10 #define REG_ROOT_KEY_NAME L"\\Registry"
11 #define REG_MACHINE_KEY_NAME L"\\Registry\\Machine"
12 #define REG_HARDWARE_KEY_NAME L"\\Registry\\Machine\\HARDWARE"
13 #define REG_DESCRIPTION_KEY_NAME L"\\Registry\\Machine\\HARDWARE\\DESCRIPTION"
14 #define REG_DEVICEMAP_KEY_NAME L"\\Registry\\Machine\\HARDWARE\\DEVICEMAP"
15 #define REG_RESOURCEMAP_KEY_NAME L"\\Registry\\Machine\\HARDWARE\\RESOURCEMAP"
16 #define REG_CLASSES_KEY_NAME L"\\Registry\\Machine\\Software\\Classes"
17 #define REG_SYSTEM_KEY_NAME L"\\Registry\\Machine\\SYSTEM"
18 #define REG_SOFTWARE_KEY_NAME L"\\Registry\\Machine\\SOFTWARE"
19 #define REG_SAM_KEY_NAME L"\\Registry\\Machine\\SAM"
20 #define REG_SEC_KEY_NAME L"\\Registry\\Machine\\SECURITY"
21 #define REG_USER_KEY_NAME L"\\Registry\\User"
22 #define REG_DEFAULT_USER_KEY_NAME L"\\Registry\\User\\.Default"
23 #define REG_CURRENT_USER_KEY_NAME L"\\Registry\\User\\CurrentUser"
25 #define SYSTEM_REG_FILE L"\\SystemRoot\\System32\\Config\\SYSTEM"
26 #define SYSTEM_LOG_FILE L"\\SystemRoot\\System32\\Config\\SYSTEM.log"
27 #define SOFTWARE_REG_FILE L"\\SystemRoot\\System32\\Config\\SOFTWARE"
28 #define DEFAULT_USER_REG_FILE L"\\SystemRoot\\System32\\Config\\DEFAULT"
29 #define SAM_REG_FILE L"\\SystemRoot\\System32\\Config\\SAM"
30 #define SEC_REG_FILE L"\\SystemRoot\\System32\\Config\\SECURITY"
32 #define REG_SYSTEM_FILE_NAME L"\\SYSTEM"
33 #define REG_SOFTWARE_FILE_NAME L"\\SOFTWARE"
34 #define REG_DEFAULT_USER_FILE_NAME L"\\DEFAULT"
35 #define REG_SAM_FILE_NAME L"\\SAM"
36 #define REG_SEC_FILE_NAME L"\\SECURITY"
38 #define REG_BLOCK_SIZE 4096
39 #define REG_HBIN_DATA_OFFSET 32
40 #define REG_INIT_BLOCK_LIST_SIZE 32
41 #define REG_INIT_HASH_TABLE_SIZE 3
42 #define REG_EXTEND_HASH_TABLE_SIZE 4
43 #define REG_VALUE_LIST_CELL_MULTIPLE 4
45 #define REG_HIVE_ID 0x66676572
46 #define REG_BIN_ID 0x6e696268
47 #define REG_KEY_CELL_ID 0x6b6e
48 #define REG_HASH_TABLE_CELL_ID 0x666c
49 #define REG_VALUE_CELL_ID 0x6b76
52 // BLOCK_OFFSET = offset in file after header block
53 typedef ULONG BLOCK_OFFSET
, *PBLOCK_OFFSET
;
57 /* header for registry hive file : */
58 typedef struct _HIVE_HEADER
60 /* Hive identifier "regf" (0x66676572) */
69 /* When this hive file was last modified */
70 LARGE_INTEGER DateModified
;
72 /* Registry format version ? (1?) */
75 /* Registry format version ? (3?) */
78 /* Registry format version ? (0?) */
81 /* Registry format version ? (1?) */
84 /* Offset into file from the byte after the end of the base block.
