2 Samba Unix/Linux SMB client utility editreg.c
3 Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program; if not, write to the Free Software
17 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19 /*************************************************************************
21 A utility to edit a Windows NT/2K etc registry file.
23 Many of the ideas in here come from other people and software.
24 I first looked in Wine in misc/registry.c and was also influenced by
25 http://www.wednesday.demon.co.uk/dosreg.html
27 Which seems to contain comments from someone else. I reproduce them here
28 incase the site above disappears. It actually comes from
29 http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt.
31 The goal here is to read the registry into memory, manipulate it, and then
32 write it out if it was changed by any actions of the user.
34 The windows NT registry has 2 different blocks, where one can occur many
40 "regf" is obviosly the abbreviation for "Registry file". "regf" is the
41 signature of the header-block which is always 4kb in size, although only
42 the first 64 bytes seem to be used and a checksum is calculated over
43 the first 0x200 bytes only!
46 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572
47 0x00000004 D-Word ???? //see struct REGF
48 0x00000008 D-Word ???? Always the same value as at 0x00000004
49 0x0000000C Q-Word last modify date in WinNT date-format
54 0x00000024 D-Word Offset of 1st key record
55 0x00000028 D-Word Size of the data-blocks (Filesize-4kb)
57 0x000001FC D-Word Sum of all D-Words from 0x00000000 to
58 0x000001FB //XOR of all words. Nigel
60 I have analyzed more registry files (from multiple machines running
61 NT 4.0 german version) and could not find an explanation for the values
62 marked with ???? the rest of the first 4kb page is not important...
66 I don't know what "hbin" stands for, but this block is always a multiple
69 Inside these hbin-blocks the different records are placed. The memory-
70 management looks like a C-compiler heap management to me...
75 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268
76 0x0004 D-Word Offset from the 1st hbin-Block
77 0x0008 D-Word Offset to the next hbin-Block
78 0x001C D-Word Block-size
80 The values in 0x0008 and 0x001C should be the same, so I don't know
81 if they are correct or swapped...
83 From offset 0x0020 inside a hbin-block data is stored with the following
87 0x0000 D-Word Data-block size //this size must be a
91 If the size field is negative (bit 31 set), the corresponding block
92 is free and has a size of -blocksize!
94 That does not seem to be true. All block lengths seem to be negative! (Richard Sharpe)
96 The data is stored as one record per block. Block size is a multiple
97 of 4 and the last block reaches the next hbin-block, leaving no room.
99 Records in the hbin-blocks
100 ==========================
104 The nk-record can be treated as a kombination of tree-record and
105 key-record of the win 95 registry.
109 The lf-record is the counterpart to the RGKN-record (the
114 The vk-record consists information to a single value.
118 sk (? Security Key ?) is the ACL of the registry.
122 The value-lists contain information about which values are inside a
123 sub-key and don't have a header.
127 The datas of the registry are (like the value-list) stored without a
130 All offset-values are relative to the first hbin-block and point to the
131 block-size field of the record-entry. to get the file offset, you have to add
132 the header size (4kb) and the size field (4 bytes)...
137 0x0000 Word ID: ASCII-"nk" = 0x6B6E
138 0x0002 Word for the root-key: 0x2C, otherwise 0x20 //key symbolic links 0x10. Nigel
139 0x0004 Q-Word write-date/time in windows nt notation
140 0x0010 D-Word Offset of Owner/Parent key
141 0x0014 D-Word number of sub-Keys
142 0x001C D-Word Offset of the sub-key lf-Records
143 0x0024 D-Word number of values
144 0x0028 D-Word Offset of the Value-List
145 0x002C D-Word Offset of the sk-Record
147 0x0030 D-Word Offset of the Class-Name //see NK structure for the use of these fields. Nigel
148 0x0044 D-Word Unused (data-trash) //some kind of run time index. Does not appear to be important. Nigel
149 0x0048 Word name-length
150 0x004A Word class-name length
156 0x0000 D-Word Offset 1st Value
157 0x0004 D-Word Offset 2nd Value
158 0x???? D-Word Offset nth Value
160 To determine the number of values, you have to look at the owner-nk-record!
165 0x0000 Word ID: ASCII-"vk" = 0x6B76
166 0x0002 Word name length
167 0x0004 D-Word length of the data //if top bit is set when offset contains data. Nigel
168 0x0008 D-Word Offset of Data
169 0x000C D-Word Type of value
171 0x0012 Word Unused (data-trash)
174 If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default)
176 If the data-size is lower 5, the data-offset value is used to store the data itself!
181 0x0001 RegSZ: character string (in UNICODE!)
182 0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!)
183 0x0003 RegBin: raw-binary value
184 0x0004 RegDWord: Dword
185 0x0007 RegMultiSZ: multiple strings, seperated with 0
191 0x0000 Word ID: ASCII-"lf" = 0x666C
192 0x0002 Word number of keys
193 0x0004 ???? Hash-Records
198 0x0000 D-Word Offset of corresponding "nk"-Record
199 0x0004 D-Word ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv!
201 Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the
202 key-name you have to change the hash-value too!
204 //These hashrecords must be sorted low to high within the lf record. Nigel.
208 (due to the complexity of the SAM-info, not clear jet)
209 (This is just a security descriptor in the data. R Sharpe.)
213 0x0000 Word ID: ASCII-"sk" = 0x6B73
215 0x0004 D-Word Offset of previous "sk"-Record
216 0x0008 D-Word Offset of next "sk"-Record
217 0x000C D-Word usage-counter
218 0x0010 D-Word Size of "sk"-record in bytes
220 relative security desciptor. Nigel
221 ???? ???? Security and auditing settings...
224 The usage counter counts the number of references to this
225 "sk"-record. You can use one "sk"-record for the entire registry!
227 Windows nt date/time format
228 ===========================
229 The time-format is a 64-bit integer which is incremented every
230 0,0000001 seconds by 1 (I don't know how accurate it realy is!)
231 It starts with 0 at the 1st of january 1601 0:00! All values are
232 stored in GMT time! The time-zone is important to get the real
235 Common values for win95 and win-nt
236 ==================================
237 Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
238 If a value has no name (length=0, flag(bit 0)=0), it is treated as the
240 If a value has no data (length=0), it is displayed as empty.
242 simplyfied win-3.?? registry:
243 =============================
246 | next rec. |---+ +----->+------------+
247 | first sub | | | | Usage cnt. |
248 | name | | +-->+------------+ | | length |
249 | value | | | | next rec. | | | text |------->+-------+
250 +-----------+ | | | name rec. |--+ +------------+ | xxxxx |
251 +------------+ | | value rec. |-------->+------------+ +-------+
252 v | +------------+ | Usage cnt. |
253 +-----------+ | | length |
254 | next rec. | | | text |------->+-------+
255 | first sub |------+ +------------+ | xxxxx |
260 Greatly simplyfied structure of the nt-registry:
261 ================================================
263 +---------------------------------------------------------------+
266 +---------+ +---------->+-----------+ +----->+---------+ |
267 | "nk" | | | lf-rec. | | | nk-rec. | |
268 | ID | | | # of keys | | | parent |---+
269 | Date | | | 1st key |--+ | .... |
270 | parent | | +-----------+ +---------+
272 | values |--------------------->+----------+
273 | SK-rec. |---------------+ | 1. value |--> +----------+
274 | class |--+ | +----------+ | vk-rec. |
275 +---------+ | | | .... |
276 v | | data |--> +-------+
277 +------------+ | +----------+ | xxxxx |
278 | Class name | | +-------+
281 +---------+ +---------+
282 +----->| next sk |--->| Next sk |--+
283 | +---| prev sk |<---| prev sk | |
284 | | | .... | | ... | |
285 | | +---------+ +---------+ |
288 | +--------------------+ |
289 +----------------------------------+
291 ---------------------------------------------------------------------------
293 Hope this helps.... (Although it was "fun" for me to uncover this things,
294 it took me several sleepless nights ;)
298 *************************************************************************/
304 #include <sys/types.h>
305 #include <sys/stat.h>
307 #include <sys/mman.h>
313 #define REG_KEY_LIST_SIZE 10
316 * Structures for dealing with the on-disk format of the registry
319 #define IVAL(buf) ((unsigned int) \
320 (unsigned int)*((unsigned char *)(buf)+3)<<24| \
321 (unsigned int)*((unsigned char *)(buf)+2)<<16| \
322 (unsigned int)*((unsigned char *)(buf)+1)<<8| \
323 (unsigned int)*((unsigned char *)(buf)+0))
325 #define SVAL(buf) ((unsigned short) \
326 (unsigned short)*((unsigned char *)(buf)+1)<<8| \
327 (unsigned short)*((unsigned char *)(buf)+0))
329 #define CVAL(buf) ((unsigned char)*((unsigned char *)(buf)))
331 #define SIVAL(buf, val) \
332 ((unsigned char)buf[0]=(unsigned char)((val)&0xFF),\
333 (unsigned char)buf[1]=(unsigned char)(((val)>>8)&0xFF),\
334 (unsigned char)buf[2]=(unsigned char)(((val)>>16)&0xFF),\
335 (unsigned char)buf[3]=(unsigned char)((val)>>24))
337 #define SSVAL(buf, val) \
338 ((unsigned char)buf[0]=(unsigned char)((val)&0xFF),\
339 (unsigned char)buf[1]=(unsigned char)(((val)>>8)&0xFF))
341 static int verbose
= 0;
342 static int print_security
= 0;
343 static int full_print
= 0;
344 static char *def_owner_sid_str
= NULL
;
347 * These definitions are for the in-memory registry structure.
348 * It is a tree structure that mimics what you see with tools like regedit
352 * DateTime struct for Windows
355 typedef struct date_time_s
{
356 unsigned int low
, high
;
360 * Definition of a Key. It has a name, classname, date/time last modified,
361 * sub-keys, values, and a security descriptor
364 #define REG_ROOT_KEY 1
365 #define REG_SUB_KEY 2
366 #define REG_SYM_LINK 3
368 typedef struct key_sec_desc_s KEY_SEC_DESC
;
370 typedef struct reg_key_s
{
371 char *name
; /* Name of the key */
373 int type
; /* One of REG_ROOT_KEY or REG_SUB_KEY */
374 NTTIME last_mod
; /* Time last modified */
375 struct reg_key_s
*owner
;
376 struct key_list_s
*sub_keys
;
377 struct val_list_s
*values
;
378 KEY_SEC_DESC
*security
;
382 * The KEY_LIST struct lists sub-keys.
