You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1060 lines
27 KiB
1060 lines
27 KiB
/*++
|
|
|
|
Copyright (c) 1991 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
edithive.c
|
|
|
|
Abstract:
|
|
|
|
Provides functionality for dumping and editing registry hive files from
|
|
user-mode.
|
|
|
|
Author:
|
|
|
|
John Vert (jvert) 26-Mar-1992
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
#include "edithive.h"
|
|
#include "nturtl.h"
|
|
|
|
extern GENERIC_MAPPING CmpKeyMapping;
|
|
extern LIST_ENTRY CmpHiveListHead; // List of CMHIVEs
|
|
|
|
#define SECURITY_CELL_LENGTH(pDescriptor) \
|
|
FIELD_OFFSET(CM_KEY_SECURITY,Descriptor) + \
|
|
RtlLengthSecurityDescriptor(pDescriptor)
|
|
|
|
|
|
NTSTATUS
|
|
EhpAttachSecurity(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX Cell
|
|
);
|
|
|
|
PVOID
|
|
EhpAllocate(
|
|
ULONG Size
|
|
);
|
|
|
|
VOID
|
|
EhpFree(
|
|
PVOID MemoryBlock
|
|
);
|
|
|
|
BOOLEAN
|
|
EhpFileRead (
|
|
HANDLE FileHandle,
|
|
PULONG FileOffset,
|
|
PVOID DataBuffer,
|
|
ULONG DataLength
|
|
);
|
|
|
|
BOOLEAN
|
|
EhpFileWrite(
|
|
HANDLE FileHandle,
|
|
PULONG FileOffset,
|
|
PVOID DataBuffer,
|
|
ULONG DataLength
|
|
);
|
|
|
|
BOOLEAN
|
|
EhpFileFlush (
|
|
HANDLE FileHandle
|
|
);
|
|
|
|
VOID
|
|
CmpGetObjectSecurity(
|
|
IN HCELL_INDEX Cell,
|
|
IN PHHIVE Hive,
|
|
OUT PCM_KEY_SECURITY *Security,
|
|
OUT PHCELL_INDEX SecurityCell OPTIONAL
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine maps in the security cell of a registry object.
|
|
|
|
Arguments:
|
|
|
|
Cell - Supplies the cell index of the object.
|
|
|
|
Hive - Supplies the hive the object's cell is in.
|
|
|
|
Security - Returns a pointer to the security cell of the object.
|
|
|
|
SecurityCell - Returns the index of the security cell
|
|
|
|
Return Value:
|
|
|
|
NONE.
|
|
|
|
--*/
|
|
|
|
{
|
|
HCELL_INDEX CellIndex;
|
|
PCM_KEY_NODE Node;
|
|
|
|
//
|
|
// Map the node we need to get the security descriptor for
|
|
//
|
|
Node = (PCM_KEY_NODE) HvGetCell(Hive, Cell);
|
|
|
|
CellIndex = Node->u1.s1.Security;
|
|
|
|
//
|
|
// Map in the security descriptor cell
|
|
//
|
|
*Security = (PCM_KEY_SECURITY) HvGetCell(Hive, CellIndex);
|
|
|
|
if (ARGUMENT_PRESENT(SecurityCell)) {
|
|
*SecurityCell = CellIndex;
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
|
|
VOID
|
|
EhCloseHive(
|
|
IN HANDLE HiveHandle
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Closes a hive, including writing all the data out to disk and freeing
|
|
the relevant structures.
|
|
|
|
Arguments:
|
|
|
|
HiveHandle - Supplies a handle to the hive control structure
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
HvSyncHive((PHHIVE)HiveHandle);
|
|
NtClose(((PCMHIVE)HiveHandle)->FileHandles[HFILE_TYPE_PRIMARY]);
|
|
NtClose(((PCMHIVE)HiveHandle)->FileHandles[HFILE_TYPE_ALTERNATE]);
|
|
NtClose(((PCMHIVE)HiveHandle)->FileHandles[HFILE_TYPE_LOG]);
|
|
CmpFree((PCMHIVE)HiveHandle, sizeof(CMHIVE));
|
|
|
|
}
|
|
|
|
|
|
HANDLE
|
|
EhOpenHive(
|
|
IN PUNICODE_STRING FileName,
|
|
OUT PHANDLE RootHandle,
|
|
IN PUNICODE_STRING RootName,
|
|
IN ULONG HiveType
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Opens an existing hive. If the filename does not exist it will be
|
|
created.
