registry.c File Reference

#include "mkhive.h"

Include dependency graph for registry.c:

Go to the source code of this file.

Classes
struct	_REPARSE_POINT
struct	_MEMKEY

Macros
#define	NDEBUG
#define	HKEY_TO_MEMKEY(hKey)   ((PMEMKEY)(hKey))
#define	MEMKEY_TO_HKEY(memKey)   ((HKEY)(memKey))

Typedefs
typedef struct _REPARSE_POINT	REPARSE_POINT
typedef struct _REPARSE_POINT *	PREPARSE_POINT
typedef struct _MEMKEY	MEMKEY
typedef struct _MEMKEY *	PMEMKEY

Functions
	C_ASSERT (_countof(RegistryHives)==MAX_NUMBER_OF_REGISTRY_HIVES)
static PMEMKEY	CreateInMemoryStructure (IN PCMHIVE RegistryHive, IN HCELL_INDEX KeyCellOffset)
static LONG	RegpCreateOrOpenKey (IN HKEY hParentKey, IN PCWSTR KeyName, IN BOOL AllowCreation, IN BOOL Volatile, OUT PHKEY Key)
LONG WINAPI	RegCloseKey (IN HKEY hKey)
LONG WINAPI	RegCreateKeyW (IN HKEY hKey, IN LPCWSTR lpSubKey, OUT PHKEY phkResult)
LONG WINAPI	RegCreateKeyExW (IN HKEY hKey, IN LPCWSTR lpSubKey, IN DWORD Reserved, IN LPWSTR lpClass OPTIONAL, IN DWORD dwOptions, IN REGSAM samDesired, IN LPSECURITY_ATTRIBUTES lpSecurityAttributes OPTIONAL, OUT PHKEY phkResult, OUT LPDWORD lpdwDisposition OPTIONAL)
LONG WINAPI	RegDeleteKeyW (IN HKEY hKey, IN LPCWSTR lpSubKey)
LONG WINAPI	RegOpenKeyW (IN HKEY hKey, IN LPCWSTR lpSubKey, OUT PHKEY phkResult)
LONG WINAPI	RegSetValueExW (IN HKEY hKey, IN LPCWSTR lpValueName OPTIONAL, IN ULONG Reserved, IN ULONG dwType, IN const UCHAR *lpData, IN ULONG cbData)
static VOID	RepGetValueData (IN PHHIVE Hive, IN PCM_KEY_VALUE ValueCell, OUT PULONG Type OPTIONAL, OUT PUCHAR Data OPTIONAL, IN OUT PULONG DataSize OPTIONAL)
LONG WINAPI	RegQueryValueExW (IN HKEY hKey, IN LPCWSTR lpValueName, IN PULONG lpReserved, OUT PULONG lpType OPTIONAL, OUT PUCHAR lpData OPTIONAL, IN OUT PULONG lpcbData OPTIONAL)
LONG WINAPI	RegDeleteValueW (IN HKEY hKey, IN LPCWSTR lpValueName OPTIONAL)
static BOOL	ConnectRegistry (IN HKEY RootKey, IN PCWSTR Path, IN PCMHIVE HiveToConnect, IN PUCHAR SecurityDescriptor, IN ULONG SecurityDescriptorLength)
static BOOL	CreateSymLink (IN PCWSTR LinkKeyPath OPTIONAL, IN OUT PHKEY LinkKeyHandle OPTIONAL, IN HKEY TargetKeyHandle)
VOID	RegInitializeRegistry (IN PCSTR HiveList)
VOID	RegShutdownRegistry (VOID)

Variables
static CMHIVE	RootHive
static PMEMKEY	RootKey
static CMHIVE	SystemHive
static CMHIVE	SoftwareHive
static CMHIVE	DefaultHive
static CMHIVE	SamHive
static CMHIVE	SecurityHive
static CMHIVE	BcdHive
static UCHAR	BcdSecurity []
static UCHAR	SoftwareSecurity []
static UCHAR	SystemSecurity []
HIVE_LIST_ENTRY	RegistryHives []
LIST_ENTRY	CmiHiveListHead
LIST_ENTRY	CmiReparsePointsHead

Macro Definition Documentation

HKEY_TO_MEMKEY

#define HKEY_TO_MEMKEY

(

hKey

)

((PMEMKEY)(hKey))

Definition at line 51 of file registry.c.

MEMKEY_TO_HKEY

#define MEMKEY_TO_HKEY

(

memKey

)

((HKEY)(memKey))

Definition at line 52 of file registry.c.

NDEBUG

#define NDEBUG

Definition at line 30 of file registry.c.

Typedef Documentation

MEMKEY

typedef struct _MEMKEY MEMKEY

PMEMKEY

typedef struct _MEMKEY * PMEMKEY

PREPARSE_POINT

typedef struct _REPARSE_POINT * PREPARSE_POINT

REPARSE_POINT

typedef struct _REPARSE_POINT REPARSE_POINT

Function Documentation

C_ASSERT()

C_ASSERT

(

_countof(RegistryHives)

= =MAX_NUMBER_OF_REGISTRY_HIVES

)

ConnectRegistry()

static BOOL ConnectRegistry ( IN HKEY RootKey  , IN PCWSTR  Path, IN PCMHIVE  HiveToConnect, IN PUCHAR  SecurityDescriptor, IN ULONG  SecurityDescriptorLength  )

static

Definition at line 1011 of file registry.c.

