Context Navigation

source: trunk/src/sh_registry.c@ 322

Last change on this file since 322 was 312, checked in by katerina, 14 years ago
Fix for ticket #233 (Cygwin compile error).
File size: 23.1 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 2010 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	/***************************************************************************
21	*
22	* This file provides a module for samhain to check the MS Windows registry.
23	*
24	*/
25
26	#include "config_xor.h"
27
28	#ifdef USE_REGISTRY_CHECK
29
30	#include <windows.h>
31	#include <stdio.h>
32	#include <time.h>
33
34	#define FIL__ _("sh_registry.c")
35
36	/* We don't want to build this into yule
37	*/
38	#if defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE)
39
40	#include <sys/types.h>
41	#include <regex.h>
42
43	#include "samhain.h"
44	#include "sh_pthread.h"
45	#include "sh_utils.h"
46	#include "sh_unix.h"
47	#include "sh_modules.h"
48	#include "sh_hash.h"
49	#include "sh_tiger.h"
50
51	static int check_key (char * name, int isSingle);
52
53	static int sh_reg_set_active (const char *s);
54	static int sh_reg_set_interval (const char * c);
55	static int sh_reg_set_severity (const char *s);
56	static int sh_reg_add_key (const char *s);
57	static int sh_reg_add_hierarchy (const char *s);
58	static int sh_reg_add_stop (const char *s);
59	static int sh_reg_add_ign (const char *s);
60
61	#define STOP_FALSE 0
62	#define STOP_CHECK 1
63	#define STOP_IGN 2
64
65	sh_rconf sh_reg_check_table[] = {
66	{
67	N_("severitychange"),
68	sh_reg_set_severity,
69	},
70	{
71	N_("registrycheckactive"),
72	sh_reg_set_active,
73	},
74	{
75	N_("registrycheckinterval"),
76	sh_reg_set_interval,
77	},
78	{
79	N_("singlekey"),
80	sh_reg_add_key,
81	},
82	{
83	N_("hierarchy"),
84	sh_reg_add_hierarchy,
85	},
86	{
87	N_("stopatkey"),
88	sh_reg_add_stop,
89	},
90	{
91	N_("ignorekey"),
92	sh_reg_add_ign,
93	},
94	{
95	NULL,
96	NULL
97	}
98	};
99
100	/* Runtime configuration */
101
102	#define SH_REGISTRY_INTERVAL 300
103
104	static int ShRegCheckActive = S_FALSE;
105	static time_t sh_reg_check_interval = SH_REGISTRY_INTERVAL;
106	static int sh_reg_check_severity = SH_ERR_SEVERE;
107
108	struct regkeylist {
109	char * name;
110	int stop;
111	int single;
112	#ifdef HAVE_REGEX_H
113	regex_t preg;
114	#endif
115
116	struct regkeylist *next;
117	};
118
119	static struct regkeylist * keylist = NULL;
120
121	static int sh_reg_set_active(const char *s)
122	{
123	int value;
124
125	SL_ENTER(_("sh_reg_set_active"));
126
127	value = sh_util_flagval(s, &ShRegCheckActive);
128
129	SL_RETURN((value), _("sh_reg_set_active"));
130	}
131
132	static int sh_reg_set_interval (const char * c)
133	{
134	int retval = 0;
135	long val;
136
137	SL_ENTER(_("sh_reg_set_interval"));
138	val = strtol (c, (char **)NULL, 10);
