registry.h File Reference

#include <cmlib.h>

Include dependency graph for registry.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	HKEY_TO_HCI(hKey)   ((HCELL_INDEX)(ULONG_PTR)(hKey))
#define	RegCloseKey(hKey)   (ERROR_SUCCESS)

Typedefs
typedef HANDLE	HKEY
typedef HANDLE *	PHKEY

Functions
BOOLEAN	RegImportBinaryHive (_In_ PVOID ChunkBase, _In_ ULONG ChunkSize, _In_ PCSTR SearchPath, _In_ BOOLEAN LoadAlternate)
	Imports the SYSTEM binary hive from the registry base chunk that's been provided by the loader block.
BOOLEAN	RegInitCurrentControlSet (_In_ BOOLEAN LastKnownGood)
LONG	RegOpenKey (_In_ HKEY ParentKey, _In_z_ PCWSTR KeyName, _Out_ PHKEY Key)
LONG	RegQueryValue (_In_ HKEY Key, _In_z_ PCWSTR ValueName, _Out_opt_ PULONG Type, _Out_opt_ PUCHAR Data, _Inout_opt_ PULONG DataSize)

Variables
PHHIVE	SystemHive
HKEY	CurrentControlSetKey

Macro Definition Documentation

HKEY_TO_HCI

#define HKEY_TO_HCI

(

hKey

)

((HCELL_INDEX)(ULONG_PTR)(hKey))

Definition at line 28 of file registry.h.

RegCloseKey

#define RegCloseKey

(

hKey

)

(ERROR_SUCCESS)

Definition at line 49 of file registry.h.

Typedef Documentation

HKEY

typedef HANDLE HKEY

Definition at line 26 of file registry.h.

PHKEY

typedef HANDLE * PHKEY

Definition at line 26 of file registry.h.

Function Documentation

RegImportBinaryHive()

BOOLEAN RegImportBinaryHive	(	_In_ PVOID	ChunkBase,
		_In_ ULONG	ChunkSize,
		_In_ PCSTR	SearchPath,
		_In_ BOOLEAN	LoadAlternate
	)

Imports the SYSTEM binary hive from the registry base chunk that's been provided by the loader block.

Parameters

[in]	ChunkBase	A pointer to the registry base chunk that serves for SYSTEM hive initialization.
[in]	ChunkSize	The size of the registry base chunk. This parameter refers to the actual size of the SYSTEM hive. This parameter is currently unused.
[in]	LoadAlternate	If set to TRUE, the function will initialize the hive as an alternate hive, otherwise FALSE to initialize it as primary.

Returns

Returns TRUE if hive importing and initialization have succeeded, FALSE otherwise.

Definition at line 436 of file registry.c.

{
    BOOLEAN Success;
    PCM_KEY_NODE KeyNode;
 
    TRACE("RegImportBinaryHive(%p, 0x%lx)\n", ChunkBase, ChunkSize);
 
    /* Assume that we don't need boot recover, unless we have to */
    ((PHBASE_BLOCK)ChunkBase)->BootRecover = HBOOT_NO_BOOT_RECOVER;
 
    /* Allocate and initialize the hive */
    CmSystemHive = FrLdrTempAlloc(sizeof(CMHIVE), 'eviH');
    Success = RegInitializeHive(CmSystemHive, ChunkBase, LoadAlternate);
    if (!Success)
    {
        /* Free the buffer and retry again */
        FrLdrTempFree(CmSystemHive, 'eviH');
        CmSystemHive = NULL;
 
        if (!RegRecoverHeaderHive(ChunkBase, SearchPath, "SYSTEM"))
        {
            ERR("Failed to recover the hive header block\n");
            return FALSE;
        }
 
        if (!RegRecoverDataHive(ChunkBase, SearchPath, "SYSTEM"))
        {
            ERR("Failed to recover the hive data\n");
            return FALSE;
        }
 
        /* Now retry initializing the hive again */
        CmSystemHive = FrLdrTempAlloc(sizeof(CMHIVE), 'eviH');
        Success = RegInitializeHive(CmSystemHive, ChunkBase, LoadAlternate);
        if (!Success)
        {
            ERR("Corrupted hive (despite recovery) %p\n", ChunkBase);
            FrLdrTempFree(CmSystemHive, 'eviH');
            return FALSE;
        }
 
        /*
         * Acknowledge the kernel we recovered the SYSTEM hive
         * on our side by applying log data.
         */
        ((PHBASE_BLOCK)ChunkBase)->BootRecover = HBOOT_BOOT_RECOVERED_BY_HIVE_LOG;
    }
 
    /* Save the root key node */
    SystemHive = GET_HHIVE(CmSystemHive);
    SystemRootCell = SystemHive->BaseBlock->RootCell;
    ASSERT(SystemRootCell != HCELL_NIL);
 
    /* Verify it is accessible */
    KeyNode = (PCM_KEY_NODE)HvGetCell(SystemHive, SystemRootCell);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    HvReleaseCell(SystemHive, SystemRootCell);
 
    return TRUE;
}

Referenced by WinLdrInitSystemHive().