385 typedef struct key_list_s
{
391 typedef struct val_key_s
{
396 void *data_blk
; /* Might want a separate block */
399 typedef struct val_list_s
{
406 #define MAXSUBAUTHS 15
409 typedef struct dom_sid_s
{
410 unsigned char ver
, auths
;
411 unsigned char auth
[6];
412 unsigned int sub_auths
[MAXSUBAUTHS
];
415 typedef struct ace_struct_s
{
416 unsigned char type
, flags
;
417 unsigned int perms
; /* Perhaps a better def is in order */
421 typedef struct acl_struct_s
{
422 unsigned short rev
, refcnt
;
423 unsigned short num_aces
;
427 typedef struct sec_desc_s
{
428 unsigned int rev
, type
;
429 DOM_SID
*owner
, *group
;
433 #define SEC_DESC_NON 0
434 #define SEC_DESC_RES 1
435 #define SEC_DESC_OCU 2
436 #define SEC_DESC_NBK 3
437 struct key_sec_desc_s
{
438 struct key_sec_desc_s
*prev
, *next
;
445 * All of the structures below actually have a four-byte lenght before them
446 * which always seems to be negative. The following macro retrieves that
450 #define BLK_SIZE(b) ((int)*(int *)(((int *)b)-1))
452 typedef unsigned int DWORD
;
453 typedef unsigned short WORD
;
455 #define REG_REGF_ID 0x66676572
457 typedef struct regf_block
{
458 DWORD REGF_ID
; /* regf */
466 DWORD first_key
; /* offset */
467 unsigned int dblk_size
;
468 DWORD uk7
[116]; /* 1 */
472 typedef struct hbin_sub_struct
{
477 #define REG_HBIN_ID 0x6E696268
479 typedef struct hbin_struct
{
480 DWORD HBIN_ID
; /* hbin */
488 HBIN_SUB_HDR hbin_sub_hdr
;
491 #define REG_NK_ID 0x6B6E
493 typedef struct nk_struct
{
511 char key_nam
[1]; /* Actual length determined by nam_len */
514 #define REG_SK_ID 0x6B73
516 typedef struct sk_struct
{
526 typedef struct ace_struct
{
529 unsigned short length
;
534 typedef struct acl_struct
{
538 REG_ACE
*aces
; /* One or more ACEs */
541 typedef struct sec_desc_rec
{
550 typedef struct hash_struct
{
555 #define REG_LF_ID 0x666C
557 typedef struct lf_struct
{
560 struct hash_struct hr
[1]; /* Array of hash records, depending on key_count */
563 typedef DWORD VL_TYPE
[1]; /* Value list is an array of vk rec offsets */
565 #define REG_VK_ID 0x6B76
567 typedef struct vk_struct
{
570 DWORD dat_len
; /* If top-bit set, offset contains the data */
573 WORD flag
; /* =1, has name, else no name (=Default). */
575 char dat_name
[1]; /* Name starts here ... */
578 #define REG_TYPE_DELETE -1
579 #define REG_TYPE_NONE 0
580 #define REG_TYPE_REGSZ 1
581 #define REG_TYPE_EXPANDSZ 2
582 #define REG_TYPE_BIN 3
583 #define REG_TYPE_DWORD 4
584 #define REG_TYPE_MULTISZ 7
586 typedef struct _val_str
{
591 /* A map of sk offsets in the regf to KEY_SEC_DESCs for quick lookup etc */
592 typedef struct sk_map_s
{
594 KEY_SEC_DESC
*key_sec_desc
;
598 * This structure keeps track of the output format of the registry
600 #define REG_OUTBLK_HDR 1
601 #define REG_OUTBLK_HBIN 2
603 typedef struct hbin_blk_s
{
605 struct hbin_blk_s
*next
;
606 char *data
; /* The data block */
607 unsigned int file_offset
; /* Offset in file */
608 unsigned int free_space
; /* Amount of free space in block */
609 unsigned int fsp_off
; /* Start of free space in block */
610 int complete
, stored
;
614 * This structure keeps all the registry stuff in one place
616 typedef struct regf_struct_s
{
618 char *regfile_name
, *outfile_name
;
623 NTTIME last_mod_time
;
624 REG_KEY
*root
; /* Root of the tree for this file */
625 int sk_count
, sk_map_size
;
628 SEC_DESC
*def_sec_desc
;
630 * These next pointers point to the blocks used to contain the
631 * keys when we are preparing to write them to a file
633 HBIN_BLK
*blk_head
, *blk_tail
, *free_space
;
637 * An API for accessing/creating/destroying items above
641 * Iterate over the keys, depth first, calling a function for each key
642 * and indicating if it is terminal or non-terminal and if it has values.
644 * In addition, for each value in the list, call a value list function
647 typedef int (*key_print_f
)(const char *path
, char *key_name
, char *class_name
,
648 int root
, int terminal
, int values
);
650 typedef int (*val_print_f
)(const char *path
, char *val_name
, int val_type
,
651 int data_len
, void *data_blk
, int terminal
,
652 int first
, int last
);
654 typedef int (*sec_print_f
)(SEC_DESC
*sec_desc
);
656 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, const char *path
,
657 key_print_f key_print
, sec_print_f sec_print
,
658 val_print_f val_print
);
660 int nt_val_list_iterator(REGF
*regf
, VAL_LIST
*val_list
, int bf
, char *path
,
661 int terminal
, val_print_f val_print
)
665 if (!val_list
) return 1;
667 if (!val_print
) return 1;
669 for (i
=0; i
<val_list
->val_count
; i
++) {
670 if (!val_print(path
, val_list
->vals
[i
]->name
, val_list
->vals
[i
]->data_type
,
671 val_list
->vals
[i
]->data_len
, val_list
->vals
[i
]->data_blk
,
674 (i
== val_list
->val_count
))) {
684 int nt_key_list_iterator(REGF
*regf
, KEY_LIST
*key_list
, int bf
,
686 key_print_f key_print
, sec_print_f sec_print
,
687 val_print_f val_print
)
691 if (!key_list
) return 1;
693 for (i
=0; i
< key_list
->key_count
; i
++) {
694 if (!nt_key_iterator(regf
, key_list
->keys
[i
], bf
, path
, key_print
,
695 sec_print
, val_print
)) {
702 int nt_key_iterator(REGF
*regf
, REG_KEY
*key_tree
, int bf
, const char *path
,
703 key_print_f key_print
, sec_print_f sec_print
,
704 val_print_f val_print
)
706 int path_len
= strlen(path
);
709 if (!regf
|| !key_tree
)
712 /* List the key first, then the values, then the sub-keys */
716 if (!(*key_print
)(path
, key_tree
->name
,
717 key_tree
->class_name
,
718 (key_tree
->type
== REG_ROOT_KEY
),
719 (key_tree
->sub_keys
== NULL
),
720 (key_tree
->values
?(key_tree
->values
->val_count
):0)))
725 * If we have a security print routine, call it
726 * If the security print routine returns false, stop.
729 if (key_tree
->security
&& !(*sec_print
)(key_tree
->security
->sec_desc
))
733 new_path
= (char *)malloc(path_len
+ 1 + strlen(key_tree
->name
) + 1);
734 if (!new_path
) return 0; /* Errors? */
736 strcat(new_path
, path
);
737 strcat(new_path
, key_tree
->name
);
738 strcat(new_path
, "\\");
741 * Now, iterate through the values in the val_list
744 if (key_tree
->values
&&
745 !nt_val_list_iterator(regf
, key_tree
->values
, bf
, new_path
,
746 (key_tree
->values
!=NULL
),
754 * Now, iterate through the keys in the key list
757 if (key_tree
->sub_keys
&&
758 !nt_key_list_iterator(regf
, key_tree
->sub_keys
, bf
, new_path
, key_print
,
759 sec_print
, val_print
)) {
768 REG_KEY
*nt_find_key_by_name(REG_KEY
*tree
, char *key
);
771 * Find key by name in a list ...
772 * Take the first component and search for that in the list
774 REG_KEY
*nt_find_key_in_list_by_name(KEY_LIST
*list
, char *key
)
779 if (!list
|| !key
|| !*key
) return NULL
;
781 for (i
= 0; i
< list
->key_count
; i
++)
782 if ((res
= nt_find_key_by_name(list
->keys
[i
], key
)))
789 * Find key by name in a tree ... We will assume absolute names here, but we
790 * need the root of the tree ...
792 REG_KEY
*nt_find_key_by_name(REG_KEY
*tree
, char *key
)
794 char *lname
= NULL
, *c1
, *c2
;
797 if (!tree
|| !key
|| !*key
) return NULL
;
800 if (!lname
) return NULL
;
803 * Make sure that the first component is correct ...
806 c2
= strchr(c1
, '\\');
807 if (c2
) { /* Split here ... */
811 if (strcmp(c1
, tree
->name
) != 0) goto error
;
814 tmp
= nt_find_key_in_list_by_name(tree
->sub_keys
, c2
);
819 if (lname
) free(lname
);
823 if (lname
) free(lname
);
827 /* Make, delete keys */
829 int nt_delete_val_key(VAL_KEY
*val_key
)
833 if (val_key
->name
) free(val_key
->name
);
834 if (val_key
->data_blk
) free(val_key
->data_blk
);
840 int nt_delete_val_list(VAL_LIST
*vl
)
845 for (i
=0; i
<vl
->val_count
; i
++)
846 nt_delete_val_key(vl
->vals
[i
]);
852 int nt_delete_reg_key(REG_KEY
*key
, int delete_name
);
853 int nt_delete_key_list(KEY_LIST
*key_list
, int delete_name
)
858 for (i
=0; i
<key_list
->key_count
; i
++)
859 nt_delete_reg_key(key_list
->keys
[i
], False
);
866 * Find the key, and if it exists, delete it ...
868 int nt_delete_key_by_name(REGF
*regf
, char *name
)
872 if (!name
|| !*name
) return 0;
874 key
= nt_find_key_by_name(regf
->root
, name
);
877 if (key
== regf
->root
) regf
->root
= NULL
;
878 return nt_delete_reg_key(key
, True
);
885 int nt_delete_sid(DOM_SID
*sid
)
893 int nt_delete_ace(ACE
*ace
)
897 nt_delete_sid(ace
->trustee
);
904 int nt_delete_acl(ACL
*acl
)
910 for (i
=0; i
<acl
->num_aces
; i
++)
911 nt_delete_ace(acl
->aces
[i
]);
918 int nt_delete_sec_desc(SEC_DESC
*sec_desc
)
923 nt_delete_sid(sec_desc
->owner
);
924 nt_delete_sid(sec_desc
->group
);
925 nt_delete_acl(sec_desc
->sacl
);
926 nt_delete_acl(sec_desc
->dacl
);
933 int nt_delete_key_sec_desc(KEY_SEC_DESC
*key_sec_desc
)
937 key_sec_desc
->ref_cnt
--;
938 if (key_sec_desc
->ref_cnt
<=0) {
940 * There should always be a next and prev, even if they point to us
942 key_sec_desc
->next
->prev
= key_sec_desc
->prev
;
943 key_sec_desc
->prev
->next
= key_sec_desc
->next
;
944 nt_delete_sec_desc(key_sec_desc
->sec_desc
);
950 int nt_delete_reg_key(REG_KEY
*key
, int delete_name
)
954 if (key
->name
) free(key
->name
);
955 if (key
->class_name
) free(key
->class_name
);
958 * We will delete the owner if we are not the root and told to ...
961 if (key
->owner
&& key
->owner
->sub_keys
&& delete_name
) {
965 /* Find our owner, look in keylist for us and shuffle up */
966 /* Perhaps should be a function */
971 for (i
=0; i
< kl
->key_count
&& kl
->keys
[i
] != key
; i
++) {
972 /* Just find the entry ... */
975 if (i
== kl
->key_count
) {
976 fprintf(stderr
, "Bad data structure. Key not found in key list of owner\n");
982 * Shuffle up. Works for the last one also
984 for (j
= i
+ 1; j
< kl
->key_count
; j
++) {
985 kl
->keys
[j
- 1] = kl
->keys
[j
];
992 if (key
->sub_keys
) nt_delete_key_list(key
->sub_keys
, False
);
993 if (key
->values
) nt_delete_val_list(key
->values
);
994 if (key
->security
) nt_delete_key_sec_desc(key
->security
);
1001 * Convert a string to a value ...