{
    NTSTATUS Status;
    LONG rc;
    PREPARSE_POINT ReparsePoint;
    PMEMKEY NewKey;

    ReparsePoint = (PREPARSE_POINT)malloc(sizeof(*ReparsePoint));
    if (!ReparsePoint)
        return FALSE;

    /*
     * Use a dummy root key name:
     * - On 2k/XP/2k3, this is "$$$PROTO.HIV"
     * - On Vista+, this is "CMI-CreateHive{guid}"
     * See https://github.com/libyal/winreg-kb/blob/master/documentation/Registry%20files.asciidoc
     * for more information.
     */
    Status = CmiInitializeHive(HiveToConnect, L"$$$PROTO.HIV");
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("CmiInitializeHive() failed with status 0x%08x\n", Status);
        free(ReparsePoint);
        return FALSE;
    }

    /*
     * Add security to the root key.
     * NOTE: One can implement this using the lpSecurityAttributes
     * parameter of RegCreateKeyExW.
     */
    Status = CmiCreateSecurityKey(&HiveToConnect->Hive,
                                  HiveToConnect->Hive.BaseBlock->RootCell,
                                  SecurityDescriptor, SecurityDescriptorLength);
    if (!NT_SUCCESS(Status))
        DPRINT1("Failed to add security for root key '%S'\n", Path);

    /* Create the key */
    rc = RegCreateKeyExW(RootKey,
                         Path,
                         0,
                         NULL,
                         REG_OPTION_VOLATILE,
                         0,
                         NULL,
                         (PHKEY)&NewKey,
                         NULL);
    if (rc != ERROR_SUCCESS)
    {
        free(ReparsePoint);
        return FALSE;
    }

    ReparsePoint->SourceHive = NewKey->RegistryHive;
    ReparsePoint->SourceKeyCellOffset = NewKey->KeyCellOffset;
    NewKey->RegistryHive = HiveToConnect;
    NewKey->KeyCellOffset = HiveToConnect->Hive.BaseBlock->RootCell;
    ReparsePoint->DestinationHive = NewKey->RegistryHive;
    ReparsePoint->DestinationKeyCellOffset = NewKey->KeyCellOffset;
    InsertTailList(&CmiReparsePointsHead, &ReparsePoint->ListEntry);

    return TRUE;
}

Referenced by RegInitializeRegistry().

CreateInMemoryStructure()

static PMEMKEY CreateInMemoryStructure ( IN PCMHIVE  RegistryHive, IN HCELL_INDEX  KeyCellOffset  )

static

Definition at line 370 of file registry.c.

{
    PMEMKEY Key;

    Key = (PMEMKEY)malloc(sizeof(MEMKEY));
    if (!Key)
        return NULL;

    Key->RegistryHive = RegistryHive;
    Key->KeyCellOffset = KeyCellOffset;
    return Key;
}

Referenced by RegInitializeRegistry(), and RegpCreateOrOpenKey().

CreateSymLink()

static BOOL CreateSymLink ( IN PCWSTR LinkKeyPath  OPTIONAL, IN OUT PHKEY LinkKeyHandle  OPTIONAL, IN HKEY  TargetKeyHandle  )

static

Definition at line 1081 of file registry.c.

{
    LONG rc;
    PMEMKEY LinkKey, TargetKey;
    PREPARSE_POINT ReparsePoint;

    ReparsePoint = (PREPARSE_POINT)malloc(sizeof(*ReparsePoint));
    if (!ReparsePoint)
        return FALSE;

    if (LinkKeyPath && !(LinkKeyHandle && *LinkKeyHandle))
    {
        /* Create the link key */
        rc = RegCreateKeyExW(NULL,
                             LinkKeyPath,
                             0,
                             NULL,
                             REG_OPTION_VOLATILE,
                             0,
                             NULL,
                             (PHKEY)&LinkKey,
                             NULL);
        if (rc != ERROR_SUCCESS)
        {
            free(ReparsePoint);
            return FALSE;
        }
    }
    else if (LinkKeyHandle)
    {
        /* Use the user-provided link key handle */
        LinkKey = HKEY_TO_MEMKEY(*LinkKeyHandle);
    }

    if (LinkKeyHandle)
        *LinkKeyHandle = MEMKEY_TO_HKEY(LinkKey);

    TargetKey = HKEY_TO_MEMKEY(TargetKeyHandle);

    ReparsePoint->SourceHive = LinkKey->RegistryHive;
    ReparsePoint->SourceKeyCellOffset = LinkKey->KeyCellOffset;
    ReparsePoint->DestinationHive = TargetKey->RegistryHive;
    ReparsePoint->DestinationKeyCellOffset = TargetKey->KeyCellOffset;
    InsertTailList(&CmiReparsePointsHead, &ReparsePoint->ListEntry);

    return TRUE;
}

Referenced by RegInitializeRegistry().

RegCloseKey()

LONG WINAPI RegCloseKey

(

IN HKEY

hKey

)

Definition at line 512 of file registry.c.