|
|
|
|
WARNING: Allocate FileName large enough to acomodate .log or
|
|
.alt extension.
|
|
|
|
Arguments:
|
|
|
|
FileName - Supplies the NULL-terminated filename to open as a hive.
|
|
|
|
HiveType - TYPE_SIMPLE = no log or alternate
|
|
TYPE_LOG = log
|
|
TYPE_ALT = alternate
|
|
|
|
Return Value:
|
|
|
|
!= NULL - Handle to the opened hive.
|
|
== NULL - Indicates file could not be opened.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE File;
|
|
BOOLEAN Allocate;
|
|
PCMHIVE Hive;
|
|
IO_STATUS_BLOCK IoStatus;
|
|
ULONG CreateDisposition;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
PCM_KEY_NODE RootNode;
|
|
HANDLE Handle;
|
|
HANDLE Primary;
|
|
HANDLE Log;
|
|
HANDLE Alt;
|
|
ULONG FileType;
|
|
ULONG Disposition;
|
|
ULONG SecondaryDisposition;
|
|
ULONG Operation;
|
|
|
|
Alt = NULL;
|
|
Log = NULL;
|
|
InitializeListHead(&CmpHiveListHead);
|
|
|
|
switch (HiveType) {
|
|
case TYPE_SIMPLE:
|
|
Status = CmpOpenHiveFiles(
|
|
FileName,
|
|
NULL,
|
|
&Primary,
|
|
NULL,
|
|
&Disposition,
|
|
&SecondaryDisposition,
|
|
TRUE,
|
|
NULL
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
return NULL;
|
|
}
|
|
FileType = HFILE_TYPE_PRIMARY;
|
|
break;
|
|
|
|
case TYPE_LOG:
|
|
Status = CmpOpenHiveFiles(
|
|
FileName,
|
|
L".log",
|
|
&Primary,
|
|
&Log,
|
|
&Disposition,
|
|
&SecondaryDisposition,
|
|
TRUE,
|
|
NULL
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
return NULL;
|
|
}
|
|
if (Log == NULL) {
|
|
return NULL;
|
|
}
|
|
FileType = HFILE_TYPE_LOG;
|
|
break;
|
|
|
|
case TYPE_ALT:
|
|
Status = CmpOpenHiveFiles(
|
|
FileName,
|
|
L".alt",
|
|
&Primary,
|
|
&Alt,
|
|
&Disposition,
|
|
&SecondaryDisposition,
|
|
TRUE,
|
|
NULL
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
return NULL;
|
|
}
|
|
if (Alt == NULL) {
|
|
return NULL;
|
|
}
|
|
FileType = HFILE_TYPE_ALTERNATE;
|
|
break;
|
|
|
|
default:
|
|
return NULL;
|
|
}
|
|
|
|
//
|
|
// Initialize hive
|
|
//
|
|
if (Disposition == FILE_CREATED) {
|
|
Operation = HINIT_CREATE;
|
|
Allocate = TRUE;
|
|
} else {
|
|
Operation = HINIT_FILE;
|
|
Allocate = FALSE;
|
|
}
|
|
|
|
if ( ! CmpInitializeHive(
|
|
&Hive,
|
|
Operation,
|
|
FALSE,
|
|
FileType,
|
|
NULL,
|
|
Primary,
|
|
Alt,
|
|
Log,
|
|
NULL,
|
|
NULL
|
|
))
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
if (!Allocate) {
|
|
*RootHandle = (HANDLE)(Hive->Hive.BaseBlock->RootCell);
|
|
RootNode = (PCM_KEY_NODE)HvGetCell(
|
|
(PHHIVE)Hive, Hive->Hive.BaseBlock->RootCell);
|
|
RootName->Length = RootName->MaximumLength = RootNode->NameLength;
|
|
RootName->Buffer = RootNode->Name;
|
|
} else {
|
|
RtlInitUnicodeString(RootName, L"HiveRoot");
|
|
*RootHandle = (HANDLE)HCELL_NIL;
|
|
HvSyncHive((PHHIVE)Hive);
|
|
}
|
|
|
|
|
|
return((HANDLE)Hive);
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhEnumerateKey(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE CellHandle,
|
|
IN ULONG Index,
|
|
IN KEY_INFORMATION_CLASS KeyInformationClass,
|
|
IN PVOID KeyInformation,
|
|
IN ULONG Length,
|
|
IN PULONG ResultLength
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Enumerate sub keys, return data on Index'th entry.
