registry.c File Reference

#include <freeldr.h>
#include <cmlib.h>
#include "registry.h"
#include <internal/cmboot.h>
#include <debug.h>

Include dependency graph for registry.c:

Go to the source code of this file.

Macros
#define	HCI_TO_HKEY(CellIndex)   ((HKEY)(ULONG_PTR)(CellIndex))
#define	GET_HHIVE(CmHive)   (&((CmHive)->Hive))
#define	GET_HHIVE_FROM_HKEY(hKey)   GET_HHIVE(CmSystemHive)
#define	GET_CM_KEY_NODE(hHive, hKey)   ((PCM_KEY_NODE)HvGetCell(hHive, HKEY_TO_HCI(hKey)))

Functions
	DBG_DEFAULT_CHANNEL (REGISTRY)
PVOID NTAPI	CmpAllocate (IN SIZE_T Size, IN BOOLEAN Paged, IN ULONG Tag)
VOID NTAPI	CmpFree (IN PVOID Ptr, IN ULONG Quota)
BOOLEAN	RegImportBinaryHive (_In_ PVOID ChunkBase, _In_ ULONG ChunkSize)
BOOLEAN	RegInitCurrentControlSet (_In_ BOOLEAN LastKnownGood)
static BOOLEAN	GetNextPathElement (_Out_ PUNICODE_STRING NextElement, _Inout_ PUNICODE_STRING RemainingPath)
LONG	RegOpenKey (_In_ HKEY ParentKey, _In_z_ PCWSTR KeyName, _Out_ PHKEY Key)
static VOID	RepGetValueData (_In_ PHHIVE Hive, _In_ PCM_KEY_VALUE ValueCell, _Out_opt_ PULONG Type, _Out_opt_ PUCHAR Data, _Inout_opt_ PULONG DataSize)
LONG	RegQueryValue (_In_ HKEY Key, _In_z_ PCWSTR ValueName, _Out_opt_ PULONG Type, _Out_opt_ PUCHAR Data, _Inout_opt_ PULONG DataSize)

Variables
static PCMHIVE	CmSystemHive
static HCELL_INDEX	SystemRootCell
PHHIVE	SystemHive = NULL
HKEY	CurrentControlSetKey = NULL

Macro Definition Documentation

GET_CM_KEY_NODE

#define GET_CM_KEY_NODE	(		hHive,
			hKey
	)		((PCM_KEY_NODE)HvGetCell(hHive, HKEY_TO_HCI(hKey)))

Definition at line 42 of file registry.c.

GET_HHIVE

#define GET_HHIVE

(

CmHive

)

(&((CmHive)->Hive))

Definition at line 40 of file registry.c.

GET_HHIVE_FROM_HKEY

#define GET_HHIVE_FROM_HKEY

(

hKey

)

GET_HHIVE(CmSystemHive)

Definition at line 41 of file registry.c.

HCI_TO_HKEY

#define HCI_TO_HKEY

(

CellIndex

)

((HKEY)(ULONG_PTR)(CellIndex))

Definition at line 35 of file registry.c.

Function Documentation

CmpAllocate()

PVOID NTAPI CmpAllocate	(	IN SIZE_T	Size,
		IN BOOLEAN	Paged,
		IN ULONG	Tag
	)

Definition at line 46 of file registry.c.

{
    UNREFERENCED_PARAMETER(Paged);
    return FrLdrHeapAlloc(Size, Tag);
}

Referenced by RegImportBinaryHive().

CmpFree()

VOID NTAPI CmpFree	(	IN PVOID	Ptr,
		IN ULONG	Quota
	)

Definition at line 57 of file registry.c.

{
    UNREFERENCED_PARAMETER(Quota);
    FrLdrHeapFree(Ptr, 0);
}

Referenced by RegImportBinaryHive().

DBG_DEFAULT_CHANNEL()

DBG_DEFAULT_CHANNEL

(

REGISTRY

)

GetNextPathElement()

static BOOLEAN GetNextPathElement ( _Out_ PUNICODE_STRING  NextElement, _Inout_ PUNICODE_STRING  RemainingPath  )

static

Definition at line 150 of file registry.c.

