 #define CMD_DEL_KEY 2
2104 typedef struct val_spec_list
{
2105 struct val_spec_list
*next
;
2108 char *val
; /* Kept as a char string, really? */
2111 typedef struct command_s
{
2115 VAL_SPEC_LIST
*val_spec_list
, *val_spec_last
;
2118 typedef struct cmd_line
{
2124 * Some routines to handle lines of info in the command files
2126 void skip_to_eol(int fd
)
2131 while ((rc
= read(fd
, &ch
, 1)) == 1) {
2132 if (ch
== 0x0A) return;
2135 fprintf(stderr
, "Could not read file descriptor: %d, %s\n",
2136 fd
, strerror(errno
));
2141 void free_cmd(CMD
*cmd
)
2145 while (cmd
->val_spec_list
) {
2148 tmp
= cmd
->val_spec_list
;
2149 cmd
->val_spec_list
= tmp
->next
;
2157 void free_cmd_line(CMD_LINE
*cmd_line
)
2160 if (cmd_line
->line
) free(cmd_line
->line
);
2165 void print_line(struct cmd_line
*cl
)
2171 if ((pl
= malloc(cl
->line_len
+ 1)) == NULL
) {
2172 fprintf(stderr
, "Unable to allocate space to print line: %s\n",
2177 strncpy(pl
, cl
->line
, cl
->line_len
);
2178 pl
[cl
->line_len
] = 0;
2180 fprintf(stdout
, "%s\n", pl
);
2184 #define INIT_ALLOC 10
2187 * Read a line from the input file.
2188 * NULL returned when EOF and no chars read
2189 * Otherwise we return a cmd_line *
2190 * Exit if other errors
2192 struct cmd_line
*get_cmd_line(int fd
)
2194 struct cmd_line
*cl
= (CMD_LINE
*)malloc(sizeof(CMD_LINE
));
2199 fprintf(stderr
, "Unable to allocate structure for command line: %s\n",
2204 cl
->len
= INIT_ALLOC
;
2207 * Allocate some space for the line. We extend later if needed.
2210 if ((cl
->line
= (char *)malloc(INIT_ALLOC
)) == NULL
) {
2211 fprintf(stderr
, "Unable to allocate initial space for line: %s\n",
2217 * Now read in the chars to EOL. Don't store the EOL in the
2218 * line. What about CR?
2221 while ((rc
= read(fd
, &ch
, 1)) == 1 && ch
!= '\n') {
2222 if (ch
== '\r') continue; /* skip CR */
2225 * Allocate some more memory
2227 if ((cl
->line
= realloc(cl
->line
, cl
->len
+ INIT_ALLOC
)) == NULL
) {
2228 fprintf(stderr
, "Unable to realloc space for line: %s\n",
2232 cl
->len
+= INIT_ALLOC
;
2238 /* read 0 and we were at loc'n 0, return NULL */
2239 if (rc
== 0 && i
== 0) {
2251 * parse_value: parse out a value. We pull it apart as:
2253 * <value> ::= <value-name>=<type>:<value-string>
2255 * <value-name> ::= char-string-without-spaces | '"' char-string '"'
2257 * If it parsed OK, return the <value-name> as a string, and the
2258 * value type and value-string in parameters.
2260 * The value name can be empty. There can only be one empty name in
2261 * a list of values. A value of - removes the value entirely.
