Go to the documentation of this file.
69 #include <sys/types.h>
88 #define REGFI_LOG_INFO 0x0001
89 #define REGFI_LOG_WARN 0x0004
90 #define REGFI_LOG_ERROR 0x0010
91 #define REGFI_DEFAULT_LOG_MASK REGFI_LOG_ERROR|REGFI_LOG_WARN
96 REGFI_ENCODING_DEFAULT = 0,
97 REGFI_ENCODING_ASCII = 0,
98 REGFI_ENCODING_UTF8 = 1,
99 REGFI_ENCODING_UTF16LE = 2,
100 REGFI_NUM_ENCODINGS = 3
114 REG_RESOURCE_LIST = 8,
115 REG_FULL_RESOURCE_DESCRIPTOR= 9,
116 REG_RESOURCE_REQUIREMENTS_LIST= 10,
122 #define REGFI_OFFSET_NONE 0xffffffff
131 #define REGFI_CACHE_SK_MAX 64
132 #define REGFI_CACHE_NK_MAX 1024
137 #define REGFI_MAX_DEPTH 512
145 #define REGFI_MAX_SUBKEY_DEPTH 255
153 pthread_key_t regfi_log_key;
156 #define REGFI_HBIN_ALLOC 0x1000
157 #define REGFI_REGF_SIZE 0x1000
158 #define REGFI_REGF_MAGIC_SIZE 4
159 #define REGFI_REGF_NAME_SIZE 64
160 #define REGFI_REGF_RESERVED1_SIZE 340
161 #define REGFI_REGF_RESERVED2_SIZE 3528
162 #define REGFI_HBIN_MAGIC_SIZE 4
163 #define REGFI_CELL_MAGIC_SIZE 2
164 #define REGFI_HBIN_HEADER_SIZE 0x20
165 #define REGFI_NK_MIN_LENGTH 0x4C
166 #define REGFI_VK_MIN_LENGTH 0x14
167 #define REGFI_SK_MIN_LENGTH 0x14
168 #define REGFI_SUBKEY_LIST_MIN_LEN 0x4
169 #define REGFI_BIG_DATA_MIN_LENGTH 0xC
180 #define REGFI_MTIME_MIN 0x01B41E6D00000000L
185 #define REGFI_MTIME_MAX 0x0304754300000000L
189 #define REGFI_VK_FLAG_ASCIINAME 0x0001
190 #define REGFI_VK_DATA_IN_OFFSET 0x80000000
191 #define REGFI_VK_MAX_DATA_LENGTH 1024*1024
197 #define REGFI_NK_FLAG_UNKNOWN1 0x4000
198 #define REGFI_NK_FLAG_UNKNOWN2 0x1000
207 #define REGFI_NK_FLAG_UNKNOWN3 0x0080
213 #define REGFI_NK_FLAG_PREDEF_KEY 0x0040
216 #define REGFI_NK_FLAG_ASCIINAME 0x0020
221 #define REGFI_NK_FLAG_LINK 0x0010
224 #define REGFI_NK_FLAG_NO_RM 0x0008
227 #define REGFI_NK_FLAG_ROOT 0x0004
232 #define REGFI_NK_FLAG_HIVE_LINK 0x0002
237 #define REGFI_NK_FLAG_VOLATILE 0x0001
240 #define REGFI_NK_KNOWN_FLAGS (REGFI_NK_FLAG_PREDEF_KEY\
241 | REGFI_NK_FLAG_ASCIINAME\
242 | REGFI_NK_FLAG_LINK\
243 | REGFI_NK_FLAG_NO_RM\
244 | REGFI_NK_FLAG_ROOT\
245 | REGFI_NK_FLAG_HIVE_LINK\
246 | REGFI_NK_FLAG_VOLATILE\
247 | REGFI_NK_FLAG_UNKNOWN1\
248 | REGFI_NK_FLAG_UNKNOWN2\
249 | REGFI_NK_FLAG_UNKNOWN3)
256 #define TIME_T_MIN ((time_t)0 < (time_t) -1 ? (time_t) 0 \
257 : ~ (time_t) 0 << (sizeof (time_t) * CHAR_BIT - 1))
258 #define TIME_T_MAX (~ (time_t) 0 - TIME_T_MIN)
259 #define REGFI_TIME_FIXUP (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
267 typedef uint64_t REGFI_NTTIME;
304 uint8_t
magic[REGFI_HBIN_MAGIC_SIZE];
331 uint32_t num_children;
337 uint8_t magic[REGFI_CELL_MAGIC_SIZE];
344 typedef uint32_t REGFI_VALUE_LIST_ELEM;
360 REGFI_VALUE_LIST_ELEM* elements;
543 uint8_t
magic[REGFI_CELL_MAGIC_SIZE];
596 uint16_t unknown_tag;
599 uint8_t
magic[REGFI_CELL_MAGIC_SIZE];
633 uint8_t
magic[REGFI_CELL_MAGIC_SIZE];
664 uint32_t max_bytes_subkeyname;
667 uint32_t max_bytes_subkeyclassname;
670 uint32_t max_bytes_valuename;
673 uint32_t max_bytes_value;
728 uint8_t magic[REGFI_REGF_MAGIC_SIZE];