|
|
|
|
CmEnumerateKey returns the name of the Index'th sub key of the open
|
|
key specified. The value STATUS_NO_MORE_ENTRIES will be
|
|
returned if value of Index is larger than the number of sub keys.
|
|
|
|
Note that Index is simply a way to select among child keys. Two calls
|
|
to CmEnumerateKey with the same Index are NOT guaranteed to return
|
|
the same results.
|
|
|
|
If KeyInformation is not long enough to hold all requested data,
|
|
STATUS_BUFFER_OVERFLOW will be returned, and ResultLength will be
|
|
set to the number of bytes actually required.
|
|
|
|
Arguments:
|
|
|
|
Hive - supplies a pointer to the hive control structure for the hive
|
|
|
|
Cell - supplies index of node to whose sub keys are to be found
|
|
|
|
Index - Specifies the (0-based) number of the sub key to be returned.
|
|
|
|
KeyInformationClass - Specifies the type of information returned in
|
|
Buffer. One of the following types:
|
|
|
|
KeyBasicInformation - return last write time, title index, and name.
|
|
(see KEY_BASIC_INFORMATION structure)
|
|
|
|
KeyNodeInformation - return last write time, title index, name, class.
|
|
(see KEY_NODE_INFORMATION structure)
|
|
|
|
KeyInformation -Supplies pointer to buffer to receive the data.
|
|
|
|
Length - Length of KeyInformation in bytes.
|
|
|
|
ResultLength - Number of bytes actually written into KeyInformation.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Result code from call, among the following:
|
|
|
|
<TBS>
|
|
|
|
--*/
|
|
{
|
|
CM_KEY_CONTROL_BLOCK kcb;
|
|
|
|
kcb.Signature = CM_KEY_CONTROL_BLOCK_SIGNATURE;
|
|
kcb.Delete = FALSE;
|
|
kcb.KeyHive = &((PCMHIVE)HiveHandle)->Hive;
|
|
kcb.KeyCell = (HCELL_INDEX)CellHandle;
|
|
kcb.RefCount = 1;
|
|
|
|
return(CmEnumerateKey(&kcb,
|
|
Index,
|
|
KeyInformationClass,
|
|
KeyInformation,
|
|
Length,
|
|
ResultLength));
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhEnumerateValueKey(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE CellHandle,
|
|
IN ULONG Index,
|
|
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
|
|
IN PVOID KeyValueInformation,
|
|
IN ULONG Length,
|
|
IN PULONG ResultLength
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
The value entries of an open key may be enumerated.
|
|
|
|
CmEnumerateValueKey returns the name of the Index'th value
|
|
entry of the open key specified by KeyHandle. The value
|
|
STATUS_NO_MORE_ENTRIES will be returned if value of Index is
|
|
larger than the number of sub keys.
|
|
|
|
Note that Index is simply a way to select among value
|
|
entries. Two calls to NtEnumerateValueKey with the same Index
|
|
are NOT guaranteed to return the same results.
|
|
|
|
If KeyValueInformation is not long enough to hold all requested data,
|
|
STATUS_BUFFER_OVERFLOW will be returned, and ResultLength will be
|
|
set to the number of bytes actually required.
|
|
|
|
Arguments:
|
|
|
|
Hive - supplies a handle to the hive
|
|
|
|
Cell - supplies handle to node whose sub keys are to be found
|
|
|
|
Index - Specifies the (0-based) number of the sub key to be returned.
