2006-11-08 11:47:44 +00:00
|
|
|
/*
|
2016-01-09 23:42:45 +00:00
|
|
|
* PROJECT: Registry manipulation library
|
2006-11-08 11:47:44 +00:00
|
|
|
* LICENSE: GPL - See COPYING in the top level directory
|
|
|
|
* COPYRIGHT: Copyright 2005 Filip Navara <navaraf@reactos.org>
|
|
|
|
* Copyright 2001 - 2005 Eric Kohl
|
|
|
|
*/
|
|
|
|
|
2010-02-26 11:43:19 +00:00
|
|
|
#pragma once
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2007-10-25 15:53:51 +00:00
|
|
|
//
|
|
|
|
// Hive operations
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HINIT_CREATE 0
|
|
|
|
#define HINIT_MEMORY 1
|
|
|
|
#define HINIT_FILE 2
|
|
|
|
#define HINIT_MEMORY_INPLACE 3
|
|
|
|
#define HINIT_FLAT 4
|
|
|
|
#define HINIT_MAPFILE 5
|
2007-10-25 15:53:51 +00:00
|
|
|
|
|
|
|
//
|
|
|
|
// Hive flags
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HIVE_VOLATILE 1
|
|
|
|
#define HIVE_NOLAZYFLUSH 2
|
|
|
|
#define HIVE_HAS_BEEN_REPLACED 4
|
|
|
|
#define HIVE_HAS_BEEN_FREED 8
|
|
|
|
#define HIVE_UNKNOWN 0x10
|
|
|
|
#define HIVE_IS_UNLOADING 0x20
|
2007-10-25 15:53:51 +00:00
|
|
|
|
|
|
|
//
|
|
|
|
// Hive types
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HFILE_TYPE_PRIMARY 0
|
|
|
|
#define HFILE_TYPE_LOG 1
|
|
|
|
#define HFILE_TYPE_EXTERNAL 2
|
2023-10-30 17:07:21 +00:00
|
|
|
#define HFILE_TYPE_ALTERNATE 3 // Technically a HFILE_TYPE_PRIMARY but for mirror backup hives. ONLY USED for the SYSTEM hive!
|
|
|
|
#define HFILE_TYPE_MAX 4
|
2007-10-25 15:53:51 +00:00
|
|
|
|
|
|
|
//
|
|
|
|
// Hive sizes
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HBLOCK_SIZE 0x1000
|
|
|
|
#define HSECTOR_SIZE 0x200
|
|
|
|
#define HSECTOR_COUNT 8
|
2007-10-25 15:53:51 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HV_LOG_HEADER_SIZE FIELD_OFFSET(HBASE_BLOCK, Reserved2)
|
2019-02-17 00:07:56 +00:00
|
|
|
|
2022-10-26 16:20:03 +00:00
|
|
|
//
|
|
|
|
// Clean Block identifier
|
|
|
|
//
|
|
|
|
#define HV_CLEAN_BLOCK 0U
|
|
|
|
|
|
|
|
//
|
|
|
|
// Hive Log identifiers
|
|
|
|
//
|
|
|
|
#define HV_LOG_DIRTY_BLOCK 0xFF
|
|
|
|
#define HV_LOG_DIRTY_SIGNATURE 0x54524944 // "DIRT"
|
|
|
|
|
2019-02-17 00:07:56 +00:00
|
|
|
//
|
|
|
|
// Hive structure identifiers
|
|
|
|
//
|
2019-02-17 00:10:27 +00:00
|
|
|
#define HV_HHIVE_SIGNATURE 0xbee0bee0
|
2019-02-17 00:07:56 +00:00
|
|
|
#define HV_HBLOCK_SIGNATURE 0x66676572 // "regf"
|
|
|
|
#define HV_HBIN_SIGNATURE 0x6e696268 // "hbin"
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2007-10-25 15:53:51 +00:00
|
|
|
//
|
|
|
|
// Hive versions
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HSYS_MAJOR 1
|
|
|
|
#define HSYS_MINOR 3
|
|
|
|
#define HSYS_WHISTLER_BETA1 4
|
|
|
|
#define HSYS_WHISTLER 5
|
|
|
|
#define HSYS_MINOR_SUPPORTED HSYS_WHISTLER
|
2007-10-25 15:53:51 +00:00
|
|
|
|
|
|
|
//
|
|
|
|
// Hive formats
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HBASE_FORMAT_MEMORY 1
|
2007-10-25 15:53:51 +00:00
|
|
|
|
|
|
|
//
|
|
|
|
// Hive storage
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HTYPE_COUNT 2
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2022-10-26 16:20:03 +00:00
|
|
|
//
|
|
|
|
// Hive boot types
|
|
|
|
//
|
|
|
|
#define HBOOT_TYPE_REGULAR 0
|
|
|
|
#define HBOOT_TYPE_SELF_HEAL 4
|
|
|
|
|
|
|
|
//
|
|
|
|
// Hive boot recover types
|
|
|
|
//
|
|
|
|
#define HBOOT_NO_BOOT_RECOVER 0
|
|
|
|
#define HBOOT_BOOT_RECOVERED_BY_HIVE_LOG 1
|
|
|
|
#define HBOOT_BOOT_RECOVERED_BY_ALTERNATE_HIVE 2
|
|
|
|
|
2006-11-08 11:47:44 +00:00
|
|
|
/**
|
|
|
|
* @name HCELL_INDEX
|
|
|
|
*
|
|
|
|
* A handle to cell index. The highest bit specifies the cell storage and
|
|
|
|
* the other bits specify index into the hive file. The value HCELL_NULL
|
|
|
|
* (-1) is reserved for marking invalid cells.