139	if (val <= 0)
140	{
141	SH_MUTEX_LOCK(mutex_thread_nolog);
142	sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
143	_("registry check interval"), c);
144	SH_MUTEX_UNLOCK(mutex_thread_nolog);
145	retval = -1;
146	}
147
148	sh_reg_check_interval = (time_t) val;
149	SL_RETURN(0, _("sh_reg_set_interval"));
150	}
151
152	static int sh_reg_set_severity (const char *s)
153	{
154	char tmp[32];
155	tmp[0] = '='; tmp[1] = '\0';
156	sl_strlcat (tmp, s, 32);
157	return sh_error_set_level (tmp, &sh_reg_check_severity);
158	}
159
160	static int sh_reg_add_key_int (const char *s, int isSingle, int isStop)
161	{
162	struct regkeylist * newkey;
163	size_t len = sl_strlen(s);
164
165	if (len > 0)
166	{
167	newkey = SH_ALLOC(sizeof(struct regkeylist));
168	newkey->single = isSingle;
169	newkey->stop = isStop;
170	newkey->name = NULL;
171
172	if (STOP_FALSE == isStop)
173	{
174	newkey->name = SH_ALLOC(len + 1);
175	sl_strlcpy(newkey->name, s, len+1);
176	}
177	else
178	{
179	#ifdef HAVE_REGEX_H
180	int status = regcomp(&(newkey->preg), s, REG_NOSUB\|REG_EXTENDED);
181	if (status != 0)
182	{
183	char errbuf[256];
184	regerror(status, &(newkey->preg), errbuf, sizeof(errbuf));
185	SH_MUTEX_LOCK(mutex_thread_nolog);
186	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
187	errbuf, _("sh_reg_add_key_int"));
188	SH_MUTEX_UNLOCK(mutex_thread_nolog);
189	SH_FREE(newkey);
190	return -1;
191	}
192	#else
193	newkey->name = SH_ALLOC(len + 1);
194	sl_strlcpy(newkey->name, s, len+1);
195	#endif
196	}
197	newkey->next = keylist;
198	keylist = newkey;
199	return 0;
200	}
201	return -1;
202	}
203
204	static int sh_reg_add_key (const char *s)
205	{
206	return sh_reg_add_key_int (s, S_TRUE, STOP_FALSE);
207	}
208	static int sh_reg_add_hierarchy (const char *s)
209	{
210	return sh_reg_add_key_int (s, S_FALSE, STOP_FALSE);
211	}
212	static int sh_reg_add_stop (const char *s)
213	{
214	return sh_reg_add_key_int (s, S_FALSE, STOP_CHECK);
215	}
216	static int sh_reg_add_ign (const char *s)
217	{
218	return sh_reg_add_key_int (s, S_FALSE, STOP_IGN);
219	}
220
221	/* Module functions */
222
223	int sh_reg_check_init(struct mod_type * arg)
224	{
225	#ifndef HAVE_PTHREAD
226	(void) arg;
227	#endif
228
229	if (ShRegCheckActive == S_FALSE)
230	return SH_MOD_FAILED;
231	#ifdef HAVE_PTHREAD
232	if (arg != NULL && arg->initval < 0 &&
233	(sh.flag.isdaemon == S_TRUE \|\| sh.flag.loop == S_TRUE))
234	{
235	if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
236	return SH_MOD_THREAD;
237	else
238	return SH_MOD_FAILED;
239	}
240	#endif
241	return 0;
242	}
243
244	int sh_reg_check_timer(time_t tcurrent)
245	{
246	static time_t lastcheck = 0;
247
248	SL_ENTER(_("sh_reg_check_timer"));
249	if ((time_t) (tcurrent - lastcheck) >= sh_reg_check_interval)
250	{
251	lastcheck = tcurrent;
