ntobjenum.cpp File Reference

#include "precomp.h"
#include <strsafe.h>

Include dependency graph for ntobjenum.cpp:

Go to the source code of this file.

Classes
struct	RootKeyEntry
class	CEnumRegRoot
class	CEnumRegKey
class	CEnumNTDirectory

Macros
#define	MAX_EMBEDDED_DATA   32

Typedefs
typedef NTSTATUS(__stdcall *	pfnNtGenericOpen) (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES)
typedef NTSTATUS(__stdcall *	pfnNtOpenFile) (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, ULONG, ULONG)

Functions
static DWORD	NtOpenObject (OBJECT_TYPE type, PHANDLE phandle, DWORD access, LPCWSTR path)
OBJECT_TYPE	MapTypeNameToType (LPCWSTR TypeName, DWORD cbTypeName)
HRESULT	ReadRegistryValue (HKEY root, PCWSTR path, PCWSTR valueName, PVOID *valueData, PDWORD valueLength)
HRESULT	GetNTObjectSymbolicLinkTarget (LPCWSTR path, LPCWSTR entryName, PUNICODE_STRING LinkTarget)
HRESULT	GetEnumRegistryRoot (IEnumIDList **ppil)
HRESULT	GetEnumRegistryKey (LPCWSTR path, HKEY root, IEnumIDList **ppil)
HRESULT	GetEnumNTDirectory (LPCWSTR path, IEnumIDList **ppil)

Variables
static struct RootKeyEntry	RootKeys []
const LPCWSTR	ObjectTypeNames []
const LPCWSTR	RegistryTypeNames []

Macro Definition Documentation

MAX_EMBEDDED_DATA

#define MAX_EMBEDDED_DATA   32

Typedef Documentation

pfnNtGenericOpen

typedef NTSTATUS(__stdcall * pfnNtGenericOpen) (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES)

Definition at line 22 of file ntobjenum.cpp.

pfnNtOpenFile

typedef NTSTATUS(__stdcall * pfnNtOpenFile) (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, ULONG, ULONG)

Definition at line 23 of file ntobjenum.cpp.

Function Documentation

GetEnumNTDirectory()

HRESULT GetEnumNTDirectory	(	LPCWSTR	path,
		IEnumIDList **	ppil
	)

Definition at line 737 of file ntobjenum.cpp.

{
    return ShellObjectCreatorInit<CEnumNTDirectory>(path, IID_PPV_ARG(IEnumIDList, ppil));
}

Referenced by CNtObjectFolder::EnumObjects().

GetEnumRegistryKey()

HRESULT GetEnumRegistryKey	(	LPCWSTR	path,
		HKEY	root,
		IEnumIDList **	ppil
	)

Definition at line 732 of file ntobjenum.cpp.

{
    return ShellObjectCreatorInit<CEnumRegKey>(path, root, IID_PPV_ARG(IEnumIDList, ppil));
}

Referenced by CRegistryFolder::EnumObjects().

GetEnumRegistryRoot()

HRESULT GetEnumRegistryRoot

(

IEnumIDList **

ppil

)

Definition at line 727 of file ntobjenum.cpp.

{
    return ShellObjectCreator<CEnumRegRoot>(IID_PPV_ARG(IEnumIDList, ppil));
}

Referenced by CRegistryFolder::EnumObjects().

GetNTObjectSymbolicLinkTarget()

HRESULT GetNTObjectSymbolicLinkTarget	(	LPCWSTR	path,
		LPCWSTR	entryName,
		PUNICODE_STRING	LinkTarget
	)

Definition at line 151 of file ntobjenum.cpp.