85 If the hive is volatile, this is the actual pointer to the KEY_CELL */
86 BLOCK_OFFSET RootKeyOffset
;
88 /* Size of each hive block ? */
94 /* Name of hive file */
100 /* Checksum of first 0x200 bytes */
102 } HIVE_HEADER
, *PHIVE_HEADER
;
104 typedef struct _BIN_HEADER
106 /* Bin identifier "hbin" (0x6E696268) */
109 /* Block offset of this bin */
110 BLOCK_OFFSET BinOffset
;
112 /* Size in bytes, multiple of the block size (4KB) */
118 /* When this bin was last modified */
119 LARGE_INTEGER DateModified
;
125 typedef struct _CELL_HEADER
127 /* <0 if used, >0 if free */
129 } CELL_HEADER
, *PCELL_HEADER
;
131 typedef struct _KEY_CELL
133 /* Size of this cell */
136 /* Key cell identifier "kn" (0x6b6e) */
142 /* Time of last flush */
143 LARGE_INTEGER LastWriteTime
;
148 /* Block offset of parent key cell */
149 BLOCK_OFFSET ParentKeyOffset
;
151 /* Count of sub keys for the key in this key cell */
152 ULONG NumberOfSubKeys
;
157 /* Block offset of has table for FIXME: subkeys/values? */
158 BLOCK_OFFSET HashTableOffset
;
163 /* Count of values contained in this key cell */
164 ULONG NumberOfValues
;
166 /* Block offset of VALUE_LIST_CELL */
167 BLOCK_OFFSET ValueListOffset
;
169 /* Block offset of security cell */
170 BLOCK_OFFSET SecurityKeyOffset
;
172 /* Block offset of registry key class */
173 BLOCK_OFFSET ClassNameOffset
;
178 /* Size in bytes of key name */
181 /* Size of class name in bytes */
184 /* Name of key (not zero terminated) */
186 } KEY_CELL
, *PKEY_CELL
;
188 /* KEY_CELL.Flags constants */
189 #define REG_KEY_ROOT_CELL 0x0C
190 #define REG_KEY_LINK_CELL 0x10
191 #define REG_KEY_NAME_PACKED 0x20
197 * packed name: four letters of value's name
200 typedef struct _HASH_RECORD
202 BLOCK_OFFSET KeyOffset
;
204 } HASH_RECORD
, *PHASH_RECORD
;
206 typedef struct _HASH_TABLE_CELL
210 USHORT HashTableSize
;
211 HASH_RECORD Table
[0];
212 } HASH_TABLE_CELL
, *PHASH_TABLE_CELL
;
215 typedef struct _VALUE_LIST_CELL
218 BLOCK_OFFSET ValueOffset
[0];
219 } VALUE_LIST_CELL
, *PVALUE_LIST_CELL
;
221 typedef struct _VALUE_CELL
225 USHORT NameSize
; // length of Name
226 ULONG DataSize
; // length of datas in the cell pointed by DataOffset
227 BLOCK_OFFSET DataOffset
;// datas are here if high bit of DataSize is set
231 UCHAR Name
[0]; /* warning : not zero terminated */
232 } VALUE_CELL
, *PVALUE_CELL
;
234 /* VALUE_CELL.Flags constants */
235 #define REG_VALUE_NAME_PACKED 0x0001
237 /* VALUE_CELL.DataSize mask constants */
238 #define REG_DATA_SIZE_MASK 0x7FFFFFFF
239 #define REG_DATA_IN_OFFSET 0x80000000
242 typedef struct _DATA_CELL
246 } DATA_CELL
, *PDATA_CELL
;
251 typedef struct _BLOCK_LIST_ENTRY
255 } BLOCK_LIST_ENTRY
, *PBLOCK_LIST_ENTRY
;
258 typedef struct _REGISTRY_HIVE
262 UNICODE_STRING HiveFileName
;
263 UNICODE_STRING LogFileName
;
265 PHIVE_HEADER HiveHeader
;
268 PBLOCK_LIST_ENTRY BlockList
;
271 PCELL_HEADER
*FreeList
;
272 BLOCK_OFFSET
*FreeListOffset
;
273 ERESOURCE HiveResource
;
276 RTL_BITMAP DirtyBitMap
;
278 } REGISTRY_HIVE
, *PREGISTRY_HIVE
;
280 /* REGISTRY_HIVE.Flags constants */
281 /* When set, the hive uses pointers instead of offsets. */
282 #define HIVE_POINTER 0x00000001
284 /* When set, the hive is not backed by a file.
285 Therefore, it can not be flushed to disk. */
286 #define HIVE_NO_FILE 0x00000002
288 /* When set, a modified (dirty) hive is not synchronized automatically.
