1 /* hivexsh - Hive shell.
2 * Copyright (C) 2009 Red Hat Inc.
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License along
15 * with this program; if not, write to the Free Software Foundation, Inc.,
16 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
31 #ifdef HAVE_LIBREADLINE
32 #include <readline/readline.h>
33 #include <readline/history.h>
38 #define _(str) dgettext(PACKAGE, (str))
39 //#define N_(str) dgettext(PACKAGE, (str))
45 #define STREQ(a,b) (strcmp((a),(b)) == 0)
46 #define STRCASEEQ(a,b) (strcasecmp((a),(b)) == 0)
47 #define STRNEQ(a,b) (strcmp((a),(b)) != 0)
48 //#define STRCASENEQ(a,b) (strcasecmp((a),(b)) != 0)
49 //#define STREQLEN(a,b,n) (strncmp((a),(b),(n)) == 0)
50 //#define STRCASEEQLEN(a,b,n) (strncasecmp((a),(b),(n)) == 0)
51 //#define STRNEQLEN(a,b,n) (strncmp((a),(b),(n)) != 0)
52 //#define STRCASENEQLEN(a,b,n) (strncasecmp((a),(b),(n)) != 0)
53 #define STRPREFIX(a,b) (strncmp((a),(b),strlen((b))) == 0)
59 #include "byte_conversions.h"
61 #define HIVEX_MAX_VALUES 1000
65 static hive_h *h = NULL;
66 static char *prompt_string = NULL; /* Normal prompt string. */
67 static char *loaded = NULL; /* Basename of loaded file, if any. */
68 static hive_node_h cwd; /* Current node. */
69 static int open_flags = 0; /* Flags used when loading a hive file. */
71 static void usage (void) __attribute__((noreturn));
72 static void print_node_path (hive_node_h, FILE *);
73 static void set_prompt_string (void);
74 static void initialize_readline (void);
75 static void cleanup_readline (void);
76 static void add_history_line (const char *);
77 static char *rl_gets (const char *prompt_string);
78 static void sort_strings (char **strings, int len);
79 static int get_xdigit (char c);
80 static int dispatch (char *cmd, char *args);
81 static int cmd_add (char *name);
82 static int cmd_cd (char *path);
83 static int cmd_close (char *path);
84 static int cmd_commit (char *path);
85 static int cmd_del (char *args);
86 static int cmd_help (char *args);
87 static int cmd_load (char *hivefile);
88 static int cmd_ls (char *args);
89 static int cmd_lsval (char *args);
90 static int cmd_setval (char *args);
95 fprintf (stderr, "hivexsh [-dfw] [hivefile]\n");
100 main (int argc, char *argv[])
102 setlocale (LC_ALL, "");
103 #ifdef HAVE_BINDTEXTDOMAIN
104 bindtextdomain (PACKAGE, LOCALEBASEDIR);
105 textdomain (PACKAGE);
109 const char *filename = NULL;
111 set_prompt_string ();
113 while ((c = getopt (argc, argv, "df:w")) != EOF) {
116 open_flags |= HIVEX_OPEN_DEBUG;
122 open_flags |= HIVEX_OPEN_WRITE;
130 if (optind + 1 != argc)
132 if (cmd_load (argv[optind]) == -1)
136 /* -f filename parameter */
139 if (open (filename, O_RDONLY) == -1) {
147 initialize_readline ();
152 "Welcome to hivexsh, the hivex interactive shell for examining\n"
153 "Windows Registry binary hive files.\n"
155 "Type: 'help' for help summary\n"
156 " 'quit' to quit the shell\n"
160 char *buf = rl_gets (prompt_string);
168 while (*buf && c_isspace (*buf))
171 /* Ignore blank line. */
174 /* If the next character is '#' then this is a comment. */
175 if (*buf == '#') continue;
177 /* Parsing is very simple - much simpler than guestfish. This is
178 * because Registry keys often contain spaces, and we don't want
179 * to bother with quoting. Therefore here we just split at the
180 * first whitespace into "cmd<whitespace>arg(s)". We let the
181 * command decide how to deal with arg(s), if at all.
183 size_t len = strcspn (buf, " \t");
185 if (len == 0) continue;
190 if (buf[len] == '\0') {
191 /* This is mostly safe. Although the cmd_* functions do sometimes
192 * modify args, then shouldn't do so when args is "".