{
    PMEMKEY Key = HKEY_TO_MEMKEY(hKey); // ParentKey

    /* Free the object */
    free(Key);

    return ERROR_SUCCESS;
}

Referenced by check_user_privs(), CopyKey(), CreateUserHive(), delete_key(), fetch_machine_component(), fetch_machine_product(), fetch_user_component(), fetch_user_product(), get_key_value(), msi_check_product_patches(), MSI_EnumComponentQualifiers(), msi_get_patch_state(), msi_reg_set_subkey_val(), MsiEnumClientsW(), MsiEnumFeaturesW(), MsiEnumPatchesW(), MsiEnumRelatedProductsW(), MSIREG_DeleteClassesUpgradeCodesKey(), MSIREG_DeleteLocalClassesFeaturesKey(), MSIREG_DeleteLocalClassesProductKey(), MSIREG_DeleteProductKey(), MSIREG_DeleteUninstallKey(), MSIREG_DeleteUpgradeCodesKey(), MSIREG_DeleteUserDataComponentKey(), MSIREG_DeleteUserDataPatchKey(), MSIREG_DeleteUserDataProductKey(), QueryAppSettings(), RegDeleteKeyW(), RegInitializeRegistry(), registry_read_filelist(), registry_read_formatopts(), registry_read_maximized(), registry_read_options(), registry_read_winrect(), registry_set_filelist(), registry_set_formatopts(), registry_set_options(), SaveAppSettings(), test_classesroot(), test_classesroot_enum(), test_classesroot_mask(), test_delete_key_value(), test_deleted_key(), test_enum_value(), test_perflib_key(), test_redirection(), test_reg_close_key(), test_reg_copy_tree(), test_reg_create_key(), test_reg_delete_key(), test_reg_delete_tree(), test_reg_load_key(), test_reg_open_key(), test_reg_query_info(), test_reg_query_value(), test_regconnectregistry(), test_RegNotifyChangeKeyValue(), test_RegOpenCurrentUser(), test_RegQueryValueExPerformanceData(), test_set_value(), test_string_termination(), and test_symlinks().

RegCreateKeyExW()

LONG WINAPI RegCreateKeyExW	(	IN HKEY	hKey,
		IN LPCWSTR	lpSubKey,
		IN DWORD	Reserved,
		IN LPWSTR lpClass	OPTIONAL,
		IN DWORD	dwOptions,
		IN REGSAM	samDesired,
		IN LPSECURITY_ATTRIBUTES lpSecurityAttributes	OPTIONAL,
		OUT PHKEY	phkResult,
		OUT LPDWORD lpdwDisposition	OPTIONAL
	)

Definition at line 533 of file registry.c.

{
    return RegpCreateOrOpenKey(hKey,
                               lpSubKey,
                               TRUE,
                               (dwOptions & REG_OPTION_VOLATILE) != 0,
                               phkResult);
}

Referenced by ConnectRegistry(), CopyKey(), CreateSymLink(), InitAppRegKey(), MSIREG_OpenClassesUpgradeCodesKey(), MSIREG_OpenFeaturesKey(), MSIREG_OpenInstallerFeaturesKey(), MSIREG_OpenInstallProps(), MSIREG_OpenPatchesKey(), MSIREG_OpenProductKey(), MSIREG_OpenUninstallKey(), MSIREG_OpenUpgradeCodesKey(), MSIREG_OpenUserDataComponentKey(), MSIREG_OpenUserDataFeaturesKey(), MSIREG_OpenUserDataPatchKey(), MSIREG_OpenUserDataProductKey(), MSIREG_OpenUserDataProductPatchesKey(), and registry_get_handle().

RegCreateKeyW()

LONG WINAPI RegCreateKeyW	(	IN HKEY	hKey,
		IN LPCWSTR	lpSubKey,
		OUT PHKEY	phkResult
	)

Definition at line 524 of file registry.c.

{
    return RegpCreateOrOpenKey(hKey, lpSubKey, TRUE, FALSE, phkResult);
}

Referenced by msi_reg_set_subkey_val(), MSIREG_OpenUserComponentsKey(), MSIREG_OpenUserPatchesKey(), MSIREG_OpenUserUpgradeCodesKey(), and RegInitializeRegistry().

RegDeleteKeyW()

LONG WINAPI RegDeleteKeyW	(	IN HKEY	hKey,
		IN LPCWSTR	lpSubKey
	)

Definition at line 552 of file registry.c.

{
    LONG rc;
    NTSTATUS Status;
    HKEY hTargetKey;
    PMEMKEY Key; // ParentKey
    PHHIVE Hive;
    PCM_KEY_NODE KeyNode; // ParentNode
    PCM_KEY_NODE Parent;
    HCELL_INDEX ParentCell;

    if (lpSubKey)
    {
        rc = RegOpenKeyW(hKey, lpSubKey, &hTargetKey);
        if (rc != ERROR_SUCCESS)
            return rc;
    }
    else
    {
        hTargetKey = hKey;
        rc = ERROR_SUCCESS;
    }

    /* Don't allow deleting the root */
    if (hTargetKey == RootKey)
    {
        /* Fail */
        rc = ERROR_ACCESS_DENIED; // STATUS_CANNOT_DELETE;
        goto Quit;
    }

    /* Get the hive and node */
    Key = HKEY_TO_MEMKEY(hTargetKey);
    Hive = &Key->RegistryHive->Hive;

    /* Get the key node */
    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, Key->KeyCellOffset);
    if (!KeyNode)
    {
        rc = ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;
        goto Quit;
    }