|
|
|
|
KeyValueInformationClass - Specifies the type of information returned
|
|
in Buffer. One of the following types:
|
|
|
|
KeyValueBasicInformation - return time of last write,
|
|
title index, and name. (See KEY_VALUE_BASIC_INFORMATION)
|
|
|
|
KeyValueFullInformation - return time of last write,
|
|
title index, name, class. (See KEY_VALUE_FULL_INFORMATION)
|
|
|
|
KeyValueInformation -Supplies pointer to buffer to receive the data.
|
|
|
|
Length - Length of KeyValueInformation in bytes.
|
|
|
|
ResultLength - Number of bytes actually written into KeyValueInformation.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Result code from call, among the following:
|
|
|
|
<TBS>
|
|
|
|
--*/
|
|
{
|
|
CM_KEY_CONTROL_BLOCK kcb;
|
|
|
|
kcb.Signature = CM_KEY_CONTROL_BLOCK_SIGNATURE;
|
|
kcb.Delete = FALSE;
|
|
kcb.KeyHive = (PHHIVE)&(((PCMHIVE)HiveHandle)->Hive);
|
|
kcb.KeyCell = (HCELL_INDEX)CellHandle;
|
|
kcb.RefCount = 1;
|
|
|
|
return(CmEnumerateValueKey(&kcb,
|
|
Index,
|
|
KeyValueInformationClass,
|
|
KeyValueInformation,
|
|
Length,
|
|
ResultLength));
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhOpenChildByNumber(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE CellHandle,
|
|
IN ULONG Index,
|
|
IN NODE_TYPE Type,
|
|
OUT PHANDLE ChildCell
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Return the cell index of the Nth child cell.
|
|
|
|
Arguments:
|
|
|
|
HiveHandle - handle of hive control structure for hive of interest
|
|
|
|
CellHandle - handle for parent cell
|
|
|
|
Index - number of desired child
|
|
|
|
Type - type of the child object
|
|
|
|
ChildCell - supplies a pointer to a variable to receive the
|
|
HCELL_INDEX of the Index'th child.
|
|
|
|
Return Value:
|
|
|
|
status
|
|
|
|
--*/
|
|
{
|
|
return(CmpFindChildByNumber(&((PCMHIVE)HiveHandle)->Hive,
|
|
(HCELL_INDEX)CellHandle,
|
|
Index,
|
|
Type,
|
|
(PHCELL_INDEX)ChildCell));
|
|
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhSetValueKey(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE CellHandle,
|
|
IN PUNICODE_STRING ValueName,
|
|
IN ULONG TitleIndex OPTIONAL,
|
|
IN ULONG Type,
|
|
IN PVOID Data,
|
|
IN ULONG DataSize
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
A value entry may be created or replaced with EhSetValueKey.
|
|
|
|
If a value entry with a Value ID (i.e. name) matching the
|
|
one specified by ValueName exists, it is deleted and replaced
|
|
with the one specified. If no such value entry exists, a new
|
|
one is created. NULL is a legal Value ID. While Value IDs must
|
|
be unique within any given key, the same Value ID may appear
|
|
in many different keys.
|
|
|
|
Arguments:
|
|
|
|
HiveHandle - handle of hive control structure for hive of interest
|
|
|
|
CellHandle - handle for parent cell
|
|
|
|
ValueName - The unique (relative to the containing key) name
|
|
of the value entry. May be NULL.
|
|
|
|
TitleIndex - Supplies the title index for ValueName. The title
|
|
index specifies the index of the localized alias for the ValueName.
|
|
|
|
Type - The integer type number of the value entry.
|
|
|
|
Data - Pointer to buffer with actual data for the value entry.
|
|
|
|
DataSize - Size of Data buffer.
