~ubuntu-branches/ubuntu/natty/migration-assistant/natty : revision 1

1

// registry.h -- 1999-05-19 ADB

2

3

// This code is for educational and research purposes only.

4

5

enum VALTYPE { // MicroSoft UNICODE = ASCII byte followed by UNICODE byte

6

REG_NONE=0x0000,

7

REG_SZ=0x0001, // UNICODE character string

8

REG_EXPAND_SZ=0x0002, // Unicode string with "%var%" expanded

9

REG_BINARY=0x0003, // Raw-binary value

10

REG_DWORD=0x0004, // Joe Normal DWord: 2 Words, 4 Bytes, 8 Nibbles, 32 Bits

11

REG_DWORD_LITTLE_ENDIAN=0x0004, // Joe Normal DWord: 2 Words, 4 Bytes, 8 Nibbles, 32 Bits

12

REG_DWORD_BIG_ENDIAN=0x0005,

13

REG_LINK=0x0006,

14

REG_MULTI_SZ=0x0007, // Multiple UNICODE strings followed by NULL (0x0000)

15

REG_RESOURCE_LIST=0x0008,

16

REG_FULL_RESOURCE_DESCRIPTOR=0x0009,

17

REG_RESOURCE_REQUIREMENTS_LIST=0x000a

18

};

19

20

typedef struct

21

{

22

int recsize; //0x00 DWord: Length of sk record

23

char rectype[2]; //0x04 Word: ID="v=sk", 0x6B73

24

short skuk001; //0x06 Word: sk Unknown 1 -- "Unused"

25

int prevsk; //0x08 DWord: Global offset of previous sk record

26

int nextsk; //0x0C DWord: Global offset of next sk record

27

int usecount; //0x10 DWord: Count of usage

28

int sksize; //0x14 DWord: Length of sk payload in bytes

29

// a sk record is followed by sksize of bytes of security and auditing payload

30

} SK; //Security Key

31

32

typedef struct

33

{

34

int recsize; //0x00 DWord: Length of vk record

35

char rectype[2]; //0x04 Word: ID="vk", 0x6B76

36

short namesize; //0x06 Word: Length of name

37

int datasize; //0x08 DWord: Length of data

38

int mydata; //0x0C DWord: Global offset to data

39

int valtype; //0x10 DWord: Type of value

40

short flag; //0x14 Word: Flag bits (bit[0]=0 then vk is "default")

41

short vkuk001; //0x16 Word: vk Unknown 1 -- "Unused (data-trash)"

42

// a vk record is followed by namesize of chars of the vk's name

43

} VK; //Value Key

44

45

typedef struct

46

{

47

int nkrec; //0x00 DWord: Global offset of nk record

48

char pseudohash[4]; //0x04 DWord: First four characters of nk record name

49

} HASH;

50

51

typedef struct

52

{

53

int recsize; //0x00 DWord: Length of lf record

54

char rectype[2]; //0x04 Word: ID="lf", 0x666C

55

short numkeys; //0x06 Word: Number of keys

56

// a lf record is followed immediately by numkeys of HASH records

57

} LF; //List? Fields?

58

59

typedef struct

60

{

61

int recsize; //0x00 Dword: Length of nk record

62

char rectype[2]; //0x04 Word: ID="nk", 0x6B6E

63

short nktype; //0x04 Word: Type: 0x20 (0x2C for root key)

64

int datetime1; //0x04 QWord: NT Date Format

65

int datetime2; //0x04 QWord: NT Date Format

66

int parentnk; //0x0C DWord: Global offset to parent

67

int nkuk001; //0x10 DWord: nk Unknown 1

68

int numchildren; //0x14 DWord: Number of sub keys

69

int nkuk002; //0x18 DWord: nk Unknown 2

70

int mylfrec; //0x1C DWord: Global offset to lf record

71

int nkuk003; //0x20 DWord: nk Unknown 3

72

int numvalues; //0x24 DWord: Number of values = 0x00000000 if none

73

int myvallist; //0x28 DWord: Global offset to value list = 0xFFFFFFFF if none

74

int skrec; //0x2C DWord: Global offset to sk record

75

int myclassname; //0x30 DWord: Global offset to class name

76

char nkuk004[16]; //0x34 xByte: nk Unknown 4

77

int nkuk005; //0x44 DWord: nk Unknown 5 -- "Unused (data-trash)"

78

short namesize; //0x48 Word: Length of name

79

short classnamesize; //0x4A Word: Length class name

80

// a nk record is followed by namesize of chars of the nk's name

81

} NK; //Named? Key

82

83

typedef struct

84

{

85

char sig[4]; //0x00 Word: ID="regf"

86

int regfuk001; //0x04 DWord: regf Unknown 1 = regfuk002

87

int regfuk002; //0x08 DWord: regf Unknown 2 = regfuk001

88

int ntdate1; //0x0C QWord: NT Date Format Chunk 1

89

int ntdate2; //0x0C QWord: NT Date Format Chunk 2

90

int regfuk003; //0x14 DWord: regf Unknown 3 = 1

91

int regfuk004; //0x18 DWord: regf Unknown 4 = 3

92

int regfuk005; //0x1C DWord: regf Unknown 5 = 0

93

int regfuk006; //0x20 DWord: regf Unknown 6 = 1

94

int firstkey; //0x24 DWord: Global offset of root nk record

95

int hivesize; //0x28 DWord: Sum of all 4096 byte hbins

96

int regfuk007; //0x2C DWord: regf Unknown 7 = 1

97

int regfuk008[115]; //0x30 DWord: regf Unknown 8 = last accessed?

98

int cksum; //0x1FC DWord: Checksum

99

char balast[3584]; //Pure Junk = 0x00...

100

101

} REGF; //Registry File

102

103

char* findkey(const char* location, const char* path);

104

NK* getkey(char* base, NK* thisnk, char** path);

105

char *str_token( char **string, char *delimiters );

106

char* printk(char* base, NK* thisnk, char* key);

107