    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);

    /* Check if we don't have any children */
    if (!(KeyNode->SubKeyCounts[Stable] + KeyNode->SubKeyCounts[Volatile]) &&
        !(KeyNode->Flags & KEY_NO_DELETE))
    {
        /* Get the parent and free the cell */
        ParentCell = KeyNode->Parent;
        Status = CmpFreeKeyByCell(Hive, Key->KeyCellOffset, TRUE);
        if (NT_SUCCESS(Status))
        {
            /* Get the parent node */
            Parent = (PCM_KEY_NODE)HvGetCell(Hive, ParentCell);
            if (Parent)
            {
                /* Make sure we're dirty */
                ASSERT(HvIsCellDirty(Hive, ParentCell));

                /* Update the write time */
                KeQuerySystemTime(&Parent->LastWriteTime);

                /* Release the cell */
                HvReleaseCell(Hive, ParentCell);
            }

            rc = ERROR_SUCCESS;
        }
        else
        {
            /* Fail */
            rc = ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;
        }
    }
    else
    {
        /* Fail */
        rc = ERROR_ACCESS_DENIED; // STATUS_CANNOT_DELETE;
    }

    /* Release the cell */
    HvReleaseCell(Hive, Key->KeyCellOffset);

Quit:
    if (lpSubKey)
        RegCloseKey(hTargetKey);

    return rc;
}

Referenced by do_reg_operation().

RegDeleteValueW()

LONG WINAPI RegDeleteValueW	(	IN HKEY	hKey,
		IN LPCWSTR lpValueName	OPTIONAL
	)

Definition at line 901 of file registry.c.

{
    LONG rc;
    NTSTATUS Status;
    PMEMKEY Key = HKEY_TO_MEMKEY(hKey); // ParentKey
    PHHIVE Hive = &Key->RegistryHive->Hive;
    PCM_KEY_NODE KeyNode; // ParentNode
    PCM_KEY_VALUE ValueCell;
    HCELL_INDEX CellIndex;
    ULONG ChildIndex;
    UNICODE_STRING ValueNameString;

    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, Key->KeyCellOffset);
    if (!KeyNode)
        return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);

    /* Initialize value name string */
    RtlInitUnicodeString(&ValueNameString, lpValueName);
    if (!CmpFindNameInList(Hive,
                           &KeyNode->ValueList,
                           &ValueNameString,
                           &ChildIndex,
                           &CellIndex))
    {
        /* Sanity check */
        ASSERT(CellIndex == HCELL_NIL);
    }
    if (CellIndex == HCELL_NIL)
    {
        rc = ERROR_FILE_NOT_FOUND; // STATUS_OBJECT_NAME_NOT_FOUND;
        goto Quit;
    }

    /* We found the value, mark all relevant cells dirty */
    HvMarkCellDirty(Hive, Key->KeyCellOffset, FALSE);
    HvMarkCellDirty(Hive, KeyNode->ValueList.List, FALSE);
    HvMarkCellDirty(Hive, CellIndex, FALSE);

    /* Get the key value */
    ValueCell = (PCM_KEY_VALUE)HvGetCell(Hive, CellIndex);
    ASSERT(ValueCell);

    /* Mark it and all related data as dirty */
    if (!CmpMarkValueDataDirty(Hive, ValueCell))
    {
        /* Not enough log space, fail */
        rc = ERROR_NO_LOG_SPACE; // STATUS_NO_LOG_SPACE;
        goto Quit;
    }

    /* Sanity checks */
    ASSERT(HvIsCellDirty(Hive, KeyNode->ValueList.List));
    ASSERT(HvIsCellDirty(Hive, CellIndex));

    /* Remove the value from the child list */
    Status = CmpRemoveValueFromList(Hive, ChildIndex, &KeyNode->ValueList);
    if (!NT_SUCCESS(Status))
    {
        /* Set known error */
        rc = ERROR_NO_SYSTEM_RESOURCES; // STATUS_INSUFFICIENT_RESOURCES;
        goto Quit;
    }

    /* Remove the value and its data itself */
    if (!CmpFreeValue(Hive, CellIndex))
    {
        /* Failed to free the value, fail */
        rc = ERROR_NO_SYSTEM_RESOURCES; // STATUS_INSUFFICIENT_RESOURCES;
        goto Quit;
    }

    /* Set the last write time */
    KeQuerySystemTime(&KeyNode->LastWriteTime);

    /* Sanity check */
    ASSERT(HvIsCellDirty(Hive, Key->KeyCellOffset));

    /* Check if the value list is empty now */
    if (!KeyNode->ValueList.Count)
    {
        /* Then clear key node data */
        KeyNode->MaxValueNameLen = 0;
        KeyNode->MaxValueDataLen = 0;
    }

    /* Change default Status to success */
    rc = ERROR_SUCCESS;

Quit:
    /* Check if we had a value */
    if (ValueCell)
    {
        /* Release the child cell */
        ASSERT(CellIndex != HCELL_NIL);
        HvReleaseCell(Hive, CellIndex);
    }

    /* Release the parent cell, if any */
    if (KeyNode)
        HvReleaseCell(Hive, Key->KeyCellOffset);

    return rc;
}

Referenced by do_reg_operation().