289 Explicit synchronization (save/flush) works. */
290 #define HIVE_NO_SYNCH 0x00000004
292 #define IsPointerHive(Hive) ((Hive)->Flags & HIVE_POINTER)
293 #define IsNoFileHive(Hive) ((Hive)->Flags & HIVE_NO_FILE)
294 #define IsNoSynchHive(Hive) ((Hive)->Flags & HIVE_NO_SYNCH)
297 #define IsFreeCell(Cell)(Cell->CellSize >= 0)
298 #define IsUsedCell(Cell)(Cell->CellSize < 0)
301 /* KEY_OBJECT.Flags */
303 /* When set, the key is scheduled for deletion, and all
304 attempts to access the key must not succeed */
305 #define KO_MARKED_FOR_DELETE 0x00000001
308 /* Type defining the Object Manager Key Object */
309 typedef struct _KEY_OBJECT
311 /* Fields used by the Object Manager */
321 /* Registry hive the key belongs to */
322 PREGISTRY_HIVE RegistryHive
;
324 /* Block offset of the key cell this key belongs in */
325 BLOCK_OFFSET KeyCellOffset
;
327 /* KEY_CELL this key belong in */
330 /* Link to the parent KEY_OBJECT for this key */
331 struct _KEY_OBJECT
*ParentKey
;
333 /* Subkeys loaded in SubKeys */
334 ULONG NumberOfSubKeys
;
336 /* Space allocated in SubKeys */
339 /* List of subkeys loaded */
340 struct _KEY_OBJECT
**SubKeys
;
341 } KEY_OBJECT
, *PKEY_OBJECT
;
343 /* Bits 31-22 (top 10 bits) of the cell index is the directory index */
344 #define CmiDirectoryIndex(CellIndex)(CellIndex & 0xffc000000)
345 /* Bits 21-12 (middle 10 bits) of the cell index is the table index */
346 #define CmiTableIndex(Cellndex)(CellIndex & 0x003ff000)
347 /* Bits 11-0 (bottom 12 bits) of the cell index is the byte offset */
348 #define CmiByteOffset(Cellndex)(CellIndex & 0x00000fff)
351 extern BOOLEAN CmiDoVerify
;
352 extern PREGISTRY_HIVE CmiVolatileHive
;
353 extern POBJECT_TYPE CmiKeyType
;
354 extern KSPIN_LOCK CmiKeyListLock
;
356 extern LIST_ENTRY CmiHiveListHead
;
357 extern ERESOURCE CmiHiveListLock
;
359 /* Registry Callback Function */
360 typedef NTSTATUS (*PEX_CALLBACK_FUNCTION
) (
361 IN PVOID CallbackContext
,
367 CmiVerifyBinHeader(PHBIN BinHeader
);
369 CmiVerifyKeyCell(PKEY_CELL KeyCell
);
371 CmiVerifyRootKeyCell(PKEY_CELL RootKeyCell
);
373 CmiVerifyKeyObject(PKEY_OBJECT KeyObject
);
375 CmiVerifyRegistryHive(PREGISTRY_HIVE RegistryHive
);
378 #define VERIFY_BIN_HEADER CmiVerifyBinHeader
379 #define VERIFY_KEY_CELL CmiVerifyKeyCell
380 #define VERIFY_ROOT_KEY_CELL CmiVerifyRootKeyCell
381 #define VERIFY_VALUE_CELL CmiVerifyValueCell
382 #define VERIFY_VALUE_LIST_CELL CmiVerifyValueListCell
383 #define VERIFY_KEY_OBJECT CmiVerifyKeyObject
384 #define VERIFY_REGISTRY_HIVE CmiVerifyRegistryHive
386 #define VERIFY_BIN_HEADER(x)
387 #define VERIFY_KEY_CELL(x)
388 #define VERIFY_ROOT_KEY_CELL(x)
389 #define VERIFY_VALUE_CELL(x)
390 #define VERIFY_VALUE_LIST_CELL(x)