737 uint32_t major_version;
738 uint32_t minor_version;
748 uint8_t file_name[REGFI_REGF_NAME_SIZE];
754 uint32_t guid_signature;
757 uint32_t computed_checksum;
760 WINSEC_UUID* thaw_tm_id;
761 WINSEC_UUID* thaw_rm_id;
762 WINSEC_UUID* thaw_log_id;
764 uint32_t boot_recover;
769 uint8_t reserved1[REGFI_REGF_RESERVED1_SIZE];
774 uint8_t reserved2[REGFI_REGF_RESERVED2_SIZE];
780 uint32_t file_length;
792 pthread_mutex_t cb_lock;
798 pthread_rwlock_t hbins_lock;
804 pthread_mutex_t sk_lock;
810 pthread_mutex_t nk_lock;
813 pthread_mutex_t mem_lock;
830 uint32_t num_subkeys;
835 } REGFI_ITER_POSITION;
849 REGFI_ITER_POSITION* cur;
905 REGFI_FILE*
regfi_alloc(
int fd, REGFI_ENCODING output_encoding);
930 REGFI_ENCODING output_encoding);
1083 const REGFI_NK* key);
1096 const REGFI_SK*
regfi_fetch_sk(REGFI_FILE* file, const REGFI_NK* key);
1114 const REGFI_SK*
regfi_next_sk(REGFI_FILE* file, const REGFI_SK* sk);
1132 const REGFI_SK*
regfi_prev_sk(REGFI_FILE* file, const REGFI_SK* sk);
1147 const REGFI_VK* value);
1166 const
char* name, uint32_t* index);
1185 const
char* name, uint32_t* index);
1214 const REGFI_VK*
regfi_get_value(REGFI_FILE* file, const REGFI_NK* key,
1507 uint32_t num_keys, uint32_t max_size,
1519 uint32_t num_values, uint32_t max_size,
1532 uint32_t length,
bool data_in_offset,
1544 uint32_t data_length,uint32_t cell_length,
1545 range_list* used_ranges,
1558 uint32_t type, REGFI_DATA* data);
1571 const REGFI_SK*
regfi_load_sk(REGFI_FILE* file, uint32_t offset,
1595 REGFI_FILE* regfi_parse_regf(REGFI_RAW_FILE* file_cb,
bool strict);
1598 REGFI_HBIN* regfi_parse_hbin(REGFI_FILE* file, uint32_t offset,
1616 uint32_t max_size,
bool strict);
1627 uint32_t max_size,
bool strict);
1638 uint32_t max_size,
bool strict);
1649 uint32_t max_size,
bool strict);
1673 uint8_t* hdr, uint32_t hdr_len,
1674 uint32_t* cell_length,
bool* unalloc);
1685 uint16_t* name_length,
1686 uint32_t max_size,
bool strict);
1697 uint32_t length,
bool strict);
1709 uint32_t length,
bool strict);
1715 int64_t regfi_raw_seek(REGFI_RAW_FILE* self,
1716 uint64_t offset,
int whence);
1717 ssize_t regfi_raw_read(REGFI_RAW_FILE* self,
1718 void* buf,
size_t count);
1720 uint64_t regfi_seek(REGFI_RAW_FILE* file_cb,
1721 uint64_t offset,
int whence);
1723 uint32_t regfi_read(REGFI_RAW_FILE* file_cb,
1724 uint8_t* buf, uint32_t* length);
1727 const
char* regfi_type_val2str(
unsigned int val);
1729 int regfi_type_str2val(const
char* str);
1732 char* regfi_get_sacl(WINSEC_DESC* sec_desc);
1734 char* regfi_get_dacl(WINSEC_DESC* sec_desc);
1736 char* regfi_get_owner(WINSEC_DESC* sec_desc);
1738 char* regfi_get_group(WINSEC_DESC* sec_desc);
1740 REGFI_SUBKEY_LIST* regfi_merge_subkeylists(uint16_t num_lists,
1741 REGFI_SUBKEY_LIST** lists,
1743 REGFI_SUBKEY_LIST* regfi_load_subkeylist_aux(REGFI_FILE* file, uint32_t offset,
1744 uint32_t max_size,
bool strict,
1745 uint8_t depth_left);
1746 void regfi_add_message(REGFI_FILE* file, uint16_t msg_type,
1747 const
char* fmt, ...);