1002 * FIXME: Error handling and convert this at command parse time ...
1004 void *str_to_val(int type
, char *val
, int *len
)
1006 unsigned int *dwordp
= NULL
;
1008 if (!len
|| !val
) return NULL
;
1011 case REG_TYPE_REGSZ
:
1015 case REG_TYPE_DWORD
:
1016 dwordp
= (unsigned int *)malloc(sizeof(unsigned int));
1017 if (!dwordp
) return NULL
;
1018 /* Allow for ddddd and 0xhhhhh and 0ooooo */
1019 if (strncmp(val
, "0x", 2) == 0 || strncmp(val
, "0X", 2) == 0) {
1020 sscanf(&val
[2], "%X", dwordp
);
1022 else if (*val
== '0') {
1023 sscanf(&val
[1], "%o", dwordp
);
1026 sscanf(val
, "%d", dwordp
);
1028 *len
= sizeof(unsigned int);
1029 return (void *)dwordp
;
1031 /* FIXME: Implement more of these */
1042 * Add a value to the key specified ... We have to parse the value some more
1043 * based on the type to get it in the correct internal form
1044 * An empty name will be converted to "<No Name>" before here
1045 * Hmmm, maybe not. has_name is for that
1047 VAL_KEY
*nt_add_reg_value(REG_KEY
*key
, char *name
, int type
, char *value
)
1050 VAL_KEY
*tmp
= NULL
;
1052 if (!key
|| !key
->values
|| !name
|| !*name
) return NULL
;
1054 assert(type
!= REG_TYPE_DELETE
); /* We never process deletes here */
1056 for (i
= 0; i
< key
->values
->val_count
; i
++) {
1057 if ((!key
->values
->vals
[i
]->has_name
&& !*name
) ||
1058 (key
->values
->vals
[i
]->has_name
&&
1059 strcmp(name
, key
->values
->vals
[i
]->name
) == 0)){ /* Change the value */
1060 free(key
->values
->vals
[i
]->data_blk
);
1061 key
->values
->vals
[i
]->data_blk
= str_to_val(type
, value
, &
1062 key
->values
->vals
[i
]->data_len
);
1063 return key
->values
->vals
[i
];
1068 * If we get here, the name was not found, so insert it
1071 tmp
= (VAL_KEY
*)malloc(sizeof(VAL_KEY
));
1072 if (!tmp
) goto error
;
1074 bzero(tmp
, sizeof(VAL_KEY
));
1075 tmp
->name
= strdup(name
);
1076 tmp
->has_name
= True
;
1077 if (!tmp
->name
) goto error
;
1078 tmp
->data_type
= type
;
1079 tmp
->data_blk
= str_to_val(type
, value
, &tmp
->data_len
);
1081 /* Now, add to val list */
1083 if (key
->values
->val_count
>= key
->values
->max_vals
) {
1085 * Allocate some more space
1088 if ((key
->values
= (VAL_LIST
*)realloc(key
->values
, sizeof(VAL_LIST
) +
1089 key
->values
->val_count
- 1 +
1090 REG_KEY_LIST_SIZE
))) {
1091 key
->values
->max_vals
+= REG_KEY_LIST_SIZE
;
1096 i
= key
->values
->val_count
;
1097 key
->values
->val_count
++;
1098 key
->values
->vals
[i
] = tmp
;
1102 if (tmp
) nt_delete_val_key(tmp
);
1107 * Delete a value. We return the value and let the caller deal with it.
1109 VAL_KEY
*nt_delete_reg_value(REG_KEY
*key
, char *name
)
1113 if (!key
|| !key
->values
|| !name
|| !*name
) return NULL
;
1115 /* FIXME: Allow empty value name */
1116 for (i
= 0; i
< key
->values
->val_count
; i
++) {
1117 if ((!key
->values
->vals
[i
]->has_name
&& !*name
) ||
1118 (key
->values
->vals
[i
]->has_name
&&
1119 strcmp(name
, key
->values
->vals
[i
]->name
) == 0)) {
1122 val
= key
->values
->vals
[i
];
1125 for (j
= i
+ 1; j
< key
->values
->val_count
; j
++)
1126 key
->values
->vals
[j
- 1] = key
->values
->vals
[j
];
1128 key
->values
->val_count
--;
1137 * Add a key to the tree ... We walk down the components matching until
1138 * we don't find any. There must be a match on the first component ...
1139 * We return the key structure for the final component as that is
1140 * often where we want to add values ...
1144 * Create a 1 component key name and set its parent to parent
1146 REG_KEY
*nt_create_reg_key1(char *name
, REG_KEY
*parent
)
1150 if (!name
|| !*name
) return NULL
; /* A key's name cannot be empty */
1152 /* There should not be more than one component */
1153 if (strchr(name
, '\\')) return NULL
;
1155 if (!(tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
)))) return NULL
;
1157 bzero(tmp
, sizeof(REG_KEY
));
1159 if (!(tmp
->name
= strdup(name
))) goto error
;
1167 * Convert a string of the form S-1-5-x[-y-z-r] to a SID
1169 int string_to_sid(DOM_SID
**sid
, char *sid_str
)
1174 *sid
= (DOM_SID
*)malloc(sizeof(DOM_SID
));
1175 if (!*sid
) return 0;
1177 bzero(*sid
, sizeof(DOM_SID
));
1179 if (strncmp(sid_str
, "S-1-5", 5)) {
1180 fprintf(stderr
, "Does not conform to S-1-5...: %s\n", sid_str
);
1184 /* We only allow strings of form S-1-5... */
1187 (*sid
)->auth
[5] = 5;
1192 if (!lstr
|| !lstr
[0] || sscanf(lstr
, "-%u", &auth
) == 0) {
1194 fprintf(stderr
, "Not of form -d-d...: %s, %u\n", lstr
, i
);
1201 (*sid
)->sub_auths
[i
] = auth
;
1203 lstr
= strchr(lstr
+ 1, '-');
1212 ACE
*nt_create_ace(int type
, int flags
, unsigned int perms
, char *sid
)
1216 ace
= (ACE
*)malloc(sizeof(ACE
));
1217 if (!ace
) goto error
;
1221 if (!string_to_sid(&ace
->trustee
, sid
))
1226 if (ace
) nt_delete_ace(ace
);
1231 * Create a default ACL
1233 ACL
*nt_create_default_acl(REGF
*regf
)
1237 acl
= (ACL
*)malloc(sizeof(ACL
) + 7*sizeof(ACE
*));
1238 if (!acl
) goto error
;
1244 acl
->aces
[0] = nt_create_ace(0x00, 0x0, 0xF003F, regf
->owner_sid_str
);
1245 if (!acl
->aces
[0]) goto error
;
1246 acl
->aces
[1] = nt_create_ace(0x00, 0x0, 0xF003F, "S-1-5-18");
1247 if (!acl
->aces
[1]) goto error
;
1248 acl
->aces
[2] = nt_create_ace(0x00, 0x0, 0xF003F, "S-1-5-32-544");
1249 if (!acl
->aces
[2]) goto error
;
1250 acl
->aces
[3] = nt_create_ace(0x00, 0x0, 0x20019, "S-1-5-12");
1251 if (!acl
->aces
[3]) goto error
;
1252 acl
->aces
[4] = nt_create_ace(0x00, 0x0B, 0x10000000, regf
->owner_sid_str
);
1253 if (!acl
->aces
[4]) goto error
;
1254 acl
->aces
[5] = nt_create_ace(0x00, 0x0B, 0x10000000, "S-1-5-18");
1255 if (!acl
->aces
[5]) goto error
;
1256 acl
->aces
[6] = nt_create_ace(0x00, 0x0B, 0x10000000, "S-1-5-32-544");
1257 if (!acl
->aces
[6]) goto error
;
1258 acl
->aces
[7] = nt_create_ace(0x00, 0x0B, 0x80000000, "S-1-5-12");
1259 if (!acl
->aces
[7]) goto error
;
1263 if (acl
) nt_delete_acl(acl
);
1268 * Create a default security descriptor. We pull in things from env
1271 SEC_DESC
*nt_create_def_sec_desc(REGF
*regf
)
1275 tmp
= (SEC_DESC
*)malloc(sizeof(SEC_DESC
));
1276 if (!tmp
) return NULL
;
1280 if (!string_to_sid(&tmp
->owner
, "S-1-5-32-544")) goto error
;
1281 if (!string_to_sid(&tmp
->group
, "S-1-5-18")) goto error
;
1283 tmp
->dacl
= nt_create_default_acl(regf
);
1288 if (tmp
) nt_delete_sec_desc(tmp
);
1293 * We will implement inheritence that is based on what the parent's SEC_DESC
1294 * says, but the Owner and Group SIDs can be overwridden from the command line
1295 * and additional ACEs can be applied from the command line etc.
1297 KEY_SEC_DESC
*nt_inherit_security(REG_KEY
*key
)
1300 if (!key
) return NULL
;
1301 return key
->security
;
1305 * Create an initial security descriptor and init other structures, if needed
1306 * We assume that the initial security stuff is empty ...
1308 KEY_SEC_DESC
*nt_create_init_sec(REGF
*regf
)
1310 KEY_SEC_DESC
*tsec
= NULL
;
1312 tsec
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1313 if (!tsec
) return NULL
;
1316 tsec
->state
= SEC_DESC_NBK
;
1318 tsec
->sec_desc
= regf
->def_sec_desc
;
1326 REG_KEY
*nt_add_reg_key_list(REGF
*regf
, REG_KEY
*key
, char * name
, int create
)
1329 REG_KEY
*ret
= NULL
, *tmp
= NULL
;
1331 char *lname
, *c1
, *c2
;
1333 if (!key
|| !name
|| !*name
) return NULL
;
1335 list
= key
->sub_keys
;
1336 if (!list
) { /* Create an empty list */
1338 list
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (REG_KEY_LIST_SIZE
- 1) * sizeof(REG_KEY
*));
1339 list
->key_count
= 0;
1340 list
->max_keys
= REG_KEY_LIST_SIZE
;
1344 lname
= strdup(name
);
1345 if (!lname
) return NULL
;
1348 c2
= strchr(c1
, '\\');
1349 if (c2
) { /* Split here ... */
1354 for (i
= 0; i
< list
->key_count
; i
++) {
1355 if (strcmp(list
->keys
[i
]->name
, c1
) == 0) {
1356 ret
= nt_add_reg_key_list(regf
, list
->keys
[i
], c2
, create
);
1363 * If we reach here we could not find the the first component
1367 if (list
->key_count
< list
->max_keys
){
1370 else { /* Create more space in the list ... */
1371 if (!(list
= (KEY_LIST
*)realloc(list
, sizeof(KEY_LIST
) +
1372 (list
->max_keys
+ REG_KEY_LIST_SIZE
- 1)
1373 * sizeof(REG_KEY
*))));
1376 list
->max_keys
+= REG_KEY_LIST_SIZE
;
1381 * add the new key at the new slot
1382 * FIXME: Sort the list someday
1386 * We want to create the key, and then do the rest
1389 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1391 bzero(tmp
, sizeof(REG_KEY
));
1393 tmp
->name
= strdup(c1
);
1394 if (!tmp
->name
) goto error
;
1396 tmp
->type
= REG_SUB_KEY
;
1398 * Next, pull security from the parent, but override with
1399 * anything passed in on the command line
1401 tmp
->security
= nt_inherit_security(key
);
1403 list
->keys
[list
->key_count
- 1] = tmp
;
1406 ret
= nt_add_reg_key_list(regf
, key
, c2
, True
);
1409 if (lname
) free(lname
);
1415 if (lname
) free(lname
);
1420 * This routine only adds a key from the root down.