{
    HANDLE handle;
    WCHAR buffer[MAX_PATH];
    LPWSTR pend = buffer;
 
    StringCbCopyExW(buffer, sizeof(buffer), path, &pend, NULL, 0);
 
    if (pend[-1] != '\\')
    {
        *pend++ = '\\';
        *pend = 0;
    }
 
    StringCbCatW(buffer, sizeof(buffer), entryName);
 
    DbgPrint("GetNTObjectSymbolicLinkTarget %d\n", buffer);
 
    LinkTarget->Length = 0;
 
    DWORD err = NtOpenObject(SYMBOLICLINK_OBJECT, &handle, SYMBOLIC_LINK_QUERY, buffer);
    if (!NT_SUCCESS(err))
        return HRESULT_FROM_NT(err);
 
    err = NtQuerySymbolicLinkObject(handle, LinkTarget, NULL);
    if (!NT_SUCCESS(err))
        return HRESULT_FROM_NT(err);
 
    NtClose(handle);
 
    return S_OK;
}

Referenced by CNtObjectFolder::CompareIDs(), CNtObjectFolder::GetDetailsEx(), CNtObjectFolder::GetDetailsOf(), and CNtObjectFolder::ResolveSymLink().

MapTypeNameToType()

OBJECT_TYPE MapTypeNameToType	(	LPCWSTR	TypeName,
		DWORD	cbTypeName
	)

Definition at line 81 of file ntobjenum.cpp.

{
    if (!TypeName)
        return UNKNOWN_OBJECT_TYPE;
 
    for (UINT i = 0; i < _countof(ObjectTypeNames); i++)
    {
        LPCWSTR typeName = ObjectTypeNames[i];
        if (!StrCmpNW(typeName, TypeName, cbTypeName / sizeof(WCHAR)))
        {
            return (OBJECT_TYPE) i;
        }
    }
 
    return UNKNOWN_OBJECT_TYPE;
}

Referenced by CEnumNTDirectory::EnumerateNext().

NtOpenObject()

static DWORD NtOpenObject ( OBJECT_TYPE  type, PHANDLE  phandle, DWORD  access, LPCWSTR  path  )

static

Definition at line 50 of file ntobjenum.cpp.

{
    UNICODE_STRING ustr;
 
    RtlInitUnicodeString(&ustr, path);
 
    OBJECT_ATTRIBUTES open_struct = { sizeof(OBJECT_ATTRIBUTES), 0x00, &ustr, 0x40 };
 
    if (type != FILE_OBJECT)
        access |= STANDARD_RIGHTS_READ;
 
    IO_STATUS_BLOCK ioStatusBlock;
 
    switch (type)
    {
        case DIRECTORY_OBJECT:      return NtOpenDirectoryObject(phandle, access, &open_struct);
        case SYMBOLICLINK_OBJECT:   return NtOpenSymbolicLinkObject(phandle, access, &open_struct);
        case MUTANT_OBJECT:         return NtOpenMutant(phandle, access, &open_struct);
        case SECTION_OBJECT:        return NtOpenSection(phandle, access, &open_struct);
        case EVENT_OBJECT:          return NtOpenEvent(phandle, access, &open_struct);
        case SEMAPHORE_OBJECT:      return NtOpenSemaphore(phandle, access, &open_struct);
        case TIMER_OBJECT:          return NtOpenTimer(phandle, access, &open_struct);
        case KEY_OBJECT:            return NtOpenKey(phandle, access, &open_struct);
        case EVENTPAIR_OBJECT:      return NtOpenEventPair(phandle, access, &open_struct);
        case IOCOMPLETION_OBJECT:   return NtOpenIoCompletion(phandle, access, &open_struct);
        case FILE_OBJECT:           return NtOpenFile(phandle, access, &open_struct, &ioStatusBlock, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0);
        default:
            return ERROR_INVALID_FUNCTION;
    }
}

Referenced by GetNTObjectSymbolicLinkTarget(), CEnumNTDirectory::Initialize(), CEnumRegKey::Initialize(), NtObjDirectory::read_directory(), and ReadRegistryValue().

