#include <cmlib.h>

Include dependency graph for registry.h:

This graph shows which files directly or indirectly include this file:

Macros
#define	HKEY_TO_HCI(hKey) ((HCELL_INDEX)(ULONG_PTR)(hKey))

#define	RegCloseKey(hKey) (ERROR_SUCCESS)

Typedefs
typedef HANDLE	HKEY

typedef HANDLE *	PHKEY

Functions
BOOLEAN	RegImportBinaryHive (_In_ PVOID ChunkBase, _In_ ULONG ChunkSize)

BOOLEAN	RegInitCurrentControlSet (_In_ BOOLEAN LastKnownGood)

LONG	RegOpenKey (_In_ HKEY ParentKey, _In_z_ PCWSTR KeyName, _Out_ PHKEY Key)

LONG	RegQueryValue (_In_ HKEY Key, _In_z_ PCWSTR ValueName, _Out_opt_ PULONG Type, _Out_opt_ PUCHAR Data, _Inout_opt_ PULONG DataSize)

Variables
PHHIVE	SystemHive

HKEY	CurrentControlSetKey

Macro Definition Documentation

◆ HKEY_TO_HCI

#define HKEY_TO_HCI ( hKey ) ((HCELL_INDEX)(ULONG_PTR)(hKey))

Definition at line 28 of file registry.h.

◆ RegCloseKey

#define RegCloseKey ( hKey ) (ERROR_SUCCESS)

Definition at line 47 of file registry.h.

Typedef Documentation

◆ HKEY

typedef HANDLE HKEY

Definition at line 26 of file registry.h.

◆ PHKEY

typedef HANDLE * PHKEY

Definition at line 26 of file registry.h.

Function Documentation

◆ RegImportBinaryHive()

BOOLEAN RegImportBinaryHive	(	_In_ PVOID	ChunkBase,
		_In_ ULONG	ChunkSize
	)

Definition at line 66 of file registry.c.

{
    NTSTATUS Status;
    PCM_KEY_NODE KeyNode;
 
    TRACE("RegImportBinaryHive(%p, 0x%lx)\n", ChunkBase, ChunkSize);
 
    /* Allocate and initialize the hive */
    CmSystemHive = FrLdrTempAlloc(sizeof(CMHIVE), 'eviH');
    Status = HvInitialize(GET_HHIVE(CmSystemHive),
                          HINIT_FLAT, // HINIT_MEMORY_INPLACE
                          0,
                          0,
                          ChunkBase,
                          CmpAllocate,
                          CmpFree,
                          NULL,
                          NULL,
                          NULL,
                          NULL,
                          1,
                          NULL);
    if (!NT_SUCCESS(Status))
    {
        ERR("Corrupted hive %p!\n", ChunkBase);
        FrLdrTempFree(CmSystemHive, 'eviH');
        return FALSE;
    }
 
    /* Save the root key node */
    SystemHive = GET_HHIVE(CmSystemHive);
    SystemRootCell = SystemHive->BaseBlock->RootCell;
    ASSERT(SystemRootCell != HCELL_NIL);
 
    /* Verify it is accessible */
    KeyNode = (PCM_KEY_NODE)HvGetCell(SystemHive, SystemRootCell);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    HvReleaseCell(SystemHive, SystemRootCell);
 
    return TRUE;
}

Referenced by WinLdrInitSystemHive().

◆ RegInitCurrentControlSet()

BOOLEAN RegInitCurrentControlSet ( _In_ BOOLEAN LastKnownGood )

Definition at line 112 of file registry.c.

{
    UNICODE_STRING ControlSetName;
    HCELL_INDEX ControlCell;
    PCM_KEY_NODE KeyNode;
    BOOLEAN AutoSelect;
 
    TRACE("RegInitCurrentControlSet\n");
 
    /* Choose which control set to open and set it as the new "Current" */
    RtlInitUnicodeString(&ControlSetName,
                         LastKnownGood ? L"LastKnownGood"
                                       : L"Default");
 
    ControlCell = CmpFindControlSet(SystemHive,
                                    SystemRootCell,
                                    &ControlSetName,
                                    &AutoSelect);
    if (ControlCell == HCELL_NIL)
    {
        ERR("CmpFindControlSet('%wZ') failed\n", &ControlSetName);
        return FALSE;
    }
 
    CurrentControlSetKey = HCI_TO_HKEY(ControlCell);
 
    /* Verify it is accessible */
    KeyNode = (PCM_KEY_NODE)HvGetCell(SystemHive, ControlCell);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    HvReleaseCell(SystemHive, ControlCell);
 
    return TRUE;
}

Referenced by WinLdrInitSystemHive().

◆ RegOpenKey()

LONG RegOpenKey	(	_In_ HKEY	ParentKey,
		_In_z_ PCWSTR	KeyName,
		_Out_ PHKEY	Key
	)

Definition at line 263 of file registry.c.

