2 * Copyright (C) 2010-2011 Red Hat Inc.
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
39 #include "ignore-value.h"
43 #include "guestfs-internal.h"
44 #include "guestfs-internal-actions.h"
45 #include "guestfs_protocol.h"
47 #if defined(HAVE_HIVEX)
49 /* Compile all the regular expressions once when the shared library is
50 * loaded. PCRE is thread safe so we're supposedly OK here if
51 * multiple threads call into the libguestfs API functions below
54 static pcre *re_windows_version;
56 static void compile_regexps (void) __attribute__((constructor));
57 static void free_regexps (void) __attribute__((destructor));
60 compile_regexps (void)
65 #define COMPILE(re,pattern,options) \
67 re = pcre_compile ((pattern), (options), &err, &offset, NULL); \
69 ignore_value (write (2, err, strlen (err))); \
74 COMPILE (re_windows_version, "^(\\d+)\\.(\\d+)", 0);
80 pcre_free (re_windows_version);
83 static int check_windows_arch (guestfs_h *g, struct inspect_fs *fs);
84 static int check_windows_software_registry (guestfs_h *g, struct inspect_fs *fs);
85 static int check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs);
86 static char *map_registry_disk_blob (guestfs_h *g, const char *blob);
88 /* XXX Handling of boot.ini in the Perl version was pretty broken. It
89 * essentially didn't do anything for modern Windows guests.
90 * Therefore I've omitted all that code.
93 /* Try to find Windows systemroot using some common locations.
97 * (1) We check for some directories inside to see if it is a real
98 * systemroot, and not just a directory that happens to have the same
101 * (2) If a Windows guest has multiple disks and applications are
102 * installed on those other disks, then those other disks will contain
103 * "/Program Files" and "/System Volume Information". Those would
104 * *not* be Windows root disks. (RHBZ#674130)
106 static const char *systemroots[] =
107 { "/windows", "/winnt", "/win32", "/win", NULL };
110 guestfs___has_windows_systemroot (guestfs_h *g)
113 char *systemroot, *p;
116 for (i = 0; i < sizeof systemroots / sizeof systemroots[0]; ++i) {
117 systemroot = guestfs___case_sensitive_path_silently (g, systemroots[i]);
121 snprintf (path, sizeof path, "%s/system32", systemroot);
122 if (!guestfs___is_dir_nocase (g, path)) {
127 snprintf (path, sizeof path, "%s/system32/config", systemroot);
128 if (!guestfs___is_dir_nocase (g, path)) {
133 snprintf (path, sizeof path, "%s/system32/cmd.exe", systemroot);
134 if (!guestfs___is_file_nocase (g, path)) {
144 return -1; /* not found */
148 guestfs___check_windows_root (guestfs_h *g, struct inspect_fs *fs)
153 fs->type = OS_TYPE_WINDOWS;
154 fs->distro = OS_DISTRO_WINDOWS;
156 i = guestfs___has_windows_systemroot (g);
158 error (g, "check_windows_root: has_windows_systemroot unexpectedly returned -1");
162 systemroot = guestfs___case_sensitive_path_silently (g, systemroots[i]);
164 error (g, _("cannot resolve Windows %%SYSTEMROOT%%"));
168 debug (g, "windows %%SYSTEMROOT%% = %s", systemroot);
170 /* Freed by guestfs___free_inspect_info. */
171 fs->windows_systemroot = systemroot;
173 if (check_windows_arch (g, fs) == -1)
176 /* Product name and version. */
177 if (check_windows_software_registry (g, fs) == -1)
181 if (check_windows_system_registry (g, fs) == -1)
188 check_windows_arch (guestfs_h *g, struct inspect_fs *fs)
190 size_t len = strlen (fs->windows_systemroot) + 32;
192 snprintf (cmd_exe, len, "%s/system32/cmd.exe", fs->windows_systemroot);
194 char *cmd_exe_path = guestfs___case_sensitive_path_silently (g, cmd_exe);
198 char *arch = guestfs_file_architecture (g, cmd_exe_path);
202 fs->arch = arch; /* freed by guestfs___free_inspect_info */
207 /* At the moment, pull just the ProductName and version numbers from
208 * the registry. In future there is a case for making many more
209 * registry fields available to callers.