2264 char *dup_str(char *s
, int len
)
2267 nstr
= (char *)malloc(len
+ 1);
2269 memcpy(nstr
, s
, len
);
2275 char *parse_name(char *nstr
)
2277 int len
= 0, start
= 0;
2278 if (!nstr
) return NULL
;
2282 while (len
&& nstr
[len
- 1] == ' ') len
--;
2284 nstr
[len
] = 0; /* Trim any spaces ... if there were none, doesn't matter */
2287 * Beginning and end should be '"' or neither should be so
2289 if ((nstr
[0] == '"' && nstr
[len
- 1] != '"') ||
2290 (nstr
[0] != '"' && nstr
[len
- 1] == '"'))
2293 if (nstr
[0] == '"') {
2298 return dup_str(&nstr
[start
], len
);
2301 int parse_value_type(char *tstr
)
2303 int len
= strlen(tstr
);
2305 while (len
&& tstr
[len
- 1] == ' ') len
--;
2308 if (strcmp(tstr
, "REG_DWORD") == 0)
2309 return REG_TYPE_DWORD
;
2310 else if (strcmp(tstr
, "dword") == 0)
2311 return REG_TYPE_DWORD
;
2312 else if (strcmp(tstr
, "REG_EXPAND_SZ") == 0)
2313 return REG_TYPE_EXPANDSZ
;
2314 else if (strcmp(tstr
, "REG_BIN") == 0)
2315 return REG_TYPE_BIN
;
2316 else if (strcmp(tstr
, "REG_SZ") == 0)
2317 return REG_TYPE_REGSZ
;
2318 else if (strcmp(tstr
, "REG_MULTI_SZ") == 0)
2319 return REG_TYPE_MULTISZ
;
2324 char *parse_val_str(char *vstr
)
2327 return dup_str(vstr
, strlen(vstr
));
2331 char *parse_value(struct cmd_line
*cl
, int *vtype
, char **val
)
2333 char *p1
= NULL
, *p2
= NULL
, *nstr
= NULL
, *tstr
= NULL
, *vstr
= NULL
;
2335 if (!cl
|| !vtype
|| !val
) return NULL
;
2336 if (!cl
->line_len
) return NULL
;
2338 p1
= dup_str(cl
->line
, cl
->line_len
);
2339 /* FIXME: Better return codes etc ... */
2340 if (!p1
) return NULL
;
2341 p2
= strchr(p1
, '=');
2342 if (!p2
) return NULL
;
2344 *p2
= 0; p2
++; /* Split into two strings at p2 */
2346 /* Now, parse the name ... */
2348 nstr
= parse_name(p1
);
2349 if (!nstr
) goto error
;
2351 /* Now, split the remainder and parse on type and val ... */
2354 while (*tstr
== ' ') tstr
++; /* Skip leading white space */
2355 p2
= strchr(p2
, ':');
2357 if (!p2
) goto error
;
2359 *p2
= 0; p2
++; /* split on the : */
2361 *vtype
= parse_value_type(tstr
);
2363 if (!vtype
) goto error
;
2365 /* Now, parse the value string. It should return a newly malloc'd string */
2367 while (*p2
== ' ') p2
++; /* Skip leading space */
2368 vstr
= parse_val_str(p2
);
2370 if (!vstr
) goto error
;
2378 if (nstr
) free(nstr
);
2379 if (vstr
) free(vstr
);
2384 * Parse out a key. Look for a correctly formatted key [...]
2385 * and whether it is a delete or add? A delete is signalled
2386 * by a - in front of the key.
2387 * Assumes that there are no leading and trailing spaces
2390 char *parse_key(struct cmd_line
*cl
, int *cmd
)
2395 if (cl
->line
[0] != '[' ||
2396 cl
->line
[cl
->line_len
- 1] != ']') return NULL
;
2397 if (cl
->line_len
== 2) return NULL
;
2399 if (cl
->line
[1] == '-') {
2400 if (cl
->line_len
== 3) return NULL
;
2404 tmp
= malloc(cl
->line_len
- 1 - start
+ 1);
2405 if (!tmp
) return tmp
; /* Bail out on no mem ... FIXME */
2406 strncpy(tmp
, &cl
->line
[start
], cl
->line_len
- 1 - start
);
2407 tmp
[cl
->line_len
- 1 - start
] = 0;
2412 * Parse a line to determine if we have a key or a value
2413 * We only check for key or val ...
2416 int parse_line(struct cmd_line
*cl
)
2419 if (!cl
|| cl
->len
== 0) return 0;
2421 if (cl
->line
[0] == '[') /* No further checking for now */
2428 * We seek to offset 0, read in the required number of bytes,
2429 * and compare to the correct value.