252	SL_RETURN((-1), _("sh_reg_check_timer"));
253	}
254	SL_RETURN(0, _("sh_reg_check_timer"));
255	}
256
257	#define SH_REGFORM_NEW 1
258	#define SH_REGFORM_OLD 2
259
260	static char * format_changes(int flag, char * buf, size_t len,
261	time_t time_old, unsigned long size_old,
262	unsigned long keys_old, unsigned long values_old,
263	char * hash_old,
264	time_t time_new, unsigned long size_new,
265	unsigned long keys_new, unsigned long values_new,
266	char * hash_new)
267	{
268	char timestr1[32];
269	char timestr2[32];
270	char timestr3[32];
271
272	char buf_old[512] = "";
273	char buf_new[512] = "";
274
275	if ((0 != (flag & SH_REGFORM_NEW)) && (NULL != hash_new))
276	{
277	(void) sh_unix_gmttime (time_new, timestr1, sizeof(timestr1));
278	(void) sh_unix_gmttime (keys_new, timestr2, sizeof(timestr2));
279	(void) sh_unix_gmttime (values_new, timestr3, sizeof(timestr3));
280
281	#ifdef SH_USE_XML
282	sl_snprintf(buf_new, sizeof(buf_new),
283	"size_new=\"%lu\" mtime_new=\"%s\" ctime_new=\"%s\" atime_new=\"%s\" chksum_new=\"%s\"",
284	size_new, timestr1, timestr2, timestr3, hash_new);
285	#else
286	sl_snprintf(buf_new, sizeof(buf_new),
287	"size_new=<%lu>, mtime_new=<%s>, ctime_new=<%s>, atime_new=<%s>, chksum_new=<%s>",
288	size_new, timestr1, timestr2, timestr3, hash_new);
289	#endif
290	}
291
292	if ((0 != (flag & SH_REGFORM_OLD)) && (NULL != hash_old))
293	{
294	(void) sh_unix_gmttime (time_old, timestr1, sizeof(timestr1));
295	(void) sh_unix_gmttime (keys_old, timestr2, sizeof(timestr2));
296	(void) sh_unix_gmttime (values_old, timestr3, sizeof(timestr3));
297
298	#ifdef SH_USE_XML
299	sl_snprintf(buf_old, sizeof(buf_old),
300	" size_old=\"%lu\" mtime_old=\"%s\" ctime_old=\"%s\" atime_old=\"%s\" chksum_old=\"%s\"",
301	size_old, timestr1, timestr2, timestr3, hash_old);
302	#else
303	sl_snprintf(buf_old, sizeof(buf_old),
304	" size_old=<%lu>, mtime_old=<%s>, ctime_old=<%s>, atime_old=<%s>, chksum_old=<%s>",
305	size_old, timestr1, timestr2, timestr3, hash_old);
306	#endif
307	}
308
309	sl_strlcpy(buf, buf_new, len);
310	sl_strlcat(buf, buf_old, len);
311
312	return buf;
313	}
314
315	static void report_missing_entry(const char * path)
316	{
317	char * infobuf = SH_ALLOC(1024);
318	char * errbuf = SH_ALLOC(1024);
319	char * tmp = sh_util_safe_name (path);
320	char timestr[32];
321	struct store2db save;
322
323	memset(&save, '\0', sizeof(struct store2db));
324	sh_hash_db2pop (path, &save);
325
326	(void) sh_unix_gmttime (save.val1, timestr, sizeof(timestr));
327
328	sl_snprintf(infobuf, 1024, _("mtime=%s size=%lu subkeys=%lu values=%lu"),
329	timestr,
330	(unsigned long) save.val0,
331	(unsigned long) save.val2,
332	(unsigned long) save.val3);
333
334	(void) format_changes (SH_REGFORM_OLD, errbuf, 1024,
335	save.val1, save.val0, save.val2, save.val3, save.checksum,
