thr3ads.net - Libguestfs - [Libguestfs] [PATCH 0/3] virt-win-reg: Add support for HKEY

If this information is useful, please help other people find it:
Share via:

Richard W.M. Jones

2011-May-17 12:23 UTC

[Libguestfs] [PATCH 0/3] virt-win-reg: Add support for HKEY_USERS

This three part patch series extends virt-win-reg so it supports
HKEY_USERS\... paths, for reading and writing user preferences.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v

Richard W.M. Jones

2011-May-17 12:24 UTC

head link

[Libguestfs] [PATCH 1/3] virt-win-reg: Don't hard-code the relationship between hive name and path.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming blog: http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)
http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora
-------------- next part -------------->From ee85b03cd26169db067ee917f8f3e4e8ade54f0f Mon Sep 17 00:00:00 2001From: Richard W.M. Jones <rjones at redhat.com>
Date: Tue, 17 May 2011 09:00:30 +0100
Subject: [PATCH 1/3] virt-win-reg: Don't hard-code the relationship between
 hive name and path.

The crucial change is the tuple that is returned by map_path_to_hive:

-    my ($hivename, [...]) = map_path_to_hive ($_);
+    my ($hiveshortname, $hivefile, [...]) = map_path_to_hive ($_);

Previously the $hivename was both the name of the hive (eg. "sam"),
the name of the local copy in /tmp, and the name of the hive in
%systemroot%\system32\config.

In the new code, the $hiveshortname (eg. "sam") is still used for the
local copy in /tmp, but we return $hivefile which is the full Windows
path (eg. "/windows/system32/config/sam").

The purpose of this change is to allow us in future to return hives
from other Windows directories, specifically HKEY_USER hives from
Windows home directories.

Although this is just code motion, it requires some quite extensive
changes to virt-win-reg.
---
 tools/virt-win-reg |   90 ++++++++++++++++++++++++++++-----------------------
 1 files changed, 49 insertions(+), 41 deletions(-)

diff --git a/tools/virt-win-reg b/tools/virt-win-reg
index 210d99f..056ecce 100755
--- a/tools/virt-win-reg
+++ b/tools/virt-win-reg
@@ -275,7 +275,10 @@ my $systemroot = $g->inspect_get_windows_systemroot
($roots[0]);
 # Create a working directory to store the downloaded registry files.
 my $tmpdir = tempdir (CLEANUP => 1);
 
-# Only used when merging to map downloaded hive names to hive handles.
+# Used when merging (only) to map from the downloaded hiveshortname to
+# various properties about the hive.  The key is hiveshortname.  The
+# value is a hashref containing {h} (hive handle) and {hivefile} (full
+# hive path on the Windows side).
 my %hives;
 
 if (!$merge) {                  # Export mode.
@@ -286,24 +289,25 @@ if (!$merge) {                  # Export mode.
     my $name = shift @ARGV; # or undef
 
     # Map this to the hive name.  This function dies on failure.
-    my ($hivename, $prefix);
-    ($hivename, $path, $prefix) = map_path_to_hive ($path);
+    my ($hiveshortname, $hivefile, $prefix);
+    ($hiveshortname, $hivefile, $path, $prefix) = map_path_to_hive ($path);
 
     # Download the chosen hive.
-    download_hive ($hivename);
+    download_hive ($hivefile, $hiveshortname);
 
     # Open it.
-    my $h = Win::Hivex->open ("$tmpdir/$hivename", debug =>
$debug);
+    my $h = Win::Hivex->open ("$tmpdir/$hiveshortname", debug
=> $debug);
 
     unless ($name) {
         # Export it.
-        warn "exporting $path from $hivename with prefix $prefix ..."
if $debug;
+        warn "exporting $path from $hiveshortname with prefix $prefix
..."
+            if $debug;
         reg_export ($h, $path, \*STDOUT,
                     prefix => $prefix,
                     unsafe_printable_strings => $unsafe_printable_strings);
     } else {
         # Export a single key using hivexget.
-        my @args = ("hivexget", "$tmpdir/$hivename", $path,
$name);
+        my @args = ("hivexget", "$tmpdir/$hiveshortname",
$path, $name);
         warn "running ", join (" ", @args), "
..." if $debug;
         system (@args) == 0 or die "hivexget failed: $?"
     }
@@ -320,17 +324,15 @@ else {                          # Import mode.
 