|
|
|
|
*/
|
2022-04-17 14:43:17 +00:00
|
|
|
typedef ULONG HCELL_INDEX, *PHCELL_INDEX;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2007-10-25 15:53:51 +00:00
|
|
|
//
|
|
|
|
// Cell Magic Values
|
|
|
|
//
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HCELL_NIL MAXULONG
|
|
|
|
#define HCELL_CACHED 1
|
2007-10-25 15:53:51 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HCELL_TYPE_MASK 0x80000000
|
|
|
|
#define HCELL_BLOCK_MASK 0x7ffff000
|
|
|
|
#define HCELL_OFFSET_MASK 0x00000fff
|
|
|
|
#define HCELL_TYPE_SHIFT 31
|
|
|
|
#define HCELL_BLOCK_SHIFT 12
|
|
|
|
#define HCELL_OFFSET_SHIFT 0
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2007-05-13 16:58:54 +00:00
|
|
|
#define HvGetCellType(Cell) \
|
2016-01-09 23:15:05 +00:00
|
|
|
((ULONG)(((Cell) & HCELL_TYPE_MASK) >> HCELL_TYPE_SHIFT))
|
2008-02-07 03:32:47 +00:00
|
|
|
#define HvGetCellBlock(Cell) \
|
2016-01-09 23:15:05 +00:00
|
|
|
((ULONG)(((Cell) & HCELL_BLOCK_MASK) >> HCELL_BLOCK_SHIFT))
|
2007-05-13 16:58:54 +00:00
|
|
|
|
2007-10-25 15:53:51 +00:00
|
|
|
typedef enum
|
|
|
|
{
|
2016-01-09 23:15:05 +00:00
|
|
|
Stable = 0,
|
2007-10-25 15:53:51 +00:00
|
|
|
Volatile = 1
|
|
|
|
} HSTORAGE_TYPE;
|
|
|
|
|
2006-11-08 11:47:44 +00:00
|
|
|
#include <pshpack1.h>
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @name HBASE_BLOCK
|
|
|
|
*
|
|
|
|
* On-disk header for registry hive file.
|
|
|
|
*/
|
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
#define HIVE_FILENAME_MAXLEN 31
|
2014-02-02 16:59:03 +00:00
|
|
|
|
2006-11-08 11:47:44 +00:00
|
|
|
typedef struct _HBASE_BLOCK
|
|
|
|
{
|
2019-02-17 00:07:56 +00:00
|
|
|
/* Hive base block identifier "regf" (0x66676572) */
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Signature;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-10 02:16:39 +00:00
|
|
|
/* Update counters */
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Sequence1;
|
|
|
|
ULONG Sequence2;
|
2007-10-19 23:21:45 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* When this hive file was last modified */
|
|
|
|
LARGE_INTEGER TimeStamp;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Registry format major version (1) */
|
|
|
|
ULONG Major;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Registry format minor version (3)
|
|
|
|
Version 3 added fast indexes, version 5 has large value optimizations */
|
|
|
|
ULONG Minor;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Registry file type (0 - Primary, 1 - Log) */
|
|
|
|
ULONG Type;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Registry format (1 is the only defined value so far) */
|
|
|
|
ULONG Format;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Offset into file from the byte after the end of the base block.