RegInitializeRegistry()

VOID RegInitializeRegistry

(

IN PCSTR

HiveList

)

Definition at line 1134 of file registry.c.

{
    NTSTATUS Status;
    UINT i;
    HKEY ControlSetKey;

    InitializeListHead(&CmiHiveListHead);
    InitializeListHead(&CmiReparsePointsHead);

    Status = CmiInitializeHive(&RootHive, L"");
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("CmiInitializeHive() failed with status 0x%08x\n", Status);
        return;
    }

    RootKey = CreateInMemoryStructure(&RootHive,
                                      RootHive.Hive.BaseBlock->RootCell);

    for (i = 0; i < _countof(RegistryHives); ++i)
    {
        /* Skip this registry hive if it's not in the list */
        if (!strstr(HiveList, RegistryHives[i].HiveName))
            continue;

        /* Create the registry key */
        ConnectRegistry(NULL,
                        RegistryHives[i].HiveRegistryPath,
                        RegistryHives[i].CmHive,
                        RegistryHives[i].SecurityDescriptor,
                        RegistryHives[i].SecurityDescriptorLength);

        /* If we happen to deal with the special setup registry hive, stop there */
        // if (strcmp(RegistryHives[i].HiveName, "SETUPREG") == 0)
        if (i == 0)
            break;
    }

    /* Create the 'ControlSet001' key */
    RegCreateKeyW(NULL,
                  L"Registry\\Machine\\SYSTEM\\ControlSet001",
                  &ControlSetKey);

    /* Create the 'CurrentControlSet' key as a symlink to 'ControlSet001' */
    CreateSymLink(L"Registry\\Machine\\SYSTEM\\CurrentControlSet",
                  NULL, ControlSetKey);

    RegCloseKey(ControlSetKey);

#if 0
    /* Link SECURITY to SAM */
    CmpLinkKeyToHive(L"\\Registry\\Machine\\Security\\SAM", L"\\Registry\\Machine\\SAM\\SAM");
    /* Link S-1-5-18 to .Default */
    CmpLinkKeyToHive(L"\\Registry\\User\\S-1-5-18", L"\\Registry\\User\\.Default");
#endif
}

RegOpenKeyW()

LONG WINAPI RegOpenKeyW	(	IN HKEY	hKey,
		IN LPCWSTR	lpSubKey,
		OUT PHKEY	phkResult
	)

Definition at line 647 of file registry.c.

{
    return RegpCreateOrOpenKey(hKey, lpSubKey, FALSE, FALSE, phkResult);
}

Referenced by MSIREG_OpenUserComponentsKey(), MSIREG_OpenUserPatchesKey(), MSIREG_OpenUserUpgradeCodesKey(), and RegDeleteKeyW().

RegpCreateOrOpenKey()

static LONG RegpCreateOrOpenKey ( IN HKEY  hParentKey, IN PCWSTR  KeyName, IN BOOL  AllowCreation, IN BOOL  Volatile, OUT PHKEY  Key  )

static

Definition at line 389 of file registry.c.

{
    NTSTATUS Status;
    PWSTR LocalKeyName;
    PWSTR End;
    UNICODE_STRING KeyString;
    PREPARSE_POINT CurrentReparsePoint;
    PMEMKEY CurrentKey;
    PCMHIVE ParentRegistryHive;
    HCELL_INDEX ParentCellOffset;
    PCM_KEY_NODE ParentKeyCell;
    PLIST_ENTRY Ptr;
    HCELL_INDEX BlockOffset;

    DPRINT("RegpCreateOrOpenKey('%S')\n", KeyName);

    if (*KeyName == OBJ_NAME_PATH_SEPARATOR)
    {
        KeyName++;
        ParentRegistryHive = RootKey->RegistryHive;
        ParentCellOffset = RootKey->KeyCellOffset;
    }
    else if (hParentKey == NULL)
    {
        ParentRegistryHive = RootKey->RegistryHive;
        ParentCellOffset = RootKey->KeyCellOffset;
    }
    else
    {
        ParentRegistryHive = HKEY_TO_MEMKEY(hParentKey)->RegistryHive;
        ParentCellOffset = HKEY_TO_MEMKEY(hParentKey)->KeyCellOffset;
    }

    LocalKeyName = (PWSTR)KeyName;
    for (;;)
    {
        End = (PWSTR)strchrW(LocalKeyName, OBJ_NAME_PATH_SEPARATOR);
        if (End)
        {
            KeyString.Buffer = LocalKeyName;
            KeyString.Length = KeyString.MaximumLength =
                (USHORT)((ULONG_PTR)End - (ULONG_PTR)LocalKeyName);
        }
        else
        {
            RtlInitUnicodeString(&KeyString, LocalKeyName);
            if (KeyString.Length == 0)
            {
                /* Trailing path separator: we're done */
                break;
            }
        }

        ParentKeyCell = (PCM_KEY_NODE)HvGetCell(&ParentRegistryHive->Hive, ParentCellOffset);
        if (!ParentKeyCell)
            return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

        VERIFY_KEY_CELL(ParentKeyCell);

        BlockOffset = CmpFindSubKeyByName(&ParentRegistryHive->Hive, ParentKeyCell, &KeyString);
        if (BlockOffset != HCELL_NIL)
        {
            Status = STATUS_SUCCESS;