336	0, 0, 0, 0, NULL);
337
338	SH_MUTEX_LOCK(mutex_thread_nolog);
339	sh_error_handle(sh_reg_check_severity, FIL__, __LINE__, 0, MSG_REG_MISS,
340	infobuf, tmp, errbuf);
341	SH_MUTEX_UNLOCK(mutex_thread_nolog);
342
343	SH_FREE(tmp);
344	SH_FREE(errbuf);
345	SH_FREE(infobuf);
346	return;
347	}
348
349	int sh_reg_check_run(void)
350	{
351	struct regkeylist *this = keylist;
352
353	if (this)
354	{
355	SH_MUTEX_LOCK(mutex_thread_nolog);
356	sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
357	_("Checking the registry"),
358	_("sh_reg_check_run"));
359	SH_MUTEX_UNLOCK(mutex_thread_nolog);
360
361	while (this)
362	{
363	if (STOP_FALSE == this->stop)
364	{
365	/*
366	* -- Check key --
367	*/
368	check_key (this->name, this->single);
369	}
370	this = this->next;
371	}
372	}
373	sh_hash_unvisited_custom ('H', report_missing_entry);
374
375	return 0;
376	}
377
378	int sh_reg_check_reconf(void)
379	{
380	struct regkeylist *this;
381
382	while (keylist)
383	{
384	this = keylist;
385	keylist = keylist->next;
386
387	if (this->name)
388	SH_FREE(this->name);
389	#ifdef HAVE_REGEX_H
390	if (STOP_FALSE != this->stop)
391	regfree(&(this->preg));
392	#endif
393	SH_FREE(this);
394	}
395
396	sh_reg_check_interval = SH_REGISTRY_INTERVAL;
397
398	return 0;
399	}
400
401	int sh_reg_check_cleanup(void)
402	{
403	sh_reg_check_reconf();
404	return 0;
405	}
406
407	/* >>>>>>>>>>>> Main check function <<<<<<<<<<<< */
408
409
410	#include <windows.h>
411
412	#define MAX_KEY_LENGTH (2*256)
413	#define MAX_VALUE_NAME (2*16384)
414
415	CHAR achValue[MAX_VALUE_NAME];
416
417	unsigned long nKeys = 0;
418	unsigned long nVals = 0;
419
420	static int CheckThisSubkey (HKEY key, char * subkey, char * path,
421	int isSingle, int view);
422
423	static time_t convertTime(FILETIME * ft)
424	{
425	time_t result;
426
427	/* Shift high part up by 2^32
428	*/
429	UINT64 date = ((UINT64)ft->dwHighDateTime) << 32;
430
431	/* Add low part
432	*/
433	date \|= (UINT64)ft->dwLowDateTime;
434
435	/* Subtract difference between Jan 1, 1601 and Jan 1, 1970
436	*/
437	date -= ((UINT64)116444736) * ((UINT64)100) * ((UINT64)10000000);
438
439	/* Divide by number of 100-nanosecond intervals per second
440	*/
441	date /= ((UINT64)10000000);
442
443	/* Convert to a time_t
444	*/
445	result = (time_t) date;
446
447	return result;
448	}
449
450	#if !defined(KEY_WOW64_64KEY)
451	#define KEY_WOW64_64KEY 0x0100;
452	#endif
453	#if !defined(KEY_WOW64_32KEY)
454	#define KEY_WOW64_32KEY 0x0200;
455	#endif
456
457
458	#define SH_KEY_NULL _("000000000000000000000000000000000000000000000000")
459
460	int QueryKey(HKEY hKey, char * path, size_t pathlen, int isSingle)
461	{
462	CHAR achKey[MAX_KEY_LENGTH]; /* buffer for subkey name */
463	DWORD cbName; /* size of name string */
464	/* CHAR achClass[MAX_PATH] = ""; // buffer for class name */