{
    /* Check if there are any characters left */
    if (RemainingPath->Length < sizeof(WCHAR))
    {
        /* Nothing left, bail out early */
        return FALSE;
    }
 
    /* The next path elements starts with the remaining path */
    NextElement->Buffer = RemainingPath->Buffer;
 
    /* Loop until the path element ends */
    while ((RemainingPath->Length >= sizeof(WCHAR)) &&
           (RemainingPath->Buffer[0] != '\\'))
    {
        /* Skip this character */
        RemainingPath->Buffer++;
        RemainingPath->Length -= sizeof(WCHAR);
    }
 
    NextElement->Length = (USHORT)(RemainingPath->Buffer - NextElement->Buffer) * sizeof(WCHAR);
    NextElement->MaximumLength = NextElement->Length;
 
    /* Check if the path element ended with a path separator */
    if (RemainingPath->Length >= sizeof(WCHAR))
    {
        /* Skip the path separator */
        ASSERT(RemainingPath->Buffer[0] == '\\');
        RemainingPath->Buffer++;
        RemainingPath->Length -= sizeof(WCHAR);
    }
 
    /* Return whether we got any characters */
    return TRUE;
}

Referenced by RegOpenKey().

RegImportBinaryHive()

BOOLEAN RegImportBinaryHive	(	_In_ PVOID	ChunkBase,
		_In_ ULONG	ChunkSize
	)

Definition at line 66 of file registry.c.

{
    NTSTATUS Status;
    PCM_KEY_NODE KeyNode;
 
    TRACE("RegImportBinaryHive(%p, 0x%lx)\n", ChunkBase, ChunkSize);
 
    /* Allocate and initialize the hive */
    CmSystemHive = FrLdrTempAlloc(sizeof(CMHIVE), 'eviH');
    Status = HvInitialize(GET_HHIVE(CmSystemHive),
                          HINIT_FLAT, // HINIT_MEMORY_INPLACE
                          0,
                          0,
                          ChunkBase,
                          CmpAllocate,
                          CmpFree,
                          NULL,
                          NULL,
                          NULL,
                          NULL,
                          1,
                          NULL);
    if (!NT_SUCCESS(Status))
    {
        ERR("Corrupted hive %p!\n", ChunkBase);
        FrLdrTempFree(CmSystemHive, 'eviH');
        return FALSE;
    }
 
    /* Save the root key node */
    SystemHive = GET_HHIVE(CmSystemHive);
    SystemRootCell = SystemHive->BaseBlock->RootCell;
    ASSERT(SystemRootCell != HCELL_NIL);
 
    /* Verify it is accessible */
    KeyNode = (PCM_KEY_NODE)HvGetCell(SystemHive, SystemRootCell);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    HvReleaseCell(SystemHive, SystemRootCell);
 
    return TRUE;
}

Referenced by WinLdrInitSystemHive().

RegInitCurrentControlSet()

BOOLEAN RegInitCurrentControlSet

(

_In_ BOOLEAN

LastKnownGood

)

Definition at line 112 of file registry.c.

{
    UNICODE_STRING ControlSetName;
    HCELL_INDEX ControlCell;
    PCM_KEY_NODE KeyNode;
    BOOLEAN AutoSelect;
 
    TRACE("RegInitCurrentControlSet\n");
 
    /* Choose which control set to open and set it as the new "Current" */
    RtlInitUnicodeString(&ControlSetName,
                         LastKnownGood ? L"LastKnownGood"
                                       : L"Default");
 
    ControlCell = CmpFindControlSet(SystemHive,
                                    SystemRootCell,
                                    &ControlSetName,
                                    &AutoSelect);
    if (ControlCell == HCELL_NIL)
    {
        ERR("CmpFindControlSet('%wZ') failed\n", &ControlSetName);
        return FALSE;
    }
 
    CurrentControlSetKey = HCI_TO_HKEY(ControlCell);
 
    /* Verify it is accessible */
    KeyNode = (PCM_KEY_NODE)HvGetCell(SystemHive, ControlCell);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    HvReleaseCell(SystemHive, ControlCell);
 
    return TRUE;
}

Referenced by WinLdrInitSystemHive().

RegOpenKey()

LONG RegOpenKey	(	_In_ HKEY	ParentKey,
		_In_z_ PCWSTR	KeyName,
		_Out_ PHKEY	Key
	)

Definition at line 263 of file registry.c.