2430 * We then seek back to the original location
2432 int regedit4_file_type(int fd
)
2437 cur_ofs
= lseek(fd
, 0, SEEK_CUR
); /* Get current offset */
2439 fprintf(stderr
, "Unable to get current offset: %s\n", strerror(errno
));
2440 exit(1); /* FIXME */
2444 lseek(fd
, 0, SEEK_SET
);
2447 if (read(fd
, desc
, 8) < 8) {
2448 fprintf(stderr
, "Unable to read command file format\n");
2449 exit(2); /* FIXME */
2454 if (strcmp(desc
, FMT_STRING_REGEDIT4
) == 0) {
2456 lseek(fd
, cur_ofs
, SEEK_SET
);
2461 return FMT_REGEDIT4
;
2468 * Run though the data in the line and strip anything after a comment
2471 void strip_comment(struct cmd_line
*cl
)
2477 for (i
= 0; i
< cl
->line_len
; i
++) {
2478 if (cl
->line
[i
] == ';') {
2486 * trim leading space
2489 void trim_leading_spaces(struct cmd_line
*cl
)
2495 for (i
= 0; i
< cl
->line_len
; i
++) {
2496 if (cl
->line
[i
] != ' '){
2497 if (i
) memcpy(cl
->line
, &cl
->line
[i
], cl
->line_len
- i
);
2504 * trim trailing spaces
2506 void trim_trailing_spaces(struct cmd_line
*cl
)
2512 for (i
= cl
->line_len
; i
== 0; i
--) {
2513 if (cl
->line
[i
-1] != ' ' &&
2514 cl
->line
[i
-1] != '\t') {
2521 * Get a command ... This consists of possibly multiple lines:
2524 * possibly Empty line
2526 * value ::= <value-name>=<value-type>':'<value-string>
2527 * <value-name> is some path, possibly enclosed in quotes ...
2528 * We alctually look for the next key to terminate a previous key
2530 CMD
*regedit4_get_cmd(int fd
)
2532 struct command_s
*cmd
= NULL
;
2533 struct cmd_line
*cl
= NULL
;
2534 struct val_spec_list
*vl
= NULL
;
2536 if ((cmd
= (struct command_s
*)malloc(sizeof(struct command_s
))) == NULL
) {
2537 fprintf(stderr
, "Unable to malloc space for command: %s\n",
2542 cmd
->cmd
= CMD_NONE
;
2544 cmd
->val_spec_list
= cmd
->val_spec_last
= NULL
;
2545 while ((cl
= get_cmd_line(fd
))) {
2547 strip_comment(cl
); /* remove anything beyond a comment char */
2548 trim_trailing_spaces(cl
);
2549 trim_leading_spaces(cl
);
2551 if (cl
->line_len
== 0) { /* An empty line */
2554 else { /* Else, non-empty ... */
2556 * Parse out the bits ...
2558 switch (parse_line(cl
)) {
2560 if ((cmd
->key
= parse_key(cl
, &cmd
->cmd
)) == NULL
) {
2561 fprintf(stderr
, "Error parsing key from line: ");
2563 fprintf(stderr
, "\n");
2569 * We need to add the value stuff to the list
2570 * There could be a \ on the end which we need to
2571 * handle at some time
2573 vl
= (struct val_spec_list
*)malloc(sizeof(struct val_spec_list
));
2574 if (!vl
) goto error
;
2576 vl
->name
= parse_value(cl
, &vl
->type
, &vl
->val
);
2577 if (!vl
->name
) goto error
;
2578 if (cmd
->val_spec_list
== NULL
) {
2579 cmd
->val_spec_list
= cmd
->val_spec_last
= vl
;
2582 cmd
->val_spec_last
->next
= vl
;
2583 cmd
->val_spec_last
= vl
;
2589 fprintf(stderr
, "Unrecognized line in command file: \n");
2596 if (!cmd
->cmd
) goto error
; /* End of file ... */
2602 if (cmd
) free_cmd(cmd
);
2606 int regedit4_exec_cmd(CMD
*cmd
)
2612 int editreg_1_0_file_type(int fd
)
2617 cur_ofs
= lseek(fd
, 0, SEEK_CUR
); /* Get current offset */
2619 fprintf(stderr
, "Unable to get current offset: %s\n", strerror(errno
));
2620 exit(1); /* FIXME */
2624 lseek(fd
, 0, SEEK_SET
);
2627 if (read(fd
, desc
, 10) < 10) {
2628 fprintf(stderr
, "Unable to read command file format\n");
2629 exit(2); /* FIXME */
2634 if (strcmp(desc
, FMT_STRING_EDITREG1_0
) == 0) {
2635 lseek(fd
, cur_ofs
, SEEK_SET
);
2636 return FMT_REGEDIT4
;
2642 CMD
*editreg_1_0_get_cmd(int fd
)
2647 int editreg_1_0_exec_cmd(CMD
*cmd
)
2653 typedef struct command_ops_s
{
2655 int (*file_type
)(int fd
);
2656 CMD
*(*get_cmd
)(int fd
);
2657 int (*exec_cmd
)(CMD
*cmd
);
2660 CMD_OPS default_cmd_ops
[] = {
2661 {0, regedit4_file_type
, regedit4_get_cmd
, regedit4_exec_cmd
},
2662 {1, editreg_1_0_file_type
, editreg_1_0_get_cmd
, editreg_1_0_exec_cmd
},
2663 {-1, NULL
, NULL
, NULL
}
2666 typedef struct command_file_s
{
2673 * Create a new command file structure
2676 CMD_FILE
*cmd_file_create(char *file
)
2683 * Let's check if the file exists ...