            /* Search for a possible reparse point */
            Ptr = CmiReparsePointsHead.Flink;
            while (Ptr != &CmiReparsePointsHead)
            {
                CurrentReparsePoint = CONTAINING_RECORD(Ptr, REPARSE_POINT, ListEntry);
                if (CurrentReparsePoint->SourceHive == ParentRegistryHive &&
                    CurrentReparsePoint->SourceKeyCellOffset == BlockOffset)
                {
                    ParentRegistryHive = CurrentReparsePoint->DestinationHive;
                    BlockOffset = CurrentReparsePoint->DestinationKeyCellOffset;
                    break;
                }
                Ptr = Ptr->Flink;
            }
        }
        else if (AllowCreation) // && (BlockOffset == HCELL_NIL)
        {
            Status = CmiAddSubKey(ParentRegistryHive,
                                  ParentCellOffset,
                                  &KeyString,
                                  Volatile,
                                  &BlockOffset);
        }
        else // if (BlockOffset == HCELL_NIL)
        {
            Status = STATUS_OBJECT_NAME_NOT_FOUND;
        }

        HvReleaseCell(&ParentRegistryHive->Hive, ParentCellOffset);

        if (!NT_SUCCESS(Status))
        {
            DPRINT("RegpCreateOrOpenKey('%S'): Could not create or open subkey '%.*S', Status 0x%08x\n",
                   KeyName, (int)(KeyString.Length / sizeof(WCHAR)), KeyString.Buffer, Status);
            return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;
        }

        ParentCellOffset = BlockOffset;
        if (End)
            LocalKeyName = End + 1;
        else
            break;
    }

    CurrentKey = CreateInMemoryStructure(ParentRegistryHive, ParentCellOffset);
    if (!CurrentKey)
        return ERROR_NOT_ENOUGH_MEMORY; // STATUS_NO_MEMORY;

    *Key = MEMKEY_TO_HKEY(CurrentKey);

    return ERROR_SUCCESS;
}

Referenced by RegCreateKeyExW(), RegCreateKeyW(), and RegOpenKeyW().

RegQueryValueExW()

LONG WINAPI RegQueryValueExW	(	IN HKEY	hKey,
		IN LPCWSTR	lpValueName,
		IN PULONG	lpReserved,
		OUT PULONG lpType	OPTIONAL,
		OUT PUCHAR lpData	OPTIONAL,
		IN OUT PULONG lpcbData	OPTIONAL
	)

Definition at line 862 of file registry.c.

{
    PMEMKEY ParentKey = HKEY_TO_MEMKEY(hKey);
    PHHIVE Hive = &ParentKey->RegistryHive->Hive;
    PCM_KEY_NODE KeyNode;
    PCM_KEY_VALUE ValueCell;
    HCELL_INDEX CellIndex;
    UNICODE_STRING ValueNameString;

    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, ParentKey->KeyCellOffset);
    if (!KeyNode)
        return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);

    /* Initialize value name string */
    RtlInitUnicodeString(&ValueNameString, lpValueName);
    CellIndex = CmpFindValueByName(Hive, KeyNode, &ValueNameString);
    if (CellIndex == HCELL_NIL)
        return ERROR_FILE_NOT_FOUND; // STATUS_OBJECT_NAME_NOT_FOUND;

    /* Get the value cell */
    ValueCell = (PCM_KEY_VALUE)HvGetCell(Hive, CellIndex);
    ASSERT(ValueCell != NULL);

    RepGetValueData(Hive, ValueCell, lpType, lpData, lpcbData);

    HvReleaseCell(Hive, CellIndex);

    return ERROR_SUCCESS;
}

Referenced by _test_hkey_main_Value_W(), do_reg_operation(), msi_reg_get_val_dword(), msi_reg_get_val_str(), QueryAppSettings(), QueryRegistryValue(), registry_read_filelist(), registry_read_formatopts(), registry_read_maximized(), registry_read_winrect(), RegQueryDword(), RegQueryValueWithAlloc(), test_RegQueryValueExPerformanceData(), and test_set_value().

RegSetValueExW()

LONG WINAPI RegSetValueExW	(	IN HKEY	hKey,
		IN LPCWSTR lpValueName	OPTIONAL,
		IN ULONG	Reserved,
		IN ULONG	dwType,
		IN const UCHAR *	lpData,
		IN ULONG	cbData
	)

Definition at line 656 of file registry.c.

{
    PMEMKEY Key = HKEY_TO_MEMKEY(hKey); // ParentKey
    PHHIVE Hive;
    PCM_KEY_NODE KeyNode; // ParentNode
    PCM_KEY_VALUE ValueCell;
    ULONG ChildIndex;
    HCELL_INDEX CellIndex;
    UNICODE_STRING ValueNameString;

    PVOID DataCell;
    ULONG DataCellSize;
    NTSTATUS Status;

    if (dwType == REG_LINK)
    {
        PMEMKEY DestKey;

        /* Special handling of registry links */
        if (cbData != sizeof(PVOID))
            return ERROR_INVALID_PARAMETER; // STATUS_INVALID_PARAMETER;

        DestKey = HKEY_TO_MEMKEY(*(PHKEY)lpData);

        // FIXME: Add additional checks for the validity of DestKey

        /* Create the link in registry hive (if applicable) */
        if (Key->RegistryHive != DestKey->RegistryHive)
            return ERROR_SUCCESS;