{
    UNICODE_STRING RemainingPath, SubKeyName;
    UNICODE_STRING CurrentControlSet = RTL_CONSTANT_STRING(L"CurrentControlSet");
    PHHIVE Hive = (ParentKey ? GET_HHIVE_FROM_HKEY(ParentKey) : GET_HHIVE(CmSystemHive));
    PCM_KEY_NODE KeyNode;
    HCELL_INDEX CellIndex;
 
    TRACE("RegOpenKey(%p, '%S', %p)\n", ParentKey, KeyName, Key);
 
    /* Initialize the remaining path name */
    RtlInitUnicodeString(&RemainingPath, KeyName);
 
    /* Check if we have a parent key */
    if (ParentKey == NULL)
    {
        UNICODE_STRING SubKeyName1, SubKeyName2, SubKeyName3;
        UNICODE_STRING RegistryPath = RTL_CONSTANT_STRING(L"Registry");
        UNICODE_STRING MachinePath = RTL_CONSTANT_STRING(L"MACHINE");
        UNICODE_STRING SystemPath = RTL_CONSTANT_STRING(L"SYSTEM");
 
        TRACE("RegOpenKey: absolute path\n");
 
        if ((RemainingPath.Length < sizeof(WCHAR)) ||
            RemainingPath.Buffer[0] != '\\')
        {
            /* The key path is not absolute */
            ERR("RegOpenKey: invalid path '%S' (%wZ)\n", KeyName, &RemainingPath);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Skip initial path separator */
        RemainingPath.Buffer++;
        RemainingPath.Length -= sizeof(WCHAR);
 
        /* Get the first 3 path elements */
        GetNextPathElement(&SubKeyName1, &RemainingPath);
        GetNextPathElement(&SubKeyName2, &RemainingPath);
        GetNextPathElement(&SubKeyName3, &RemainingPath);
        TRACE("RegOpenKey: %wZ / %wZ / %wZ\n", &SubKeyName1, &SubKeyName2, &SubKeyName3);
 
        /* Check if we have the correct path */
        if (!RtlEqualUnicodeString(&SubKeyName1, &RegistryPath, TRUE) ||
            !RtlEqualUnicodeString(&SubKeyName2, &MachinePath, TRUE) ||
            !RtlEqualUnicodeString(&SubKeyName3, &SystemPath, TRUE))
        {
            /* The key path is not inside HKLM\Machine\System */
            ERR("RegOpenKey: invalid path '%S' (%wZ)\n", KeyName, &RemainingPath);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Use the root key */
        CellIndex = SystemRootCell;
    }
    else
    {
        /* Use the parent key */
        CellIndex = HKEY_TO_HCI(ParentKey);
    }
 
    /* Check if this is the root key */
    if (CellIndex == SystemRootCell)
    {
        UNICODE_STRING TempPath = RemainingPath;
 
        /* Get the first path element */
        GetNextPathElement(&SubKeyName, &TempPath);
 
        /* Check if this is CurrentControlSet */
        if (RtlEqualUnicodeString(&SubKeyName, &CurrentControlSet, TRUE))
        {
            /* Use the CurrentControlSetKey and update the remaining path */
            CellIndex = HKEY_TO_HCI(CurrentControlSetKey);
            RemainingPath = TempPath;
        }
    }
 
    /* Get the key node */
    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
 
    TRACE("RegOpenKey: RemainingPath '%wZ'\n", &RemainingPath);
 
    /* Loop while there are path elements */
    while (GetNextPathElement(&SubKeyName, &RemainingPath))
    {
        HCELL_INDEX NextCellIndex;
 
        TRACE("RegOpenKey: next element '%wZ'\n", &SubKeyName);
 
        /* Get the next sub key */
        NextCellIndex = CmpFindSubKeyByName(Hive, KeyNode, &SubKeyName);
        HvReleaseCell(Hive, CellIndex);
        CellIndex = NextCellIndex;
        if (CellIndex == HCELL_NIL)
        {
            WARN("Did not find sub key '%wZ' (full: %S)\n", &SubKeyName, KeyName);
            return ERROR_PATH_NOT_FOUND;
        }
 
        /* Get the found key */
        KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
        ASSERT(KeyNode);
        ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
    }
 
    HvReleaseCell(Hive, CellIndex);
    *Key = HCI_TO_HKEY(CellIndex);
 
    return ERROR_SUCCESS;
}

RegQueryValue()

LONG RegQueryValue	(	_In_ HKEY	Key,
		_In_z_ PCWSTR	ValueName,
		_Out_opt_ PULONG	Type,
		_Out_opt_ PUCHAR	Data,
		_Inout_opt_ PULONG	DataSize
	)

Definition at line 418 of file registry.c.

