5 #define REG_ROOT_KEY_NAME L"\\Registry"
6 #define REG_MACHINE_KEY_NAME L"\\Registry\\Machine"
7 #define REG_HARDWARE_KEY_NAME L"\\Registry\\Machine\\HARDWARE"
8 #define REG_DESCRIPTION_KEY_NAME L"\\Registry\\Machine\\HARDWARE\\DESCRIPTION"
9 #define REG_DEVICEMAP_KEY_NAME L"\\Registry\\Machine\\HARDWARE\\DEVICEMAP"
10 #define REG_RESOURCEMAP_KEY_NAME L"\\Registry\\Machine\\HARDWARE\\RESOURCEMAP"
11 #define REG_CLASSES_KEY_NAME L"\\Registry\\Machine\\Software\\Classes"
12 #define REG_SYSTEM_KEY_NAME L"\\Registry\\Machine\\System"
13 #define REG_SOFTWARE_KEY_NAME L"\\Registry\\Machine\\Software"
14 #define REG_SAM_KEY_NAME L"\\Registry\\Machine\\Sam"
15 #define REG_SEC_KEY_NAME L"\\Registry\\Machine\\Security"
16 #define REG_USERS_KEY_NAME L"\\Registry\\User"
17 #define REG_USER_KEY_NAME L"\\Registry\\User\\CurrentUser"
18 #define SYSTEM_REG_FILE L"\\SystemRoot\\System32\\Config\\SYSTEM"
19 #define SOFTWARE_REG_FILE L"\\SystemRoot\\System32\\Config\\SOFTWARE"
20 #define USER_REG_FILE L"\\SystemRoot\\System32\\Config\\DEFAULT"
21 #define SAM_REG_FILE L"\\SystemRoot\\System32\\Config\\SAM"
22 #define SEC_REG_FILE L"\\SystemRoot\\System32\\Config\\SECURITY"
24 #define REGISTRY_FILE_MAGIC "REGEDIT4"
26 #define REG_MACHINE_STD_HANDLE_NAME "HKEY_LOCAL_MACHINE"
27 #define REG_CLASSES_STD_HANDLE_NAME "HKEY_CLASSES_ROOT"
28 #define REG_USERS_STD_HANDLE_NAME "HKEY_USERS"
29 #define REG_USER_STD_HANDLE_NAME "HKEY_CURRENT_USER"
30 #define REG_CONFIG_STD_HANDLE_NAME "HKEY_CURRENT_CONFIG"
31 #define REG_DYN_STD_HANDLE_NAME "HKEY_DYN_DATA"
32 #define MAX_REG_STD_HANDLE_NAME 19
34 #define KO_MARKED_FOR_DELETE 0x00000001
36 // BLOCK_OFFSET = offset in file after header block
37 typedef DWORD BLOCK_OFFSET
;
39 /* header for registry hive file : */
40 typedef struct _HEADER_BLOCK
42 ULONG BlockId
; /* ="regf" */
43 ULONG Version
; /* file version ?*/
44 ULONG VersionOld
; /* file version ?*/
45 FILETIME DateModified
; /* please don't replace with LARGE_INTEGER !*/
46 ULONG Unused3
; /* registry format version ? */
47 ULONG Unused4
; /* registry format version ? */
48 ULONG Unused5
; /* registry format version ? */
49 ULONG Unused6
; /* registry format version ? */
50 BLOCK_OFFSET RootKeyBlock
;
53 WCHAR FileName
[64]; /* end of file name */
56 } HEADER_BLOCK
, *PHEADER_BLOCK
;
58 typedef struct _HEAP_BLOCK
60 ULONG BlockId
; /* = "hbin" */
61 BLOCK_OFFSET BlockOffset
; /* block offset of this heap */
62 ULONG BlockSize
; /* size in bytes, 4k multiple */
64 FILETIME DateModified
; /* please don't replace with LARGE_INTEGER !*/
66 } HEAP_BLOCK
, *PHEAP_BLOCK
;
68 // each sub_block begin with this struct :
69 // in a free subblock, higher bit of SubBlockSize is set