1421 * It calls helper functions to handle sub-key lists and sub-keys
1423 REG_KEY
*nt_add_reg_key(REGF
*regf
, char *name
, int create
)
1425 char *lname
= NULL
, *c1
, *c2
;
1426 REG_KEY
* tmp
= NULL
;
1429 * Look until we hit the first component that does not exist, and
1430 * then add from there. However, if the first component does not
1431 * match and the path we are given is the root, then it must match
1433 if (!regf
|| !name
|| !*name
) return NULL
;
1435 lname
= strdup(name
);
1436 if (!lname
) return NULL
;
1439 c2
= strchr(c1
, '\\');
1440 if (c2
) { /* Split here ... */
1446 * If the root does not exist, create it and make it equal to the
1447 * first component ...
1452 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
1453 if (!tmp
) goto error
;
1454 bzero(tmp
, sizeof(REG_KEY
));
1455 tmp
->name
= strdup(c1
);
1456 if (!tmp
->name
) goto error
;
1457 tmp
->security
= nt_create_init_sec(regf
);
1458 if (!tmp
->security
) goto error
;
1464 * If we don't match, then we have to return error ...
1465 * If we do match on this component, check the next one in the
1466 * list, and if not found, add it ... short circuit, add all the
1470 if (strcmp(c1
, regf
->root
->name
) != 0)
1474 tmp
= nt_add_reg_key_list(regf
, regf
->root
, c2
, True
);
1480 if (lname
) free(lname
);
1485 * Load and unload a registry file.
1487 * Load, loads it into memory as a tree, while unload sealizes/flattens it
1491 * Get the starting record for NT Registry file
1495 * Where we keep all the regf stuff for one registry.
1496 * This is the structure that we use to tie the in memory tree etc
1497 * together. By keeping separate structs, we can operate on different
1498 * registries at the same time.
1499 * Currently, the SK_MAP is an array of mapping structure.
1500 * Since we only need this on input and output, we fill in the structure
1501 * as we go on input. On output, we know how many SK items we have, so
1502 * we can allocate the structure as we need to.
1503 * If you add stuff here that is dynamically allocated, add the
1504 * appropriate free statements below.
1507 #define REGF_REGTYPE_NONE 0
1508 #define REGF_REGTYPE_NT 1
1509 #define REGF_REGTYPE_W9X 2
1511 #define TTTONTTIME(r, t1, t2) (r)->last_mod_time.low = (t1); \
1512 (r)->last_mod_time.high = (t2);
1514 #define REGF_HDR_BLKSIZ 0x1000
1516 #define OFF(f) ((f) + REGF_HDR_BLKSIZ + 4)
1517 #define LOCN(base, f) ((base) + OFF(f))
1519 const VAL_STR reg_type_names
[] = {
1520 { REG_TYPE_REGSZ
, "REG_SZ" },
1521 { REG_TYPE_EXPANDSZ
, "REG_EXPAND_SZ" },
1522 { REG_TYPE_BIN
, "REG_BIN" },
1523 { REG_TYPE_DWORD
, "REG_DWORD" },
1524 { REG_TYPE_MULTISZ
, "REG_MULTI_SZ" },
1528 const char *val_to_str(unsigned int val
, const VAL_STR
*val_array
)
1532 if (!val_array
) return NULL
;
1534 while (val_array
[i
].val
&& val_array
[i
].str
) {
1536 if (val_array
[i
].val
== val
) return val_array
[i
].str
;
1546 * Convert from UniCode to Ascii ... Does not take into account other lang
1547 * Restrict by ascii_max if > 0
1549 int uni_to_ascii(unsigned char *uni
, unsigned char *ascii
, int ascii_max
,
1554 while (i
< ascii_max
&& !(!uni
[i
*2] && !uni
[i
*2+1])) {
1555 if (uni_max
> 0 && (i
*2) >= uni_max
) break;
1556 ascii
[i
] = uni
[i
*2];
1567 * Convert a data value to a string for display
1569 int data_to_ascii(unsigned char *datap
, int len
, int type
, char *ascii
, int ascii_max
)
1571 unsigned char *asciip
;
1575 case REG_TYPE_REGSZ
:
1576 if (verbose
) fprintf(stderr
, "Len: %d\n", len
);
1577 return uni_to_ascii(datap
, ascii
, len
, ascii_max
);
1580 case REG_TYPE_EXPANDSZ
:
1581 return uni_to_ascii(datap
, ascii
, len
, ascii_max
);
1586 for (i
=0; (i
<len
)&&(i
+1)*3<ascii_max
; i
++) {
1587 int str_rem
= ascii_max
- ((int)asciip
- (int)ascii
);
1588 asciip
+= snprintf(asciip
, str_rem
, "%02x", *(unsigned char *)(datap
+i
));
1589 if (i
< len
&& str_rem
> 0)
1590 *asciip
= ' '; asciip
++;
1593 return ((int)asciip
- (int)ascii
);
1596 case REG_TYPE_DWORD
:
1597 if (*(int *)datap
== 0)
1598 return snprintf(ascii
, ascii_max
, "0");
1600 return snprintf(ascii
, ascii_max
, "0x%x", *(int *)datap
);
1603 case REG_TYPE_MULTISZ
:
1616 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
, REG_KEY
*parent
);
1618 int nt_set_regf_input_file(REGF
*regf
, char *filename
)
1620 return ((regf
->regfile_name
= strdup(filename
)) != NULL
);
1623 int nt_set_regf_output_file(REGF
*regf
, char *filename
)
1625 return ((regf
->outfile_name
= strdup(filename
)) != NULL
);
1628 /* Create a regf structure and init it */
1630 REGF
*nt_create_regf(void)
1632 REGF
*tmp
= (REGF
*)malloc(sizeof(REGF
));
1633 if (!tmp
) return tmp
;
1634 bzero(tmp
, sizeof(REGF
));
1635 tmp
->owner_sid_str
= def_owner_sid_str
;
1639 /* Free all the bits and pieces ... Assumes regf was malloc'd */
1640 /* If you add stuff to REGF, add the relevant free bits here */
1641 int nt_free_regf(REGF
*regf
)
1643 if (!regf
) return 0;
1645 if (regf
->regfile_name
) free(regf
->regfile_name
);
1646 if (regf
->outfile_name
) free(regf
->outfile_name
);
1648 nt_delete_reg_key(regf
->root
, False
); /* Free the tree */
1650 regf
->sk_count
= regf
->sk_map_size
= 0;
1657 /* Get the header of the registry. Return a pointer to the structure
1658 * If the mmap'd area has not been allocated, then mmap the input file
1660 REGF_HDR
*nt_get_regf_hdr(REGF
*regf
)
1663 return NULL
; /* What about errors */
1665 if (!regf
->regfile_name
)
1666 return NULL
; /* What about errors */
1668 if (!regf
->base
) { /* Try to mmap etc the file */
1670 if ((regf
->fd
= open(regf
->regfile_name
, O_RDONLY
, 0000)) <0) {
1671 return NULL
; /* What about errors? */
1674 if (fstat(regf
->fd
, ®f
->sbuf
) < 0) {
1678 regf
->base
= mmap(0, regf
->sbuf
.st_size
, PROT_READ
, MAP_SHARED
, regf
->fd
, 0);
1680 if ((int)regf
->base
== 1) {
1681 fprintf(stderr
, "Could not mmap file: %s, %s\n", regf
->regfile_name
,
1688 * At this point, regf->base != NULL, and we should be able to read the
1692 assert(regf
->base
!= NULL
);
1694 return (REGF_HDR
*)regf
->base
;
1698 * Validate a regf header
1699 * For now, do nothing, but we should check the checksum
1701 int valid_regf_hdr(REGF_HDR
*regf_hdr
)
1703 if (!regf_hdr
) return 0;
1709 * Process an SK header ...
1710 * Every time we see a new one, add it to the map. Otherwise, just look it up.
1711 * We will do a simple linear search for the moment, since many KEYs have the
1712 * same security descriptor.
1713 * We allocate the map in increments of 10 entries.
1717 * Create a new entry in the map, and increase the size of the map if needed
1720 SK_MAP
*alloc_sk_map_entry(REGF
*regf
, KEY_SEC_DESC
*tmp
, int sk_off
)
1722 if (!regf
->sk_map
) { /* Allocate a block of 10 */
1723 regf
->sk_map
= (SK_MAP
*)malloc(sizeof(SK_MAP
) * 10);
1724 if (!regf
->sk_map
) {
1728 regf
->sk_map_size
= 10;
1730 (regf
->sk_map
)[0].sk_off
= sk_off
;
1731 (regf
->sk_map
)[0].key_sec_desc
= tmp
;
1733 else { /* Simply allocate a new slot, unless we have to expand the list */
1734 int ndx
= regf
->sk_count
;
1735 if (regf
->sk_count
>= regf
->sk_map_size
) {
1736 regf
->sk_map
= (SK_MAP
*)realloc(regf
->sk_map
,
1737 (regf
->sk_map_size
+ 10)*sizeof(SK_MAP
));
1738 if (!regf
->sk_map
) {
1743 * ndx already points at the first entry of the new block
1745 regf
->sk_map_size
+= 10;
1747 (regf
->sk_map
)[ndx
].sk_off
= sk_off
;
1748 (regf
->sk_map
)[ndx
].key_sec_desc
= tmp
;
1751 return regf
->sk_map
;
1755 * Search for a KEY_SEC_DESC in the sk_map, but don't create one if not
1759 KEY_SEC_DESC
*lookup_sec_key(SK_MAP
*sk_map
, int count
, int sk_off
)
1763 if (!sk_map
) return NULL
;
1765 for (i
= 0; i
< count
; i
++) {
1767 if (sk_map
[i
].sk_off
== sk_off
)
1768 return sk_map
[i
].key_sec_desc
;
1777 * Allocate a KEY_SEC_DESC if we can't find one in the map
1780 KEY_SEC_DESC
*lookup_create_sec_key(REGF
*regf
, SK_MAP
*sk_map
, int sk_off
)
1782 KEY_SEC_DESC
*tmp
= lookup_sec_key(regf
->sk_map
, regf
->sk_count
, sk_off
);
1787 else { /* Allocate a new one */
1788 tmp
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1792 tmp
->state
= SEC_DESC_RES
;
1793 if (!alloc_sk_map_entry(regf
, tmp
, sk_off
)) {
1801 * Allocate storage and duplicate a SID
1802 * We could allocate the SID to be only the size needed, but I am too lazy.