{
    PHHIVE Hive = GET_HHIVE_FROM_HKEY(Key);
    PCM_KEY_NODE KeyNode;
    PCM_KEY_VALUE ValueCell;
    HCELL_INDEX CellIndex;
    UNICODE_STRING ValueNameString;
 
    TRACE("RegQueryValue(%p, '%S', %p, %p, %p)\n",
          Key, ValueName, Type, Data, DataSize);
 
    /* Get the key node */
    KeyNode = GET_CM_KEY_NODE(Hive, Key);
    ASSERT(KeyNode);
    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);
 
    /* Initialize value name string */
    RtlInitUnicodeString(&ValueNameString, ValueName);
    CellIndex = CmpFindValueByName(Hive, KeyNode, &ValueNameString);
    if (CellIndex == HCELL_NIL)
    {
        TRACE("RegQueryValue value not found in key (%.*s)\n",
              KeyNode->NameLength, KeyNode->Name);
        HvReleaseCell(Hive, HKEY_TO_HCI(Key));
        return ERROR_FILE_NOT_FOUND;
    }
    HvReleaseCell(Hive, HKEY_TO_HCI(Key));
 
    /* Get the value cell */
    ValueCell = (PCM_KEY_VALUE)HvGetCell(Hive, CellIndex);
    ASSERT(ValueCell != NULL);
 
    RepGetValueData(Hive, ValueCell, Type, Data, DataSize);
 
    HvReleaseCell(Hive, CellIndex);
 
    return ERROR_SUCCESS;
}

RepGetValueData()

static VOID RepGetValueData ( _In_ PHHIVE  Hive, _In_ PCM_KEY_VALUE  ValueCell, _Out_opt_ PULONG  Type, _Out_opt_ PUCHAR  Data, _Inout_opt_ PULONG  DataSize  )

static

Definition at line 381 of file registry.c.

{
    ULONG DataLength;
    PVOID DataCell;
 
    /* Does the caller want the type? */
    if (Type != NULL)
        *Type = ValueCell->Type;
 
    /* Does the caller provide DataSize? */
    if (DataSize != NULL)
    {
        // NOTE: CmpValueToData doesn't support big data (the function will
        // bugcheck if so), FreeLdr is not supposed to read such data.
        // If big data is needed, use instead CmpGetValueData.
        // CmpGetValueData(Hive, ValueCell, DataSize, &DataCell, ...);
        DataCell = CmpValueToData(Hive, ValueCell, &DataLength);
 
        /* Does the caller want the data? */
        if ((Data != NULL) && (*DataSize != 0))
        {
            RtlCopyMemory(Data,
                          DataCell,
                          min(*DataSize, DataLength));
        }
 
        /* Return the actual data length */
        *DataSize = DataLength;
    }
}

Referenced by RegQueryValue(), and RegQueryValueExW().

Variable Documentation

CmSystemHive

PCMHIVE CmSystemHive

static

Definition at line 29 of file registry.c.

Referenced by RegImportBinaryHive(), and RegOpenKey().

CurrentControlSetKey

HKEY CurrentControlSetKey = NULL

Definition at line 33 of file registry.c.

Referenced by RegInitCurrentControlSet(), RegOpenKey(), WinLdrDetectVersion(), WinLdrInitErrataInf(), WinLdrScanRegistry(), and WinLdrScanSystemHive().

SystemHive

PHHIVE SystemHive = NULL

Definition at line 32 of file registry.c.

Referenced by CmGetSystemControlValues(), CmpFindControlSet(), CmpInitializeSystemHive(), CmpWalkPath(), RegImportBinaryHive(), RegInitCurrentControlSet(), and WinLdrScanRegistry().

SystemRootCell

HCELL_INDEX SystemRootCell

static

Definition at line 30 of file registry.c.

Referenced by RegImportBinaryHive(), RegInitCurrentControlSet(), and RegOpenKey().