70 typedef struct _FREE_SUB_BLOCK
72 LONG SubBlockSize
;/* <0 if used, >0 if free */
73 } FREE_SUB_BLOCK
, *PFREE_SUB_BLOCK
;
75 typedef struct _KEY_BLOCK
80 FILETIME LastWriteTime
; /* please don't replace with LARGE_INTEGER !*/
82 BLOCK_OFFSET ParentKeyOffset
;
83 ULONG NumberOfSubKeys
;
85 BLOCK_OFFSET HashTableOffset
;
88 BLOCK_OFFSET ValuesOffset
;
89 BLOCK_OFFSET SecurityKeyOffset
;
90 BLOCK_OFFSET ClassNameOffset
;
93 USHORT ClassSize
; /* size of ClassName in bytes */
94 UCHAR Name
[0]; /* warning : not zero terminated */
95 } KEY_BLOCK
, *PKEY_BLOCK
;
98 // HashValue=four letters of value's name
99 typedef struct _HASH_RECORD
101 BLOCK_OFFSET KeyOffset
;
103 } HASH_RECORD
, *PHASH_RECORD
;
105 typedef struct _HASH_TABLE_BLOCK
109 USHORT HashTableSize
;
110 HASH_RECORD Table
[0];
111 } HASH_TABLE_BLOCK
, *PHASH_TABLE_BLOCK
;
113 typedef struct _VALUE_LIST_BLOCK
116 BLOCK_OFFSET Values
[0];
117 } VALUE_LIST_BLOCK
, *PVALUE_LIST_BLOCK
;
119 typedef struct _VALUE_BLOCK
122 USHORT SubBlockId
; // "kv"
123 USHORT NameSize
; // length of Name
124 LONG DataSize
; // length of datas in the subblock pointed by DataOffset
125 BLOCK_OFFSET DataOffset
;// datas are here if high bit of DataSize is set
129 UCHAR Name
[0]; /* warning : not zero terminated */
130 } VALUE_BLOCK
, *PVALUE_BLOCK
;
132 typedef struct _DATA_BLOCK
136 } DATA_BLOCK
, *PDATA_BLOCK
;
138 typedef struct _REGISTRY_FILE
142 PFILE_OBJECT FileObject
;
143 PHEADER_BLOCK HeaderBlock
;
144 // ULONG NumberOfBlocks;
146 PHEAP_BLOCK
*BlockList
;
149 PFREE_SUB_BLOCK
*FreeList
;
150 BLOCK_OFFSET
*FreeListOffset
;
151 // KSPIN_LOCK RegLock;
155 // NTSTATUS (*Extend)(ULONG NewSize);
156 // PVOID (*Flush)(VOID);
157 } REGISTRY_FILE
, *PREGISTRY_FILE
;
159 /* Type defining the Object Manager Key Object */
160 typedef struct _KEY_OBJECT
166 USHORT NameSize
; // length of Name
168 PREGISTRY_FILE RegistryFile
;
169 BLOCK_OFFSET BlockOffset
;
171 struct _KEY_OBJECT
*ParentKey
;
172 ULONG NumberOfSubKeys
; /* subkeys loaded in SubKeys */
173 ULONG SizeOfSubKeys
; /* space allocated in SubKeys */
174 struct _KEY_OBJECT
**SubKeys
; /* list of subkeys loaded */
175 } KEY_OBJECT
, *PKEY_OBJECT
;
179 CmiObjectParse(PVOID ParsedObject
,
181 PUNICODE_STRING FullPath
,
183 POBJECT_TYPE ObjectType
,
187 CmiObjectCreate(PVOID ObjectBody
,
190 struct _OBJECT_ATTRIBUTES
* ObjectAttributes
);
193 CmiObjectDelete(PVOID DeletedObject
);
195 VOID
CmiAddKeyToList(PKEY_OBJECT ParentKey
,PKEY_OBJECT NewKey
);
196 NTSTATUS
CmiRemoveKeyFromList(PKEY_OBJECT NewKey
);
197 PKEY_OBJECT
CmiScanKeyList(PKEY_OBJECT Parent
,
201 PREGISTRY_FILE
CmiCreateRegistry(PWSTR Filename
);
203 ULONG