1748 REGFI_NK* regfi_copy_nk(const REGFI_NK* nk);
1749 REGFI_VK* regfi_copy_vk(const REGFI_VK* vk);
1751 int32_t regfi_calc_maxsize(REGFI_FILE* file, uint32_t offset);
1752 REGFI_BUFFER regfi_conv_charset(const
char* input_charset, const
char* output_charset,
1753 uint8_t* input, uint32_t input_len);
1755 REGFI_DATA* regfi_buffer_to_data(REGFI_BUFFER raw_data);
1759 REGFI_NTTIME regfi_unix2nt_time(time_t t);
1761 double regfi_nt2unix_time(REGFI_NTTIME nt);
1765 void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK* nk,
bool strict);
1767 void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK* vk,
bool strict);
uint16_t name_length
Length of name_raw.
Definition: regfi.h:639
uint16_t size
Length of the raw data.
Definition: regfi.h:385
REGFI_NK * regfi_load_key(REGFI_FILE *file, uint32_t offset, bool strict)
Loads a key and associated data structures given a file offset.
Definition: regfi.c:1317
uint8_t * raw
Represents raw buffer read from classname cell.
Definition: regfi.h:379
REGFI_SK * regfi_parse_sk(REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
Parses an SK (security) record at the specified offset.
Definition: regfi.c:974
char * regfi_log_get_str()
Get errors, warnings, and/or verbose information relating to processing of the given registry file.
Definition: regfi.c:178
bool lru_cache_update(lru_cache *ht, const void *index, uint32_t index_len, void *data)
XXX: finish documenting.
Definition: lru_cache.c:159
void regfi_free(REGFI_FILE *file)
Frees a hive's data structures without closing the underlying file.
Definition: regfi.c:1720
uint32_t interpreted_size
Represents the length of the interpreted value.
Definition: regfi.h:411
uint32_t hbin_off
Offset from beginning of this hbin block.
Definition: regfi.h:528
range_list * range_list_new()
Allocates a new range_list.
Definition: range_list.c:125
Value structure.
Definition: regfi.h:503
const REGFI_SK * regfi_load_sk(REGFI_FILE *file, uint32_t offset, bool strict)
Loads an "sk" security record at the specified offset.
Definition: regfi.c:1437
bool range_list_add(range_list *rl, uint32_t offset, uint32_t length, void *data)
Adds an element to the range_list.
Definition: range_list.c:161
uint32_t regfi_fetch_num_values(const REGFI_NK *key)
Retrieves number of values referenced by this key.
Definition: regfi.c:1827
void range_list_free(range_list *rl)
Frees the memory associated with a range_list, including the elements, but not any data parameters re...
Definition: range_list.c:147
bool regfi_find_value(REGFI_FILE *file, const REGFI_NK *key, const char *name, uint32_t *index)
Locates a specific value of a given key.
Definition: regfi.c:2385
uint32_t dword
REG_DWORD.
Definition: regfi.h:449
const void * void_stack_iterator_next(void_stack_iterator *iter)
Returns a pointer to the the next element in the stack.
Definition: void_stack.c:173
Class name structure (used in storing SysKeys)
Definition: regfi.h:367
uint8_t * none
REG_NONE.
Definition: regfi.h:425
uint32_t offset
Real file offset of this record.