199 args = buf + len + 1 + strspn (&buf[len+1], " \t");
202 while (len > 0 && c_isspace (args[len-1])) {
208 /*printf ("command: '%s' args: '%s'\n", cmd, args)*/;
209 int r = dispatch (cmd, args);
210 if (!is_tty && r == -1)
215 free (prompt_string);
217 if (h) hivex_close (h);
221 /* Set the prompt string. This is called whenever it could change, eg.
222 * after loading a file or changing directory.
225 set_prompt_string (void)
227 free (prompt_string);
228 prompt_string = NULL;
233 fp = open_memstream (&ptr, &size);
235 perror ("open_memstream");
240 assert (loaded != NULL);
244 print_node_path (cwd, fp);
252 /* Print the \full\path of a node. */
254 print_node_path (hive_node_h node, FILE *fp)
256 hive_node_h root = hivex_root (h);
263 hive_node_h parent = hivex_node_parent (h, node);
265 fprintf (stderr, _("hivexsh: error getting parent of node %zu\n"), node);
268 print_node_path (parent, fp);
273 char *name = hivex_node_name (h, node);
275 fprintf (stderr, _("hivexsh: error getting node name of node %zx\n"), node);
283 static char *line_read = NULL;
286 rl_gets (const char *prompt_string)
288 #ifdef HAVE_LIBREADLINE
296 line_read = readline (prompt_string);
298 if (line_read && *line_read)
299 add_history_line (line_read);
304 #endif /* HAVE_LIBREADLINE */
306 static char buf[8192];
310 printf ("%s", prompt_string);
311 line_read = fgets (buf, sizeof buf, stdin);
314 len = strlen (line_read);
315 if (len > 0 && buf[len-1] == '\n') buf[len-1] = '\0';
321 #ifdef HAVE_LIBREADLINE
322 static char histfile[1024];
323 static int nr_history_lines = 0;
327 initialize_readline (void)
329 #ifdef HAVE_LIBREADLINE
332 home = getenv ("HOME");
334 snprintf (histfile, sizeof histfile, "%s/.hivexsh", home);
336 (void) read_history (histfile);
339 rl_readline_name = "hivexsh";
344 cleanup_readline (void)
346 #ifdef HAVE_LIBREADLINE
349 if (histfile[0] != '\0') {
350 fd = open (histfile, O_WRONLY|O_CREAT, 0644);
357 (void) append_history (nr_history_lines, histfile);
363 add_history_line (const char *line)
365 #ifdef HAVE_LIBREADLINE
372 compare (const void *vp1, const void *vp2)
374 char * const *p1 = (char * const *) vp1;
375 char * const *p2 = (char * const *) vp2;
376 return strcasecmp (*p1, *p2);
380 sort_strings (char **strings, int len)
382 qsort (strings, len, sizeof (char *), compare);
389 case '0'...'9': return c - '0';
390 case 'a'...'f': return c - 'a' + 10;
391 case 'A'...'F': return c - 'A' + 10;
397 dispatch (char *cmd, char *args)
399 if (STRCASEEQ (cmd, "help"))
400 return cmd_help (args);
401 else if (STRCASEEQ (cmd, "load"))
402 return cmd_load (args);
403 else if (STRCASEEQ (cmd, "exit") ||
404 STRCASEEQ (cmd, "q") ||
405 STRCASEEQ (cmd, "quit")) {
410 /* If no hive file is loaded (!h) then only the small selection of
411 * commands above will work.