391 #define VERIFY_KEY_OBJECT(x)
392 #define VERIFY_REGISTRY_HIVE(x)
396 CmRegisterCallback(IN PEX_CALLBACK_FUNCTION Function
,
398 IN OUT PLARGE_INTEGER Cookie
402 CmUnRegisterCallback(IN LARGE_INTEGER Cookie
);
405 CmiObjectParse(IN PVOID ParsedObject
,
406 OUT PVOID
*NextObject
,
407 IN PUNICODE_STRING FullPath
,
412 CmiObjectCreate(PVOID ObjectBody
,
415 POBJECT_ATTRIBUTES ObjectAttributes
);
418 CmiObjectDelete(PVOID DeletedObject
);
421 CmiObjectSecurity(PVOID ObjectBody
,
422 SECURITY_OPERATION_CODE OperationCode
,
423 SECURITY_INFORMATION SecurityInformation
,
424 PSECURITY_DESCRIPTOR SecurityDescriptor
,
425 PULONG BufferLength
);
428 CmiObjectQueryName (PVOID ObjectBody
,
429 POBJECT_NAME_INFORMATION ObjectNameInfo
,
431 PULONG ReturnLength
);
434 CmiImportHiveBins(PREGISTRY_HIVE Hive
,
438 CmiFreeHiveBins(PREGISTRY_HIVE Hive
);
441 CmiCreateHiveFreeCellList(PREGISTRY_HIVE Hive
);
444 CmiFreeHiveFreeCellList(PREGISTRY_HIVE Hive
);
447 CmiCreateHiveBitmap(PREGISTRY_HIVE Hive
);
451 CmiAddKeyToList(IN PKEY_OBJECT ParentKey
,
452 IN PKEY_OBJECT NewKey
);
455 CmiRemoveKeyFromList(IN PKEY_OBJECT NewKey
);
458 CmiScanKeyList(IN PKEY_OBJECT Parent
,
459 IN PUNICODE_STRING KeyName
,
460 IN ULONG Attributes
);
463 CmiCreateVolatileHive(PREGISTRY_HIVE
*RegistryHive
);
466 CmiLoadHive(POBJECT_ATTRIBUTES KeyObjectAttributes
,
467 PUNICODE_STRING FileName
,
471 CmiRemoveRegistryHive(PREGISTRY_HIVE RegistryHive
);
474 CmiFlushRegistryHive(PREGISTRY_HIVE RegistryHive
);
477 CmiGetNumberOfSubKeys(PKEY_OBJECT KeyObject
);
480 CmiGetMaxNameLength(IN PKEY_OBJECT KeyObject
);
483 CmiGetMaxClassLength(IN PKEY_OBJECT KeyObject
);
486 CmiGetMaxValueNameLength(IN PREGISTRY_HIVE RegistryHive
,
487 IN PKEY_CELL KeyCell
);
490 CmiGetMaxValueDataLength(IN PREGISTRY_HIVE RegistryHive
,
491 IN PKEY_CELL KeyCell
);
494 CmiScanForSubKey(IN PREGISTRY_HIVE RegistryHive
,
495 IN PKEY_CELL KeyCell
,
496 OUT PKEY_CELL
*SubKeyCell
,
497 OUT BLOCK_OFFSET
*BlockOffset
,
498 IN PUNICODE_STRING KeyName
,
499 IN ACCESS_MASK DesiredAccess
,
500 IN ULONG Attributes
);
503 CmiAddSubKey(IN PREGISTRY_HIVE RegistryHive
,
504 IN PKEY_OBJECT ParentKey
,
505 OUT PKEY_OBJECT SubKey
,
506 IN PUNICODE_STRING SubKeyName
,
508 IN PUNICODE_STRING Class
,
509 IN ULONG CreateOptions
);
512 CmiRemoveSubKey(IN PREGISTRY_HIVE RegistryHive
,
513 IN PKEY_OBJECT Parent
,
514 IN PKEY_OBJECT SubKey
);
517 CmiScanKeyForValue(IN PREGISTRY_HIVE RegistryHive
,
518 IN PKEY_CELL KeyCell
,
519 IN PUNICODE_STRING ValueName
,
520 OUT PVALUE_CELL
*ValueCell
,
521 OUT BLOCK_OFFSET
*VBOffset
);
524 CmiGetValueFromKeyByIndex(IN PREGISTRY_HIVE RegistryHive
,
525 IN PKEY_CELL KeyCell
,
527 OUT PVALUE_CELL
*ValueCell
);