212 check_windows_software_registry (guestfs_h *g, struct inspect_fs *fs)
214 size_t len = strlen (fs->windows_systemroot) + 64;
216 snprintf (software, len, "%s/system32/config/software",
217 fs->windows_systemroot);
219 char *software_path = guestfs___case_sensitive_path_silently (g, software);
221 /* If the software hive doesn't exist, just accept that we cannot
222 * find product_name etc.
226 char *software_hive = NULL;
229 hive_value_h *values = NULL;
231 software_hive = guestfs___download_to_tmp (g, fs, software_path, "software",
233 if (software_hive == NULL)
236 h = hivex_open (software_hive, g->verbose ? HIVEX_OPEN_VERBOSE : 0);
238 perrorf (g, "hivex_open");
242 hive_node_h node = hivex_root (h);
243 const char *hivepath[] =
244 { "Microsoft", "Windows NT", "CurrentVersion" };
247 node != 0 && i < sizeof hivepath / sizeof hivepath[0];
249 node = hivex_node_get_child (h, node, hivepath[i]);
253 perrorf (g, "hivex: cannot locate HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion");
257 values = hivex_node_values (h, node);
259 for (i = 0; values[i] != 0; ++i) {
260 char *key = hivex_value_key (h, values[i]);
262 perrorf (g, "hivex_value_key");
266 if (STRCASEEQ (key, "ProductName")) {
267 fs->product_name = hivex_value_string (h, values[i]);
268 if (!fs->product_name) {
269 perrorf (g, "hivex_value_string");
274 else if (STRCASEEQ (key, "CurrentVersion")) {
275 char *version = hivex_value_string (h, values[i]);
277 perrorf (g, "hivex_value_string");
282 if (match2 (g, version, re_windows_version, &major, &minor)) {
283 fs->major_version = guestfs___parse_unsigned_int (g, major);
285 if (fs->major_version == -1) {
291 fs->minor_version = guestfs___parse_unsigned_int (g, minor);
293 if (fs->minor_version == -1) {
302 else if (STRCASEEQ (key, "InstallationType")) {
303 fs->product_variant = hivex_value_string (h, values[i]);
304 if (!fs->product_variant) {
305 perrorf (g, "hivex_value_string");
317 if (h) hivex_close (h);
319 free (software_path);
320 free (software_hive);
326 check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs)
328 size_t len = strlen (fs->windows_systemroot) + 64;
330 snprintf (system, len, "%s/system32/config/system",
331 fs->windows_systemroot);
333 char *system_path = guestfs___case_sensitive_path_silently (g, system);
335 /* If the system hive doesn't exist, just accept that we cannot
340 char *system_hive = NULL;
343 hive_node_h root, node;
344 hive_value_h value, *values = NULL;
349 guestfs___download_to_tmp (g, fs, system_path, "system",
351 if (system_hive == NULL)
354 h = hivex_open (system_hive, g->verbose ? HIVEX_OPEN_VERBOSE : 0);
356 perrorf (g, "hivex_open");
360 root = hivex_root (h);
362 perrorf (g, "hivex_root");
366 /* Get the CurrentControlSet. */
368 node = hivex_node_get_child (h, root, "Select");
371 perrorf (g, "hivex_node_get_child");
373 error (g, "hivex: could not locate HKLM\\SYSTEM\\Select");
378 value = hivex_node_get_value (h, node, "Current");
381 perrorf (g, "hivex_node_get_value");
383 error (g, "hivex: HKLM\\System\\Select Default entry not found.");
387 /* XXX Should check the type. */
388 dword = hivex_value_dword (h, value);
389 fs->windows_current_control_set = safe_asprintf (g, "ControlSet%03d", dword);
391 /* Get the drive mappings.
392 * This page explains the contents of HKLM\System\MountedDevices:
393 * http://www.goodells.net/multiboot/partsigs.shtml
396 node = hivex_node_get_child (h, root, "MountedDevices");
399 perrorf (g, "hivex_node_get_child");
401 error (g, "hivex: could not locate HKLM\\SYSTEM\\MountedDevices");
405 values = hivex_node_values (h, node);
407 /* Count how many DOS drive letter mappings there are. This doesn't
408 * ignore removable devices, so it overestimates, but that doesn't
409 * matter because it just means we'll allocate a few bytes extra.