     # Now we've done importing, commit all the hive handles and
     # close them all.
-    $_->commit (undef) foreach values %hives;
-    %hives = ();
-
-    # Look in the tmpdir for all the hive files which have been
-    # downloaded / modified by the import mapper, and upload
-    # each one.
-    opendir my $dh, $tmpdir or die "$tmpdir: $!";
-    foreach (readdir $dh) {
-        unless (/^\./) {
-            upload_hive ($_)
-        }
+    foreach (values %hives) {
+        my $h = $_->{h};
+        delete $_->{h};
+        $h->commit (undef);
+    }
+
+    # Upload all the downloaded hives.
+    foreach my $hiveshortname (keys %hives) {
+        upload_hive ($hiveshortname, $hives{$hiveshortname}->{hivefile})
     }
 
     # Sync everything.
@@ -345,18 +347,19 @@ sub import_mapper
 {
     local $_ = shift;
 
-    my ($hivename, $path, $prefix) = map_path_to_hive ($_);
+    my ($hiveshortname, $hivefile, $path, $prefix) = map_path_to_hive ($_);
 
     # Need to download this hive?
-    unless (-f "$tmpdir/$hivename") {
-        download_hive ($hivename);
+    unless (-f "$tmpdir/$hiveshortname") {
+        download_hive ($hivefile, $hiveshortname);
 
-        my $h = Win::Hivex->open ("$tmpdir/$hivename",
+        my $h = Win::Hivex->open ("$tmpdir/$hiveshortname",
                                   write => 1, debug => $debug);
-        $hives{$hivename} = $h;
+        my %hash = ( h => $h, hivefile => $hivefile );
+        $hives{$hiveshortname} = \%hash;
     }
 
-    return ($hives{$hivename}, $path);
+    return ($hives{$hiveshortname}->{h}, $path);
 }
 
 # Given a path, map that to the name of the hive and the true path
@@ -364,30 +367,35 @@ sub import_mapper
 sub map_path_to_hive
 {
     local $_ = shift;
-    my ($hivename, $prefix);
+    my ($hiveshortname, $hivefile, $prefix);
 
     if (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SAM(\\.*)?$/i) {
-        $hivename = "sam";
+        $hiveshortname = "sam";
+        $hivefile = "$systemroot/system32/config/$hiveshortname";
         $_ = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SAM";
     }
     elsif (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SECURITY(\\.*)?$/i) {
-        $hivename = "security";
+        $hiveshortname = "security";
+        $hivefile = "$systemroot/system32/config/$hiveshortname";
         $_ = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SECURITY";
     }
     elsif (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SOFTWARE(\\.*)?$/i) {
-        $hivename = "software";
+        $hiveshortname = "software";
+        $hivefile = "$systemroot/system32/config/$hiveshortname";
         $_ = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SOFTWARE";
     }
     elsif (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SYSTEM(\\.*)?$/i) {
-        $hivename = "system";
+        $hiveshortname = "system";
+        $hivefile = "$systemroot/system32/config/$hiveshortname";
         $_ = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SYSTEM";
     }
     elsif (/^\\?(?:HKEY_USERS|HKU)\\.DEFAULT(\\.*)?$/i) {
-        $hivename = "default";
+        $hiveshortname = "default";
+        $hivefile = "$systemroot/system32/config/$hiveshortname";
         $_ = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\.DEFAULT";
     }
@@ -396,25 +404,25 @@ sub map_path_to_hive
                 p => $_)
     }
 
-    return ($hivename, $_, $prefix);
+    return ($hiveshortname, $hivefile, $_, $prefix);
 }
 
 # Download a named hive file.  Die on failure.
 sub download_hive
 {
     local $_;
-    my $hivename = shift;
+    my $hivefile = shift;
+    my $hiveshortname = shift;
 