|
|
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Result code from call, among the following:
|
|
|
|
<TBS>
|
|
|
|
--*/
|
|
{
|
|
CM_KEY_CONTROL_BLOCK kcb;
|
|
|
|
kcb.Delete = FALSE;
|
|
kcb.Signature = CM_KEY_CONTROL_BLOCK_SIGNATURE;
|
|
kcb.KeyHive = (PHHIVE)&(((PCMHIVE)HiveHandle)->Hive);
|
|
kcb.KeyCell = (HCELL_INDEX)CellHandle;
|
|
kcb.FullName.Length = 0;
|
|
kcb.FullName.MaximumLength = 0;
|
|
kcb.FullName.Buffer = NULL;
|
|
|
|
return(CmSetValueKey(&kcb,
|
|
*ValueName,
|
|
TitleIndex,
|
|
Type,
|
|
Data,
|
|
DataSize));
|
|
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhOpenChildByName(
|
|
HANDLE HiveHandle,
|
|
HANDLE CellHandle,
|
|
PUNICODE_STRING Name,
|
|
PHANDLE ChildCell
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Find the child subkey cell specified by Name.
|
|
|
|
Arguments:
|
|
|
|
HiveHandle - handle of hive control structure for hive of interest
|
|
|
|
CellHandle - handle for parent cell
|
|
|
|
Name - name of child object to find
|
|
|
|
ChildCell - pointer to variable to receive cell index of child
|
|
|
|
Return Value:
|
|
|
|
status
|
|
|
|
--*/
|
|
{
|
|
PHCELL_INDEX Index;
|
|
|
|
return(CmpFindChildByName(&((PCMHIVE)HiveHandle)->Hive,
|
|
(HCELL_INDEX)CellHandle,
|
|
*Name,
|
|
KeyBodyNode,
|
|
(PHCELL_INDEX)ChildCell,
|
|
&Index));
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhCreateChild(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE CellHandle,
|
|
IN PUNICODE_STRING Name,
|
|
OUT PHANDLE ChildCell,
|
|
OUT PULONG Disposition OPTIONAL
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Attempts to open the given child subkey specified by name. If the
|
|
child does not exist, it is created.
|
|
|
|
Arguments:
|
|
|
|
HiveHandle - handle of hive control structure for hive of interest
|
|
|
|
CellHandle - handle for parent cell
|
|
|
|
|
|
Name - name of child object to create
|
|
|
|
ChildCell - pointer to variable to receive cell index of child
|
|
|
|
Disposition - This optional parameter is a pointer to a variable
|
|
that will receive a value indicating whether a new Registry
|
|
key was created or an existing one opened:
|
|
|
|
REG_CREATED_NEW_KEY - A new Registry Key was created
|
|
REG_OPENED_EXISTING_KEY - An existing Registry Key was opened
|
|
|
|
Return Value:
|
|
|
|
status
|
|
|
|
--*/
|
|
{
|
|
PHCELL_INDEX Index;
|
|
NTSTATUS Status;
|
|
PHHIVE Hive;
|
|
HCELL_INDEX NewCell;
|
|
HCELL_INDEX NewListCell;
|
|
HCELL_INDEX OldListCell;
|
|
PHCELL_INDEX NewList;
|
|
PHCELL_INDEX OldList;
|
|
PCM_KEY_NODE Child;
|
|
PCM_KEY_NODE Parent;
|
|
PCM_KEY_SECURITY Security;
|
|
HANDLE Handle;
|
|
ULONG oldcount;
|
|
|
|
Hive = &((PCMHIVE)HiveHandle)->Hive;
|
|
|
|
if ((HCELL_INDEX)CellHandle == HCELL_NIL) {
|
|
if (Hive->BaseBlock->RootCell != HCELL_NIL) {
|
|
*ChildCell = (HANDLE)(Hive->BaseBlock->RootCell);
|
|
if (ARGUMENT_PRESENT(Disposition)) {
|
|
*Disposition = REG_OPENED_EXISTING_KEY;
|
|
}
|
|
return(STATUS_SUCCESS);
|
|
} else {
|
|
Status = STATUS_OBJECT_NAME_NOT_FOUND;
|
|
}
|
|