411 for (i = count = 0; values[i] != 0; ++i) {
412 char *key = hivex_value_key (h, values[i]);
414 perrorf (g, "hivex_value_key");
417 if (STRCASEEQLEN (key, "\\DosDevices\\", 12) &&
418 c_isalpha (key[12]) && key[13] == ':')
423 fs->drive_mappings = calloc (2*count + 1, sizeof (char *));
424 if (fs->drive_mappings == NULL) {
425 perrorf (g, "calloc");
429 for (i = count = 0; values[i] != 0; ++i) {
430 char *key = hivex_value_key (h, values[i]);
432 perrorf (g, "hivex_value_key");
435 if (STRCASEEQLEN (key, "\\DosDevices\\", 12) &&
436 c_isalpha (key[12]) && key[13] == ':') {
437 /* Get the binary value. Is it a fixed disk? */
442 blob = hivex_value_value (h, values[i], &type, &len);
443 if (blob != NULL && type == 3 && len == 12) {
444 /* Try to map the blob to a known disk and partition. */
445 device = map_registry_disk_blob (g, blob);
446 if (device != NULL) {
447 fs->drive_mappings[count++] = safe_strndup (g, &key[12], 1);
448 fs->drive_mappings[count++] = device;
456 /* Get the hostname. */
457 const char *hivepath[] =
458 { fs->windows_current_control_set, "Services", "Tcpip", "Parameters" };
459 for (node = root, i = 0;
460 node != 0 && i < sizeof hivepath / sizeof hivepath[0];
462 node = hivex_node_get_child (h, node, hivepath[i]);
466 perrorf (g, "hivex: cannot locate HKLM\\SYSTEM\\%s\\Services\\Tcpip\\Parameters",
467 fs->windows_current_control_set);
472 values = hivex_node_values (h, node);
474 for (i = 0; values[i] != 0; ++i) {
475 char *key = hivex_value_key (h, values[i]);
477 perrorf (g, "hivex_value_key");
481 if (STRCASEEQ (key, "Hostname")) {
482 fs->hostname = hivex_value_string (h, values[i]);
484 perrorf (g, "hivex_value_string");
489 /* many other interesting fields here ... */
497 if (h) hivex_close (h);
505 /* Windows Registry HKLM\SYSTEM\MountedDevices uses a blob of data
506 * to store partitions. This blob is described here:
507 * http://www.goodells.net/multiboot/partsigs.shtml
508 * The following function maps this blob to a libguestfs partition
512 map_registry_disk_blob (guestfs_h *g, const char *blob)
514 char **devices = NULL;
515 struct guestfs_partition_list *partitions = NULL;
519 uint64_t part_offset;
521 /* First 4 bytes are the disk ID. Search all devices to find the
522 * disk with this disk ID.
524 devices = guestfs_list_devices (g);
528 for (i = 0; devices[i] != NULL; ++i) {
529 /* Read the disk ID. */
530 diskid = guestfs_pread_device (g, devices[i], 4, 0x01b8, &len);
537 if (memcmp (diskid, blob, 4) == 0) { /* found it */
546 /* Next 8 bytes are the offset of the partition in bytes(!) given as
547 * a 64 bit little endian number. Luckily it's easy to get the
548 * partition byte offset from guestfs_part_list.
550 part_offset = le64toh (* (uint64_t *) &blob[4]);
552 partitions = guestfs_part_list (g, devices[i]);
553 if (partitions == NULL)
556 for (j = 0; j < partitions->len; ++j) {
557 if (partitions->val[j].part_start == part_offset) /* found it */
558 goto found_partition;
563 /* Construct the full device name. */
564 ret = safe_asprintf (g, "%s%d", devices[i], partitions->val[j].part_num);
568 guestfs___free_string_list (devices);
570 guestfs_free_partition_list (partitions);
574 #endif /* defined(HAVE_HIVEX) */
577 guestfs___case_sensitive_path_silently (guestfs_h *g, const char *path)
579 guestfs_error_handler_cb old_error_cb = g->error_cb;
581 char *ret = guestfs_case_sensitive_path (g, path);
582 g->error_cb = old_error_cb;