465	/* DWORD cchClassName = MAX_PATH/2;// size of class string */
466	DWORD cSubKeys=0; /* number of subkeys */
467	DWORD cbMaxSubKey; /* longest subkey size */
468	DWORD cchMaxClass; /* longest class string */
469	DWORD cValues; /* number of values for key */
470	DWORD cchMaxValue; /* longest value name */
471	DWORD cbMaxValueData; /* longest value data */
472	DWORD cbSecurityDescriptor; /* size of security descriptor */
473	FILETIME ftLastWriteTime; /* last write time */
474	DWORD lpType; /* type of data stored in value */
475	BYTE lpData[256]; /* buffer for data in value */
476	DWORD lpcbData; /* size of lpData buffer */
477	DWORD i, retCode;
478	DWORD cchValue = MAX_VALUE_NAME/2;
479
480	char hashbuf[KEYBUF_SIZE];
481	unsigned long totalSize = 0;
482	time_t fTime = 0;
483
484	char * tPath = NULL;
485	int doUpdate = S_FALSE;
486
487	retCode = RegQueryInfoKey(
488	hKey, /* key handle */
489	NULL /* achClass /, / buffer for class name */
490	NULL /* &cchClassName /,/ size of class string */
491	NULL, /* reserved */
492	&cSubKeys, /* number of subkeys */
493	&cbMaxSubKey, /* longest subkey size */
494	&cchMaxClass, /* longest class string */
495	&cValues, /* number of values for this key */
496	&cchMaxValue, /* longest value name */
497	&cbMaxValueData, /* longest value data */
498	&cbSecurityDescriptor, /* security descriptor */
499	&ftLastWriteTime); /* last write time */
500
501	if (retCode != ERROR_SUCCESS)
502	{
503	return -1;
504	}
505
506	++nKeys;
507
508	fTime = convertTime (&ftLastWriteTime);
509
510	/* Enumerate the subkeys, until RegEnumKeyEx fails. */
511
512	if (cSubKeys)
513	{
514	/*
515	* printf( "\nNumber of subkeys: %lu\n", (unsigned long) cSubKeys);
516	*/
517
518	for (i=0; i<cSubKeys; i++)
519	{
520	cbName = MAX_KEY_LENGTH/2;
521	retCode = RegEnumKeyEx(hKey, i,
522	achKey,
523	&cbName,
524	NULL,
525	NULL,
526	NULL,
527	&ftLastWriteTime);
528
529	if (retCode == ERROR_SUCCESS && S_TRUE != isSingle)
530	{
531	/*
532	* _tprintf(TEXT("(%lu) %s\\%s\n"), (unsigned long) i+1,
533	* path, achKey);
534	*/
535	CheckThisSubkey (hKey, achKey, path, isSingle, 0);
536	}
537	}
538	}
539
540	/* Enumerate the key values. */
541
542	if (cValues)
543	{
544	char hashtmp[3][KEYBUF_SIZE];
545
546	memset(hashbuf, '0', sizeof(hashbuf));
547
548	/* Loop over values and build checksum */
549
550	for (i=0, retCode=ERROR_SUCCESS; i<cValues; i++)
551	{
552	LPBYTE lpDataAlloc = NULL;
553
554	cchValue = MAX_VALUE_NAME/2;
555	achValue[0] = '\0';
556	lpcbData = sizeof(lpData);
557	retCode = RegEnumValue(hKey, i,
558	achValue,
559	&cchValue,
560	NULL,
561	&lpType,
562	lpData,
563	&lpcbData);
564
565	if (retCode == ERROR_MORE_DATA)
566	{
567	lpDataAlloc = SH_ALLOC(lpcbData);
568
569	retCode = RegEnumValue(hKey, i,
570	achValue,
571	&cchValue,
572	NULL,
573	&lpType,
574	lpDataAlloc,