1804 DOM_SID
*dup_sid(DOM_SID
*sid
)
1806 DOM_SID
*tmp
= (DOM_SID
*)malloc(sizeof(DOM_SID
));
1809 if (!tmp
) return NULL
;
1810 tmp
->ver
= sid
->ver
;
1811 tmp
->auths
= sid
->auths
;
1812 for (i
=0; i
<6; i
++) {
1813 tmp
->auth
[i
] = sid
->auth
[i
];
1815 for (i
=0; i
<tmp
->auths
&&i
<MAXSUBAUTHS
; i
++) {
1816 tmp
->sub_auths
[i
] = sid
->sub_auths
[i
];
1822 * Allocate space for an ACE and duplicate the registry encoded one passed in
1824 ACE
*dup_ace(REG_ACE
*ace
)
1828 tmp
= (ACE
*)malloc(sizeof(ACE
));
1830 if (!tmp
) return NULL
;
1832 tmp
->type
= CVAL(&ace
->type
);
1833 tmp
->flags
= CVAL(&ace
->flags
);
1834 tmp
->perms
= IVAL(&ace
->perms
);
1835 tmp
->trustee
= dup_sid(&ace
->trustee
);
1840 * Allocate space for an ACL and duplicate the registry encoded one passed in
1842 ACL
*dup_acl(REG_ACL
*acl
)
1848 num_aces
= IVAL(&acl
->num_aces
);
1850 tmp
= (ACL
*)malloc(sizeof(ACL
) + (num_aces
- 1)*sizeof(ACE
*));
1851 if (!tmp
) return NULL
;
1853 tmp
->num_aces
= num_aces
;
1855 tmp
->rev
= SVAL(&acl
->rev
);
1856 if (verbose
) fprintf(stdout
, "ACL: refcnt: %u, rev: %u\n", tmp
->refcnt
,
1858 ace
= (REG_ACE
*)&acl
->aces
;
1859 for (i
=0; i
<num_aces
; i
++) {
1860 tmp
->aces
[i
] = dup_ace(ace
);
1861 ace
= (REG_ACE
*)((char *)ace
+ SVAL(&ace
->length
));
1862 /* XXX: FIXME, should handle malloc errors */
1868 SEC_DESC
*process_sec_desc(REGF
*regf
, REG_SEC_DESC
*sec_desc
)
1870 SEC_DESC
*tmp
= NULL
;
1872 tmp
= (SEC_DESC
*)malloc(sizeof(SEC_DESC
));
1878 tmp
->rev
= SVAL(&sec_desc
->rev
);
1879 tmp
->type
= SVAL(&sec_desc
->type
);
1880 if (verbose
) fprintf(stdout
, "SEC_DESC Rev: %0X, Type: %0X\n",
1881 tmp
->rev
, tmp
->type
);
1882 tmp
->owner
= dup_sid((DOM_SID
*)((char *)sec_desc
+ IVAL(&sec_desc
->owner_off
)));
1887 tmp
->group
= dup_sid((DOM_SID
*)((char *)sec_desc
+ IVAL(&sec_desc
->group_off
)));
1893 /* Now pick up the SACL and DACL */
1895 if (sec_desc
->sacl_off
)
1896 tmp
->sacl
= dup_acl((REG_ACL
*)((char *)sec_desc
+ IVAL(&sec_desc
->sacl_off
)));
1900 if (sec_desc
->dacl_off
)
1901 tmp
->dacl
= dup_acl((REG_ACL
*)((char *)sec_desc
+ IVAL(&sec_desc
->dacl_off
)));
1908 KEY_SEC_DESC
*process_sk(REGF
*regf
, SK_HDR
*sk_hdr
, int sk_off
, int size
)
1910 KEY_SEC_DESC
*tmp
= NULL
;
1911 int sk_next_off
, sk_prev_off
, sk_size
;
1912 REG_SEC_DESC
*sec_desc
;
1914 if (!sk_hdr
) return NULL
;
1916 if (SVAL(&sk_hdr
->SK_ID
) != REG_SK_ID
) {
1917 fprintf(stderr
, "Unrecognized SK Header ID: %08X, %s\n", (int)sk_hdr
,
1918 regf
->regfile_name
);
1922 if (-size
< (sk_size
= IVAL(&sk_hdr
->rec_size
))) {
1923 fprintf(stderr
, "Incorrect SK record size: %d vs %d. %s\n",
1924 -size
, sk_size
, regf
->regfile_name
);
1929 * Now, we need to look up the SK Record in the map, and return it
1930 * Since the map contains the SK_OFF mapped to KEY_SEC_DESC, we can
1935 ((tmp
= lookup_sec_key(regf
->sk_map
, regf
->sk_count
, sk_off
)) != NULL
)
1936 && (tmp
->state
== SEC_DESC_OCU
)) {
1941 /* Here, we have an item in the map that has been reserved, or tmp==NULL. */
1943 assert(tmp
== NULL
|| (tmp
&& tmp
->state
!= SEC_DESC_NON
));
1946 * Now, allocate a KEY_SEC_DESC, and parse the structure here, and add the
1947 * new KEY_SEC_DESC to the mapping structure, since the offset supplied is
1948 * the actual offset of structure. The same offset will be used by
1949 * all future references to this structure
1950 * We could put all this unpleasantness in a function.
1954 tmp
= (KEY_SEC_DESC
*)malloc(sizeof(KEY_SEC_DESC
));
1955 if (!tmp
) return NULL
;
1956 bzero(tmp
, sizeof(KEY_SEC_DESC
));
1959 * Allocate an entry in the SK_MAP ...
1960 * We don't need to free tmp, because that is done for us if the
1961 * sm_map entry can't be expanded when we need more space in the map.
1964 if (!alloc_sk_map_entry(regf
, tmp
, sk_off
)) {
1970 tmp
->state
= SEC_DESC_OCU
;
1973 * Now, process the actual sec desc and plug the values in
1976 sec_desc
= (REG_SEC_DESC
*)&sk_hdr
->sec_desc
[0];
1977 tmp
->sec_desc
= process_sec_desc(regf
, sec_desc
);
1980 * Now forward and back links. Here we allocate an entry in the sk_map
1981 * if it does not exist, and mark it reserved
1984 sk_prev_off
= IVAL(&sk_hdr
->prev_off
);
1985 tmp
->prev
= lookup_create_sec_key(regf
, regf
->sk_map
, sk_prev_off
);
1986 assert(tmp
->prev
!= NULL
);
1987 sk_next_off
= IVAL(&sk_hdr
->next_off
);
1988 tmp
->next
= lookup_create_sec_key(regf
, regf
->sk_map
, sk_next_off
);
1989 assert(tmp
->next
!= NULL
);
1995 * Process a VK header and return a value
1997 VAL_KEY
*process_vk(REGF
*regf
, VK_HDR
*vk_hdr
, int size
)
1999 char val_name
[1024];
2000 int nam_len
, dat_len
, flag
, dat_type
, dat_off
, vk_id
;
2001 const char *val_type
;
2002 VAL_KEY
*tmp
= NULL
;
2004 if (!vk_hdr
) return NULL
;
2006 if ((vk_id
= SVAL(&vk_hdr
->VK_ID
)) != REG_VK_ID
) {
2007 fprintf(stderr
, "Unrecognized VK header ID: %0X, block: %0X, %s\n",
2008 vk_id
, (int)vk_hdr
, regf
->regfile_name
);
2012 nam_len
= SVAL(&vk_hdr
->nam_len
);
2013 val_name
[nam_len
] = '\0';
2014 flag
= SVAL(&vk_hdr
->flag
);
2015 dat_type
= IVAL(&vk_hdr
->dat_type
);
2016 dat_len
= IVAL(&vk_hdr
->dat_len
); /* If top bit, offset contains data */
2017 dat_off
= IVAL(&vk_hdr
->dat_off
);
2019 tmp
= (VAL_KEY
*)malloc(sizeof(VAL_KEY
));
2023 bzero(tmp
, sizeof(VAL_KEY
));
2024 tmp
->has_name
= flag
;
2025 tmp
->data_type
= dat_type
;
2028 strncpy(val_name
, vk_hdr
->dat_name
, nam_len
);
2029 tmp
->name
= strdup(val_name
);
2035 strncpy(val_name
, "<No Name>", 10);
2038 * Allocate space and copy the data as a BLOB
2043 char *dtmp
= (char *)malloc(dat_len
&0x7FFFFFFF);
2049 tmp
->data_blk
= dtmp
;
2051 if ((dat_len
&0x80000000) == 0) { /* The data is pointed to by the offset */
2052 char *dat_ptr
= LOCN(regf
->base
, dat_off
);
2053 bcopy(dat_ptr
, dtmp
, dat_len
);
2055 else { /* The data is in the offset */
2056 dat_len
= dat_len
& 0x7FFFFFFF;
2057 bcopy(&dat_off
, dtmp
, dat_len
);
2060 tmp
->data_len
= dat_len
;
2063 val_type
= val_to_str(dat_type
, reg_type_names
);
2066 * We need to save the data area as well
2069 if (verbose
) fprintf(stdout
, " %s : %s : \n", val_name
, val_type
);
2074 if (tmp
) nt_delete_val_key(tmp
);
2080 * Process a VL Header and return a list of values
2082 VAL_LIST
*process_vl(REGF
*regf
, VL_TYPE vl
, int count
, int size
)
2086 VAL_LIST
*tmp
= NULL
;
2088 if (!vl
) return NULL
;
2090 if (-size
< (count
+1)*sizeof(int)){
2091 fprintf(stderr
, "Error in VL header format. Size less than space required. %d\n", -size
);
2095 tmp
= (VAL_LIST
*)malloc(sizeof(VAL_LIST
) + (count
- 1) * sizeof(VAL_KEY
*));
2100 for (i
=0; i
<count
; i
++) {
2101 vk_off
= IVAL(&vl
[i
]);
2102 vk_hdr
= (VK_HDR
*)LOCN(regf
->base
, vk_off
);
2103 tmp
->vals
[i
] = process_vk(regf
, vk_hdr
, BLK_SIZE(vk_hdr
));
2109 tmp
->val_count
= count
;
2110 tmp
->max_vals
= count
;
2115 /* XXX: FIXME, free the partially allocated structure */
2120 * Process an LF Header and return a list of sub-keys
2122 KEY_LIST
*process_lf(REGF
*regf
, LF_HDR
*lf_hdr
, int size
, REG_KEY
*parent
)
2124 int count
, i
, nk_off
;
2128 if (!lf_hdr
) return NULL
;
2130 if ((lf_id
= SVAL(&lf_hdr
->LF_ID
)) != REG_LF_ID
) {
2131 fprintf(stderr
, "Unrecognized LF Header format: %0X, Block: %0X, %s.\n",
2132 lf_id
, (int)lf_hdr
, regf
->regfile_name
);
2138 count
= SVAL(&lf_hdr
->key_count
);
2139 if (verbose
) fprintf(stdout
, "Key Count: %u\n", count
);
2140 if (count
<= 0) return NULL
;
2142 /* Now, we should allocate a KEY_LIST struct and fill it in ... */
2144 tmp
= (KEY_LIST
*)malloc(sizeof(KEY_LIST
) + (count
- 1) * sizeof(REG_KEY
*));
2149 tmp
->key_count
= count
;
2150 tmp
->max_keys
= count
;
2152 for (i
=0; i
<count
; i
++) {
2155 nk_off
= IVAL(&lf_hdr
->hr
[i
].nk_off
);
2156 if (verbose
) fprintf(stdout
, "NK Offset: %0X\n", nk_off
);
2157 nk_hdr
= (NK_HDR
*)LOCN(regf
->base
, nk_off
);
2158 tmp
->keys
[i
] = nt_get_key_tree(regf
, nk_hdr
, BLK_SIZE(nk_hdr
), parent
);
2159 if (!tmp
->keys
[i
]) {
2167 if (tmp
) nt_delete_key_list(tmp
, False
);
2172 * This routine is passed an NK_HDR pointer and retrieves the entire tree
2173 * from there down. It returns a REG_KEY *.
