registry.c File Reference

#include "lsasrv.h"

Include dependency graph for registry.c:

Go to the source code of this file.

Functions
static BOOLEAN	IsStringType (ULONG Type)
NTSTATUS	LsapRegCloseKey (IN HANDLE KeyHandle)
NTSTATUS	LsapRegCreateKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName, IN ACCESS_MASK DesiredAccess, OUT HANDLE KeyHandle)
NTSTATUS	LsapRegDeleteSubKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName)
NTSTATUS	LsapRegDeleteKey (IN HANDLE KeyHandle)
NTSTATUS	LsapRegEnumerateSubKey (IN HANDLE KeyHandle, IN ULONG Index, IN ULONG Length, OUT LPWSTR Buffer)
NTSTATUS	LsapRegOpenKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName, IN ACCESS_MASK DesiredAccess, OUT HANDLE KeyHandle)
NTSTATUS	LsapRegQueryKeyInfo (IN HANDLE KeyHandle, OUT PULONG SubKeyCount, OUT PULONG MaxSubKeyNameLength, OUT PULONG ValueCount)
NTSTATUS	LsapRegDeleteValue (IN HANDLE KeyHandle, IN LPWSTR ValueName)
NTSTATUS	LsapRegEnumerateValue (IN HANDLE KeyHandle, IN ULONG Index, OUT LPWSTR Name, IN OUT PULONG NameLength, OUT PULONG Type OPTIONAL, OUT PVOID Data OPTIONAL, IN OUT PULONG DataLength OPTIONAL)
NTSTATUS	LsapRegQueryValue (IN HANDLE KeyHandle, IN LPWSTR ValueName, OUT PULONG Type OPTIONAL, OUT PVOID Data OPTIONAL, IN OUT PULONG DataLength OPTIONAL)
NTSTATUS	LsapRegSetValue (HANDLE KeyHandle, LPWSTR ValueName, ULONG Type, LPVOID Data, ULONG DataLength)

Function Documentation

IsStringType()

static BOOLEAN IsStringType ( ULONG  Type )

static

Definition at line 16 of file registry.c.

{
    return (Type == REG_SZ) || (Type == REG_EXPAND_SZ) || (Type == REG_MULTI_SZ);
}

Referenced by LsapRegEnumerateValue(), and LsapRegQueryValue().

LsapRegCloseKey()

NTSTATUS LsapRegCloseKey

(

IN HANDLE

KeyHandle

)

Definition at line 23 of file registry.c.

{
    return NtClose(KeyHandle);
}

Referenced by LsarEnumerateAccounts(), and LsarEnumerateAccountsWithUserRight().

LsapRegCreateKey()

NTSTATUS LsapRegCreateKey	(	IN HANDLE	ParentKeyHandle,
		IN LPCWSTR	KeyName,
		IN ACCESS_MASK	DesiredAccess,
		OUT HANDLE	KeyHandle
	)

Definition at line 30 of file registry.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING Name;
    ULONG Disposition;

    RtlInitUnicodeString(&Name, KeyName);

    InitializeObjectAttributes(&ObjectAttributes,
                               &Name,
                               OBJ_CASE_INSENSITIVE | OBJ_OPENIF,
                               ParentKeyHandle,
                               NULL);

    /* Create the key */
    return ZwCreateKey(KeyHandle,
                       DesiredAccess,
                       &ObjectAttributes,
                       0,
                       NULL,
                       0,
                       &Disposition);
}

LsapRegDeleteKey()

NTSTATUS LsapRegDeleteKey

(

IN HANDLE

KeyHandle

)

Definition at line 89 of file registry.c.

{
    return NtDeleteKey(KeyHandle);
}

Referenced by LsapDeleteDbObject().