530 CmiAddValueToKey(IN PREGISTRY_HIVE RegistryHive
,
531 IN PKEY_CELL KeyCell
,
532 IN BLOCK_OFFSET KeyCellOffset
,
533 IN PUNICODE_STRING ValueName
,
534 OUT PVALUE_CELL
*pValueCell
,
535 OUT BLOCK_OFFSET
*pValueCellOffset
);
538 CmiDeleteValueFromKey(IN PREGISTRY_HIVE RegistryHive
,
539 IN PKEY_CELL KeyCell
,
540 IN BLOCK_OFFSET KeyCellOffset
,
541 IN PUNICODE_STRING ValueName
);
544 CmiAllocateHashTableCell(IN PREGISTRY_HIVE RegistryHive
,
545 OUT PHASH_TABLE_CELL
*HashBlock
,
546 OUT BLOCK_OFFSET
*HBOffset
,
547 IN ULONG HashTableSize
);
550 CmiGetKeyFromHashByIndex(PREGISTRY_HIVE RegistryHive
,
551 PHASH_TABLE_CELL HashBlock
,
555 CmiAddKeyToHashTable(PREGISTRY_HIVE RegistryHive
,
556 PHASH_TABLE_CELL HashCell
,
557 BLOCK_OFFSET HashCellOffset
,
558 PKEY_CELL NewKeyCell
,
559 BLOCK_OFFSET NKBOffset
);
562 CmiRemoveKeyFromHashTable(PREGISTRY_HIVE RegistryHive
,
563 PHASH_TABLE_CELL HashBlock
,
564 BLOCK_OFFSET NKBOffset
);
567 CmiAllocateValueCell(IN PREGISTRY_HIVE RegistryHive
,
568 OUT PVALUE_CELL
*ValueCell
,
569 OUT BLOCK_OFFSET
*VBOffset
,
570 IN PUNICODE_STRING ValueName
);
573 CmiDestroyValueCell(PREGISTRY_HIVE RegistryHive
,
574 PVALUE_CELL ValueCell
,
575 BLOCK_OFFSET VBOffset
);
578 CmiAllocateCell(PREGISTRY_HIVE RegistryHive
,
581 BLOCK_OFFSET
*CellOffset
);
584 CmiDestroyCell(PREGISTRY_HIVE RegistryHive
,
586 BLOCK_OFFSET CellOffset
);
589 CmiGetCell (PREGISTRY_HIVE RegistryHive
,
590 BLOCK_OFFSET CellOffset
,
594 CmiMarkBlockDirty(PREGISTRY_HIVE RegistryHive
,
595 BLOCK_OFFSET BlockOffset
);
598 CmiMarkBinDirty(PREGISTRY_HIVE RegistryHive
,
599 BLOCK_OFFSET BinOffset
);
602 CmiAddFree(PREGISTRY_HIVE RegistryHive
,
603 PCELL_HEADER FreeBlock
,
604 BLOCK_OFFSET FreeOffset
,
605 BOOLEAN MergeFreeBlocks
);
608 CmiConnectHive(POBJECT_ATTRIBUTES KeyObjectAttributes
,
609 PREGISTRY_HIVE RegistryHive
);
612 CmiDisconnectHive (POBJECT_ATTRIBUTES KeyObjectAttributes
,
613 PREGISTRY_HIVE
*RegistryHive
);
616 CmiInitHives(BOOLEAN SetupBoot
);
619 CmiGetPackedNameLength(IN PUNICODE_STRING Name
,
620 OUT PBOOLEAN Packable
);
623 CmiComparePackedNames(IN PUNICODE_STRING Name
,
625 IN USHORT NameBufferSize
,
626 IN BOOLEAN NamePacked
);
629 CmiCopyPackedName(PWCHAR NameBuffer
,
630 PCHAR PackedNameBuffer
,
631 ULONG PackedNameSize
);
634 CmiCompareHash(PUNICODE_STRING KeyName
,
638 CmiCompareHashI(PUNICODE_STRING KeyName
,
642 CmiCompareKeyNames(PUNICODE_STRING KeyName
,
646 CmiCompareKeyNamesI(PUNICODE_STRING KeyName
,
655 CmiCreateTempHive(PREGISTRY_HIVE
*RegistryHive
);
658 CmiCopyKey (PREGISTRY_HIVE DstHive
,
659 PKEY_CELL DstKeyCell
,
660 PREGISTRY_HIVE SrcHive
,
661 PKEY_CELL SrcKeyCell
);
664 CmiSaveTempHive (PREGISTRY_HIVE Hive
,
667 #endif /*__INCLUDE_CM_H*/