414 fprintf (stderr, _("hivexsh: you must load a hive file first using 'load hivefile'\n"));
418 if (STRCASEEQ (cmd, "add"))
419 return cmd_add (args);
420 else if (STRCASEEQ (cmd, "cd"))
421 return cmd_cd (args);
422 else if (STRCASEEQ (cmd, "close") || STRCASEEQ (cmd, "unload"))
423 return cmd_close (args);
424 else if (STRCASEEQ (cmd, "commit"))
425 return cmd_commit (args);
426 else if (STRCASEEQ (cmd, "del"))
427 return cmd_del (args);
428 else if (STRCASEEQ (cmd, "ls"))
429 return cmd_ls (args);
430 else if (STRCASEEQ (cmd, "lsval"))
431 return cmd_lsval (args);
432 else if (STRCASEEQ (cmd, "setval"))
433 return cmd_setval (args);
435 fprintf (stderr, _("hivexsh: unknown command '%s', use 'help' for help summary\n"),
442 cmd_load (char *hivefile)
444 if (STREQ (hivefile, "")) {
445 fprintf (stderr, _("hivexsh: load: no hive file name given to load\n"));
449 if (h) hivex_close (h);
457 h = hivex_open (hivefile, open_flags);
461 "hivexsh: failed to open hive file: %s: %m\n"
463 "If you think this file is a valid Windows binary hive file (_not_\n"
464 "a regedit *.reg file) then please run this command again using the\n"
465 "hivexsh option '-d' and attach the complete output _and_ the hive file\n"
466 "which fails into a bug report at https://bugzilla.redhat.com/\n"
472 /* Get the basename of the file for the prompt. */
473 char *p = strrchr (hivefile, '/');
475 loaded = strdup (p+1);
477 loaded = strdup (hivefile);
483 cwd = hivex_root (h);
485 set_prompt_string ();
491 cmd_close (char *args)
493 if (STRNEQ (args, "")) {
494 fprintf (stderr, _("hivexsh: '%s' command should not be given arguments\n"),
499 if (h) hivex_close (h);
507 set_prompt_string ();
513 cmd_commit (char *path)
515 if (STREQ (path, ""))
518 if (hivex_commit (h, path, 0) == -1) {
519 perror ("hivexsh: commit");
529 if (STREQ (path, "")) {
530 print_node_path (cwd, stdout);
531 fputc ('\n', stdout);
535 if (path[0] == '\\' && path[1] == '\\') {
536 fprintf (stderr, _("%s: %s: \\ characters in path are doubled - are you escaping the path parameter correctly?\n"), "hivexsh", path);
540 hive_node_h new_cwd = cwd;
541 hive_node_h root = hivex_root (h);
543 if (path[0] == '\\') {
549 size_t len = strcspn (path, "\\");
556 path = path[len] == '\0' ? &path[len] : &path[len+1];
559 if (len == 1 && STREQ (elem, "."))
562 if (len == 2 && STREQ (elem, "..")) {
564 new_cwd = hivex_node_parent (h, new_cwd);
569 new_cwd = hivex_node_get_child (h, new_cwd, elem);
572 perror ("hivexsh: cd");
574 fprintf (stderr, _("hivexsh: cd: subkey '%s' not found\n"),
580 if (new_cwd != cwd) {
582 set_prompt_string ();
589 cmd_help (char *args)
592 "Navigate through the hive's keys using the 'cd' command, as if it\n"
593 "contained a filesystem, and use 'ls' to list the subkeys of the\n"
594 "current key. Full documentation is in the hivexsh(1) manual page.\n"));
602 if (STRNEQ (args, "")) {
603 fprintf (stderr, _("hivexsh: '%s' command should not be given arguments\n"),
608 /* Get the subkeys. */
609 hive_node_h *children = hivex_node_children (h, cwd);
610 if (children == NULL) {
615 /* Get names for each subkey. */
617 for (len = 0; children[len] != 0; ++len)
620 char **names = calloc (len, sizeof (char *));
628 for (i = 0; i < len; ++i) {
629 names[i] = hivex_node_name (h, children[i]);
630 if (names[i] == NULL) {
631 perror ("hivex_node_name");
636 /* Sort the names. */
637 sort_strings (names, len);
639 for (i = 0; i < len; ++i)
640 printf ("%s\n", names[i]);
645 for (i = 0; i < len; ++i)
652 cmd_lsval (char *key)
654 if (STRNEQ (key, "")) {
658 if (STREQ (key, "@")) /* default key written as "@" */
659 value = hivex_node_get_value (h, cwd, "");
661 value = hivex_node_get_value (h, cwd, key);
666 /* else key not found */
667 fprintf (stderr, _("%s: %s: key not found\n"), "hivexsh", key);
671 /* Print the value. */
674 if (hivex_value_type (h, value, &t, &len) == -1)
679 case hive_t_expand_string:
681 char *str = hivex_value_string (h, value);
685 puts (str); /* note: this adds a single \n character */
691 case hive_t_dword_be: {
692 int32_t j = hivex_value_dword (h, value);
693 printf ("%" PRIi32 "\n", j);
698 int64_t j = hivex_value_qword (h, value);
699 printf ("%" PRIi64 "\n", j);
703 case hive_t_multiple_strings: {
704 char **strs = hivex_value_multiple_strings (h, value);
708 for (j = 0; strs[j] != NULL; ++j) {
718 case hive_t_resource_list:
719 case hive_t_full_resource_description:
720 case hive_t_resource_requirements_list:
722 char *data = hivex_value_value (h, value, &t, &len);
726 if (fwrite (data, 1, len, stdout) != len)
734 /* No key specified, so print all keys in this node. We do this
735 * in a format which looks like the output of regedit, although
736 * this isn't a particularly useful format.