Definition: regfi.h:572
void void_stack_iterator_free(void_stack_iterator *iter)
Frees a void_stack_iterator.
Definition: void_stack.c:167
bool regfi_find_subkey(REGFI_FILE *file, const REGFI_NK *key, const char *name, uint32_t *index)
Locates a specific subkey of a given key.
Definition: regfi.c:2344
Subkey-list structure.
Definition: regfi.h:323
uint8_t * string
REG_SZ.
Definition: regfi.h:432
uint32_t dword_be
REG_DWORD_BE.
Definition: regfi.h:452
uint8_t * name_raw
The raw key name.
Definition: regfi.h:655
uint16_t flags
Key flags.
Definition: regfi.h:630
WINSEC_UUID * winsec_parse_uuid(void *talloc_ctx, const uint8_t *buf, uint32_t buf_len)
XXX: finish documenting.
Definition: winsec.c:315
range_list * regfi_parse_unalloc_cells(REGFI_FILE *file)
Retrieves information on all cells in the registry hive which are currently in the unallocated status...
Definition: regfi.c:3757
uint32_t num_subkeys
Number of subkeys.
Definition: regfi.h:682
const REGFI_NK * regfi_get_subkey(REGFI_FILE *file, const REGFI_NK *key, uint32_t index)
Retrieves a specific subkey of a given key.
Definition: regfi.c:2422
bool regfi_iterator_find_value(REGFI_ITERATOR *i, const char *name)
Searches for a value with a given name under the current key.
Definition: regfi.c:2125
const REGFI_VK * regfi_iterator_cur_value(REGFI_ITERATOR *i)
Returns the currently indexed value.
Definition: regfi.c:2160
bool void_stack_push(void_stack *stack, void *e)
Puts a new element on the top of a void_stack.
Definition: void_stack.c:126
REGFI_VALUE_LIST * values
Preloaded value-list for this key.
Definition: regfi.h:620
uint32_t parent_off
Virtual offset of parent key.
Definition: regfi.h:658
uint32_t hbin_off
Offset of this record from beginning of this hbin block.
Definition: regfi.h:581
uint32_t next_sk_off
Offset of the next SK record in the linked list of SK records.
Definition: regfi.h:587
void_stack_iterator * void_stack_iterator_new(const void_stack *stack)
Creates a new iterator for the specified void_stack.
Definition: void_stack.c:149
const REGFI_VK * regfi_get_value(REGFI_FILE *file, const REGFI_NK *key, uint32_t index)
Retrieves a specific value of a given key.
Definition: regfi.c:2438
uint8_t * raw
This is always present, representing the raw data cell contents.
Definition: regfi.h:406
bool regfi_log_set_mask(uint16_t msg_mask)
Set the verbosity level of messages generated by the library for the current thread.
Definition: regfi.c:194
REGFI_VK * regfi_load_value(REGFI_FILE *file, uint32_t offset, bool strict)
Loads a value at a given file offset alng with associated data structures.
Definition: regfi.c:1224
uint32_t subkeys_off
Virtual offset of subkey-list.
Definition: regfi.h:685
uint32_t file_off
Offset of this HBIN in the registry file.
Definition: regfi.h:286
unsigned short void_stack_size(const void_stack *stack)
Query the current number of elements on a void_stack()
Definition: void_stack.c:106
uint32_t block_size
Block size of this block Should be a multiple of 4096 (0x1000)
Definition: regfi.h:295
REGFI_FILE * f
The registry hive this iterator is associated with.
Definition: regfi.h:844
REGFI_BUFFER regfi_load_data(REGFI_FILE *file, uint32_t voffset, uint32_t length, bool data_in_offset, bool strict)
Loads a data record which may be contained in the virtual offset, in a single cell,...
Definition: regfi.c:3259
General purpose buffer with stored length.
Definition: regfi.h:857
void * void_stack_pop(void_stack *stack)
Removes the top element on a void_stack and returns a reference to it.
Definition: void_stack.c:112
uint32_t prev_sk_off
Offset of the previous SK record in the linked list of SK records.
Definition: regfi.h:584
const REGFI_HBIN * regfi_lookup_hbin(REGFI_FILE *file, uint32_t offset)
Retrieves the HBIN data structure stored at the specified offset.
Definition: regfi.c:690
uint16_t name_length
Length of name_raw.