ReadRegistryValue()

HRESULT ReadRegistryValue	(	HKEY	root,
		PCWSTR	path,
		PCWSTR	valueName,
		PVOID *	valueData,
		PDWORD	valueLength
	)

Definition at line 98 of file ntobjenum.cpp.

{
    HKEY hkey;
 
    DWORD res;
    if (root)
    {
        res = RegOpenKeyExW(root, *path == '\\' ? path + 1 : path, 0, STANDARD_RIGHTS_READ | KEY_QUERY_VALUE, &hkey);
    }
    else
    {
        res = NtOpenObject(KEY_OBJECT, (PHANDLE) &hkey, STANDARD_RIGHTS_READ | KEY_QUERY_VALUE, path);
    }
    if (!NT_SUCCESS(res))
    {
        ERR("RegOpenKeyExW failed for path %S with status=%x\n", path, res);
        return HRESULT_FROM_NT(res);
    }
 
    res = RegQueryValueExW(hkey, valueName, NULL, NULL, NULL, valueLength);
    if (!NT_SUCCESS(res))
    {
        ERR("RegQueryValueExW failed for path %S with status=%x\n", path, res);
        return HRESULT_FROM_NT(res);
    }
 
    if (*valueLength > 0)
    {
        PBYTE data = (PBYTE) CoTaskMemAlloc(*valueLength);
        *valueData = data;
 
        res = RegQueryValueExW(hkey, valueName, NULL, NULL, data, valueLength);
        if (!NT_SUCCESS(res))
        {
            CoTaskMemFree(data);
            *valueData = NULL;
 
            RegCloseKey(hkey);
 
            ERR("RegOpenKeyExW failed for path %S with status=%x\n", path, res);
            return HRESULT_FROM_NT(res);
        }
    }
    else
    {
        *valueData = NULL;
    }
 
    RegCloseKey(hkey);
 
    return S_OK;
}

Variable Documentation

ObjectTypeNames

const LPCWSTR ObjectTypeNames[]

Initial value:

= {
    L"Directory", L"SymbolicLink",
    L"Mutant", L"Section", L"Event", L"Semaphore",
    L"Timer", L"Key", L"EventPair", L"IoCompletion",
    L"Device", L"File", L"Controller", L"Profile",
    L"Type", L"Desktop", L"WindowStation", L"Driver",
    L"Token", L"Process", L"Thread", L"Adapter", L"Port",
    0
}

Definition at line 25 of file ntobjenum.cpp.

Referenced by CNtObjectFolder::GetDetailsEx(), CNtObjectFolder::GetDetailsOf(), and MapTypeNameToType().

RegistryTypeNames

const LPCWSTR RegistryTypeNames[]

Initial value:

= {
    L"REG_NONE",
    L"REG_SZ",
    L"REG_EXPAND_SZ",
    L"REG_BINARY",
    L"REG_DWORD",
    L"REG_DWORD_BIG_ENDIAN",
    L"REG_LINK",
    L"REG_MULTI_SZ",
    L"REG_RESOURCE_LIST",
    L"REG_FULL_RESOURCE_DESCRIPTOR",
    L"REG_RESOURCE_REQUIREMENTS_LIST",
    L"REG_QWORD"
}

Definition at line 35 of file ntobjenum.cpp.

Referenced by CRegistryFolder::GetDetailsEx(), and CRegistryFolder::GetDetailsOf().

RootKeys

struct RootKeyEntry RootKeys[]

static

Initial value:

= {
    { HKEY_CLASSES_ROOT, L"HKEY_CLASSES_ROOT" },
    { HKEY_CURRENT_USER, L"HKEY_CURRENT_USER" },
    { HKEY_LOCAL_MACHINE, L"HKEY_LOCAL_MACHINE" },
    { HKEY_USERS, L"HKEY_USERS" },
    { HKEY_CURRENT_CONFIG, L"HKEY_CURRENT_CONFIG" }
}

Referenced by CEnumRegRoot::EnumerateNext().