-    my $winfile_before = "$systemroot/system32/config/$hivename";
     my $winfile;
-    eval { $winfile = $g->case_sensitive_path ($winfile_before); };
+    eval { $winfile = $g->case_sensitive_path ($hivefile); };
     if ($@) {
         die __x("virt-win-reg: {p}: file not found in guest:
{err}\n",
-                p => $winfile_before, err => $@);
+                p => $hivefile, err => $@);
     }
 
     warn "downloading $winfile ..." if $debug;
-    eval { $g->download ($winfile, "$tmpdir/$hivename"); };
+    eval { $g->download ($winfile, "$tmpdir/$hiveshortname"); };
     if ($@) {
         die __x("virt-win-reg: {p}: could not download registry file:
{err}\n",
                 p => $winfile, err => $@);
@@ -425,18 +433,18 @@ sub download_hive
 sub upload_hive
 {
     local $_;
-    my $hivename = shift;
+    my $hiveshortname = shift;
+    my $hivefile = shift;
 
-    my $winfile_before = "$systemroot/system32/config/$hivename";
     my $winfile;
-    eval { $winfile = $g->case_sensitive_path ($winfile_before); };
+    eval { $winfile = $g->case_sensitive_path ($hivefile); };
     if ($@) {
         die __x("virt-win-reg: {p}: file not found in guest:
{err}\n",
-                p => $winfile_before, err => $@);
+                p => $hivefile, err => $@);
     }
 
     warn "uploading $winfile ..." if $debug;
-    eval { $g->upload ("$tmpdir/$hivename", $winfile); };
+    eval { $g->upload ("$tmpdir/$hiveshortname", $winfile); };
     if ($@) {
         die __x("virt-win-reg: {p}: could not upload registry file:
{err}\n",
                 p => $winfile, err => $@);
-- 
1.7.5

Richard W.M. Jones

2011-May-17 12:24 UTC

head link

[Libguestfs] [PATCH 2/3] virt-win-reg: Don't use implicit $_ in map_path_to_hive function.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v
-------------- next part -------------->From 073fa21e98a004721ecca156a245f55337773c70 Mon Sep 17 00:00:00 2001From: Richard W.M. Jones <rjones at redhat.com>
Date: Tue, 17 May 2011 13:15:25 +0100
Subject: [PATCH 2/3] virt-win-reg: Don't use implicit $_ in map_path_to_hive
 function.

---
 tools/virt-win-reg |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tools/virt-win-reg b/tools/virt-win-reg
index 056ecce..1018e11 100755
--- a/tools/virt-win-reg
+++ b/tools/virt-win-reg
@@ -367,36 +367,36 @@ sub import_mapper
 sub map_path_to_hive
 {
     local $_ = shift;
-    my ($hiveshortname, $hivefile, $prefix);
+    my ($hiveshortname, $hivefile, $path, $prefix);
 
     if (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SAM(\\.*)?$/i) {
         $hiveshortname = "sam";
         $hivefile = "$systemroot/system32/config/$hiveshortname";
-        $_ = defined $1 ? $1 : "\\";
+        $path = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SAM";
     }
     elsif (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SECURITY(\\.*)?$/i) {
         $hiveshortname = "security";
         $hivefile = "$systemroot/system32/config/$hiveshortname";
-        $_ = defined $1 ? $1 : "\\";
+        $path = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SECURITY";
     }
     elsif (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SOFTWARE(\\.*)?$/i) {
         $hiveshortname = "software";
         $hivefile = "$systemroot/system32/config/$hiveshortname";
-        $_ = defined $1 ? $1 : "\\";
+        $path = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SOFTWARE";
     }
     elsif (/^\\?(?:HKEY_LOCAL_MACHINE|HKLM)\\SYSTEM(\\.*)?$/i) {
         $hiveshortname = "system";
         $hivefile = "$systemroot/system32/config/$hiveshortname";
-        $_ = defined $1 ? $1 : "\\";
+        $path = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\SYSTEM";
     }
     elsif (/^\\?(?:HKEY_USERS|HKU)\\.DEFAULT(\\.*)?$/i) {
         $hiveshortname = "default";
         $hivefile = "$systemroot/system32/config/$hiveshortname";
-        $_ = defined $1 ? $1 : "\\";
+        $path = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\.DEFAULT";
     }
     else {
@@ -404,7 +404,7 @@ sub map_path_to_hive
                 p => $_)
     }
 
-    return ($hiveshortname, $hivefile, $_, $prefix);
+    return ($hiveshortname, $hivefile, $path, $prefix);
 }
 
 # Download a named hive file.  Die on failure.
-- 
1.7.5

Richard W.M. Jones

2011-May-17 12:24 UTC

head link

[Libguestfs] [PATCH 3/3] virt-win-reg: Support HKEY_USERS keys.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org
-------------- next part -------------->From 39d56100851fd900ec9bf7fc4725b899325eae8f Mon Sep 17 00:00:00 2001From: Richard W.M. Jones <rjones at redhat.com>
Date: Tue, 17 May 2011 13:16:17 +0100
Subject: [PATCH 3/3] virt-win-reg: Support HKEY_USERS keys.