2684 * No use creating the cmd_file structure if the file does not exist
2687 if (stat(file
, &sbuf
) < 0) { /* Not able to access file */
2692 tmp
= (CMD_FILE
*)malloc(sizeof(CMD_FILE
));
2698 * Let's fill in some of the fields;
2701 tmp
->name
= strdup(file
);
2703 if ((tmp
->fd
= open(file
, O_RDONLY
, 666)) < 0) {
2709 * Now, try to find the format by indexing through the table
2711 while (default_cmd_ops
[i
].type
!= -1) {
2712 if ((tmp
->type
= default_cmd_ops
[i
].file_type(tmp
->fd
)) >= 0) {
2713 tmp
->cmd_ops
= default_cmd_ops
[i
];
2720 * If we got here, return NULL, as we could not figure out the type
2723 * What about errors?
2731 * Extract commands from the command file, and execute them.
2732 * We pass a table of command callbacks for that
2736 * Main code from here on ...
2740 * key print function here ...
2743 int print_key(const char *path
, char *name
, char *class_name
, int root
,
2744 int terminal
, int vals
)
2747 /*if (terminal)*/ fprintf(stdout
, "[%s%s]\n", path
, name
);
2753 * Sec Desc print functions
2756 void print_type(unsigned char type
)
2760 fprintf(stdout
, " ALLOW");
2763 fprintf(stdout
, " DENY");
2766 fprintf(stdout
, " AUDIT");
2769 fprintf(stdout
, " ALARM");
2772 fprintf(stdout
, "ALLOW CPD");
2775 fprintf(stdout
, "OBJ ALLOW");
2778 fprintf(stdout
, " OBJ DENY");
2780 fprintf(stdout
, " UNKNOWN");
2785 void print_flags(unsigned char flags
)
2787 char flg_output
[21];
2792 fprintf(stdout
, " ");
2796 if (some
) strcat(flg_output
, ",");
2798 strcat(flg_output
, "OI");
2801 if (some
) strcat(flg_output
, ",");
2803 strcat(flg_output
, "CI");
2806 if (some
) strcat(flg_output
, ",");
2808 strcat(flg_output
, "NP");
2811 if (some
) strcat(flg_output
, ",");
2813 strcat(flg_output
, "IO");
2816 if (some
) strcat(flg_output
, ",");
2818 strcat(flg_output
, "IA");
2821 if (some
) strcat(flg_output
, ",");
2823 strcat(flg_output
, "VI");
2825 fprintf(stdout
, " %s", flg_output
);
2828 void print_perms(int perms
)
2830 fprintf(stdout
, " %8X", perms
);
2833 void print_sid(DOM_SID
*sid
)
2835 int i
, comps
= sid
->auths
;
2836 fprintf(stdout
, "S-%u-%u", sid
->ver
, sid
->auth
[5]);
2838 for (i
= 0; i
< comps
; i
++) {
2840 fprintf(stdout
, "-%u", sid
->sub_auths
[i
]);
2843 fprintf(stdout
, "\n");
2846 void print_acl(ACL
*acl
, char *prefix
)
2850 for (i
= 0; i
< acl
->num_aces
; i
++) {
2851 fprintf(stdout
, ";;%s", prefix
);
2852 print_type(acl
->aces
[i
]->type
);
2853 print_flags(acl
->aces
[i
]->flags
);
2854 print_perms(acl
->aces
[i
]->perms
);
2855 fprintf(stdout
, " ");
2856 print_sid(acl
->aces
[i
]->trustee
);
2860 int print_sec(SEC_DESC
*sec_desc
)
2862 if (!print_security
) return 1;
2863 fprintf(stdout
, ";; SECURITY\n");
2864 fprintf(stdout
, ";; Owner: ");
2865 print_sid(sec_desc
->owner
);
2866 fprintf(stdout
, ";; Group: ");
2867 print_sid(sec_desc
->group
);
2868 if (sec_desc
->sacl
) {
2869 fprintf(stdout
, ";; SACL:\n");
2870 print_acl(sec_desc
->sacl
, " ");
2872 if (sec_desc
->dacl
) {
2873 fprintf(stdout
, ";; DACL:\n");
2874 print_acl(sec_desc
->dacl
, " ");
2880 * Value print function here ...