Definition: regfi.h:525
uint32_t desc_size
Size of security descriptor (sec_desc)
Definition: regfi.h:593
uint8_t * name_raw
The raw value name.
Definition: regfi.h:522
const REGFI_NK * regfi_iterator_cur_subkey(REGFI_ITERATOR *i)
Returns the currently indexed subkey.
Definition: regfi.c:2095
uint8_t magic[REGFI_CELL_MAGIC_SIZE]
VK record's magic number (should be "vk")
Definition: regfi.h:543
REGFI_ITERATOR * regfi_iterator_new(REGFI_FILE *file)
Creates a new iterator for the provided registry file.
Definition: regfi.c:1850
REGFI_VALUE_LIST * regfi_load_valuelist(REGFI_FILE *file, uint32_t offset, uint32_t num_values, uint32_t max_size, bool strict)
Loads a valuelist.
Definition: regfi.c:1246
uint8_t magic[REGFI_CELL_MAGIC_SIZE]
Magic number of key (should be "nk")
Definition: regfi.h:633
uint8_t * resource_requirements_list
REG_RESOURCE_REQUIREMENTS_LIST.
Definition: regfi.h:495
REGFI_DATA_TYPE type
Value's data type.
Definition: regfi.h:540
const REGFI_NK ** regfi_iterator_ancestry(REGFI_ITERATOR *i)
Returns the current key and all parent keys as a list of NK records.
Definition: regfi.c:2192
REGFI_FILE * regfi_alloc(int fd, REGFI_ENCODING output_encoding)
Parses file headers of an already open registry hive file and allocates related structures for furthe...
Definition: regfi.c:1546
REGFI_BUFFER regfi_load_big_data(REGFI_FILE *file, uint32_t offset, uint32_t data_length, uint32_t cell_length, range_list *used_ranges, bool strict)
Loads the data associated with a big data record at the specified offset.
Definition: regfi.c:3625
uint32_t cell_size
((start_offset - end_offset) & 0xfffffff8)
Definition: regfi.h:575
const REGFI_NK * regfi_get_parentkey(REGFI_FILE *file, const REGFI_NK *key)
Uses a key's parent_off reference to retrieve it's parent.
Definition: regfi.c:2455
REGFI_SUBKEY_LIST * regfi_load_subkeylist(REGFI_FILE *file, uint32_t offset, uint32_t num_keys, uint32_t max_size, bool strict)
Loads a logical subkey list in its entirety which may span multiple records.
Definition: regfi.c:714
uint32_t offset
Real offset of this record's cell in the file.
Definition: regfi.h:506
const REGFI_NK * regfi_iterator_cur_key(REGFI_ITERATOR *i)
Returns the currently referenced key.
Definition: regfi.c:2041
uint8_t * regfi_parse_classname(REGFI_FILE *file, uint32_t offset, uint16_t *name_length, uint32_t max_size, bool strict)
Parses a classname cell.
Definition: regfi.c:3061
const range_list_element * range_list_get(const range_list *rl, uint32_t index)
Retrieves the element for a given index.
Definition: range_list.c:244
Security structure.
Definition: regfi.h:569
uint32_t sk_off
Virtual offset of SK record.
Definition: regfi.h:694
const void * regfi_reference_record(REGFI_FILE *file, const void *record)
Increments reference count on record.
Definition: regfi.c:1788
uint8_t magic[REGFI_HBIN_MAGIC_SIZE]
Magic number for the HBIN (should be "hbin").
Definition: regfi.h:304
uint32_t num_values
Number of values for this key.
Definition: regfi.h:688
uint32_t first_hbin_off
Offset from first hbin block.
Definition: regfi.h:292
uint32_t cell_size
((start_offset - end_offset) & 0xfffffff8)
Definition: regfi.h:509
const REGFI_SK * regfi_prev_sk(REGFI_FILE *file, const REGFI_SK *sk)
Returns the previous SK (security) record referenced by the supplied SK record.
Definition: regfi.c:2075
uint16_t classname_length
Length of referenced classname.
Definition: regfi.h:642
uint32_t offset
Real offset of this record's cell in the file.
Definition: regfi.h:609
bool regfi_iterator_next_value(REGFI_ITERATOR *i)
Increments the internal value index to the next value in the value-list.
