public void Delete()
{
int result = OffRegHive.CatchException(() => key_.Delete());
hive_.MarkAsModified();
Win32Exception.CheckResult(result);
}
public void DeleteValue(string lpValueName)
{
int result = OffRegHive.CatchException(() => key_.DeleteValue(lpValueName));
hive_.MarkAsModified();
Win32Exception.CheckResult(result);
}
public void SetValue(
string lpValueName,
Win32Api.RegValueType dwType,
IntPtr lpData,
int cbData)
{
int result;
if (!DoUni2AnsiConversion ||
!DataTransformer.IsStringType(dwType))
{
result = OffRegHive.CatchException(() =>
key_.SetValueUnmanaged(lpValueName, (OffregLib.RegValueType)dwType, lpData, cbData));
hive_.MarkAsModified();
Win32Exception.CheckResult(result);
return;
}
string str = Marshal.PtrToStringAnsi(lpData, cbData);
using (HGlobalPtr pStr =
new HGlobalPtr(Marshal.StringToHGlobalUni(str)))
{
result = OffRegHive.CatchException(() =>
key_.SetValueUnmanaged(lpValueName, (OffregLib.RegValueType)dwType,
pStr.Ptr, cbData * sizeof(char)));
hive_.MarkAsModified();
Win32Exception.CheckResult(result);
}
}
public void SetValue(
string lpValueName,
Win32Api.RegValueType dwType,
IntPtr lpData,
int cbData)
{
Win32Exception.CheckResult(
Win32Api.RegSetKeyValue(handle_, null, lpValueName, dwType, lpData, cbData));
}
public void Close()
{
// Returning error if predefined key is requested for closing
if (Enum.IsDefined(typeof(Win32Api.RegPredefinedKeys), (int)handle_))
{
throw new InvalidHandleException();
}
Win32Exception.CheckResult(
Win32Api.RegCloseKey(handle_));
}
internal void OpenUserClassesRoot(
IntPtr hToken,
UInt32 dwOptions,
KeySecurity samDesired,
out IntPtr phkResult)
{
IntPtr baseKey;
Win32Exception.CheckResult(
Win32Api.RegOpenUserClassesRoot(hToken, dwOptions, samDesired.Value, out baseKey));
OpenWindowsBaseKey(baseKey, samDesired, out phkResult);
}
public void EnumValue(
uint dwIndex,
IntPtr lpValueName,
/*ref UInt32*/ IntPtr lpcchValueName,
IntPtr lpReserved,
/*ref Win32Api.RegValueType*/ IntPtr lpType,
IntPtr lpData,
/*ref UInt32*/ IntPtr lpcbData)
{
Win32Exception.CheckResult(
Win32Api.RegEnumValue(handle_, dwIndex, lpValueName,
lpcchValueName, lpReserved, lpType, lpData, lpcbData));
}
public void EnumKey(
uint dwIndex,
IntPtr lpName,
/*ref UInt32*/ IntPtr lpcchName,
IntPtr lpReserved,
IntPtr lpClass,
/*ref UInt32*/ IntPtr lpcchClass,
/*ref Win32Api.FILETIME*/ IntPtr lpftLastWriteTime)
{
Win32Exception.CheckResult(
Win32Api.RegEnumKeyEx(handle_, dwIndex, lpName, lpcchName, lpReserved,
lpClass, lpcchClass, lpftLastWriteTime));
}
internal void OpenCurrentUser(
KeySecurity samDesired,
out IntPtr phkResult)
{
// CurrentUser identity depends on the user to which opening
// thread is impersonated right now, so we need to do the syscall
// exactly at the moment and then use the returned value
IntPtr baseKey;
Win32Exception.CheckResult(
Win32Api.RegOpenCurrentUser(samDesired.Value, out baseKey));
OpenWindowsBaseKey(baseKey, samDesired, out phkResult);
}
public void QueryInfo(
/*out StringBuilder*/ IntPtr lpClass,
/*ref */ IntPtr lpcClass,
IntPtr lpReserved,
/*out */ IntPtr lpcSubKeys,
/*out */ IntPtr lpcbMaxSubKeyLen,
/*out */ IntPtr lpcbMaxClassLen,
/*out */ IntPtr lpcValues,
/*out */ IntPtr lpcbMaxValueNameLen,
/*out */ IntPtr lpcbMaxValueLen,
/*out */ IntPtr lpcbSecurityDescriptor,
IntPtr lpftLastWriteTime)
{
Win32Exception.CheckResult(
Win32Api.RegQueryInfoKey(handle_, lpClass, lpcClass, lpReserved, lpcSubKeys,
lpcbMaxSubKeyLen, lpcbMaxClassLen, lpcValues, lpcbMaxValueNameLen,
lpcbMaxValueLen, lpcbSecurityDescriptor, lpftLastWriteTime));
}
internal void BaseKeyClosed(IntPtr baseKey)
{
if (KeyIdentity.IsPredefined(baseKey))
{
return;
}
Int64 key = baseKey.ToInt64();
lock (this)
{
baseKeyRefCount_[key]--;
if (baseKeyRefCount_[key] == 0)