} else {
|
|
Parent = (PCM_KEY_NODE)HvGetCell(Hive, (HCELL_INDEX)CellHandle);
|
|
Status = CmpFindChildByName(Hive,
|
|
(HCELL_INDEX)CellHandle,
|
|
*Name,
|
|
KeyBodyNode,
|
|
(PHCELL_INDEX)ChildCell,
|
|
&Index);
|
|
}
|
|
if (Status == STATUS_OBJECT_NAME_NOT_FOUND) {
|
|
|
|
NewCell = HvAllocateCell(Hive,
|
|
CmpHKeyNodeSize(Hive,Name->Length),
|
|
Stable);
|
|
if (NewCell != HCELL_NIL) {
|
|
|
|
*ChildCell = (HANDLE)NewCell;
|
|
Child = (PCM_KEY_NODE)HvGetCell(Hive, NewCell);
|
|
|
|
Child->Signature = CM_KEY_NODE_SIGNATURE;
|
|
Child->Flags = 0;
|
|
|
|
KeQuerySystemTime(&(Child->LastWriteTime));
|
|
|
|
Child->Spare = 0;
|
|
Child->Parent = (HCELL_INDEX)CellHandle;
|
|
|
|
Child->ValueList.Count = 0;
|
|
Child->ValueList.List = HCELL_NIL;
|
|
Child->u1.s1.Security = HCELL_NIL;
|
|
Child->u1.s1.Class = HCELL_NIL;
|
|
Child->NameLength = Name->Length;
|
|
Child->ClassLength = 0;
|
|
|
|
Child->SubKeyCounts[Stable] = 0;
|
|
Child->SubKeyCounts[Volatile] = 0;
|
|
Child->SubKeyLists[Stable] = HCELL_NIL;
|
|
Child->SubKeyLists[Volatile] = HCELL_NIL;
|
|
|
|
Child->MaxValueDataLen = 0;
|
|
Child->MaxNameLen = 0;
|
|
Child->MaxValueNameLen = 0;
|
|
Child->MaxClassLen = 0;
|
|
|
|
if((HCELL_INDEX)CellHandle == HCELL_NIL) {
|
|
Hive->BaseBlock->RootCell = NewCell;
|
|
Status = EhpAttachSecurity(Hive, NewCell);
|
|
} else {
|
|
Child->u1.s1.Security = Parent->u1.s1.Security;
|
|
Security = (PCM_KEY_SECURITY)HvGetCell(Hive, Child->u1.s1.Security);
|
|
++Security->ReferenceCount;
|
|
}
|
|
|
|
RtlMoveMemory(
|
|
&(Child->Name[0]),
|
|
Name->Buffer,
|
|
Name->Length
|
|
);
|
|
|
|
Status = STATUS_SUCCESS;
|
|
} else {
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
return(Status);
|
|
}
|
|
if (ARGUMENT_PRESENT(Disposition)) {
|
|
*Disposition = REG_CREATED_NEW_KEY;
|
|
}
|
|
|
|
if ((HCELL_INDEX)CellHandle != HCELL_NIL) {
|
|
|
|
//
|
|
// put newly created child into parent's sub key list
|
|
//
|
|
if (! CmpAddSubKey(Hive, (HCELL_INDEX)CellHandle, NewCell)) {
|
|
CmpFreeKeyByCell(Hive, NewCell, FALSE);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
Parent = (PCM_KEY_NODE)HvGetCell(Hive, (HCELL_INDEX)CellHandle);
|
|
|
|
if (Parent->MaxNameLen < Name->Length) {
|
|
Parent->MaxNameLen = Name->Length;
|
|
}
|
|
Parent->MaxClassLen = 0;
|
|
}
|
|
} else {
|
|
Status = STATUS_SUCCESS;
|
|
if (ARGUMENT_PRESENT(Disposition)) {
|
|
*Disposition = REG_OPENED_EXISTING_KEY;
|
|
}
|
|
}
|
|
return(Status);
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhQueryKey(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE KeyHandle,
|
|
IN KEY_INFORMATION_CLASS KeyInformationClass,
|
|
IN PVOID KeyInformation,
|
|
IN ULONG Length,
|
|
IN PULONG ResultLength
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Data about the class of a key, and the numbers and sizes of its
|
|
children and value entries may be queried with CmQueryKey.
|
|
|
|
NOTE: The returned lengths are guaranteed to be at least as
|
|
long as the described values, but may be longer in
|
|
some circumstances.