LsapRegDeleteSubKey()

NTSTATUS LsapRegDeleteSubKey	(	IN HANDLE	ParentKeyHandle,
		IN LPCWSTR	KeyName
	)

Definition at line 59 of file registry.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING SubKeyName;
    HANDLE TargetKey;
    NTSTATUS Status;

    RtlInitUnicodeString(&SubKeyName,
                         (LPWSTR)KeyName);
    InitializeObjectAttributes(&ObjectAttributes,
                               &SubKeyName,
                               OBJ_CASE_INSENSITIVE,
                               ParentKeyHandle,
                               NULL);
    Status = NtOpenKey(&TargetKey,
                       DELETE,
                       &ObjectAttributes);
    if (!NT_SUCCESS(Status))
        return Status;

    Status = NtDeleteKey(TargetKey);

    NtClose(TargetKey);

    return Status;
}

Referenced by LsapDeleteDbObject(), and LsapDeleteObjectAttribute().

LsapRegDeleteValue()

NTSTATUS LsapRegDeleteValue	(	IN HANDLE	KeyHandle,
		IN LPWSTR	ValueName
	)

Definition at line 211 of file registry.c.

{
    UNICODE_STRING Name;

    RtlInitUnicodeString(&Name,
                         ValueName);

    return NtDeleteValueKey(KeyHandle,
                            &Name);
}

LsapRegEnumerateSubKey()

NTSTATUS LsapRegEnumerateSubKey	(	IN HANDLE	KeyHandle,
		IN ULONG	Index,
		IN ULONG	Length,
		OUT LPWSTR	Buffer
	)

Definition at line 96 of file registry.c.

{
    PKEY_BASIC_INFORMATION KeyInfo = NULL;
    ULONG BufferLength = 0;
    ULONG ReturnedLength;
    NTSTATUS Status;

    /* Check if we have a name */
    if (Length)
    {
        /* Allocate a buffer for it */
        BufferLength = sizeof(KEY_BASIC_INFORMATION) + Length * sizeof(WCHAR);

        KeyInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, BufferLength);
        if (KeyInfo == NULL)
            return STATUS_NO_MEMORY;
    }

    /* Enumerate the key */
    Status = ZwEnumerateKey(KeyHandle,
                            Index,
                            KeyBasicInformation,
                            KeyInfo,
                            BufferLength,
                            &ReturnedLength);
    if (NT_SUCCESS(Status))
    {
        /* Check if the name fits */
        if (KeyInfo->NameLength < (Length * sizeof(WCHAR)))
        {
            /* Copy it */
            RtlMoveMemory(Buffer,
                          KeyInfo->Name,
                          KeyInfo->NameLength);

            /* Terminate the string */
            Buffer[KeyInfo->NameLength / sizeof(WCHAR)] = UNICODE_NULL;
        }
        else
        {
            /* Otherwise, we ran out of buffer space */
            Status = STATUS_BUFFER_OVERFLOW;
        }
    }

    /* Free the buffer and return status */
    if (KeyInfo)
        RtlFreeHeap(RtlGetProcessHeap(), 0, KeyInfo);

    return Status;
}

Referenced by LsapDeleteDbObject(), LsarEnumerateAccounts(), and LsarEnumerateAccountsWithUserRight().

LsapRegEnumerateValue()

NTSTATUS LsapRegEnumerateValue	(	IN HANDLE	KeyHandle,
		IN ULONG	Index,
		OUT LPWSTR	Name,
		IN OUT PULONG	NameLength,
		OUT PULONG Type	OPTIONAL,
		OUT PVOID Data	OPTIONAL,
		IN OUT PULONG DataLength	OPTIONAL
	)

Definition at line 225 of file registry.c.