{
    UNICODE_STRING RemainingPath, SubKeyName;
    UNICODE_STRING CurrentControlSet = RTL_CONSTANT_STRING(L"CurrentControlSet");
    PHHIVE Hive = (ParentKey ? GET_HHIVE_FROM_HKEY(ParentKey) : GET_HHIVE(CmSystemHive));
    PCM_KEY_NODE KeyNode;
    HCELL_INDEX CellIndex;
 
    TRACE("RegOpenKey(%p, '%S', %p)\n", ParentKey, KeyName, Key);
 
    /* Initialize the remaining path name */
    RtlInitUnicodeString(&RemainingPath, KeyName);
 
    /* Check if we have a parent key */
    if (ParentKey == NULL)
    {
        UNICODE_STRING SubKeyName1, SubKeyName2, SubKeyName3;
        UNICODE_STRING RegistryPath = RTL_CONSTANT_STRING(L"Registry");
        UNICODE_STRING MachinePath = RTL_CONSTANT_STRING(L"MACHINE");
        UNICODE_STRING SystemPath = RTL_CONSTANT_STRING(L"SYSTEM");
 
        TRACE("RegOpenKey: absolute path\n");
 
        if ((RemainingPath.Length < sizeof(WCHAR)) ||
            RemainingPath.Buffer[0] != '\\')
        {
            /* The key path is not absolute */
            ERR("RegOpenKey: invalid path '%S' (%wZ)\n", KeyName, &RemainingPath);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Skip initial path separator */
        RemainingPath.Buffer++;
        RemainingPath.Length -= sizeof(WCHAR);
 
        /* Get the first 3 path elements */
        GetNextPathElement(&SubKeyName1, &RemainingPath);
        GetNextPathElement(&SubKeyName2, &RemainingPath);
        GetNextPathElement(&SubKeyName3, &RemainingPath);
        TRACE("RegOpenKey: %wZ / %wZ / %wZ\n", &SubKeyName1, &SubKeyName2, &SubKeyName3);
 
        /* Check if we have the correct path */
        if (!RtlEqualUnicodeString(&SubKeyName1, &RegistryPath, TRUE) ||
            !RtlEqualUnicodeString(&SubKeyName2, &MachinePath, TRUE) ||
            !RtlEqualUnicodeString(&SubKeyName3, &SystemPath, TRUE))
        {
            /* The key path is not inside HKLM\Machine\System */
            ERR("RegOpenKey: invalid path '%S' (%wZ)\n", KeyName, &RemainingPath);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Use the root key */
        CellIndex = SystemRootCell;
    }
    else
    {
        /* Use the parent key */
        CellIndex = HKEY_TO_HCI(ParentKey);
    }
 
    /* Check if this is the root key */
    if (CellIndex == SystemRootCell)
    {
        UNICODE_STRING TempPath = RemainingPath;
 
        /* Get the first path element */
        GetNextPathElement(&SubKeyName, &TempPath);
 
        /* Check if this is CurrentControlSet */
        if (RtlEqualUnicodeString(&SubKeyName, &CurrentControlSet, TRUE))
        {
            /* Use the CurrentControlSetKey and update the remaining path */
            CellIndex = HKEY_TO_HCI(CurrentControlSetKey);
            RemainingPath = TempPath;
        }
    }
 
    /* Get the key node */
    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
 
    TRACE("RegOpenKey: RemainingPath '%wZ'\n", &RemainingPath);
 
    /* Loop while there are path elements */
    while (GetNextPathElement(&SubKeyName, &RemainingPath))
    {
        HCELL_INDEX NextCellIndex;
 
        TRACE("RegOpenKey: next element '%wZ'\n", &SubKeyName);
 
        /* Get the next sub key */
        NextCellIndex = CmpFindSubKeyByName(Hive, KeyNode, &SubKeyName);
        HvReleaseCell(Hive, CellIndex);
        CellIndex = NextCellIndex;
        if (CellIndex == HCELL_NIL)
        {
            WARN("Did not find sub key '%wZ' (full: %S)\n", &SubKeyName, KeyName);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Get the found key */
        KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
        ASSERT(KeyNode);
        ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    }
 
    HvReleaseCell(Hive, CellIndex);
    *Key = HCI_TO_HKEY(CellIndex);
 
    return ERROR_SUCCESS;
}

◆ RegQueryValue()

LONG RegQueryValue	(	_In_ HKEY	Key,
		_In_z_ PCWSTR	ValueName,
		_Out_opt_ PULONG	Type,
		_Out_opt_ PUCHAR	Data,
		_Inout_opt_ PULONG	DataSize
	)

Definition at line 418 of file registry.c.

{
    PHHIVE Hive = GET_HHIVE_FROM_HKEY(Key);
    PCM_KEY_NODE KeyNode;
    PCM_KEY_VALUE ValueCell;
    HCELL_INDEX CellIndex;
    UNICODE_STRING ValueNameString;
 
    TRACE("RegQueryValue(%p, '%S', %p, %p, %p)\n",
          Key, ValueName, Type, Data, DataSize);
 
    /* Get the key node */
    KeyNode = GET_CM_KEY_NODE(Hive, Key);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
 
    /* Initialize value name string */
    RtlInitUnicodeString(&ValueNameString, ValueName);
    CellIndex = CmpFindValueByName(Hive, KeyNode, &ValueNameString);
    if (CellIndex == HCELL_NIL)
    {
        TRACE("RegQueryValue value not found in key (%.*s)\n",
              KeyNode->NameLength, KeyNode->Name);
        HvReleaseCell(Hive, HKEY_TO_HCI(Key));
        return ERROR_FILE_NOT_FOUND;
    }
    HvReleaseCell(Hive, HKEY_TO_HCI(Key));
 
    /* Get the value cell */
    ValueCell = (PCM_KEY_VALUE)HvGetCell(Hive, CellIndex);
    ASSERT(ValueCell != NULL);
 
    RepGetValueData(Hive, ValueCell, Type, Data, DataSize);
 
    HvReleaseCell(Hive, CellIndex);
 
    return ERROR_SUCCESS;
}

Variable Documentation

◆ CurrentControlSetKey

HKEY CurrentControlSetKey

extern

Definition at line 33 of file registry.c.

Referenced by RegInitCurrentControlSet(), RegOpenKey(), WinLdrDetectVersion(), WinLdrInitErrataInf(), WinLdrScanRegistry(), and WinLdrScanSystemHive().

◆ SystemHive

PHHIVE SystemHive