|
|
|
|
Arguments:
|
|
|
|
Hive - supplies a handle to the hive control structure for the hive
|
|
|
|
Cell - supplies handle of node to whose sub keys are to be found
|
|
|
|
KeyInformationClass - Specifies the type of information
|
|
returned in Buffer. One of the following types:
|
|
|
|
KeyBasicInformation - return last write time, title index, and name.
|
|
(See KEY_BASIC_INFORMATION)
|
|
|
|
KeyNodeInformation - return last write time, title index, name, class.
|
|
(See KEY_NODE_INFORMATION)
|
|
|
|
KeyFullInformation - return all data except for name and security.
|
|
(See KEY_FULL_INFORMATION)
|
|
|
|
KeyInformation -Supplies pointer to buffer to receive the data.
|
|
|
|
Length - Length of KeyInformation in bytes.
|
|
|
|
ResultLength - Number of bytes actually written into KeyInformation.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Result code from call, among the following:
|
|
|
|
<TBS>
|
|
|
|
--*/
|
|
{
|
|
CM_KEY_CONTROL_BLOCK Kcb;
|
|
|
|
Kcb.Delete = FALSE;
|
|
Kcb.Signature = CM_KEY_CONTROL_BLOCK_SIGNATURE;
|
|
Kcb.KeyHive = &((PCMHIVE)HiveHandle)->Hive;
|
|
Kcb.KeyCell = (HCELL_INDEX)KeyHandle;
|
|
Kcb.FullName.Length = 0;
|
|
Kcb.FullName.MaximumLength = 0;
|
|
Kcb.FullName.Buffer = NULL;
|
|
|
|
return(CmQueryKey(&Kcb,
|
|
KeyInformationClass,
|
|
KeyInformation,
|
|
Length,
|
|
ResultLength));
|
|
}
|
|
|
|
PSECURITY_DESCRIPTOR
|
|
EhGetKeySecurity(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE KeyHandle
|
|
)
|
|
{
|
|
PCM_KEY_SECURITY Security;
|
|
|
|
CmpGetObjectSecurity((HCELL_INDEX)KeyHandle,
|
|
&((PCMHIVE)HiveHandle)->Hive,
|
|
&Security,
|
|
NULL);
|
|
|
|
return(&Security->Descriptor);
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhQueryValueKey(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE KeyHandle,
|
|
IN PUNICODE_STRING ValueName,
|
|
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
|
|
IN PVOID KeyValueInformation,
|
|
IN ULONG Length,
|
|
IN PULONG ResultLength
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
The ValueName, TitleIndex, Type, and Data for any one of a key's
|
|
value entries may be queried with CmQueryValueKey.
|
|
|
|
If KeyValueInformation is not long enough to hold all requested data,
|
|
STATUS_BUFFER_OVERFLOW will be returned, and ResultLength will be
|
|
set to the number of bytes actually required.
|
|
|
|
Arguments:
|
|
|
|
Hive - supplies a pointer to the hive control structure for the hive
|
|
|
|
Cell - supplies index of node to whose sub keys are to be found
|
|
|
|
ValueName - The name of the value entry to return data for.
|
|
|
|
KeyValueInformationClass - Specifies the type of information
|
|
returned in KeyValueInformation. One of the following types:
|
|
|
|
KeyValueBasicInformation - return time of last write, title
|
|
index, and name. (See KEY_VALUE_BASIC_INFORMATION)
|
|
|
|
KeyValueFullInformation - return time of last write, title
|
|
index, name, class. (See KEY_VALUE_FULL_INFORMATION)
|
|
|
|
KeyValueInformation -Supplies pointer to buffer to receive the data.
|
|
|
|
Length - Length of KeyValueInformation in bytes.