This adds support for various Registry keys under HKEY_USERS (user
preferences).

(1) HKEY_USERS\<SID>
    where <SID> is a User SID.

For example:

lists out the LocalService user's registry.

(2) HKEY_USERS\<username>
    where <username> is a Windows local username (this is a
    libguestfs extension).

For example:

lists out the user preferences of user 'rjones'.

HKU can be used as an abbreviation for HKEY_USERS.  Merging is also
supported.
---
 tools/virt-win-reg |  129 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 files changed, 124 insertions(+), 5 deletions(-)

diff --git a/tools/virt-win-reg b/tools/virt-win-reg
index 1018e11..333bd15 100755
--- a/tools/virt-win-reg
+++ b/tools/virt-win-reg
@@ -399,6 +399,52 @@ sub map_path_to_hive
         $path = defined $1 ? $1 : "\\";
         $prefix = "HKEY_LOCAL_MACHINE\\.DEFAULT";
     }
+    elsif (/^\\?(?:HKEY_USERS|HKU)\\(S-1-5-[-\d]+)(\\.*)?$/i) {
+        my $sid = $1;
+        $hiveshortname = $sid;
+        $prefix = "HKEY_USERS\\$sid";
+        $path = defined $2 ? $2 : "\\";
+        # This requires a recursive call to download the SOFTWARE hive.
+        $hivefile = lookup_pip_of_user_sid ($sid) . "/ntuser.dat";
+    }
+    elsif (/^\\?(?:HKEY_USERS|HKU)\\LocalSystem(\\.*)?$/i) {
+        my $sid = "S-1-5-18";
+        $hiveshortname = $sid;
+        $prefix = "HKEY_USERS\\$sid";
+        $path = defined $1 ? $1 : "\\";
+        # This requires a recursive call to download the SOFTWARE hive.
+        $hivefile = lookup_pip_of_user_sid ($sid) . "/ntuser.dat";
+    }
+    elsif (/^\\?(?:HKEY_USERS|HKU)\\LocalService(\\.*)?$/i) {
+        my $sid = "S-1-5-19";
+        $hiveshortname = $sid;
+        $prefix = "HKEY_USERS\\$sid";
+        $path = defined $1 ? $1 : "\\";
+        # This requires a recursive call to download the SOFTWARE hive.
+        $hivefile = lookup_pip_of_user_sid ($sid) . "/ntuser.dat";
+    }
+    elsif (/^\\?(?:HKEY_USERS|HKU)\\NetworkService(\\.*)?$/i) {
+        my $sid = "S-1-5-20";
+        $hiveshortname = $sid;
+        $prefix = "HKEY_USERS\\$sid";
+        $path = defined $1 ? $1 : "\\";
+        # This requires a recursive call to download the SOFTWARE hive.
+        $hivefile = lookup_pip_of_user_sid ($sid) . "/ntuser.dat";
+    }
+    elsif (/^\\?(?:HKEY_USERS|HKU)\\(.*?)(\\.*)?$/i) {
+        $hiveshortname = "user_$1";
+        $prefix = "HKEY_USERS\\$1";
+        $path = defined $2 ? $2 : "\\";
+        # XXX We should probably look this up properly.
+        if (is_dir_nocase ("/Users/$1")) {
+            $hivefile = "/Users/$1/ntuser.dat"
+        } elsif (is_dir_nocase ("/Documents and Settings/$1")) {
+            $hivefile = "/Documents and Settings/$1/ntuser.dat"
+        } else {
+            die __x("virt-win-reg: {p}: cannot find user
directory\n",
+                    p => $1)
+        }
+    }
     else {
         die __x("virt-win-reg: {p}: not a supported Windows Registry
path\n",
                 p => $_)
@@ -407,6 +453,59 @@ sub map_path_to_hive
     return ($hiveshortname, $hivefile, $path, $prefix);
 }
 