CmiGetMaxNameLength(PREGISTRY_FILE RegistryFile
,
204 PKEY_BLOCK KeyBlock
);
205 ULONG
CmiGetMaxClassLength(PREGISTRY_FILE RegistryFile
,
206 PKEY_BLOCK KeyBlock
);
207 ULONG
CmiGetMaxValueNameLength(PREGISTRY_FILE RegistryFile
,
208 PKEY_BLOCK KeyBlock
);
209 ULONG
CmiGetMaxValueDataLength(PREGISTRY_FILE RegistryFile
,
210 PKEY_BLOCK KeyBlock
);
212 NTSTATUS
CmiScanForSubKey(IN PREGISTRY_FILE RegistryFile
,
213 IN PKEY_BLOCK KeyBlock
,
214 OUT PKEY_BLOCK
*SubKeyBlock
,
215 OUT BLOCK_OFFSET
*BlockOffset
,
217 IN ACCESS_MASK DesiredAccess
,
218 IN ULONG Attributes
);
219 NTSTATUS
CmiAddSubKey(IN PREGISTRY_FILE RegistryFile
,
220 IN PKEY_OBJECT Parent
,
221 OUT PKEY_OBJECT SubKey
,
222 IN PWSTR NewSubKeyName
,
223 IN USHORT NewSubKeyNameSize
,
225 IN PUNICODE_STRING Class
,
226 IN ULONG CreateOptions
);
228 NTSTATUS
CmiScanKeyForValue(IN PREGISTRY_FILE RegistryFile
,
229 IN PKEY_BLOCK KeyBlock
,
231 OUT PVALUE_BLOCK
*ValueBlock
,
232 OUT BLOCK_OFFSET
*VBOffset
);
233 NTSTATUS
CmiGetValueFromKeyByIndex(IN PREGISTRY_FILE RegistryFile
,
234 IN PKEY_BLOCK KeyBlock
,
236 OUT PVALUE_BLOCK
*ValueBlock
);
237 NTSTATUS
CmiAddValueToKey(IN PREGISTRY_FILE RegistryFile
,
238 IN PKEY_BLOCK KeyBlock
,
239 IN PCHAR ValueNameBuf
,
240 OUT PVALUE_BLOCK
*pValueBlock
,
241 OUT BLOCK_OFFSET
*pVBOffset
);
242 NTSTATUS
CmiDeleteValueFromKey(IN PREGISTRY_FILE RegistryFile
,
243 IN PKEY_BLOCK KeyBlock
,
246 NTSTATUS
CmiAllocateHashTableBlock(IN PREGISTRY_FILE RegistryFile
,
247 OUT PHASH_TABLE_BLOCK
*HashBlock
,
248 OUT BLOCK_OFFSET
*HBOffset
,
249 IN ULONG HashTableSize
);
250 PKEY_BLOCK
CmiGetKeyFromHashByIndex(PREGISTRY_FILE RegistryFile
,
251 PHASH_TABLE_BLOCK HashBlock
,
253 NTSTATUS
CmiAddKeyToHashTable(PREGISTRY_FILE RegistryFile
,
254 PHASH_TABLE_BLOCK HashBlock
,
255 PKEY_BLOCK NewKeyBlock
,
256 BLOCK_OFFSET NKBOffset
);
258 NTSTATUS
CmiAllocateValueBlock(IN PREGISTRY_FILE RegistryFile
,
259 OUT PVALUE_BLOCK
*ValueBlock
,
260 OUT BLOCK_OFFSET
*VBOffset
,
261 IN PCHAR ValueNameBuf
);
262 NTSTATUS
CmiDestroyValueBlock(PREGISTRY_FILE RegistryFile
,
263 PVALUE_BLOCK ValueBlock
, BLOCK_OFFSET VBOffset
);
265 NTSTATUS
CmiAllocateBlock(PREGISTRY_FILE RegistryFile
,
268 BLOCK_OFFSET
* pBlockOffset
);
269 NTSTATUS
CmiDestroyBlock(PREGISTRY_FILE RegistryFile
,
270 PVOID Block
,BLOCK_OFFSET Offset
);
271 PVOID
CmiGetBlock(PREGISTRY_FILE RegistryFile
,
272 BLOCK_OFFSET BlockOffset
,
273 OUT PHEAP_BLOCK
* ppHeap
);
274 VOID
CmiLockBlock(PREGISTRY_FILE RegistryFile
,
276 VOID
CmiReleaseBlock(PREGISTRY_FILE RegistryFile
,
279 CmiAddFree(PREGISTRY_FILE RegistryFile
,
280 PFREE_SUB_BLOCK FreeBlock
,BLOCK_OFFSET FreeOffset
);
282 #endif /*__INCLUDE_CM_H*/