2882 int print_val(const char *path
, char *val_name
, int val_type
, int data_len
,
2883 void *data_blk
, int terminal
, int first
, int last
)
2885 char data_asc
[1024];
2887 bzero(data_asc
, sizeof(data_asc
));
2888 if (!terminal
&& first
)
2889 fprintf(stdout
, "%s\n", path
);
2890 data_to_ascii((unsigned char *)data_blk
, data_len
, val_type
, data_asc
,
2891 sizeof(data_asc
) - 1);
2892 fprintf(stdout
, " %s = %s : %s\n", (val_name
?val_name
:"<No Name>"),
2893 val_to_str(val_type
, reg_type_names
), data_asc
);
2899 fprintf(stderr
, "Usage: editreg [-v] [-p] [-k] [-s] [-c <command-file>] <registryfile>\n");
2900 fprintf(stderr
, "Version: 0.1\n\n");
2901 fprintf(stderr
, "\n\t-v\t sets verbose mode");
2902 fprintf(stderr
, "\n\t-p\t prints the registry");
2903 fprintf(stderr
, "\n\t-s\t prints security descriptors");
2904 fprintf(stderr
, "\n\t-c <command-file>\t specifies a command file");
2905 fprintf(stderr
, "\n");
2908 int main(int argc
, char *argv
[])
2911 extern char *optarg
;
2913 int opt
, print_keys
= 0;
2914 int regf_opt
= 1; /* Command name */
2916 char *cmd_file_name
= NULL
;
2917 char *out_file_name
= NULL
;
2918 CMD_FILE
*cmd_file
= NULL
;
2926 * Now, process the arguments
2929 while ((opt
= getopt(argc
, argv
, "spvko:c:")) != EOF
) {
2933 cmd_file_name
= optarg
;
2938 out_file_name
= optarg
;
2968 if ((regf
= nt_create_regf()) == NULL
) {
2969 fprintf(stderr
, "Could not create registry object: %s\n", strerror(errno
));
2973 if (regf_opt
< argc
) { /* We have a registry file */
2974 if (!nt_set_regf_input_file(regf
, argv
[regf_opt
])) {
2975 fprintf(stderr
, "Could not set name of registry file: %s, %s\n",
2976 argv
[regf_opt
], strerror(errno
));
2980 /* Now, open it, and bring it into memory :-) */
2982 if (nt_load_registry(regf
) < 0) {
2983 fprintf(stderr
, "Could not load registry: %s\n", argv
[1]);
2988 if (out_file_name
) {
2989 if (!nt_set_regf_output_file(regf
, out_file_name
)) {
2990 fprintf(stderr
, "Could not set name of output registry file: %s, %s\n",
2991 out_file_name
, strerror(errno
));
3000 cmd_file
= cmd_file_create(cmd_file_name
);
3002 while ((cmd
= cmd_file
->cmd_ops
.get_cmd(cmd_file
->fd
)) != NULL
) {
3005 * Now, apply the requests to the tree ...
3014 * Any value does not matter ...
3015 * Find the key if it exists, and delete it ...
3018 nt_delete_key_by_name(regf
, cmd
->key
);
3026 * At this point, we should have a registry in memory and should be able
3027 * to iterate over it.
3031 nt_key_iterator(regf
, regf
->root
, 0, "", print_key
, print_sec
, print_val
);