Definition: regfi.c:2181
void regfi_iterator_free(REGFI_ITERATOR *i)
Frees a registry file iterator previously created by regfi_iterator_new.
Definition: regfi.c:1903
bool regfi_iterator_descend(REGFI_ITERATOR *i, const char **path)
Traverse down multiple levels in the registry hive.
Definition: regfi.c:2014
uint8_t magic[REGFI_CELL_MAGIC_SIZE]
The magic number for this record (should be "sk")
Definition: regfi.h:599
REGFI_ENCODING string_encoding
The encoding that all strings are converted to during interpretation.
Definition: regfi.h:784
HBIN block information.
Definition: regfi.h:283
Registry hive file data structure.
Definition: regfi.h:724
REGFI_NK * regfi_parse_nk(REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
Parses an NK record at the specified offset.
Definition: regfi.c:2918
bool regfi_parse_cell(REGFI_RAW_FILE *file_cb, uint32_t offset, uint8_t *hdr, uint32_t hdr_len, uint32_t *cell_length, bool *unalloc)
Helper function to parse a cell.
Definition: regfi.c:628
uint32_t range_list_size(const range_list *rl)
Query the current number of elements on a range_list.
Definition: range_list.c:154
bool regfi_iterator_first_value(REGFI_ITERATOR *i)
Sets the internal value index to the first value referenced by the current key.
Definition: regfi.c:2151
uint32_t size
Length of the raw data.
Definition: regfi.h:403
void regfi_free_record(REGFI_FILE *file, const void *record)
Frees a record previously returned by one of the API functions.
Definition: regfi.c:1775
char * name
The name of this value converted to desired REGFI_ENCODING.
Definition: regfi.h:516
const REGFI_CLASSNAME * regfi_fetch_classname(REGFI_FILE *file, const REGFI_NK *key)
Retrieves classname for a given key.
Definition: regfi.c:2238
REGFI_BUFFER regfi_parse_data(REGFI_FILE *file, uint32_t offset, uint32_t length, bool strict)
Parses a single-cell data record.
Definition: regfi.c:3373
uint8_t * expand_string
REG_EXPAND_SZ.
Definition: regfi.h:439
uint32_t cell_size
Actual or estimated length of the cell.
Definition: regfi.h:614
Registry hive iterator.
Definition: regfi.h:841
Value-list structure.
Definition: regfi.h:348
bool regfi_iterator_to_root(REGFI_ITERATOR *i)
Traverse up to the root key of the hive.
Definition: regfi.c:1977
const char * regfi_version()
Returns the current regfi library version.
Definition: regfi.c:58
bool regfi_iterator_find_subkey(REGFI_ITERATOR *i, const char *name)
Searches for a subkey with a given name under the current key.
Definition: regfi.c:1988
uint8_t * full_resource_descriptor
REG_FULL_RESOURCE_DESCRIPTOR.
Definition: regfi.h:488
REGFI_VK * regfi_parse_vk(REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
Parses a VK (value) record at the specified offset.
Definition: regfi.c:3138
uint8_t ** multiple_string
REG_MULTI_SZ.
Definition: regfi.h:467
void_stack * void_stack_new(unsigned short max_size)
Allocates a new void_stack.
Definition: void_stack.c:27
REGFI_NTTIME mtime
Key's last modification time.
Definition: regfi.h:636
Key structure.
Definition: regfi.h:606
uint32_t ref_count
Number of keys referencing this SK record.
Definition: regfi.h:590
bool regfi_iterator_down(REGFI_ITERATOR *i)
Traverse deeper into the registry tree at the current subkey.
Definition: regfi.c:1912
void * range_list_find_data(const range_list *rl, uint32_t offset)
Same as range_list_find(), but returns the data associated with an element.
Definition: range_list.c:275
uint16_t flags
VK record flags.
Definition: regfi.h:546
WINSEC_DESC * winsec_parse_desc(void *talloc_ctx, const uint8_t *buf, uint32_t buf_len)
XXX: finish documenting.
Definition: winsec.c:48
lru_cache * lru_cache_create_ctx(void *talloc_ctx, uint32_t max_keys, uint32_t secret, bool talloc_data)
XXX: finish documenting.
Definition: lru_cache.c:111
void * lru_cache_find(lru_cache *ht, const void *index, uint32_t index_len)
XXX: finish documenting.