575	&lpcbData);
576	}
577
578	if (retCode == ERROR_SUCCESS)
579	{
580	totalSize += lpcbData;
581
582	/* checksum(valuename) */
583	sh_tiger_hash (achValue, TIGER_DATA, cchValue,
584	hashtmp[0], KEYBUF_SIZE);
585
586	/* checksum(valuedata) */
587	if (NULL == lpDataAlloc)
588	{
589	sh_tiger_hash ((char*) lpData, TIGER_DATA, lpcbData,
590	hashtmp[1], KEYBUF_SIZE);
591	}
592	else
593	{
594	sh_tiger_hash ((char*) lpDataAlloc, TIGER_DATA, lpcbData,
595	hashtmp[1], KEYBUF_SIZE);
596	}
597
598	/* old_checksum */
599	memcpy(hashtmp[2], hashbuf, KEYBUF_SIZE);
600
601	/* hash(hash(valuename)+hash(valuedata)+old_hash) */
602	sh_tiger_hash ((char*) hashtmp, TIGER_DATA,
603	sizeof(hashtmp), hashbuf, sizeof(hashbuf));
604
605	++nVals;
606	}
607
608	if (lpDataAlloc)
609	{
610	SH_FREE(lpDataAlloc);
611	}
612	}
613	}
614	else
615	{
616	/* no values */
617	sl_strlcpy(hashbuf, SH_KEY_NULL, sizeof(hashbuf));
618	}
619
620	/* Here we have:
621	* hashbuf [checksum over values],
622	* fTime [last write time],
623	* totalSize [size of all value data],
624	* cSubKeys [number of subkeys],
625	* cValues [number of values],
626	* path, pathlen [which may be up to 131072 (256*512) bytes]
627	*/
628
629	if (pathlen > (PATH_MAX-1))
630	{
631	char hashbuf2[KEYBUF_SIZE];
632	char * p = strchr(path, '\\');
633
634	if (p)
635	{
636	char *q = p;
637
638	++p;
639
640	tPath = SH_ALLOC(256 + KEYBUF_SIZE);
641	*q = '\0';
642	sl_strlcpy(tPath, path, 256); /* truncates */
643	*q = '\\';
644	sl_strlcat(tPath, "\\", 257);
645	(void) sh_tiger_hash(p, TIGER_DATA, sl_strlen(p),
646	hashbuf2, sizeof(hashbuf2));
647	sl_strlcat(tPath, hashbuf2, 256 + KEYBUF_SIZE);
648	}
649	}
650
651	if (sh.flag.checkSum == SH_CHECK_CHECK \|\| sh.flag.update == S_TRUE)
652	{
653	struct store2db save;
654
655	memset(&save, '\0', sizeof(struct store2db));
656
657	if (tPath)
658	{
659	sh_hash_db2pop (tPath, &save);
660	}
661	else
662	{
663	sh_hash_db2pop (path, &save);
664	}
665
666	if (save.size == -1)
667	{
668	/* Not in database */
669
670	char * infobuf = SH_ALLOC(1024);
671	char * errbuf = SH_ALLOC(1024);
672	char * tmp = sh_util_safe_name ((tPath == NULL) ? path : tPath);
673	char timestr[32];
674
675	(void) sh_unix_gmttime (fTime, timestr, sizeof(timestr));
676
677	sl_snprintf(infobuf, 1024,
678	_("mtime=%s size=%lu subkeys=%lu values=%lu"),
679	timestr,
680	(unsigned long) totalSize,
681	(unsigned long) cSubKeys,
682	(unsigned long) cValues);
683
684	(void) format_changes (SH_REGFORM_NEW, errbuf, 1024,
685	0, 0, 0, 0, NULL,
686	fTime, totalSize, cSubKeys, cValues, hashbuf);
687
688	SH_MUTEX_LOCK(mutex_thread_nolog);
689	sh_error_handle(sh_reg_check_severity, FIL__, __LINE__,
690	0, MSG_REG_NEW,
691	infobuf, tmp, errbuf);
692	SH_MUTEX_UNLOCK(mutex_thread_nolog);
693
694	SH_FREE(tmp);
695	SH_FREE(errbuf);
696	SH_FREE(infobuf);
