2 * Copyright (C) 2010-2011 Red Hat Inc.
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
39 #include "ignore-value.h"
43 #include "guestfs-internal.h"
44 #include "guestfs-internal-actions.h"
45 #include "guestfs_protocol.h"
47 #if defined(HAVE_HIVEX)
49 /* Compile all the regular expressions once when the shared library is
50 * loaded. PCRE is thread safe so we're supposedly OK here if
51 * multiple threads call into the libguestfs API functions below
54 static pcre *re_windows_version;
56 static void compile_regexps (void) __attribute__((constructor));
57 static void free_regexps (void) __attribute__((destructor));
60 compile_regexps (void)
65 #define COMPILE(re,pattern,options) \
67 re = pcre_compile ((pattern), (options), &err, &offset, NULL); \
69 ignore_value (write (2, err, strlen (err))); \
74 COMPILE (re_windows_version, "^(\\d+)\\.(\\d+)", 0);
80 pcre_free (re_windows_version);
83 static int check_windows_arch (guestfs_h *g, struct inspect_fs *fs);
84 static int check_windows_software_registry (guestfs_h *g, struct inspect_fs *fs);
85 static int check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs);
86 static char *map_registry_disk_blob (guestfs_h *g, const char *blob);
88 /* XXX Handling of boot.ini in the Perl version was pretty broken. It
89 * essentially didn't do anything for modern Windows guests.
90 * Therefore I've omitted all that code.
93 guestfs___check_windows_root (guestfs_h *g, struct inspect_fs *fs)
95 fs->type = OS_TYPE_WINDOWS;
96 fs->distro = OS_DISTRO_WINDOWS;
98 /* Try to find Windows systemroot using some common locations. */
99 const char *systemroots[] =
100 { "/windows", "/winnt", "/win32", "/win" };
102 char *systemroot = NULL;
104 systemroot == NULL && i < sizeof systemroots / sizeof systemroots[0];
106 systemroot = guestfs___case_sensitive_path_silently (g, systemroots[i]);
110 error (g, _("cannot resolve Windows %%SYSTEMROOT%%"));
114 debug (g, "windows %%SYSTEMROOT%% = %s", systemroot);
116 /* Freed by guestfs___free_inspect_info. */
117 fs->windows_systemroot = systemroot;
119 if (check_windows_arch (g, fs) == -1)
122 /* Product name and version. */
123 if (check_windows_software_registry (g, fs) == -1)
127 if (check_windows_system_registry (g, fs) == -1)
134 check_windows_arch (guestfs_h *g, struct inspect_fs *fs)
136 size_t len = strlen (fs->windows_systemroot) + 32;
138 snprintf (cmd_exe, len, "%s/system32/cmd.exe", fs->windows_systemroot);
140 char *cmd_exe_path = guestfs___case_sensitive_path_silently (g, cmd_exe);
144 char *arch = guestfs_file_architecture (g, cmd_exe_path);
148 fs->arch = arch; /* freed by guestfs___free_inspect_info */
153 /* At the moment, pull just the ProductName and version numbers from
154 * the registry. In future there is a case for making many more
155 * registry fields available to callers.
158 check_windows_software_registry (guestfs_h *g, struct inspect_fs *fs)
160 size_t len = strlen (fs->windows_systemroot) + 64;
162 snprintf (software, len, "%s/system32/config/software",
163 fs->windows_systemroot);
165 char *software_path = guestfs___case_sensitive_path_silently (g, software);
167 /* If the software hive doesn't exist, just accept that we cannot
168 * find product_name etc.
172 char *software_hive = NULL;
175 hive_value_h *values = NULL;
177 software_hive = guestfs___download_to_tmp (g, fs, software_path, "software",
179 if (software_hive == NULL)
182 h = hivex_open (software_hive, g->verbose ? HIVEX_OPEN_VERBOSE : 0);
184 perrorf (g, "hivex_open");
188 hive_node_h node = hivex_root (h);
189 const char *hivepath[] =
190 { "Microsoft", "Windows NT", "CurrentVersion" };
193 node != 0 && i < sizeof hivepath / sizeof hivepath[0];
195 node = hivex_node_get_child (h, node, hivepath[i]);
199 perrorf (g, "hivex: cannot locate HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion");
203 values = hivex_node_values (h, node);
205 for (i = 0; values[i] != 0; ++i) {
206 char *key = hivex_value_key (h, values[i]);
208 perrorf (g, "hivex_value_key");
212 if (STRCASEEQ (key, "ProductName")) {
213 fs->product_name = hivex_value_string (h, values[i]);
214 if (!fs->product_name) {
215 perrorf (g, "hivex_value_string");
220 else if (STRCASEEQ (key, "CurrentVersion")) {
221 char *version = hivex_value_string (h, values[i]);
223 perrorf (g, "hivex_value_string");
228 if (match2 (g, version, re_windows_version, &major, &minor)) {
229 fs->major_version = guestfs___parse_unsigned_int (g, major);
231 if (fs->major_version == -1) {
237 fs->minor_version = guestfs___parse_unsigned_int (g, minor);
239 if (fs->minor_version == -1) {
248 else if (STRCASEEQ (key, "InstallationType")) {
249 fs->product_variant = hivex_value_string (h, values[i]);
250 if (!fs->product_variant) {
251 perrorf (g, "hivex_value_string");
263 if (h) hivex_close (h);
265 free (software_path);
266 free (software_hive);
272 check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs)
274 size_t len = strlen (fs->windows_systemroot) + 64;
276 snprintf (system, len, "%s/system32/config/system",
277 fs->windows_systemroot);
279 char *system_path = guestfs___case_sensitive_path_silently (g, system);
281 /* If the system hive doesn't exist, just accept that we cannot
286 char *system_hive = NULL;
289 hive_node_h root, node;
290 hive_value_h value, *values = NULL;
295 guestfs___download_to_tmp (g, fs, system_path, "system",
297 if (system_hive == NULL)
300 h = hivex_open (system_hive, g->verbose ? HIVEX_OPEN_VERBOSE : 0);
302 perrorf (g, "hivex_open");
306 root = hivex_root (h);
308 perrorf (g, "hivex_root");
312 /* Get the CurrentControlSet. */
314 node = hivex_node_get_child (h, root, "Select");
317 perrorf (g, "hivex_node_get_child");
319 error (g, "hivex: could not locate HKLM\\SYSTEM\\Select");
324 value = hivex_node_get_value (h, node, "Current");
327 perrorf (g, "hivex_node_get_value");
329 error (g, "hivex: HKLM\\System\\Select Default entry not found.");
333 /* XXX Should check the type. */
334 dword = hivex_value_dword (h, value);
335 fs->windows_current_control_set = safe_asprintf (g, "ControlSet%03d", dword);
337 /* Get the drive mappings.