738 hive_value_h *values;
740 values = hivex_node_values (h, cwd);
745 for (i = 0; values[i] != 0; ++i) {
746 char *key = hivex_value_key (h, values[i]);
747 if (!key) goto error;
752 for (j = 0; key[j] != 0; ++j) {
753 if (key[j] == '"' || key[j] == '\\')
759 printf ("\"@\""); /* default key in regedit files */
765 if (hivex_value_type (h, values[i], &t, &len) == -1)
770 case hive_t_expand_string:
772 char *str = hivex_value_string (h, values[i]);
776 if (t != hive_t_string)
777 printf ("str(%d):", t);
780 for (j = 0; str[j] != 0; ++j) {
781 if (str[j] == '"' || str[j] == '\\')
791 case hive_t_dword_be: {
792 int32_t j = hivex_value_dword (h, values[i]);
793 printf ("dword:%08" PRIx32, j);
797 case hive_t_qword: /* sic */
800 case hive_t_multiple_strings:
801 case hive_t_resource_list:
802 case hive_t_full_resource_description:
803 case hive_t_resource_requirements_list:
805 unsigned char *data =
806 (unsigned char *) hivex_value_value (h, values[i], &t, &len);
810 printf ("hex(%d):", t);
812 for (j = 0; j < len; ++j) {
815 printf ("%02x", data[j]);
830 perror ("hivexsh: lsval");
835 cmd_setval (char *nrvals_str)
839 /* Parse number of values. */
841 xerr = xstrtol (nrvals_str, NULL, 0, &nrvals, "");
842 if (xerr != LONGINT_OK) {
843 fprintf (stderr, _("%s: %s: invalid integer parameter (%s returned %d)\n"),
844 "setval", "nrvals", "xstrtol", xerr);
847 if (nrvals < 0 || nrvals > HIVEX_MAX_VALUES) {
848 fprintf (stderr, _("%s: %s: integer out of range\n"),
853 struct hive_set_value *values =
854 calloc (nrvals, sizeof (struct hive_set_value));
855 if (values == NULL) {
862 /* Read nrvals * 2 lines of input, nrvals * (key, value) pairs, as
863 * explained in the man page.