{
baseKeyRefCount_.Remove(key);
Win32Exception.CheckResult(Win32Api.RegCloseKey(baseKey));
}
}
}
// TODO: query info does not take data altering into account,
// data may be replaced by some larger data and this may lead to
// buffer overflow in client's code
public void QueryInfo(
/*out StringBuilder*/ IntPtr lpClass,
/*ref */ IntPtr lpcClass,
IntPtr lpReserved,
/*out */ IntPtr lpcSubKeys,
/*out */ IntPtr lpcbMaxSubKeyLen,
/*out */ IntPtr lpcbMaxClassLen,
/*out */ IntPtr lpcValues,
/*out */ IntPtr lpcbMaxValueNameLen,
/*out */ IntPtr lpcbMaxValueLen,
/*out */ IntPtr lpcbSecurityDescriptor,
IntPtr lpftLastWriteTime)
{
// TODO: this function does not take into accout the intersection
// of subkey names between windows regisry key and offreg key, and
// the same thing about value names, this is
// to be done in the next version
// It does not matter if the current key is open in windows registry or in offreg
// we need to open and both of them
// if the class or security descriptor is defined for both of keys and are
// different, then the values of windows registry keys just take priority.
// TODO: during implementation of RegSetSecurity* probably the logic should be
// changed to take security descriptor from OffReg key if it is there
bool callSucceeded = false;
KeyInfo result = new KeyInfo();
foreach (KeyDisposition disposition in HIVES_REVERSE_ORDER)
{
KeyInfo current = new KeyInfo();
if (!TryApplyOperation(disposition, null,
new KeySecurity(Win32Api.KeySecurity.KEY_QUERY_VALUE),
keyImpl =>
{
current = keyImpl.QueryInfo();
return(true);
}))
{
continue;
}
// Taking class and security descriptor from higher level (windows registry)
// if possible, this is subject to change as soon as Reg*Security functions
// are implemented
if (!callSucceeded)
{
result.Class = current.Class;
result.SecurityDescriptorLength = current.SecurityDescriptorLength;
}
callSucceeded = true;
result.SubKeysNumber += current.SubKeysNumber;
result.MaxSubKeyLength = Math.Max(result.MaxSubKeyLength,
current.MaxSubKeyLength);
result.MaxClassLength = Math.Max(result.MaxClassLength,
current.MaxClassLength);
result.ValuesNumber += current.ValuesNumber;
result.MaxValueNameLength = Math.Max(result.MaxValueNameLength,
current.MaxValueNameLength);
result.MaxValueLength = Math.Max(result.MaxValueLength,
current.MaxValueLength);
if (DateTime.FromFileTime(result.LastWriteTime.AsLong) <
DateTime.FromFileTime(current.LastWriteTime.AsLong))
{
result.LastWriteTime = current.LastWriteTime;
}
}
// At least one of windows or OffReg key exists (because it is open
// and passed as hKey to this function), so at least one of calls did not return
// FILE_NOT_FOUND, thus suppressing it here
if (lpcSubKeys != IntPtr.Zero)
{
Marshal.WriteInt32(lpcSubKeys, unchecked ((int)result.SubKeysNumber));
}
if (lpcbMaxSubKeyLen != IntPtr.Zero)
{
Marshal.WriteInt32(lpcbMaxSubKeyLen, unchecked ((int)result.MaxSubKeyLength));
}
if (lpcbMaxClassLen != IntPtr.Zero)
{
Marshal.WriteInt32(lpcbMaxClassLen, unchecked ((int)result.MaxClassLength));
}
if (lpcValues != IntPtr.Zero)
{
Marshal.WriteInt32(lpcValues, unchecked ((int)result.ValuesNumber));
}
if (lpcbMaxValueNameLen != IntPtr.Zero)
{
Marshal.WriteInt32(lpcbMaxValueNameLen, unchecked ((int)result.MaxValueNameLength));
}
if (lpcbMaxValueLen != IntPtr.Zero)
{
Marshal.WriteInt32(lpcbMaxValueLen, unchecked ((int)result.MaxValueLength));
}
if (lpftLastWriteTime != IntPtr.Zero)
{
Marshal.StructureToPtr(result.LastWriteTime, lpftLastWriteTime, true);
}
Win32Exception.CheckResult(
new Data(lpClass, lpcClass, Data.CountIn.Chars).FillWithString(
new ManagedString(result.Class),
HookBarrier.IsLastInjectedFuncAnsi ? StringFormat.Ansi : StringFormat.Unicode,
Data.NullCharHandling.NotCountingOnReturn));
}