2175 REG_KEY
*nt_get_key_tree(REGF
*regf
, NK_HDR
*nk_hdr
, int size
, REG_KEY
*parent
)
2177 REG_KEY
*tmp
= NULL
, *own
;
2178 int name_len
, clsname_len
, lf_off
, val_off
, val_count
, sk_off
, own_off
;
2183 char key_name
[1024], cls_name
[1024];
2185 if (!nk_hdr
) return NULL
;
2187 if ((nk_id
= SVAL(&nk_hdr
->NK_ID
)) != REG_NK_ID
) {
2188 fprintf(stderr
, "Unrecognized NK Header format: %08X, Block: %0X. %s\n",
2189 nk_id
, (int)nk_hdr
, regf
->regfile_name
);
2195 name_len
= SVAL(&nk_hdr
->nam_len
);
2196 clsname_len
= SVAL(&nk_hdr
->clsnam_len
);
2199 * The value of -size should be ge
2200 * (sizeof(NK_HDR) - 1 + name_len)
2201 * The -1 accounts for the fact that we included the first byte of
2202 * the name in the structure. clsname_len is the length of the thing
2203 * pointed to by clsnam_off
2206 if (-size
< (sizeof(NK_HDR
) - 1 + name_len
)) {
2207 fprintf(stderr
, "Incorrect NK_HDR size: %d, %0X\n", -size
, (int)nk_hdr
);
2208 fprintf(stderr
, "Sizeof NK_HDR: %d, name_len %d, clsname_len %d\n",
2209 sizeof(NK_HDR
), name_len
, clsname_len
);
2213 if (verbose
) fprintf(stdout
, "NK HDR: Name len: %d, class name len: %d\n",
2214 name_len
, clsname_len
);
2216 /* Fish out the key name and process the LF list */
2218 assert(name_len
< sizeof(key_name
));
2220 /* Allocate the key struct now */
2221 tmp
= (REG_KEY
*)malloc(sizeof(REG_KEY
));
2222 if (!tmp
) return tmp
;
2223 bzero(tmp
, sizeof(REG_KEY
));
2225 tmp
->type
= (SVAL(&nk_hdr
->type
)==0x2C?REG_ROOT_KEY
:REG_SUB_KEY
);
2227 strncpy(key_name
, nk_hdr
->key_nam
, name_len
);
2228 key_name
[name_len
] = '\0';
2230 if (verbose
) fprintf(stdout
, "Key name: %s\n", key_name
);
2232 tmp
->name
= strdup(key_name
);
2238 * Fish out the class name, it is in UNICODE, while the key name is
2242 if (clsname_len
) { /* Just print in Ascii for now */
2246 clsnam_off
= IVAL(&nk_hdr
->clsnam_off
);
2247 clsnamep
= LOCN(regf
->base
, clsnam_off
);
2248 if (verbose
) fprintf(stdout
, "Class Name Offset: %0X\n", clsnam_off
);
2250 bzero(cls_name
, clsname_len
);
2251 uni_to_ascii(clsnamep
, cls_name
, sizeof(cls_name
), clsname_len
);
2254 * I am keeping class name as an ascii string for the moment.
2255 * That means it needs to be converted on output.
2256 * It will also piss off people who need Unicode/UTF-8 strings. Sorry.
2260 tmp
->class_name
= strdup(cls_name
);
2261 if (!tmp
->class_name
) {
2265 if (verbose
) fprintf(stdout
, " Class Name: %s\n", cls_name
);
2270 * Process the owner offset ...
2273 own_off
= IVAL(&nk_hdr
->own_off
);
2274 own
= (REG_KEY
*)LOCN(regf
->base
, own_off
);
2275 if (verbose
) fprintf(stdout
, "Owner Offset: %0X\n", own_off
);
2277 if (verbose
) fprintf(stdout
, " Owner locn: %0X, Our locn: %0X\n",
2278 (unsigned int)own
, (unsigned int)nk_hdr
);
2281 * We should verify that the owner field is correct ...
2282 * for now, we don't worry ...
2285 tmp
->owner
= parent
;
2288 * If there are any values, process them here
2291 val_count
= IVAL(&nk_hdr
->val_cnt
);
2292 if (verbose
) fprintf(stdout
, "Val Count: %d\n", val_count
);
2295 val_off
= IVAL(&nk_hdr
->val_off
);
2296 vl
= (VL_TYPE
*)LOCN(regf
->base
, val_off
);
2297 if (verbose
) fprintf(stdout
, "Val List Offset: %0X\n", val_off
);
2299 tmp
->values
= process_vl(regf
, *vl
, val_count
, BLK_SIZE(vl
));
2307 * Also handle the SK header ...
2310 sk_off
= IVAL(&nk_hdr
->sk_off
);
2311 sk_hdr
= (SK_HDR
*)LOCN(regf
->base
, sk_off
);
2312 if (verbose
) fprintf(stdout
, "SK Offset: %0X\n", sk_off
);
2316 tmp
->security
= process_sk(regf
, sk_hdr
, sk_off
, BLK_SIZE(sk_hdr
));
2320 lf_off
= IVAL(&nk_hdr
->lf_off
);
2321 if (verbose
) fprintf(stdout
, "SubKey list offset: %0X\n", lf_off
);
2324 * No more subkeys if lf_off == -1
2329 lf_hdr
= (LF_HDR
*)LOCN(regf
->base
, lf_off
);
2331 tmp
->sub_keys
= process_lf(regf
, lf_hdr
, BLK_SIZE(lf_hdr
), tmp
);
2332 if (!tmp
->sub_keys
){
2341 if (tmp
) nt_delete_reg_key(tmp
, False
);
2345 int nt_load_registry(REGF
*regf
)
2348 unsigned int regf_id
, hbin_id
;
2352 /* Get the header */
2354 if ((regf_hdr
= nt_get_regf_hdr(regf
)) == NULL
) {
2358 /* Now process that header and start to read the rest in */
2360 if ((regf_id
= IVAL(®f_hdr
->REGF_ID
)) != REG_REGF_ID
) {
2361 fprintf(stderr
, "Unrecognized NT registry header id: %0X, %s\n",
2362 regf_id
, regf
->regfile_name
);
2367 * Validate the header ...
2369 if (!valid_regf_hdr(regf_hdr
)) {
2370 fprintf(stderr
, "Registry file header does not validate: %s\n",
2371 regf
->regfile_name
);
2375 /* Update the last mod date, and then go get the first NK record and on */
2377 TTTONTTIME(regf
, IVAL(®f_hdr
->tim1
), IVAL(®f_hdr
->tim2
));
2380 * The hbin hdr seems to be just uninteresting garbage. Check that
2381 * it is there, but that is all.
2384 hbin_hdr
= (HBIN_HDR
*)(regf
->base
+ REGF_HDR_BLKSIZ
);
2386 if ((hbin_id
= IVAL(&hbin_hdr
->HBIN_ID
)) != REG_HBIN_ID
) {
2387 fprintf(stderr
, "Unrecognized registry hbin hdr ID: %0X, %s\n",
2388 hbin_id
, regf
->regfile_name
);
2393 * Get a pointer to the first key from the hreg_hdr
2396 if (verbose
) fprintf(stdout
, "First Key: %0X\n",
2397 IVAL(®f_hdr
->first_key
));
2399 first_key
= (NK_HDR
*)LOCN(regf
->base
, IVAL(®f_hdr
->first_key
));
2400 if (verbose
) fprintf(stdout
, "First Key Offset: %0X\n",
2401 IVAL(®f_hdr
->first_key
));
2403 if (verbose
) fprintf(stdout
, "Data Block Size: %d\n",
2404 IVAL(®f_hdr
->dblk_size
));
2406 if (verbose
) fprintf(stdout
, "Offset to next hbin block: %0X\n",
2407 IVAL(&hbin_hdr
->next_off
));
2409 if (verbose
) fprintf(stdout
, "HBIN block size: %0X\n",
2410 IVAL(&hbin_hdr
->blk_size
));
2413 * Now, get the registry tree by processing that NK recursively
2416 regf
->root
= nt_get_key_tree(regf
, first_key
, BLK_SIZE(first_key
), NULL
);
2418 assert(regf
->root
!= NULL
);
2421 * Unmap the registry file, as we might want to read in another
2425 if (regf
->base
) munmap(regf
->base
, regf
->sbuf
.st_size
);
2427 close(regf
->fd
); /* Ignore the error :-) */
2433 * Allocate a new hbin block and link it to the others.
2435 int nt_create_hbin_blk(REGF
*regf
)
2442 * Allocate a unit of space ...
2444 void *nt_alloc_regf_space(REGF
*regf
, int size
)
2451 * Store a KEY in the file ...
2453 * We store this depth first, and defer storing the lf struct until
2454 * all the sub-keys have been stored.
2456 * We store the NK hdr, any SK header, class name, and VK structure, then
2457 * recurse down the LF structures ...
2459 int nt_store_reg_key(REGF
*regf
, REG_KEY
*key
)
2467 * Store the registry header ...
2468 * We actually create the registry header block and link it to the chain
2471 REGF_HDR
*nt_get_reg_header(REGF
*regf
)
2473 HBIN_BLK
*tmp
= NULL
;
2475 tmp
= (HBIN_BLK
*)malloc(sizeof(HBIN_BLK
));
2478 bzero(tmp
, sizeof(HBIN_BLK
));
2479 tmp
->type
= REG_OUTBLK_HDR
;
2480 tmp
->size
= REGF_HDR_BLKSIZ
;
2481 tmp
->data
= malloc(REGF_HDR_BLKSIZ
);
2482 if (!tmp
->data
) goto error
;
2484 bzero(tmp
->data
, REGF_HDR_BLKSIZ
); /* Make it pristine, unlike Windows */
2485 regf
->blk_head
= regf
->blk_tail
= tmp
;
2487 return (REGF_HDR
*)tmp
->data
;
2495 * Store the registry in the output file
2496 * We write out the header and then each of the keys etc into the file
2497 * We have to flatten the data structure ...
2499 * The structures are stored in a depth-first fashion, with all records
2500 * aligned on 8-byte boundaries, with sub-keys and values layed down before
2501 * the lists that contain them. SK records are layed down first, however.
2502 * The lf fields are layed down after all sub-keys have been layed down, it
2503 * seems, including the whole tree associated with each sub-key.
2505 int nt_store_registry(REGF
*regf
)
2509 reg
= nt_get_reg_header(regf
);
2515 * Routines to parse a REGEDIT4 file
2517 * The file consists of:
2524 * [cmd:]name=type:value
2526 * cmd = a|d|c|add|delete|change|as|ds|cs
2528 * There can be more than one key-path and value-spec.