866 for (i = 0; i < nrvals; ++i) {
868 char *buf = rl_gets (" key> ");
870 fprintf (stderr, _("hivexsh: setval: unexpected end of input\n"));
875 /* Note that buf will be overwritten by the next call to rl_gets. */
876 if (STREQ (buf, "@"))
877 values[i].key = strdup ("");
879 values[i].key = strdup (buf);
880 if (values[i].key == NULL) {
886 buf = rl_gets ("value> ");
888 fprintf (stderr, _("hivexsh: setval: unexpected end of input\n"));
893 if (STREQ (buf, "none")) {
894 values[i].t = hive_t_none;
897 else if (STRPREFIX (buf, "string:")) {
899 values[i].t = hive_t_string;
900 int nr_chars = strlen (buf);
901 values[i].len = 2 * (nr_chars + 1);
902 values[i].value = malloc (values[i].len);
903 if (!values[i].value) {
907 for (j = 0; j <= /* sic */ nr_chars; ++j) {
909 fprintf (stderr, _("hivexsh: string(utf16le): only 7 bit ASCII strings are supported for input\n"));
912 values[i].value[2*j] = buf[j];
913 values[i].value[2*j+1] = '\0';
916 else if (STRPREFIX (buf, "expandstring:")) {
918 values[i].t = hive_t_expand_string;
919 int nr_chars = strlen (buf);
920 values[i].len = 2 * (nr_chars + 1);
921 values[i].value = malloc (values[i].len);
922 if (!values[i].value) {
926 for (j = 0; j <= /* sic */ nr_chars; ++j) {
928 fprintf (stderr, _("hivexsh: string(utf16le): only 7 bit ASCII strings are supported for input\n"));
931 values[i].value[2*j] = buf[j];
932 values[i].value[2*j+1] = '\0';
935 else if (STRPREFIX (buf, "dword:")) {
937 values[i].t = hive_t_dword;
939 values[i].value = malloc (4);
940 if (!values[i].value) {
945 xerr = xstrtol (buf, NULL, 0, &n, "");
946 if (xerr != LONGINT_OK) {
947 fprintf (stderr, _("%s: %s: invalid integer parameter (%s returned %d)\n"),
948 "setval", "dword", "xstrtol", xerr);
952 if (n < 0 || n > UINT32_MAX) {
953 fprintf (stderr, _("%s: %s: integer out of range\n"),
958 uint32_t u32 = htole32 (n);
959 memcpy (values[i].value, &u32, 4);
961 else if (STRPREFIX (buf, "qword:")) {
963 values[i].t = hive_t_qword;
965 values[i].value = malloc (8);
966 if (!values[i].value) {
971 xerr = xstrtoll (buf, NULL, 0, &n, "");
972 if (xerr != LONGINT_OK) {
973 fprintf (stderr, _("%s: %s: invalid integer parameter (%s returned %d)\n"),
974 "setval", "dword", "xstrtoll", xerr);
978 if (n < 0 || n > UINT64_MAX) {
979 fprintf (stderr, _("%s: %s: integer out of range\n"),
984 uint64_t u64 = htole64 (n);
985 memcpy (values[i].value, &u64, 4);
987 else if (STRPREFIX (buf, "hex:")) {
990 size_t len = strcspn (buf, ":");
992 if (buf[len] == '\0') /* "hex:t" */
994 else { /* "hex:t:..." */
996 nextbuf = &buf[len+1];
1000 xerr = xstrtol (buf, NULL, 0, &t, "");
1001 if (xerr != LONGINT_OK) {
1002 fprintf (stderr, _("%s: %s: invalid integer parameter (%s returned %d)\n"),
1003 "setval", "hex", "xstrtol", xerr);
1007 if (t < 0 || t > UINT32_MAX) {
1008 fprintf (stderr, _("%s: %s: integer out of range\n"),
1015 /* Read the hex data. */
1018 /* The allocation length is an overestimate, but it doesn't matter. */
1019 values[i].value = malloc (1 + strlen (buf) / 2);
1020 if (!values[i].value) {
1022 exit (EXIT_FAILURE);
1029 for (j = 0; *buf && j < 2; buf++) {
1030 if (c_isxdigit (*buf)) { /* NB: ignore non-hex digits. */
1032 c |= get_xdigit (*buf);
1037 if (j == 2) values[i].value[values[i].len++] = c;
1039 fprintf (stderr, _("hivexsh: setval: trailing garbage after hex string\n"));
1046 _("hivexsh: setval: cannot parse value string, please refer to the man page hivexsh(1) for help: %s\n"),
1052 ret = hivex_node_set_values (h, cwd, nrvals, values, 0);
1055 /* Free values array. */
1056 for (i = 0; i < nrvals; ++i) {
1057 free (values[i].key);
1058 free (values[i].value);
1066 cmd_del (char *args)
1068 if (STRNEQ (args, "")) {
1069 fprintf (stderr, _("hivexsh: '%s' command should not be given arguments\n"),
1074 if (cwd == hivex_root (h)) {
1075 fprintf (stderr, _("hivexsh: del: the root node cannot be deleted\n"));
1079 hive_node_h new_cwd = hivex_node_parent (h, cwd);
1081 if (hivex_node_delete_child (h, cwd) == -1) {
1082 perror ("hivexsh: del");
1087 set_prompt_string ();
1092 cmd_add (char *name)
1094 hive_node_h node = hivex_node_add_child (h, cwd, name);
1096 perror ("hivexsh: add");