RegInitCurrentControlSet()

BOOLEAN RegInitCurrentControlSet

(

_In_ BOOLEAN

LastKnownGood

)

Definition at line 503 of file registry.c.

{
    UNICODE_STRING ControlSetName;
    HCELL_INDEX ControlCell;
    PCM_KEY_NODE KeyNode;
    BOOLEAN AutoSelect;
 
    TRACE("RegInitCurrentControlSet\n");
 
    /* Choose which control set to open and set it as the new "Current" */
    RtlInitUnicodeString(&ControlSetName,
                         LastKnownGood ? L"LastKnownGood"
                                       : L"Default");
 
    ControlCell = CmpFindControlSet(SystemHive,
                                    SystemRootCell,
                                    &ControlSetName,
                                    &AutoSelect);
    if (ControlCell == HCELL_NIL)
    {
        ERR("CmpFindControlSet('%wZ') failed\n", &ControlSetName);
        return FALSE;
    }
 
    CurrentControlSetKey = HCI_TO_HKEY(ControlCell);
 
    /* Verify it is accessible */
    KeyNode = (PCM_KEY_NODE)HvGetCell(SystemHive, ControlCell);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    HvReleaseCell(SystemHive, ControlCell);
 
    return TRUE;
}

Referenced by WinLdrInitSystemHive().

RegOpenKey()

LONG RegOpenKey	(	_In_ HKEY	ParentKey,
		_In_z_ PCWSTR	KeyName,
		_Out_ PHKEY	Key
	)

Definition at line 654 of file registry.c.

{
    UNICODE_STRING RemainingPath, SubKeyName;
    UNICODE_STRING CurrentControlSet = RTL_CONSTANT_STRING(L"CurrentControlSet");
    PHHIVE Hive = (ParentKey ? GET_HHIVE_FROM_HKEY(ParentKey) : GET_HHIVE(CmSystemHive));
    PCM_KEY_NODE KeyNode;
    HCELL_INDEX CellIndex;
 
    TRACE("RegOpenKey(%p, '%S', %p)\n", ParentKey, KeyName, Key);
 
    /* Initialize the remaining path name */
    RtlInitUnicodeString(&RemainingPath, KeyName);
 
    /* Check if we have a parent key */
    if (ParentKey == NULL)
    {
        UNICODE_STRING SubKeyName1, SubKeyName2, SubKeyName3;
        UNICODE_STRING RegistryPath = RTL_CONSTANT_STRING(L"Registry");
        UNICODE_STRING MachinePath = RTL_CONSTANT_STRING(L"MACHINE");
        UNICODE_STRING SystemPath = RTL_CONSTANT_STRING(L"SYSTEM");
 
        TRACE("RegOpenKey: absolute path\n");
 
        if ((RemainingPath.Length < sizeof(WCHAR)) ||
            RemainingPath.Buffer[0] != '\\')
        {
            /* The key path is not absolute */
            ERR("RegOpenKey: invalid path '%S' (%wZ)\n", KeyName, &RemainingPath);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Skip initial path separator */
        RemainingPath.Buffer++;
        RemainingPath.Length -= sizeof(WCHAR);
 
        /* Get the first 3 path elements */
        GetNextPathElement(&SubKeyName1, &RemainingPath);
        GetNextPathElement(&SubKeyName2, &RemainingPath);
        GetNextPathElement(&SubKeyName3, &RemainingPath);
        TRACE("RegOpenKey: %wZ / %wZ / %wZ\n", &SubKeyName1, &SubKeyName2, &SubKeyName3);
 