2530 * Since we want to support more than one type of file format, we
2531 * construct a command-file structure that keeps info about the command file
2534 #define FMT_UNREC -1
2535 #define FMT_REGEDIT4 0
2536 #define FMT_EDITREG1_1 1
2538 #define FMT_STRING_REGEDIT4 "REGEDIT4"
2539 #define FMT_STRING_EDITREG1_0 "EDITREG1.0"
2542 #define CMD_ADD_KEY 1
2543 #define CMD_DEL_KEY 2
2548 typedef struct val_spec_list
{
2549 struct val_spec_list
*next
;
2552 char *val
; /* Kept as a char string, really? */
2555 typedef struct command_s
{
2559 VAL_SPEC_LIST
*val_spec_list
, *val_spec_last
;
2562 typedef struct cmd_line
{
2567 void free_val_spec_list(VAL_SPEC_LIST
*vl
)
2570 if (vl
->name
) free(vl
->name
);
2571 if (vl
->val
) free(vl
->val
);
2577 * Some routines to handle lines of info in the command files
2579 void skip_to_eol(int fd
)
2584 while ((rc
= read(fd
, &ch
, 1)) == 1) {
2585 if (ch
== 0x0A) return;
2588 fprintf(stderr
, "Could not read file descriptor: %d, %s\n",
2589 fd
, strerror(errno
));
2594 void free_cmd(CMD
*cmd
)
2598 while (cmd
->val_spec_list
) {
2601 tmp
= cmd
->val_spec_list
;
2602 cmd
->val_spec_list
= tmp
->next
;
2610 void free_cmd_line(CMD_LINE
*cmd_line
)
2613 if (cmd_line
->line
) free(cmd_line
->line
);
2618 void print_line(struct cmd_line
*cl
)
2624 if ((pl
= malloc(cl
->line_len
+ 1)) == NULL
) {
2625 fprintf(stderr
, "Unable to allocate space to print line: %s\n",
2630 strncpy(pl
, cl
->line
, cl
->line_len
);
2631 pl
[cl
->line_len
] = 0;
2633 fprintf(stdout
, "%s\n", pl
);
2637 #define INIT_ALLOC 10
2640 * Read a line from the input file.
2641 * NULL returned when EOF and no chars read
2642 * Otherwise we return a cmd_line *
2643 * Exit if other errors
2645 struct cmd_line
*get_cmd_line(int fd
)
2647 struct cmd_line
*cl
= (CMD_LINE
*)malloc(sizeof(CMD_LINE
));
2652 fprintf(stderr
, "Unable to allocate structure for command line: %s\n",
2657 cl
->len
= INIT_ALLOC
;
2660 * Allocate some space for the line. We extend later if needed.
2663 if ((cl
->line
= (char *)malloc(INIT_ALLOC
)) == NULL
) {
2664 fprintf(stderr
, "Unable to allocate initial space for line: %s\n",
2670 * Now read in the chars to EOL. Don't store the EOL in the
2671 * line. What about CR?
2674 while ((rc
= read(fd
, &ch
, 1)) == 1 && ch
!= '\n') {
2675 if (ch
== '\r') continue; /* skip CR */
2678 * Allocate some more memory
2680 if ((cl
->line
= realloc(cl
->line
, cl
->len
+ INIT_ALLOC
)) == NULL
) {
2681 fprintf(stderr
, "Unable to realloc space for line: %s\n",
2685 cl
->len
+= INIT_ALLOC
;
2691 /* read 0 and we were at loc'n 0, return NULL */
2692 if (rc
== 0 && i
== 0) {
2704 * parse_value: parse out a value. We pull it apart as:
2706 * <value> ::= <value-name>=<type>:<value-string>
2708 * <value-name> ::= char-string-without-spaces | '"' char-string '"'
2710 * If it parsed OK, return the <value-name> as a string, and the
2711 * value type and value-string in parameters.
2713 * The value name can be empty. There can only be one empty name in
2714 * a list of values. A value of - removes the value entirely.
2717 char *dup_str(char *s
, int len
)
2720 nstr
= (char *)malloc(len
+ 1);
2722 memcpy(nstr
, s
, len
);
2728 char *parse_name(char *nstr
)
2730 int len
= 0, start
= 0;
2731 if (!nstr
) return NULL
;
2735 while (len
&& nstr
[len
- 1] == ' ') len
--;
2737 nstr
[len
] = 0; /* Trim any spaces ... if there were none, doesn't matter */
2740 * Beginning and end should be '"' or neither should be so
2742 if ((nstr
[0] == '"' && nstr
[len
- 1] != '"') ||
2743 (nstr
[0] != '"' && nstr
[len
- 1] == '"'))
2746 if (nstr
[0] == '"') {
2751 return dup_str(&nstr
[start
], len
);
2754 int parse_value_type(char *tstr
)
2756 int len
= strlen(tstr
);
2758 while (len
&& tstr
[len
- 1] == ' ') len
--;
2761 if (strcmp(tstr
, "REG_DWORD") == 0)
2762 return REG_TYPE_DWORD
;
2763 else if (strcmp(tstr
, "dword") == 0)
2764 return REG_TYPE_DWORD
;
2765 else if (strcmp(tstr
, "REG_EXPAND_SZ") == 0)
2766 return REG_TYPE_EXPANDSZ
;
2767 else if (strcmp(tstr
, "REG_BIN") == 0)
2768 return REG_TYPE_BIN
;
2769 else if (strcmp(tstr
, "REG_SZ") == 0)
2770 return REG_TYPE_REGSZ
;
2771 else if (strcmp(tstr
, "REG_MULTI_SZ") == 0)
2772 return REG_TYPE_MULTISZ
;
2773 else if (strcmp(tstr
, "-") == 0)
2774 return REG_TYPE_DELETE
;
2779 char *parse_val_str(char *vstr
)
2782 return dup_str(vstr
, strlen(vstr
));
2786 char *parse_value(struct cmd_line
*cl
, int *vtype
, char **val
)
2788 char *p1
= NULL
, *p2
= NULL
, *nstr
= NULL
, *tstr
= NULL
, *vstr
= NULL
;
2790 if (!cl
|| !vtype
|| !val
) return NULL
;
2791 if (!cl
->line_len
) return NULL
;
2793 p1
= dup_str(cl
->line
, cl
->line_len
);
2794 /* FIXME: Better return codes etc ... */
2795 if (!p1
) return NULL
;
2796 p2
= strchr(p1
, '=');
2797 if (!p2
) return NULL
;
2799 *p2
= 0; p2
++; /* Split into two strings at p2 */
2801 /* Now, parse the name ... */
2803 nstr
= parse_name(p1
);
2804 if (!nstr
) goto error
;
2806 /* Now, split the remainder and parse on type and val ... */
2809 while (*tstr
== ' ') tstr
++; /* Skip leading white space */
2810 p2
= strchr(p2
, ':');
2813 *p2
= 0; p2
++; /* split on the : */
2816 *vtype
= parse_value_type(tstr
);
2818 if (!vtype
) goto error
;
2820 if (!p2
|| !*p2
) return nstr
;
2822 /* Now, parse the value string. It should return a newly malloc'd string */
2824 while (*p2
== ' ') p2
++; /* Skip leading space */
2825 vstr
= parse_val_str(p2
);
2827 if (!vstr
) goto error
;
2835 if (nstr
) free(nstr
);
2836 if (vstr
) free(vstr
);
2841 * Parse out a key. Look for a correctly formatted key [...]
2842 * and whether it is a delete or add? A delete is signalled
2843 * by a - in front of the key.
2844 * Assumes that there are no leading and trailing spaces
2847 char *parse_key(struct cmd_line
*cl
, int *cmd
)
2852 if (cl
->line
[0] != '[' ||
2853 cl
->line
[cl
->line_len
- 1] != ']') return NULL
;
2854 if (cl
->line_len
== 2) return NULL
;
2856 if (cl
->line
[1] == '-') {
2857 if (cl
->line_len
== 3) return NULL
;
2861 tmp
= malloc(cl
->line_len
- 1 - start
+ 1);
2862 if (!tmp
) return tmp
; /* Bail out on no mem ... FIXME */
2863 strncpy(tmp
, &cl
->line
[start
], cl
->line_len
- 1 - start
);
2864 tmp
[cl
->line_len
- 1 - start
] = 0;
2869 * Parse a line to determine if we have a key or a value
2870 * We only check for key or val ...
2873 int parse_line(struct cmd_line
*cl
)
2876 if (!cl
|| cl
->len
== 0) return 0;
2878 if (cl
->line
[0] == '[') /* No further checking for now */
2885 * We seek to offset 0, read in the required number of bytes,
2886 * and compare to the correct value.
2887 * We then seek back to the original location
2889 int regedit4_file_type(int fd
)
2894 cur_ofs
= lseek(fd
, 0, SEEK_CUR
); /* Get current offset */
2896 fprintf(stderr
, "Unable to get current offset: %s\n", strerror(errno
));
2897 exit(1); /* FIXME */
2901 lseek(fd
, 0, SEEK_SET
);
2904 if (read(fd
, desc
, 8) < 8) {
2905 fprintf(stderr
, "Unable to read command file format\n");
2906 exit(2); /* FIXME */
2911 if (strcmp(desc
, FMT_STRING_REGEDIT4
) == 0) {
2913 lseek(fd
, cur_ofs
, SEEK_SET
);
2918 return FMT_REGEDIT4
;
2925 * Run though the data in the line and strip anything after a comment
2928 void strip_comment(struct cmd_line
*cl
)
2934 for (i
= 0; i
< cl
->line_len
; i
++) {
2935 if (cl
->line
[i
] == ';') {
2943 * trim leading space
2946 void trim_leading_spaces(struct cmd_line
*cl
)
2952 for (i
= 0; i
< cl
->line_len
; i
++) {
2953 if (cl
->line
[i
] != ' '){
2954 if (i
) memcpy(cl
->line
, &cl
->line
[i
], cl
->line_len
- i
);
2961 * trim trailing spaces
2963 void trim_trailing_spaces(struct cmd_line
*cl
)
2969 for (i
= cl
->line_len
; i
== 0; i
--) {
2970 if (cl
->line
[i
-1] != ' ' &&
2971 cl
->line
[i
-1] != '\t') {
2978 * Get a command ... This consists of possibly multiple lines:
2981 * possibly Empty line
2983 * value ::= <value-name>=<value-type>':'<value-string>
2984 * <value-name> is some path, possibly enclosed in quotes ...
2985 * We alctually look for the next key to terminate a previous key
2986 * if <value-type> == '-', then it is a delete type.
2988 CMD
*regedit4_get_cmd(int fd
)
2990 struct command_s
*cmd
= NULL
;
2991 struct cmd_line
*cl
= NULL
;
2992 struct val_spec_list
*vl
= NULL
;
2994 if ((cmd
= (struct command_s
*)malloc(sizeof(struct command_s
))) == NULL
) {
2995 fprintf(stderr
, "Unable to malloc space for command: %s\n",
3000 cmd
->cmd
= CMD_NONE
;
3003 cmd
->val_spec_list
= cmd
->val_spec_last
= NULL
;
3004 while ((cl
= get_cmd_line(fd
))) {
3007 * If it is an empty command line, and we already have a key
3008 * then exit from here ... FIXME: Clean up the parser
3011 if (cl
->line_len
== 0 && cmd
->key
) {
3016 strip_comment(cl
); /* remove anything beyond a comment char */
3017 trim_trailing_spaces(cl
);
3018 trim_leading_spaces(cl
);
3020 if (cl
->line_len
== 0) { /* An empty line */
3023 else { /* Else, non-empty ... */
3025 * Parse out the bits ...