697
698	doUpdate = S_TRUE;
699	}
700	else if (save.val0 != totalSize \|\|
701	((time_t) save.val1) != fTime \|\|
702	save.val2 != cSubKeys \|\|
703	save.val3 != cValues \|\|
704	0 != strcmp(save.checksum, hashbuf))
705	{
706	/* Change detected */
707	char * infobuf = SH_ALLOC(1024);
708	char * errbuf = SH_ALLOC(1024);
709	char * tmp = sh_util_safe_name ((tPath == NULL) ? path : tPath);
710	char timestr_new[32];
711
712	(void) sh_unix_gmttime (fTime, timestr_new, sizeof(timestr_new));
713
714	sl_snprintf(infobuf, 1024,
715	_("mtime=%s size %lu->%lu subkeys %lu->%lu values %lu->%lu checksum %s"),
716	timestr_new,
717	(unsigned long) save.val0, (unsigned long) totalSize,
718	(unsigned long) save.val2, (unsigned long) cSubKeys,
719	(unsigned long) save.val3, (unsigned long) cValues,
720	(0 == strcmp(save.checksum, hashbuf)) ? _("good") : _("bad"));
721
722	(void) format_changes (SH_REGFORM_OLD\|SH_REGFORM_NEW, errbuf, 1024,
723	save.val1, save.val0,
724	save.val2, save.val3, save.checksum,
725	fTime, totalSize,
726	cSubKeys, cValues, hashbuf);
727
728	SH_MUTEX_LOCK(mutex_thread_nolog);
729	sh_error_handle(sh_reg_check_severity, FIL__, __LINE__,
730	0, MSG_REG_CHANGE,
731	infobuf, tmp, errbuf);
732	SH_MUTEX_UNLOCK(mutex_thread_nolog);
733
734	SH_FREE(tmp);
735	SH_FREE(errbuf);
736	SH_FREE(infobuf);
737
738	doUpdate = S_TRUE;
739	}
740	}
741
742	if ( sh.flag.checkSum == SH_CHECK_INIT \|\| doUpdate == S_TRUE )
743	{
744	struct store2db save;
745
746	memset(&save, '\0', sizeof(struct store2db));
747
748	save.val0 = totalSize;
749	save.val1 = fTime;
750	save.val2 = cSubKeys;
751	save.val3 = cValues;
752	sl_strlcpy(save.checksum, hashbuf, KEY_LEN+1);
753
754	if (tPath)
755	{
756	sh_hash_push2db (tPath, &save);
757	}
758	else
759	{
760	sh_hash_push2db (path, &save);
761	}
762	}
763
764	if (tPath)
765	sh_hash_set_visited (tPath);
766	else
767	sh_hash_set_visited (path);
768
769	if (tPath)
770	{
771	SH_FREE(tPath);
772	}
773
774	return 0;
775	}
776
777	static int check_for_stop (char * name)
778	{
779	struct regkeylist *this = keylist;
780
781	while (this)
782	{
783	if (STOP_FALSE != this->stop)
784	{
785	#ifdef HAVE_REGEX_H
786	if (0 == regexec(&(this->preg), name, 0, NULL, 0))
787	return this->stop;
788	#else
789	if (0 == strcmp(this->name, name))
790	return this->stop;
791	#endif
792	}
793	this = this->next;
794	}
795	return STOP_FALSE;
796	}
797
798
799	int CheckThisSubkey (HKEY key, char * subkey, char * path, int isSingle,
800	int view)
801	{
802	HKEY hTestKey;
803	char * newpath;
804	size_t len;
805	int retval = -1;
806
807	len = strlen(path) + 1 + strlen(subkey) + 1;
808	newpath = SH_ALLOC(len);
809	snprintf(newpath, len, "%s\\%s", path, subkey);
810
811	/* Check for stop condition, if not single key.
812	* Set flag to isSingle = S_TRUE if we should stop here.