|
|
|
|
If the hive is volatile, this is the actual pointer to the CM_KEY_NODE */
|
|
|
|
HCELL_INDEX RootCell;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-12 21:37:36 +00:00
|
|
|
/* Size in bytes of the full hive, minus the header, multiple of the block size (4KB) */
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Length;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* (1?) */
|
|
|
|
ULONG Cluster;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Last 31 UNICODE characters, plus terminating NULL character,
|
|
|
|
of the full name of the hive file */
|
|
|
|
WCHAR FileName[HIVE_FILENAME_MAXLEN + 1];
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Reserved1[99];
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Checksum of first 0x200 bytes */
|
|
|
|
ULONG CheckSum;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Reserved2[0x37E];
|
|
|
|
ULONG BootType;
|
|
|
|
ULONG BootRecover;
|
2006-11-08 11:47:44 +00:00
|
|
|
} HBASE_BLOCK, *PHBASE_BLOCK;
|
|
|
|
|
2016-01-12 21:37:36 +00:00
|
|
|
C_ASSERT(sizeof(HBASE_BLOCK) == HBLOCK_SIZE);
|
|
|
|
|
2006-11-08 11:47:44 +00:00
|
|
|
typedef struct _HBIN
|
|
|
|
{
|
2019-02-17 00:07:56 +00:00
|
|
|
/* Hive bin identifier "hbin" (0x6E696268) */
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Signature;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Block offset of this bin */
|
|
|
|
HCELL_INDEX FileOffset;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-12 21:37:36 +00:00
|
|
|
/* Size in bytes of this bin, multiple of the block size (4KB) */
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Size;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
ULONG Reserved1[2];
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* When this bin was last modified */
|
|
|
|
LARGE_INTEGER TimeStamp;
|
2006-11-08 11:47:44 +00:00
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
/* Unused (In-memory only) */
|
|
|
|
ULONG Spare;
|
2006-11-08 11:47:44 +00:00
|
|
|
} HBIN, *PHBIN;
|
|
|
|
|
|
|
|
typedef struct _HCELL
|
|
|
|
{
|
2016-01-09 23:15:05 +00:00
|
|
|
/* <0 if used, >0 if free */
|
|
|
|
LONG Size;
|
2006-11-08 11:47:44 +00:00
|
|
|
} HCELL, *PHCELL;
|
|
|
|
|
|
|
|
#include <poppack.h>
|
|
|
|
|
2007-10-28 21:31:46 +00:00
|
|
|
struct _HHIVE;
|
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
typedef struct _CELL_DATA*
|
|
|
|
(CMAPI *PGET_CELL_ROUTINE)(
|
|
|
|
struct _HHIVE *Hive,
|
|
|
|
HCELL_INDEX Cell
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef VOID
|
|
|
|
(CMAPI *PRELEASE_CELL_ROUTINE)(
|
|
|
|
struct _HHIVE *Hive,
|
|
|
|
HCELL_INDEX Cell
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef PVOID
|
|
|
|
(CMAPI *PALLOCATE_ROUTINE)(
|
|
|
|
SIZE_T Size,
|
|
|
|
BOOLEAN Paged,
|
|
|
|
ULONG Tag
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef VOID
|
|
|
|
(CMAPI *PFREE_ROUTINE)(
|
|
|
|
PVOID Ptr,
|
|
|
|
ULONG Quota
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef BOOLEAN
|
|
|
|
(CMAPI *PFILE_READ_ROUTINE)(
|
|
|
|
struct _HHIVE *RegistryHive,
|
|
|
|
ULONG FileType,
|
|
|
|
PULONG FileOffset,
|
|
|
|
PVOID Buffer,
|
|
|
|
SIZE_T BufferLength
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef BOOLEAN
|
|
|
|
(CMAPI *PFILE_WRITE_ROUTINE)(
|
|
|
|
struct _HHIVE *RegistryHive,
|
|
|
|
ULONG FileType,
|
|
|
|
PULONG FileOffset,
|
|
|
|
PVOID Buffer,
|
|
|
|
SIZE_T BufferLength
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef BOOLEAN
|
|
|
|
(CMAPI *PFILE_SET_SIZE_ROUTINE)(
|
|
|
|
struct _HHIVE *RegistryHive,
|
|
|
