69 #include <sys/types.h>
88 #define REGFI_LOG_INFO 0x0001
89 #define REGFI_LOG_WARN 0x0004
90 #define REGFI_LOG_ERROR 0x0010
91 #define REGFI_DEFAULT_LOG_MASK REGFI_LOG_ERROR|REGFI_LOG_WARN
96 REGFI_ENCODING_DEFAULT = 0,
97 REGFI_ENCODING_ASCII = 0,
98 REGFI_ENCODING_UTF8 = 1,
99 REGFI_ENCODING_UTF16LE = 2,
100 REGFI_NUM_ENCODINGS = 3
114 REG_RESOURCE_LIST = 8,
115 REG_FULL_RESOURCE_DESCRIPTOR= 9,
116 REG_RESOURCE_REQUIREMENTS_LIST= 10,
122 #define REGFI_OFFSET_NONE 0xffffffff
131 #define REGFI_CACHE_SK_MAX 64
132 #define REGFI_CACHE_NK_MAX 1024
137 #define REGFI_MAX_DEPTH 512
145 #define REGFI_MAX_SUBKEY_DEPTH 255
153 pthread_key_t regfi_log_key;
156 #define REGFI_HBIN_ALLOC 0x1000
157 #define REGFI_REGF_SIZE 0x1000
158 #define REGFI_REGF_MAGIC_SIZE 4
159 #define REGFI_REGF_NAME_SIZE 64
160 #define REGFI_REGF_RESERVED1_SIZE 340
161 #define REGFI_REGF_RESERVED2_SIZE 3528
162 #define REGFI_HBIN_MAGIC_SIZE 4
163 #define REGFI_CELL_MAGIC_SIZE 2
164 #define REGFI_HBIN_HEADER_SIZE 0x20
165 #define REGFI_NK_MIN_LENGTH 0x4C
166 #define REGFI_VK_MIN_LENGTH 0x14
167 #define REGFI_SK_MIN_LENGTH 0x14
168 #define REGFI_SUBKEY_LIST_MIN_LEN 0x4
169 #define REGFI_BIG_DATA_MIN_LENGTH 0xC
180 #define REGFI_MTIME_MIN 0x01B41E6D00000000L
185 #define REGFI_MTIME_MAX 0x0304754300000000L
189 #define REGFI_VK_FLAG_ASCIINAME 0x0001
190 #define REGFI_VK_DATA_IN_OFFSET 0x80000000
191 #define REGFI_VK_MAX_DATA_LENGTH 1024*1024
197 #define REGFI_NK_FLAG_UNKNOWN1 0x4000
198 #define REGFI_NK_FLAG_UNKNOWN2 0x1000
207 #define REGFI_NK_FLAG_UNKNOWN3 0x0080
213 #define REGFI_NK_FLAG_PREDEF_KEY 0x0040
216 #define REGFI_NK_FLAG_ASCIINAME 0x0020
221 #define REGFI_NK_FLAG_LINK 0x0010
224 #define REGFI_NK_FLAG_NO_RM 0x0008
227 #define REGFI_NK_FLAG_ROOT 0x0004
232 #define REGFI_NK_FLAG_HIVE_LINK 0x0002
237 #define REGFI_NK_FLAG_VOLATILE 0x0001
240 #define REGFI_NK_KNOWN_FLAGS (REGFI_NK_FLAG_PREDEF_KEY\
241 | REGFI_NK_FLAG_ASCIINAME\
242 | REGFI_NK_FLAG_LINK\
243 | REGFI_NK_FLAG_NO_RM\
244 | REGFI_NK_FLAG_ROOT\
245 | REGFI_NK_FLAG_HIVE_LINK\
246 | REGFI_NK_FLAG_VOLATILE\
247 | REGFI_NK_FLAG_UNKNOWN1\
248 | REGFI_NK_FLAG_UNKNOWN2\
249 | REGFI_NK_FLAG_UNKNOWN3)
256 #define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
257 : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
258 #define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
259 #define REGFI_TIME_FIXUP (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
267 typedef uint64_t REGFI_NTTIME;
269 typedef struct _regfi_log
283 typedef struct _regfi_hbin
304 uint8_t magic[REGFI_HBIN_MAGIC_SIZE];
323 typedef struct _regfi_subkey_list
331 uint32_t num_children;
337 uint8_t magic[REGFI_CELL_MAGIC_SIZE];