{
    PKEY_VALUE_FULL_INFORMATION ValueInfo = NULL;
    ULONG BufferLength = 0;
    ULONG ReturnedLength;
    NTSTATUS Status;

    TRACE("Index: %lu\n", Index);

    /* Calculate the required buffer length */
    BufferLength = FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name);
    BufferLength += (MAX_PATH + 1) * sizeof(WCHAR);
    if (Data != NULL)
        BufferLength += *DataLength;

    /* Allocate the value buffer */
    ValueInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, BufferLength);
    if (ValueInfo == NULL)
        return STATUS_NO_MEMORY;

    /* Enumerate the value*/
    Status = ZwEnumerateValueKey(KeyHandle,
                                 Index,
                                 KeyValueFullInformation,
                                 ValueInfo,
                                 BufferLength,
                                 &ReturnedLength);
    if (NT_SUCCESS(Status))
    {
        if (Name != NULL)
        {
            /* Check if the name fits */
            if (ValueInfo->NameLength < (*NameLength * sizeof(WCHAR)))
            {
                /* Copy it */
                RtlMoveMemory(Name,
                              ValueInfo->Name,
                              ValueInfo->NameLength);

                /* Terminate the string */
                Name[ValueInfo->NameLength / sizeof(WCHAR)] = UNICODE_NULL;
            }
            else
            {
                /* Otherwise, we ran out of buffer space */
                Status = STATUS_BUFFER_OVERFLOW;
                goto done;
            }
        }

        if (Data != NULL)
        {
            /* Check if the data fits */
            if (ValueInfo->DataLength <= *DataLength)
            {
                /* Copy it */
                RtlMoveMemory(Data,
                              (PVOID)((ULONG_PTR)ValueInfo + ValueInfo->DataOffset),
                              ValueInfo->DataLength);

                /* if the type is REG_SZ and data is not 0-terminated
                 * and there is enough space in the buffer NT appends a \0 */
                if (IsStringType(ValueInfo->Type) &&
                    ValueInfo->DataLength <= *DataLength - sizeof(WCHAR))
                {
                    WCHAR *ptr = (WCHAR *)((ULONG_PTR)Data + ValueInfo->DataLength);
                    if ((ptr > (WCHAR *)Data) && ptr[-1])
                        *ptr = UNICODE_NULL;
                }
            }
            else
            {
                Status = STATUS_BUFFER_OVERFLOW;
                goto done;
            }
        }
    }

done:
    if ((NT_SUCCESS(Status)) || (Status == STATUS_BUFFER_OVERFLOW))
    {
        if (Type != NULL)
            *Type = ValueInfo->Type;

        if (NameLength != NULL)
            *NameLength = ValueInfo->NameLength;

        if (DataLength != NULL)
            *DataLength = ValueInfo->DataLength;
    }

    /* Free the buffer and return status */
    if (ValueInfo)
        RtlFreeHeap(RtlGetProcessHeap(), 0, ValueInfo);

    return Status;
}

LsapRegOpenKey()

NTSTATUS LsapRegOpenKey	(	IN HANDLE	ParentKeyHandle,
		IN LPCWSTR	KeyName,
		IN ACCESS_MASK	DesiredAccess,
		OUT HANDLE	KeyHandle
	)

Definition at line 153 of file registry.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING Name;

    RtlInitUnicodeString(&Name, KeyName);

    InitializeObjectAttributes(&ObjectAttributes,
                               &Name,
                               OBJ_CASE_INSENSITIVE,
                               ParentKeyHandle,
                               NULL);

    return NtOpenKey(KeyHandle,
                     DesiredAccess,
                     &ObjectAttributes);
}

Referenced by LsarEnumerateAccounts(), and LsarEnumerateAccountsWithUserRight().

LsapRegQueryKeyInfo()

NTSTATUS LsapRegQueryKeyInfo	(	IN HANDLE	KeyHandle,
		OUT PULONG	SubKeyCount,
		OUT PULONG	MaxSubKeyNameLength,
		OUT PULONG	ValueCount
	)

Definition at line 176 of file registry.c.