|
ULONG FileType,
|
|
|
|
ULONG FileSize,
|
|
|
|
ULONG OldfileSize
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef BOOLEAN
|
|
|
|
(CMAPI *PFILE_FLUSH_ROUTINE)(
|
2007-10-28 21:31:46 +00:00
|
|
|
struct _HHIVE *RegistryHive,
|
|
|
|
ULONG FileType,
|
|
|
|
PLARGE_INTEGER FileOffset,
|
|
|
|
ULONG Length
|
|
|
|
);
|
|
|
|
|
|
|
|
typedef struct _HMAP_ENTRY
|
|
|
|
{
|
|
|
|
ULONG_PTR BlockAddress;
|
|
|
|
ULONG_PTR BinAddress;
|
|
|
|
struct _CM_VIEW_OF_FILE *CmView;
|
|
|
|
ULONG MemAlloc;
|
|
|
|
} HMAP_ENTRY, *PHMAP_ENTRY;
|
|
|
|
|
|
|
|
typedef struct _HMAP_TABLE
|
|
|
|
{
|
|
|
|
HMAP_ENTRY Table[512];
|
|
|
|
} HMAP_TABLE, *PHMAP_TABLE;
|
|
|
|
|
|
|
|
typedef struct _HMAP_DIRECTORY
|
|
|
|
{
|
|
|
|
PHMAP_TABLE Directory[2048];
|
|
|
|
} HMAP_DIRECTORY, *PHMAP_DIRECTORY;
|
|
|
|
|
|
|
|
typedef struct _DUAL
|
|
|
|
{
|
|
|
|
ULONG Length;
|
|
|
|
PHMAP_DIRECTORY Map;
|
|
|
|
PHMAP_ENTRY BlockList; // PHMAP_TABLE SmallDir;
|
|
|
|
ULONG Guard;
|
2016-01-09 23:15:05 +00:00
|
|
|
HCELL_INDEX FreeDisplay[24]; // FREE_DISPLAY FreeDisplay[24];
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG FreeSummary;
|
|
|
|
LIST_ENTRY FreeBins;
|
|
|
|
} DUAL, *PDUAL;
|
|
|
|
|
|
|
|
typedef struct _HHIVE
|
|
|
|
{
|
2019-02-17 00:07:56 +00:00
|
|
|
/* Hive identifier (0xBEE0BEE0) */
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG Signature;
|
2019-02-17 00:07:56 +00:00
|
|
|
|
|
|
|
/* Callbacks */
|
2007-10-28 21:31:46 +00:00
|
|
|
PGET_CELL_ROUTINE GetCellRoutine;
|
|
|
|
PRELEASE_CELL_ROUTINE ReleaseCellRoutine;
|
|
|
|
PALLOCATE_ROUTINE Allocate;
|
|
|
|
PFREE_ROUTINE Free;
|
|
|
|
PFILE_SET_SIZE_ROUTINE FileSetSize;
|
2016-01-12 21:37:36 +00:00
|
|
|
PFILE_WRITE_ROUTINE FileWrite;
|
|
|
|
PFILE_READ_ROUTINE FileRead;
|
2007-10-28 21:31:46 +00:00
|
|
|
PFILE_FLUSH_ROUTINE FileFlush;
|
2019-02-17 00:07:56 +00:00
|
|
|
|
2016-01-12 21:37:36 +00:00
|
|
|
#if (NTDDI_VERSION >= NTDDI_WIN7)
|
|
|
|
PVOID HiveLoadFailure; // PHIVE_LOAD_FAILURE
|
|
|
|
#endif
|
2007-10-28 21:31:46 +00:00
|
|
|
PHBASE_BLOCK BaseBlock;
|
|
|
|
RTL_BITMAP DirtyVector;
|
|
|
|
ULONG DirtyCount;
|
|
|
|
ULONG DirtyAlloc;
|
|
|
|
ULONG BaseBlockAlloc;
|
|
|
|
ULONG Cluster;
|
|
|
|
BOOLEAN Flat;
|
|
|
|
BOOLEAN ReadOnly;
|
2016-01-12 21:37:36 +00:00
|
|
|
#if (NTDDI_VERSION < NTDDI_VISTA) // NTDDI_LONGHORN
|
2007-10-28 21:31:46 +00:00
|
|
|
BOOLEAN Log;
|
2023-10-30 17:07:21 +00:00
|
|
|
BOOLEAN Alternate;
|
2016-01-12 21:37:36 +00:00
|
|
|
#endif
|
2007-10-28 21:31:46 +00:00
|
|
|
BOOLEAN DirtyFlag;
|
2016-01-12 21:37:36 +00:00
|
|
|
#if (NTDDI_VERSION >= NTDDI_VISTA) // NTDDI_LONGHORN
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG HvBinHeadersUse;
|
|
|
|
ULONG HvFreeCellsUse;
|
2016-01-12 21:37:36 +00:00
|
|
|
ULONG HvUsedCellsUse;
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG CmUsedCellsUse;
|
2016-01-12 21:37:36 +00:00
|
|
|
#endif
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG HiveFlags;
|
2016-01-12 21:37:36 +00:00
|
|
|
#if (NTDDI_VERSION < NTDDI_VISTA) // NTDDI_LONGHORN
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG LogSize;
|
2016-01-12 21:37:36 +00:00
|
|
|
#else
|
|
|
|
ULONG CurrentLog;
|
|
|
|
ULONG LogSize[2];
|
|
|
|
#endif
|
2007-10-28 21:31:46 +00:00
|
|
|
ULONG RefreshCount;
|
|
|
|
ULONG StorageTypeCount;
|
|
|
|
ULONG Version;
|
|
|
|
DUAL Storage[HTYPE_COUNT];
|
|
|
|
} HHIVE, *PHHIVE;
|
|
|
|
|
2016-01-09 23:15:05 +00:00
|
|
|
#define IsFreeCell(Cell) ((Cell)->Size >= 0)
|
|
|
|
#define IsUsedCell(Cell) ((Cell)->Size < 0)
|