338 * This page explains the contents of HKLM\System\MountedDevices:
339 * http://www.goodells.net/multiboot/partsigs.shtml
342 node = hivex_node_get_child (h, root, "MountedDevices");
345 perrorf (g, "hivex_node_get_child");
347 error (g, "hivex: could not locate HKLM\\SYSTEM\\MountedDevices");
351 values = hivex_node_values (h, node);
353 /* Count how many DOS drive letter mappings there are. This doesn't
354 * ignore removable devices, so it overestimates, but that doesn't
355 * matter because it just means we'll allocate a few bytes extra.
357 for (i = count = 0; values[i] != 0; ++i) {
358 char *key = hivex_value_key (h, values[i]);
360 perrorf (g, "hivex_value_key");
363 if (STRCASEEQLEN (key, "\\DosDevices\\", 12) &&
364 c_isalpha (key[12]) && key[13] == ':')
369 fs->drive_mappings = calloc (2*count + 1, sizeof (char *));
370 if (fs->drive_mappings == NULL) {
371 perrorf (g, "calloc");
375 for (i = count = 0; values[i] != 0; ++i) {
376 char *key = hivex_value_key (h, values[i]);
378 perrorf (g, "hivex_value_key");
381 if (STRCASEEQLEN (key, "\\DosDevices\\", 12) &&
382 c_isalpha (key[12]) && key[13] == ':') {
383 /* Get the binary value. Is it a fixed disk? */
388 blob = hivex_value_value (h, values[i], &type, &len);
389 if (blob != NULL && type == 3 && len == 12) {
390 /* Try to map the blob to a known disk and partition. */
391 device = map_registry_disk_blob (g, blob);
392 if (device != NULL) {
393 fs->drive_mappings[count++] = safe_strndup (g, &key[12], 1);
394 fs->drive_mappings[count++] = device;
402 /* Get the hostname. */
403 const char *hivepath[] =
404 { fs->windows_current_control_set, "Services", "Tcpip", "Parameters" };
405 for (node = root, i = 0;
406 node != 0 && i < sizeof hivepath / sizeof hivepath[0];
408 node = hivex_node_get_child (h, node, hivepath[i]);
412 perrorf (g, "hivex: cannot locate HKLM\\SYSTEM\\%s\\Services\\Tcpip\\Parameters",
413 fs->windows_current_control_set);
418 values = hivex_node_values (h, node);
420 for (i = 0; values[i] != 0; ++i) {
421 char *key = hivex_value_key (h, values[i]);
423 perrorf (g, "hivex_value_key");
427 if (STRCASEEQ (key, "Hostname")) {
428 fs->hostname = hivex_value_string (h, values[i]);
430 perrorf (g, "hivex_value_string");
435 /* many other interesting fields here ... */
443 if (h) hivex_close (h);
451 /* Windows Registry HKLM\SYSTEM\MountedDevices uses a blob of data
452 * to store partitions. This blob is described here:
453 * http://www.goodells.net/multiboot/partsigs.shtml
454 * The following function maps this blob to a libguestfs partition
458 map_registry_disk_blob (guestfs_h *g, const char *blob)
460 char **devices = NULL;
461 struct guestfs_partition_list *partitions = NULL;
465 uint64_t part_offset;
467 /* First 4 bytes are the disk ID. Search all devices to find the
468 * disk with this disk ID.
470 devices = guestfs_list_devices (g);
474 for (i = 0; devices[i] != NULL; ++i) {
475 /* Read the disk ID. */
476 diskid = guestfs_pread_device (g, devices[i], 4, 0x01b8, &len);
483 if (memcmp (diskid, blob, 4) == 0) { /* found it */
492 /* Next 8 bytes are the offset of the partition in bytes(!) given as
493 * a 64 bit little endian number. Luckily it's easy to get the
494 * partition byte offset from guestfs_part_list.
496 part_offset = le64toh (* (uint64_t *) &blob[4]);
498 partitions = guestfs_part_list (g, devices[i]);
499 if (partitions == NULL)
502 for (j = 0; j < partitions->len; ++j) {
503 if (partitions->val[j].part_start == part_offset) /* found it */
504 goto found_partition;
509 /* Construct the full device name. */
510 ret = safe_asprintf (g, "%s%d", devices[i], partitions->val[j].part_num);
514 guestfs___free_string_list (devices);
516 guestfs_free_partition_list (partitions);
521 guestfs___case_sensitive_path_silently (guestfs_h *g, const char *path)
523 guestfs_error_handler_cb old_error_cb = g->error_cb;
525 char *ret = guestfs_case_sensitive_path (g, path);
526 g->error_cb = old_error_cb;
530 #endif /* defined(HAVE_HIVEX) */