3027 switch (parse_line(cl
)) {
3029 if ((cmd
->key
= parse_key(cl
, &cmd
->cmd
)) == NULL
) {
3030 fprintf(stderr
, "Error parsing key from line: ");
3032 fprintf(stderr
, "\n");
3038 * We need to add the value stuff to the list
3039 * There could be a \ on the end which we need to
3040 * handle at some time
3042 vl
= (struct val_spec_list
*)malloc(sizeof(struct val_spec_list
));
3043 if (!vl
) goto error
;
3046 vl
->name
= parse_value(cl
, &vl
->type
, &vl
->val
);
3047 if (!vl
->name
) goto error
;
3048 if (cmd
->val_spec_list
== NULL
) {
3049 cmd
->val_spec_list
= cmd
->val_spec_last
= vl
;
3052 cmd
->val_spec_last
->next
= vl
;
3053 cmd
->val_spec_last
= vl
;
3059 fprintf(stderr
, "Unrecognized line in command file: \n");
3066 if (!cmd
->cmd
) goto error
; /* End of file ... */
3072 if (cmd
) free_cmd(cmd
);
3076 int regedit4_exec_cmd(CMD
*cmd
)
3082 int editreg_1_0_file_type(int fd
)
3087 cur_ofs
= lseek(fd
, 0, SEEK_CUR
); /* Get current offset */
3089 fprintf(stderr
, "Unable to get current offset: %s\n", strerror(errno
));
3090 exit(1); /* FIXME */
3094 lseek(fd
, 0, SEEK_SET
);
3097 if (read(fd
, desc
, 10) < 10) {
3098 fprintf(stderr
, "Unable to read command file format\n");
3099 exit(2); /* FIXME */
3104 if (strcmp(desc
, FMT_STRING_EDITREG1_0
) == 0) {
3105 lseek(fd
, cur_ofs
, SEEK_SET
);
3106 return FMT_REGEDIT4
;
3112 CMD
*editreg_1_0_get_cmd(int fd
)
3117 int editreg_1_0_exec_cmd(CMD
*cmd
)
3123 typedef struct command_ops_s
{
3125 int (*file_type
)(int fd
);
3126 CMD
*(*get_cmd
)(int fd
);
3127 int (*exec_cmd
)(CMD
*cmd
);
3130 CMD_OPS default_cmd_ops
[] = {
3131 {0, regedit4_file_type
, regedit4_get_cmd
, regedit4_exec_cmd
},
3132 {1, editreg_1_0_file_type
, editreg_1_0_get_cmd
, editreg_1_0_exec_cmd
},
3133 {-1, NULL
, NULL
, NULL
}
3136 typedef struct command_file_s
{
3143 * Create a new command file structure
3146 CMD_FILE
*cmd_file_create(char *file
)
3153 * Let's check if the file exists ...
3154 * No use creating the cmd_file structure if the file does not exist
3157 if (stat(file
, &sbuf
) < 0) { /* Not able to access file */
3162 tmp
= (CMD_FILE
*)malloc(sizeof(CMD_FILE
));
3168 * Let's fill in some of the fields;
3171 tmp
->name
= strdup(file
);
3173 if ((tmp
->fd
= open(file
, O_RDONLY
, 666)) < 0) {
3179 * Now, try to find the format by indexing through the table
3181 while (default_cmd_ops
[i
].type
!= -1) {
3182 if ((tmp
->type
= default_cmd_ops
[i
].file_type(tmp
->fd
)) >= 0) {
3183 tmp
->cmd_ops
= default_cmd_ops
[i
];
3190 * If we got here, return NULL, as we could not figure out the type
3193 * What about errors?
3201 * Extract commands from the command file, and execute them.
3202 * We pass a table of command callbacks for that
3206 * Main code from here on ...
3210 * key print function here ...
3213 int print_key(const char *path
, char *name
, char *class_name
, int root
,
3214 int terminal
, int vals
)
3217 if (full_print
|| terminal
) fprintf(stdout
, "[%s%s]\n", path
, name
);
3223 * Sec Desc print functions
3226 void print_type(unsigned char type
)
3230 fprintf(stdout
, " ALLOW");
3233 fprintf(stdout
, " DENY");
3236 fprintf(stdout
, " AUDIT");
3239 fprintf(stdout
, " ALARM");
3242 fprintf(stdout
, "ALLOW CPD");
3245 fprintf(stdout
, "OBJ ALLOW");
3248 fprintf(stdout
, " OBJ DENY");
3250 fprintf(stdout
, " UNKNOWN");
3255 void print_flags(unsigned char flags
)
3257 char flg_output
[21];
3262 fprintf(stdout
, " ");
3266 if (some
) strcat(flg_output
, ",");
3268 strcat(flg_output
, "OI");
3271 if (some
) strcat(flg_output
, ",");
3273 strcat(flg_output
, "CI");
3276 if (some
) strcat(flg_output
, ",");
3278 strcat(flg_output
, "NP");
3281 if (some
) strcat(flg_output
, ",");
3283 strcat(flg_output
, "IO");
3286 if (some
) strcat(flg_output
, ",");
3288 strcat(flg_output
, "IA");
3291 if (some
) strcat(flg_output
, ",");
3293 strcat(flg_output
, "VI");
3295 fprintf(stdout
, " %s", flg_output
);
3298 void print_perms(int perms
)
3300 fprintf(stdout
, " %8X", perms
);
3303 void print_sid(DOM_SID
*sid
)
3305 int i
, comps
= sid
->auths
;
3306 fprintf(stdout
, "S-%u-%u", sid
->ver
, sid
->auth
[5]);
3308 for (i
= 0; i
< comps
; i
++) {
3310 fprintf(stdout
, "-%u", sid
->sub_auths
[i
]);
3313 fprintf(stdout
, "\n");
3316 void print_acl(ACL
*acl
, char *prefix
)
3320 for (i
= 0; i
< acl
->num_aces
; i
++) {
3321 fprintf(stdout
, ";;%s", prefix
);
3322 print_type(acl
->aces
[i
]->type
);
3323 print_flags(acl
->aces
[i
]->flags
);
3324 print_perms(acl
->aces
[i
]->perms
);
3325 fprintf(stdout
, " ");
3326 print_sid(acl
->aces
[i
]->trustee
);
3330 int print_sec(SEC_DESC
*sec_desc
)
3332 if (!print_security
) return 1;
3333 fprintf(stdout
, ";; SECURITY\n");
3334 fprintf(stdout
, ";; Owner: ");
3335 print_sid(sec_desc
->owner
);
3336 fprintf(stdout
, ";; Group: ");
3337 print_sid(sec_desc
->group
);
3338 if (sec_desc
->sacl
) {
3339 fprintf(stdout
, ";; SACL:\n");
3340 print_acl(sec_desc
->sacl
, " ");
3342 if (sec_desc
->dacl
) {
3343 fprintf(stdout
, ";; DACL:\n");
3344 print_acl(sec_desc
->dacl
, " ");
3350 * Value print function here ...
3352 int print_val(const char *path
, char *val_name
, int val_type
, int data_len
,
3353 void *data_blk
, int terminal
, int first
, int last
)
3355 char data_asc
[1024];
3357 bzero(data_asc
, sizeof(data_asc
));
3358 if (!terminal
&& first
)
3359 fprintf(stdout
, "%s\n", path
);
3360 data_to_ascii((unsigned char *)data_blk
, data_len
, val_type
, data_asc
,
3361 sizeof(data_asc
) - 1);
3362 fprintf(stdout
, " %s = %s : %s\n", (val_name
?val_name
:"<No Name>"),
3363 val_to_str(val_type
, reg_type_names
), data_asc
);
3369 fprintf(stderr
, "Usage: editreg [-f] [-v] [-p] [-k] [-s] [-c <command-file>] <registryfile>\n");
3370 fprintf(stderr
, "Version: 0.1\n\n");
3371 fprintf(stderr
, "\n\t-v\t sets verbose mode");
3372 fprintf(stderr
, "\n\t-f\t sets full print mode where non-terminals are printed");
3373 fprintf(stderr
, "\n\t-p\t prints the registry");
3374 fprintf(stderr
, "\n\t-s\t prints security descriptors");
3375 fprintf(stderr
, "\n\t-c <command-file>\t specifies a command file");
3376 fprintf(stderr
, "\n");
3379 int main(int argc
, char *argv
[])
3382 extern char *optarg
;
3384 int opt
, print_keys
= 0;
3385 int regf_opt
= 1; /* Command name */
3387 char *cmd_file_name
= NULL
;
3388 char *out_file_name
= NULL
;
3389 CMD_FILE
*cmd_file
= NULL
;
3398 * Now, process the arguments
3401 while ((opt
= getopt(argc
, argv
, "fspvko:O:c:")) != EOF
) {
3405 cmd_file_name
= optarg
;
3415 out_file_name
= optarg
;
3420 def_owner_sid_str
= strdup(optarg
);
3422 if (!string_to_sid(&lsid
, def_owner_sid_str
)) {
3423 fprintf(stderr
, "Default Owner SID: %s is incorrectly formatted\n",
3425 free(def_owner_sid_str
);
3426 def_owner_sid_str
= NULL
;
3429 nt_delete_sid(lsid
);
3460 * We only want to complain about the lack of a default owner SID if
3461 * we need one. This approximates that need
3463 if (!def_owner_sid_str
) {
3464 def_owner_sid_str
= "S-1-5-21-1-2-3-4";
3465 if (out_file_name
|| verbose
)
3466 fprintf(stderr
, "Warning, default owner SID not set. Setting to %s\n",
3470 if ((regf
= nt_create_regf()) == NULL
) {
3471 fprintf(stderr
, "Could not create registry object: %s\n", strerror(errno
));
3475 if (regf_opt
< argc
) { /* We have a registry file */
3476 if (!nt_set_regf_input_file(regf
, argv
[regf_opt
])) {
3477 fprintf(stderr
, "Could not set name of registry file: %s, %s\n",
3478 argv
[regf_opt
], strerror(errno
));
3482 /* Now, open it, and bring it into memory :-) */
3484 if (nt_load_registry(regf
) < 0) {
3485 fprintf(stderr
, "Could not load registry: %s\n", argv
[1]);
3490 if (out_file_name
) {
3491 if (!nt_set_regf_output_file(regf
, out_file_name
)) {
3492 fprintf(stderr
, "Could not set name of output registry file: %s, %s\n",
3493 out_file_name
, strerror(errno
));
3502 cmd_file
= cmd_file_create(cmd_file_name
);
3504 while ((cmd
= cmd_file
->cmd_ops
.get_cmd(cmd_file
->fd
)) != NULL
) {
3507 * Now, apply the requests to the tree ...
3511 REG_KEY
*tmp
= NULL
;
3513 tmp
= nt_find_key_by_name(regf
->root
, cmd
->key
);
3515 /* If we found it, apply the other bits, else create such a key */
3518 tmp
= nt_add_reg_key(regf
, cmd
->key
, True
);
3524 while (cmd
->val_count
) {
3525 VAL_SPEC_LIST
*val
= cmd
->val_spec_list
;
3526 VAL_KEY
*reg_val
= NULL
;
3528 if (val
->type
== REG_TYPE_DELETE
) {
3529 reg_val
= nt_delete_reg_value(tmp
, val
-> name
);
3530 if (reg_val
) nt_delete_val_key(reg_val
);
3533 reg_val
= nt_add_reg_value(tmp
, val
->name
, val
->type
,
3537 cmd
->val_spec_list
= val
->next
;
3538 free_val_spec_list(val
);
3547 * Any value does not matter ...
3548 * Find the key if it exists, and delete it ...
3551 nt_delete_key_by_name(regf
, cmd
->key
);
3559 * At this point, we should have a registry in memory and should be able
3560 * to iterate over it.
3564 nt_key_iterator(regf
, regf
->root
, 0, "", print_key
, print_sec
, print_val
);