        DPRINT1("Save link to registry\n");
        return ERROR_INVALID_FUNCTION; // STATUS_NOT_IMPLEMENTED;
    }

    if ((cbData & ~CM_KEY_VALUE_SPECIAL_SIZE) != cbData)
        return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

    Hive = &Key->RegistryHive->Hive;

    KeyNode = (PCM_KEY_NODE)HvGetCell(Hive, Key->KeyCellOffset);
    if (!KeyNode)
        return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

    ASSERT(KeyNode->Signature == CM_KEY_NODE_SIGNATURE);

    /* Mark the parent as dirty since we are going to create a new value in it */
    HvMarkCellDirty(Hive, Key->KeyCellOffset, FALSE);

    /* Initialize value name string */
    RtlInitUnicodeString(&ValueNameString, lpValueName);
    if (!CmpFindNameInList(Hive,
                           &KeyNode->ValueList,
                           &ValueNameString,
                           &ChildIndex,
                           &CellIndex))
    {
        /* Sanity check */
        ASSERT(CellIndex == HCELL_NIL);
        /* Fail */
        Status = STATUS_INSUFFICIENT_RESOURCES;
    }
    if (CellIndex == HCELL_NIL)
    {
        /* The value doesn't exist, create a new one */
        Status = CmiAddValueKey(Key->RegistryHive,
                                KeyNode,
                                ChildIndex,
                                &ValueNameString,
                                &ValueCell,
                                &CellIndex);
    }
    else
    {
        /* The value already exists, use it. Get the value cell. */
        ValueCell = (PCM_KEY_VALUE)HvGetCell(&Key->RegistryHive->Hive, CellIndex);
        ASSERT(ValueCell != NULL);
        Status = STATUS_SUCCESS;
    }

    // /**/HvReleaseCell(Hive, CellIndex);/**/

    if (!NT_SUCCESS(Status))
        return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

    /* Get size of the allocated cell (if any) */
    if (!(ValueCell->DataLength & CM_KEY_VALUE_SPECIAL_SIZE) &&
         (ValueCell->DataLength & ~CM_KEY_VALUE_SPECIAL_SIZE) != 0)
    {
        DataCell = HvGetCell(Hive, ValueCell->Data);
        if (!DataCell)
            return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;

        DataCellSize = (ULONG)(-HvGetCellSize(Hive, DataCell));
    }
    else
    {
        DataCell = NULL;
        DataCellSize = 0;
    }

    if (cbData <= sizeof(HCELL_INDEX))
    {
        /* If data size <= sizeof(HCELL_INDEX) then store data in the data offset */
        DPRINT("ValueCell->DataLength %u\n", ValueCell->DataLength);
        if (DataCell)
            HvFreeCell(Hive, ValueCell->Data);

        RtlCopyMemory(&ValueCell->Data, lpData, cbData);
        ValueCell->DataLength = (cbData | CM_KEY_VALUE_SPECIAL_SIZE);
        ValueCell->Type = dwType;
    }
    else
    {
        if (cbData > DataCellSize)
        {
            /* New data size is larger than the current, destroy current
             * data block and allocate a new one. */
            HCELL_INDEX NewOffset;

            DPRINT("ValueCell->DataLength %u\n", ValueCell->DataLength);

            NewOffset = HvAllocateCell(Hive, cbData, Stable, HCELL_NIL);
            if (NewOffset == HCELL_NIL)
            {
                DPRINT("HvAllocateCell() has failed!\n");
                return ERROR_GEN_FAILURE; // STATUS_UNSUCCESSFUL;
            }

            if (DataCell)
                HvFreeCell(Hive, ValueCell->Data);

            ValueCell->Data = NewOffset;
            DataCell = (PVOID)HvGetCell(Hive, NewOffset);
        }

        /* Copy new contents to cell */
        RtlCopyMemory(DataCell, lpData, cbData);
        ValueCell->DataLength = (cbData & ~CM_KEY_VALUE_SPECIAL_SIZE);
        ValueCell->Type = dwType;
        HvMarkCellDirty(Hive, ValueCell->Data, FALSE);
    }

    HvMarkCellDirty(Hive, CellIndex, FALSE);

    /* Check if the maximum value name length changed, update it if so */
    if (KeyNode->MaxValueNameLen < ValueNameString.Length)
        KeyNode->MaxValueNameLen = ValueNameString.Length;

    /* Check if the maximum data length changed, update it if so */
    if (KeyNode->MaxValueDataLen < cbData)
        KeyNode->MaxValueDataLen = cbData;

    /* Save the write time */
    KeQuerySystemTime(&KeyNode->LastWriteTime);

    return ERROR_SUCCESS;
}

Referenced by CopyKey(), msi_reg_set_val_dword(), msi_reg_set_val_multi_str(), msi_reg_set_val_str(), registry_set_filelist(), registry_set_formatopts(), registry_set_options(), SaveAppSettings(), test_enum_value(), and test_set_value().

RegShutdownRegistry()

VOID RegShutdownRegistry

(

VOID

)

Definition at line 1193 of file registry.c.