344 typedef uint32_t REGFI_VALUE_LIST_ELEM;
348 typedef struct _regfi_value_list
360 REGFI_VALUE_LIST_ELEM* elements;
367 typedef struct _regfi_classname
392 typedef struct _regfi_data
503 typedef struct _regfi_vk
543 uint8_t magic[REGFI_CELL_MAGIC_SIZE];
569 typedef struct _regfi_sk
596 uint16_t unknown_tag;
599 uint8_t magic[REGFI_CELL_MAGIC_SIZE];
606 typedef struct _regfi_nk
633 uint8_t magic[REGFI_CELL_MAGIC_SIZE];
664 uint32_t max_bytes_subkeyname;
667 uint32_t max_bytes_subkeyclassname;
670 uint32_t max_bytes_valuename;
673 uint32_t max_bytes_value;
698 typedef struct _regfi_raw_file
724 typedef struct _regfi_file
728 uint8_t magic[REGFI_REGF_MAGIC_SIZE];
737 uint32_t major_version;
738 uint32_t minor_version;
748 uint8_t file_name[REGFI_REGF_NAME_SIZE];
754 uint32_t guid_signature;
757 uint32_t computed_checksum;
764 uint32_t boot_recover;
769 uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
774 uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
780 uint32_t file_length;
792 pthread_mutex_t cb_lock;
798 pthread_rwlock_t hbins_lock;
804 pthread_mutex_t sk_lock;
810 pthread_mutex_t nk_lock;
813 pthread_mutex_t mem_lock;
818 typedef struct _regfi_iter_position
830 uint32_t num_subkeys;
841 typedef struct _regfi_iterator
857 typedef struct _regfi_buffer
930 REGFI_ENCODING output_encoding);
1166 const
char* name, uint32_t* index);
1185 const
char* name, uint32_t* index);
1507 uint32_t num_keys, uint32_t max_size,
1519 uint32_t num_values, uint32_t max_size,
1532 uint32_t length,
bool data_in_offset,
1544 uint32_t data_length,uint32_t cell_length,
1616 uint32_t max_size,
bool strict);
1627 uint32_t max_size,
bool strict);
1638 uint32_t max_size,
bool strict);
1649 uint32_t max_size,
bool strict);
1673 uint8_t* hdr, uint32_t hdr_len,
1674 uint32_t* cell_length,
bool* unalloc);
1685 uint16_t* name_length,
1686 uint32_t max_size,
bool strict);
1697 uint32_t length,
bool strict);
1709 uint32_t length,
bool strict);
1716 uint64_t offset,
int whence);
1718 void* buf,
size_t count);
1721 uint64_t offset,
int whence);
1724 uint8_t* buf, uint32_t* length);
1727 const
char* regfi_type_val2str(
unsigned int val);
1729 int regfi_type_str2val(const
char* str);
1744 uint32_t max_size,
bool strict,
1745 uint8_t depth_left);
1746 void regfi_add_message(
REGFI_FILE* file, uint16_t msg_type,
1747 const
char* fmt, ...);
1751 int32_t regfi_calc_maxsize(
REGFI_FILE* file, uint32_t offset);
1752 REGFI_BUFFER regfi_conv_charset(const
char* input_charset, const
char* output_charset,
1753 uint8_t* input, uint32_t input_len);
1759 REGFI_NTTIME regfi_unix2nt_time(time_t t);
1761 double regfi_nt2unix_time(REGFI_NTTIME nt);