|
|
|
|
ResultLength - Number of bytes actually written into KeyValueInformation.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Result code from call, among the following:
|
|
|
|
<TBS>
|
|
|
|
--*/
|
|
{
|
|
CM_KEY_CONTROL_BLOCK kcb;
|
|
|
|
kcb.Delete = FALSE;
|
|
kcb.Signature = CM_KEY_CONTROL_BLOCK_SIGNATURE;
|
|
kcb.KeyHive = &((PCMHIVE)HiveHandle)->Hive;
|
|
kcb.KeyCell = (HCELL_INDEX)KeyHandle;
|
|
kcb.FullName.Length = 0;
|
|
kcb.FullName.MaximumLength = 0;
|
|
kcb.FullName.Buffer = NULL;
|
|
|
|
return(CmQueryValueKey(&kcb,
|
|
*ValueName,
|
|
KeyValueInformationClass,
|
|
KeyValueInformation,
|
|
Length,
|
|
ResultLength));
|
|
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhDeleteValueKey(
|
|
IN HANDLE HiveHandle,
|
|
IN HANDLE CellHandle,
|
|
IN PUNICODE_STRING ValueName // RAW
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
One of the value entries of a registry key may be removed with this call.
|
|
|
|
The value entry with ValueName matching ValueName is removed from the key.
|
|
If no such entry exists, an error is returned.
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies a handle to the hive control structure
|
|
|
|
Cell - Supplies a handle to the registry key to be operated on
|
|
|
|
ValueName - The name of the value to be deleted. NULL is a legal name.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Result code from call, among the following:
|
|
|
|
<TBS>
|
|
|
|
--*/
|
|
{
|
|
CM_KEY_CONTROL_BLOCK kcb;
|
|
|
|
kcb.Delete = FALSE;
|
|
kcb.Signature = CM_KEY_CONTROL_BLOCK_SIGNATURE;
|
|
kcb.KeyHive = &((PCMHIVE)HiveHandle)->Hive;
|
|
kcb.KeyCell = (HCELL_INDEX)CellHandle;
|
|
kcb.FullName.Length = 0;
|
|
kcb.FullName.MaximumLength = 0;
|
|
kcb.FullName.Buffer = NULL;
|
|
|
|
return(CmDeleteValueKey(&kcb, *ValueName));
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
EhpAttachSecurity(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX Cell
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Creates a security descriptor cell and attaches it to the given
|
|
node.
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies a pointer to the hive control structure.
|
|
|
|
Cell - Supplies the cell index of the node to attach the security
|
|
descriptor to.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE Token;
|
|
HCELL_INDEX SecurityCell;
|
|
PCM_KEY_NODE Node;
|
|
PCM_KEY_SECURITY Security;
|
|
PSECURITY_DESCRIPTOR Descriptor;
|
|
ULONG DescriptorLength;
|
|
HANDLE Handle;
|
|
|
|
Status = NtOpenProcessToken( NtCurrentProcess(),
|
|
TOKEN_QUERY,
|
|
&Token );
|
|
if (!NT_SUCCESS(Status)) {
|
|
return(Status);
|
|
}
|
|
|
|
Status = RtlNewSecurityObject( NULL,
|
|
NULL,
|
|
&Descriptor,
|
|
FALSE,
|
|
Token,
|
|
&CmpKeyMapping );
|
|
if (!NT_SUCCESS(Status)) {
|
|
return(Status);
|
|
}
|
|
|
|
Node = (PCM_KEY_NODE)HvGetCell(Hive, Cell);
|
|
SecurityCell = HvAllocateCell(Hive,
|
|
SECURITY_CELL_LENGTH(Descriptor),
|
|
Stable);
|
|
if (SecurityCell == HCELL_NIL) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
Node->u1.s1.Security = SecurityCell;
|
|
Security = (PCM_KEY_SECURITY)HvGetCell(Hive, SecurityCell);
|
|
DescriptorLength = RtlLengthSecurityDescriptor(Descriptor);
|
|
Security->Signature = CM_KEY_SECURITY_SIGNATURE;
|
|
Security->ReferenceCount = 1;
|
|
Security->DescriptorLength = DescriptorLength;
|
|
RtlMoveMemory( &Security->Descriptor,
|
|
Descriptor,
|
|
DescriptorLength );
|
|
Security->Flink = Security->Blink = SecurityCell;
|
|
return(STATUS_SUCCESS);
|
|
|
|
}
|
|
|