Definition: lru_cache.c:280
uint32_t regfi_fetch_num_subkeys(const REGFI_NK *key)
Retrieves number of subkeys referenced by this key.
Definition: regfi.c:1804
char * winsec_sid2str(const WINSEC_DOM_SID *sid)
XXX: finish documenting.
Definition: winsec.c:411
uint32_t classname_off
Virtual offset of classname key.
Definition: regfi.h:661
WINSEC_DESC * sec_desc
The stored Windows security descriptor for this SK record.
Definition: regfi.h:578
bool regfi_interpret_data(REGFI_FILE *file, uint32_t type, REGFI_DATA *data)
Given raw data, attempts to interpret the data based on a specified registry data type.
Definition: regfi.c:2491
void_stack * key_positions
All current parent keys and associated iterator positions.
Definition: regfi.h:847
const REGFI_NK * regfi_get_rootkey(REGFI_FILE *file)
Fetches a hive's root key.
Definition: regfi.c:1731
REGFI_SUBKEY_LIST * regfi_parse_subkeylist(REGFI_FILE *file, uint32_t offset, uint32_t max_size, bool strict)
Parses a single cell containing a subkey-list record.
Definition: regfi.c:795
char * name
The name of this key converted to desired REGFI_ENCODING.
Definition: regfi.h:649
uint64_t qword
REG_QWORD.
Definition: regfi.h:470
bool regfi_iterator_up(REGFI_ITERATOR *i)
Traverse up to the current key's parent key.
Definition: regfi.c:1955
uint32_t data_off
Virtual offset of data cell.
Definition: regfi.h:537
uint32_t values_off
Virtual offset of value-list.
Definition: regfi.h:691
REGFI_DATA_TYPE type
Data type of this data, as indicated by the referencing VK record.
Definition: regfi.h:400
char * interpreted
As converted to requested REGFI_ENCODING.
Definition: regfi.h:373
uint32_t ref_count
Number of active records pointing to this block (not used currently)
Definition: regfi.h:289
bool regfi_iterator_next_subkey(REGFI_ITERATOR *i)
Increments the internal subkey index to the next key in the subkey-list.
Definition: regfi.c:2116
Data record structure.
Definition: regfi.h:392
These items represent interpreted versions of the REGFI_DATA::raw field.
Definition: regfi.h:418
const REGFI_SK * regfi_fetch_sk(REGFI_FILE *file, const REGFI_NK *key)
Returns the SK (security) record referenced by the supplied key.
Definition: regfi.c:2052
uint32_t data_size
Size of the value's data as reported in the VK record.
Definition: regfi.h:534
REGFI_SUBKEY_LIST * subkeys
Preloaded subkey-list for this key.
Definition: regfi.h:627
uint32_t next_block
Relative offset to next block.
Definition: regfi.h:301
REGFI_FILE * regfi_alloc_cb(REGFI_RAW_FILE *file_cb, REGFI_ENCODING output_encoding)
Parses file headers returned by supplied callback functions.
Definition: regfi.c:1595
uint8_t * link
REG_LINK.
Definition: regfi.h:459
const REGFI_SK * regfi_next_sk(REGFI_FILE *file, const REGFI_SK *sk)
Returns the next SK (security) record referenced by the supplied SK record.
Definition: regfi.c:2064
REGFI_BUFFER regfi_parse_little_data(REGFI_FILE *file, uint32_t voffset, uint32_t length, bool strict)
Parses a "little data" record which is stored entirely within the provided virtual offset.
Definition: regfi.c:3424
bool data_in_offset
Whether or not the data record is stored in the VK record's data_off field.
Definition: regfi.h:555
uint32_t offset
Real offset of this record's cell in the file.
Definition: regfi.h:370
const REGFI_DATA * regfi_fetch_data(REGFI_FILE *file, const REGFI_VK *value)
Retrieves data for a given value.
Definition: regfi.c:2298
uint8_t * resource_list
REG_RESOURCE_LIST.
Definition: regfi.h:481
bool regfi_iterator_first_subkey(REGFI_ITERATOR *i)
Sets the internal subkey index to the first subkey referenced by the current key.
Definition: regfi.c:2086
uint8_t * binary
REG_BINARY.
Definition: regfi.h:446