        /* Check if we have the correct path */
        if (!RtlEqualUnicodeString(&SubKeyName1, &RegistryPath, TRUE) ||
            !RtlEqualUnicodeString(&SubKeyName2, &MachinePath, TRUE) ||
            !RtlEqualUnicodeString(&SubKeyName3, &SystemPath, TRUE))
        {
            /* The key path is not inside HKLM\Machine\System */
            ERR("RegOpenKey: invalid path '%S' (%wZ)\n", KeyName, &RemainingPath);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Use the root key */
        CellIndex = SystemRootCell;
    }
    else
    {
        /* Use the parent key */
        CellIndex = HKEY_TO_HCI(ParentKey);
    }
 
    /* Check if this is the root key */
    if (CellIndex == SystemRootCell)
    {
        UNICODE_STRING TempPath = RemainingPath;
 
        /* Get the first path element */
        GetNextPathElement(&SubKeyName, &TempPath);
 
        /* Check if this is CurrentControlSet */
        if (RtlEqualUnicodeString(&SubKeyName, &CurrentControlSet, TRUE))
        {
            /* Use the CurrentControlSetKey and update the remaining path */
            CellIndex = HKEY_TO_HCI(CurrentControlSetKey);
            RemainingPath = TempPath;
        }
    }
 
    /* Get the key node */
    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
 
    TRACE("RegOpenKey: RemainingPath '%wZ'\n", &RemainingPath);
 
    /* Loop while there are path elements */
    while (GetNextPathElement(&SubKeyName, &RemainingPath))
    {
        HCELL_INDEX NextCellIndex;
 
        TRACE("RegOpenKey: next element '%wZ'\n", &SubKeyName);
 
        /* Get the next sub key */
        NextCellIndex = CmpFindSubKeyByName(Hive, KeyNode, &SubKeyName);
        HvReleaseCell(Hive, CellIndex);
        CellIndex = NextCellIndex;
        if (CellIndex == HCELL_NIL)
        {
            WARN("Did not find sub key '%wZ' (full: %S)\n", &SubKeyName, KeyName);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Get the found key */
        KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
        ASSERT(KeyNode);
        ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    }
 
    HvReleaseCell(Hive, CellIndex);
    *Key = HCI_TO_HKEY(CellIndex);
 
    return ERROR_SUCCESS;
}

RegQueryValue()

LONG RegQueryValue	(	_In_ HKEY	Key,
		_In_z_ PCWSTR	ValueName,
		_Out_opt_ PULONG	Type,
		_Out_opt_ PUCHAR	Data,
		_Inout_opt_ PULONG	DataSize
	)

Definition at line 809 of file registry.c.

{
    PHHIVE Hive = GET_HHIVE_FROM_HKEY(Key);
    PCM_KEY_NODE KeyNode;
    PCM_KEY_VALUE ValueCell;
    HCELL_INDEX CellIndex;
    UNICODE_STRING ValueNameString;
 
    TRACE("RegQueryValue(%p, '%S', %p, %p, %p)\n",
          Key, ValueName, Type, Data, DataSize);
 
    /* Get the key node */
    KeyNode = GET_CM_KEY_NODE(Hive, Key);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
 
    /* Initialize value name string */
    RtlInitUnicodeString(&ValueNameString, ValueName);
    CellIndex = CmpFindValueByName(Hive, KeyNode, &ValueNameString);
    if (CellIndex == HCELL_NIL)
    {
        TRACE("RegQueryValue value not found in key (%.*s)\n",
              KeyNode->NameLength, KeyNode->Name);
        HvReleaseCell(Hive, HKEY_TO_HCI(Key));
        return ERROR_FILE_NOT_FOUND;
    }
    HvReleaseCell(Hive, HKEY_TO_HCI(Key));
 
    /* Get the value cell */
    ValueCell = (PCM_KEY_VALUE)HvGetCell(Hive, CellIndex);
    ASSERT(ValueCell != NULL);
 
    RepGetValueData(Hive, ValueCell, Type, Data, DataSize);
 
    HvReleaseCell(Hive, CellIndex);
 
    return ERROR_SUCCESS;
}

Variable Documentation

CurrentControlSetKey

HKEY CurrentControlSetKey

extern

Definition at line 34 of file registry.c.

Referenced by RegInitCurrentControlSet(), RegOpenKey(), WinLdrDetectVersion(), WinLdrInitErrataInf(), WinLdrScanRegistry(), and WinLdrScanSystemHive().

SystemHive

PHHIVE SystemHive

extern

Definition at line 33 of file registry.c.

Referenced by CmGetSystemControlValues(), CmpFindControlSet(), CmpInitializeSystemHive(), CmpWalkPath(), RegImportBinaryHive(), RegInitCurrentControlSet(), and WinLdrScanRegistry().