{
    KEY_FULL_INFORMATION FullInfoBuffer;
    ULONG Length;
    NTSTATUS Status;

    FullInfoBuffer.ClassLength = 0;
    FullInfoBuffer.ClassOffset = FIELD_OFFSET(KEY_FULL_INFORMATION, Class);

    Status = NtQueryKey(KeyHandle,
                        KeyFullInformation,
                        &FullInfoBuffer,
                        sizeof(KEY_FULL_INFORMATION),
                        &Length);
    TRACE("NtQueryKey() returned status 0x%08lX\n", Status);
    if (!NT_SUCCESS(Status))
        return Status;

    if (SubKeyCount != NULL)
        *SubKeyCount = FullInfoBuffer.SubKeys;

    if (MaxSubKeyNameLength != NULL)
        *MaxSubKeyNameLength = FullInfoBuffer.MaxNameLen;

    if (ValueCount != NULL)
        *ValueCount = FullInfoBuffer.Values;

    return Status;
}

Referenced by LsarEnumerateAccounts(), and LsarEnumerateAccountsWithUserRight().

LsapRegQueryValue()

NTSTATUS LsapRegQueryValue	(	IN HANDLE	KeyHandle,
		IN LPWSTR	ValueName,
		OUT PULONG Type	OPTIONAL,
		OUT PVOID Data	OPTIONAL,
		IN OUT PULONG DataLength	OPTIONAL
	)

Definition at line 331 of file registry.c.

{
    PKEY_VALUE_PARTIAL_INFORMATION ValueInfo;
    UNICODE_STRING Name;
    ULONG BufferLength = 0;
    NTSTATUS Status;

    RtlInitUnicodeString(&Name,
                         ValueName);

    if (DataLength != NULL)
        BufferLength = *DataLength;

    BufferLength += FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data);

    /* Allocate memory for the value */
    ValueInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, BufferLength);
    if (ValueInfo == NULL)
        return STATUS_NO_MEMORY;

    /* Query the value */
    Status = ZwQueryValueKey(KeyHandle,
                             &Name,
                             KeyValuePartialInformation,
                             ValueInfo,
                             BufferLength,
                             &BufferLength);
    if ((NT_SUCCESS(Status)) || (Status == STATUS_BUFFER_OVERFLOW))
    {
        if (Type != NULL)
            *Type = ValueInfo->Type;

        if (DataLength != NULL)
            *DataLength = ValueInfo->DataLength;
    }

    /* Check if the caller wanted data back, and we got it */
    if ((NT_SUCCESS(Status)) && (Data != NULL))
    {
        /* Copy it */
        RtlMoveMemory(Data,
                      ValueInfo->Data,
                      ValueInfo->DataLength);

        /* if the type is REG_SZ and data is not 0-terminated
         * and there is enough space in the buffer NT appends a \0 */
        if (IsStringType(ValueInfo->Type) &&
            ValueInfo->DataLength <= *DataLength - sizeof(WCHAR))
        {
            WCHAR *ptr = (WCHAR *)((ULONG_PTR)Data + ValueInfo->DataLength);
            if ((ptr > (WCHAR *)Data) && ptr[-1])
                *ptr = UNICODE_NULL;
        }
    }

    /* Free the memory and return status */
    RtlFreeHeap(RtlGetProcessHeap(), 0, ValueInfo);

    if ((Data == NULL) && (Status == STATUS_BUFFER_OVERFLOW))
        Status = STATUS_SUCCESS;

    return Status;
}

Referenced by LsarEnumerateAccounts(), and LsarEnumerateAccountsWithUserRight().

LsapRegSetValue()

NTSTATUS LsapRegSetValue	(	HANDLE	KeyHandle,
		LPWSTR	ValueName,
		ULONG	Type,
		LPVOID	Data,
		ULONG	DataLength
	)

Definition at line 401 of file registry.c.

{
    UNICODE_STRING Name;

    RtlInitUnicodeString(&Name,
                         ValueName);

    return ZwSetValueKey(KeyHandle,
                         &Name,
                         0,
                         Type,
                         Data,
                         DataLength);
}