{
    PLIST_ENTRY Entry;
    PREPARSE_POINT ReparsePoint;

    /* Clean up the reparse points list */
    while (!IsListEmpty(&CmiReparsePointsHead))
    {
        Entry = RemoveHeadList(&CmiReparsePointsHead);
        ReparsePoint = CONTAINING_RECORD(Entry, REPARSE_POINT, ListEntry);
        free(ReparsePoint);
    }

    /* FIXME: clean up the complete hive */

    free(RootKey);
}

Referenced by main().

RepGetValueData()

static VOID RepGetValueData ( IN PHHIVE  Hive, IN PCM_KEY_VALUE  ValueCell, OUT PULONG Type  OPTIONAL, OUT PUCHAR Data  OPTIONAL, IN OUT PULONG DataSize  OPTIONAL  )

static

Definition at line 824 of file registry.c.

{
    ULONG DataLength;
    PVOID DataCell;

    /* Does the caller want the type? */
    if (Type != NULL)
        *Type = ValueCell->Type;

    /* Does the caller provide DataSize? */
    if (DataSize != NULL)
    {
        // NOTE: CmpValueToData doesn't support big data (the function will
        // bugcheck if so), FreeLdr is not supposed to read such data.
        // If big data is needed, use instead CmpGetValueData.
        // CmpGetValueData(Hive, ValueCell, DataSize, &DataCell, ...);
        DataCell = CmpValueToData(Hive, ValueCell, &DataLength);

        /* Does the caller want the data? */
        if ((Data != NULL) && (*DataSize != 0))
        {
            RtlCopyMemory(Data,
                          DataCell,
                          min(*DataSize, DataLength));
        }

        /* Return the actual data length */
        *DataSize = DataLength;
    }
}

Referenced by RegQueryValueExW().

Variable Documentation

BcdHive

CMHIVE BcdHive

static

Definition at line 62 of file registry.c.

Referenced by BiLoadHive().

BcdSecurity

UCHAR BcdSecurity[]

static

Definition at line 75 of file registry.c.

CmiHiveListHead

LIST_ENTRY CmiHiveListHead

Definition at line 385 of file registry.c.

Referenced by CmiInitializeHive(), and RegInitializeRegistry().

CmiReparsePointsHead

LIST_ENTRY CmiReparsePointsHead

Definition at line 386 of file registry.c.

Referenced by ConnectRegistry(), CreateSymLink(), RegInitializeRegistry(), RegpCreateOrOpenKey(), and RegShutdownRegistry().

DefaultHive

CMHIVE DefaultHive

static

Definition at line 59 of file registry.c.

RegistryHives

HIVE_LIST_ENTRY RegistryHives[]

Initial value:

=
{
    
    
    { "SETUPREG", L"Registry\\Machine\\SYSTEM"     , &SystemHive  , SystemSecurity  , sizeof(SystemSecurity)   },

    
    { "SYSTEM"  , L"Registry\\Machine\\SYSTEM"     , &SystemHive  , SystemSecurity  , sizeof(SystemSecurity)   },
    { "SOFTWARE", L"Registry\\Machine\\SOFTWARE"   , &SoftwareHive, SoftwareSecurity, sizeof(SoftwareSecurity) },
    { "DEFAULT" , L"Registry\\User\\.DEFAULT"      , &DefaultHive , SystemSecurity  , sizeof(SystemSecurity)   },
    { "SAM"     , L"Registry\\Machine\\SAM"        , &SamHive     , SystemSecurity  , sizeof(SystemSecurity)   },
    { "SECURITY", L"Registry\\Machine\\SECURITY"   , &SecurityHive, NULL            , 0                        },
    { "BCD"     , L"Registry\\Machine\\BCD00000000", &BcdHive     , BcdSecurity     , sizeof(BcdSecurity)      },
}

Definition at line 351 of file registry.c.

RootHive

CMHIVE RootHive

static

Definition at line 54 of file registry.c.

Referenced by RegInitializeRegistry().

RootKey

PMEMKEY RootKey

static

Definition at line 55 of file registry.c.

Referenced by BaseSrvIsVdmAllowed(), CmpCreateRegistryRoot(), ConnectRegistry(), CreateRegKey(), CreateSymLinkKey(), DeleteSubKey(), DeleteSymLinkKey(), DisconnectRegistry(), HalpOpenRegistryKey(), IopQueryBusDescription(), IopQueryDeviceDescription(), LdrOpenImageFileOptionsKey(), PciOpenKey(), RegDeleteKeyW(), RegInitializeRegistry(), RegpCreateOrOpenKey(), RegShutdownRegistry(), SETUPDI_CreateDevKey(), SETUPDI_CreateDrvKey(), SETUPDI_OpenDevKey(), SETUPDI_OpenDrvKey(), SetupDiCreateDevRegKeyW(), SetupDiDeleteDevRegKey(), SetupDiOpenDevRegKey(), SpiCreatePortConfig(), and WsProcInitialize().

SamHive

CMHIVE SamHive

static

Definition at line 60 of file registry.c.

SecurityHive

CMHIVE SecurityHive

static

Definition at line 61 of file registry.c.

SoftwareHive

CMHIVE SoftwareHive

static

Definition at line 58 of file registry.c.

SoftwareSecurity

UCHAR SoftwareSecurity[]

static

Definition at line 137 of file registry.c.

SystemHive

CMHIVE SystemHive

static

Definition at line 57 of file registry.c.

SystemSecurity

UCHAR SystemSecurity[]

static

Definition at line 253 of file registry.c.