+# Given a User SID, consult
+# HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid
+# and return the ProfileImagePath value.
+sub lookup_pip_of_user_sid
+{
+    local $_;
+    my $sid = shift;
+
+    my $path +        "HKLM\\SOFTWARE\\Microsoft\\Windows
NT\\CurrentVersion\\ProfileList\\".
+        $sid;
+
+    my ($hiveshortname, $hivefile, $prefix);
+    ($hiveshortname, $hivefile, $path, $prefix) = map_path_to_hive ($path);
+
+    download_hive ($hivefile, $hiveshortname)
+        unless -f "$tmpdir/$hiveshortname";
+
+    my @args = ("$tmpdir/$hiveshortname", $path,
"ProfileImagePath");
+    warn "running hivexget ", join (" ", @args), "
..." if $debug;
+
+    my $fh;
+    open $fh, "-|", "hivexget", @args
+        or die "hivexget: see earlier errors: $!";
+    $_ = <$fh>;
+    close $fh or die "hivexget: see earlier errors: $!";
+
+    chomp;
+
+    # The contents of the registry are a windows path, possibly
+    # containing %systemroot%.  Expand it and remove some other
+    # windows-isms.  The caller will do case_sensitive_path for us, so
+    # we don't need to do that.
+    s/%systemroot%/$systemroot/;
+    s/^c://i;
+    s,\\,/,g;
+
+    $_;
+}
+
+sub is_dir_nocase
+{
+    local $_;
+    my $dir = shift;
+
+    my $windir;
+    eval { $windir = $g->case_sensitive_path ($dir); };
+    if ($@) {
+        return 0;
+    }
+    return $g->is_dir ($windir);
+}
+
 # Download a named hive file.  Die on failure.
 sub download_hive
 {
@@ -456,15 +555,35 @@ sub upload_hive
 The program currently supports Windows NT-derived guests starting with
 Windows XP through to at least Windows 7.
 
-Registry support is done for C<HKEY_LOCAL_MACHINE\SAM>,
-C<HKEY_LOCAL_MACHINE\SECURITY>, C<HKEY_LOCAL_MACHINE\SOFTWARE>,
-C<HKEY_LOCAL_MACHINE\SYSTEM> and C<HKEY_USERS\.DEFAULT>.
+The following Registry keys are supported:
+
+=over 4
+
+=item C<HKEY_LOCAL_MACHINE\SAM>
+
+=item C<HKEY_LOCAL_MACHINE\SECURITY>
+
+=item C<HKEY_LOCAL_MACHINE\SOFTWARE>
+
+=item C<HKEY_LOCAL_MACHINE\SYSTEM>
+
+=item C<HKEY_USERS\.DEFAULT>
+
+=item C<HKEY_USERS\I<SID>>
+
+where I<SID> is a Windows User SID (eg. C<S-1-5-18>).
+
+=item C<HKEY_USERS\I<username>>
+
+where I<username> is a local user name (this is a libguestfs extension).
+
+=back
 
 You can use C<HKLM> as a shorthand for C<HKEY_LOCAL_MACHINE>, and
 C<HKU> for C<HKEY_USERS>.
 
-C<HKEY_USERS\$SID> and C<HKEY_CURRENT_USER> are B<not>
supported at
-this time.
+The literal keys C<HKEY_USERS\$SID> and C<HKEY_CURRENT_USER> are
not
+supported (there is no "current user").
 
 =head1 ENCODING
 
-- 
1.7.5

Apparently Analagous Threads

Search for more apparently analagous threads

Libguestfs - May 2011 - [PATCH 0/3] virt-win-reg: Add support for HKEY_USERS

[Libguestfs] [PATCH 0/3] virt-win-reg: Add support for HKEY_USERS

[Libguestfs] [PATCH 1/3] virt-win-reg: Don't hard-code the relationship between hive name and path.

[Libguestfs] [PATCH 2/3] virt-win-reg: Don't use implicit $_ in map_path_to_hive function.

[Libguestfs] [PATCH 3/3] virt-win-reg: Support HKEY_USERS keys.

Apparently Analagous Threads