813	*/
814	if (S_TRUE != isSingle)
815	{
816	int isStop = check_for_stop(newpath);
817
818	if (STOP_CHECK == isStop)
819	{
820	isSingle = S_TRUE;
821	}
822	else if (STOP_IGN == isStop)
823	{
824	SH_FREE(newpath);
825	return 0;
826	}
827	}
828
829	len = strlen(path) + 1 + strlen(subkey) + 1;
830	newpath = SH_ALLOC(len);
831	snprintf(newpath, len, "%s\\%s", path, subkey);
832
833	if( RegOpenKeyEx( key,
834	subkey,
835	0,
836	(KEY_READ \| view),
837	&hTestKey) == ERROR_SUCCESS
838	)
839	{
840	QueryKey(hTestKey, newpath, len-1, isSingle);
841	RegCloseKey(hTestKey);
842	retval = 0;
843	}
844	else
845	{
846	/* Error message */
847	char * tmp = sh_util_safe_name (newpath);
848	size_t tlen = sl_strlen(tmp);
849
850	if (SL_TRUE == sl_ok_adds(64, tlen))
851	{
852	char * errbuf = SH_ALLOC(64 + tlen);
853	sl_snprintf(errbuf, 64+tlen, _("Failed to open key %s"), tmp);
854
855	SH_MUTEX_LOCK(mutex_thread_nolog);
856	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
857	errbuf, _("CheckThisSubkey"));
858	SH_MUTEX_UNLOCK(mutex_thread_nolog);
859
860	SH_FREE(errbuf);
861	}
862	sh_reg_add_ign (tmp);
863	SH_FREE(tmp);
864	}
865
866	SH_FREE(newpath);
867	return retval;
868	}
869
870
871	int check_key (char * key, int isSingle)
872	{
873	HKEY topKey;
874	char * subkey;
875	char path[20] = "";
876	int pos = 0;
877	int retval = -1;
878
879	if (0 == strncmp(key, _("HKEY_CLASSES_ROOT"), 17))
880	{
881	topKey = HKEY_CLASSES_ROOT;
882	pos = 17;
883	strncpy(path, _("HKEY_CLASSES_ROOT"), sizeof(path));
884	}
885	else if (0 == strncmp(key, _("HKEY_CURRENT_USER"), 17))
886	{
887	topKey = HKEY_CURRENT_USER;
888	pos = 17;
889	strncpy(path, _("HKEY_CURRENT_USER"), sizeof(path));
890	}
891	else if (0 == strncmp(key, _("HKEY_LOCAL_MACHINE"), 18))
892	{
893	topKey = HKEY_LOCAL_MACHINE;
894	pos = 18;
895	strncpy(path, _("HKEY_LOCAL_MACHINE"), sizeof(path));
896	}
897	else if (0 == strncmp(key, _("HKEY_USERS"), 10))
898	{
899	topKey = HKEY_USERS;
900	pos = 10;
901	strncpy(path, _("HKEY_USERS"), sizeof(path));
902	}
903
904
905	if (pos > 0)
906	{
907	if (key[pos] == '\\')
908	{
909	++pos;
910	subkey = &key[pos];
911	}
912	}
913	else
914	{
915
916	char * tmp = sh_util_safe_name_keepspace(key);
917	size_t tlen = sl_strlen(tmp);
918
919	if (SL_TRUE == sl_ok_adds(64, tlen))
920	{
921	char * errbuf = SH_ALLOC(64 + tlen);
922
923	sl_snprintf(errbuf, 64+tlen, _("Invalid key %s"), tmp);
924
925	SH_MUTEX_LOCK(mutex_thread_nolog);
926	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
927	errbuf, _("check_key"));
928	SH_MUTEX_UNLOCK(mutex_thread_nolog);
929
930	SH_FREE(errbuf);
931	}
932	SH_FREE(tmp);
933	return -1;
934	}
935
936	/************************
937	if (ShCheckBothViews)
938	{
939	CheckThisSubkey (topKey, subkey, path, isSingle, KEY_WOW64_32KEY);
940	return CheckThisSubkey (topKey, subkey, path, isSingle, KEY_WOW64_64KEY);
941	}
942	*************************/
943
944	return CheckThisSubkey (topKey, subkey, path, isSingle, 0);
945	}
946
947	/* #if defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE) */
948	#endif
949
950	/* #ifdef USE_REGISTRY_CHECK */
951	#endif
952

Note: See TracBrowser for help on using the repository browser.

Download in other formats: