public bool TryOpen(KeyIdentity identity, KeySecurity samDesired, out IKeyImpl openedImpl) { OffRegKey offregKey; bool result = OffRegKey.TryOpen(this, hive_, identity, out offregKey); openedImpl = offregKey; return(result); }
public bool Handle(OffRegKey key) { // TODO: Until we have implemented SetKeySecurity and made sure that original // sandboxie-generated reghives contain correct security descriptors, we support this only // for windows registry. return(false); // RegistryException.CheckResult( // OffRegApi.ORGetKeySecurity(key.Handle, securityInformation_, pSecurityDescriptor_, lpcbSecurityDescriptor_)); }
internal void MarkKeyAsDeleted(KeyIdentity identity) { try { string[] subkeys = identity.SplitPath(); int existingLevels, nonRemovableLevels; CalcNonRemovableLevels(null, identity, out existingLevels, out nonRemovableLevels); if (subkeys.Length <= nonRemovableLevels) { // We can't mark root keys as deleted return; } using (HGlobalPtr pData = new HGlobalPtr(Marshal.SizeOf(typeof(int)))) { Marshal.WriteInt32(pData.Ptr, 1); // Conciously suppressing errors OffRegKey key = null; try { key = new OffRegKey(this, hive_, KeyIdentity.Build(identity.BaseKey, subkeys, subkeys.Length - 1), null, Win32Api.RegOption.REG_OPTION_NON_VOLATILE, IntPtr.Zero, IntPtr.Zero); key.SetValue(DELETED_PREFIX + subkeys[subkeys.Length - 1], Win32Api.RegValueType.REG_DWORD, pData.Ptr, Marshal.SizeOf(typeof(int))); } catch (Win32Exception) { // Suppressing errors because there might be access issues // or may be other stuff if (key != null) { key.Close(); } } } } catch (FileNotFoundException) { // We don't know anything about the key, so we can't mark it as deleted return; } }
public static bool TryOpen(OffRegHive hive, OffregLib.OffregHive hiveImpl, KeyIdentity identity, out OffRegKey openedKey) { // TODO: possibly we need to simulate security restrictions in some way so that, // for instance, write operations from app w/o administrative permissions // to HKEY_LOCAL_MACHINE hive would fail List <string> paths = GetOffRegPaths(identity); foreach (string path in paths) { OffregLib.Win32Result result; OffregLib.OffregKey key; if (hiveImpl.Root.TryOpenSubKey(path, out key, out result)) { openedKey = new OffRegKey(hive, key, identity); return(true); } if ((int)result != (int)Win32Api.Error.ERROR_FILE_NOT_FOUND) { throw Win32Exception.Create((int)result); } } openedKey = null; return(false); }
public bool Handle(OffRegKey key) { // TODO: implement for Offreg keys return(false); }
private DoesntExistOrMarkedAsDeletedState DoesntExistOrMarkedAsDeleted(KeyIdentity existingBase, KeyIdentity identity, IntPtr allocatedpData, IntPtr allocatedpcbData) { string[] subkeys = identity.SplitPath(); int existingLevels, nonRemovableLevels; CalcNonRemovableLevels(existingBase, identity, out existingLevels, out nonRemovableLevels); if (subkeys.Length <= nonRemovableLevels) { return(DoesntExistOrMarkedAsDeletedState.Exists); } for (int level = existingLevels; level < subkeys.Length; level++) { KeyIdentity curLevelIdentity = KeyIdentity.Build(identity.BaseKey, subkeys, level); KeyImplHolder holder; lock (this) { IKeyImpl keyImpl = null; if (level <= nonRemovableLevels) { keyImpl = cacheForDeletedMarks_.TryGet(curLevelIdentity, KeyDisposition.DIFF_HIVE, cacheSecurity_); } if (keyImpl != null) { holder = new NotOwningKeyImplHolder(keyImpl); } else { OffregLib.OffregKey key; OffregLib.Win32Result result; if (!hive_.Root.TryOpenSubKey(OffRegKey.GetMainOffRegPath(curLevelIdentity), out key, out result)) { return(DoesntExistOrMarkedAsDeletedState.DoesntExist); } holder = new KeyImplHolder(new OffRegKey(this, key, curLevelIdentity)); if (level <= nonRemovableLevels) { // Adding to cache only the lowest, non removable level holder = cacheForDeletedMarks_.Add( curLevelIdentity, KeyDisposition.DIFF_HIVE, holder); } } } using (holder) { Marshal.WriteInt32(allocatedpcbData, Marshal.SizeOf(typeof(int))); if (holder.GetKeyImpl().TryQueryValue( DELETED_PREFIX + subkeys[level], IntPtr.Zero, IntPtr.Zero, allocatedpData, allocatedpcbData)) { if (Marshal.ReadInt32(allocatedpcbData) == Marshal.SizeOf(typeof(int)) && Marshal.ReadInt32(allocatedpData) != 0) { // There is a special value marking key as deleted return(DoesntExistOrMarkedAsDeletedState.MarkedAsDeleted); } } } } return(DoesntExistOrMarkedAsDeletedState.Exists); }
public bool Handle(OffRegKey key) { // TODO: exceptions thrown from this function should use STATUS_* error codes set // instead of ERROR_* string name = key.Identity.GetSystemPath(); KeyInfo info = key.QueryInfo(); // TODO: either test the following error-prone code with offsets thoroughly // or replace it with safer alternative code int offset = 0; switch (KeyInformationClass_) { case Win32Api.KeyInformationClass.KeyBasicInformation: ResultLength_ = unchecked((uint)(16 + sizeof(char) * name.Length)); if (Length_ < ResultLength_) { throw Win32Exception.Create((int)Win32Api.Status.STATUS_BUFFER_TOO_SMALL); } if (KeyInformation_ != IntPtr.Zero) { Marshal.StructureToPtr(info.LastWriteTime, KeyInformation_, false); offset += 8; Marshal.WriteInt32(KeyInformation_, offset, 0); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, sizeof(char) * name.Length); offset += 4; PInvokeHelper.CopyStringUni(name, (IntPtr)((Int64)KeyInformation_ + offset), name.Length); } return true; case Win32Api.KeyInformationClass.KeyNodeInformation: ResultLength_ = unchecked((uint)(24 + sizeof(char) * (name.Length + info.Class.Length))); if (Length_ < ResultLength_) { throw Win32Exception.Create((int)Win32Api.Status.STATUS_BUFFER_TOO_SMALL); } if (KeyInformation_ != IntPtr.Zero) { // TODO: fill the parts of structures w/o strings using // C# structures (until now I don't know solution for strings, but // at least all other fields will be set carefully) // do this throughout the function Marshal.StructureToPtr(info.LastWriteTime, KeyInformation_, false); offset += 8; Marshal.WriteInt32(KeyInformation_, offset, 0); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, 24 + sizeof(char) * name.Length); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, sizeof(char) * info.Class.Length); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, sizeof(char) * name.Length); offset += 4; PInvokeHelper.CopyStringUni(name, (IntPtr)((Int64)KeyInformation_ + offset), name.Length); offset += name.Length * sizeof(char); PInvokeHelper.CopyStringUni(info.Class, (IntPtr)((Int64)KeyInformation_ + offset), info.Class.Length); } return true; case Win32Api.KeyInformationClass.KeyFullInformation: ResultLength_ = unchecked((uint)(44 + sizeof(char) * (info.Class.Length))); if (Length_ < ResultLength_) { throw Win32Exception.Create((int)Win32Api.Status.STATUS_BUFFER_TOO_SMALL); } if (KeyInformation_ != IntPtr.Zero) { Marshal.StructureToPtr(info.LastWriteTime, KeyInformation_, false); offset += 8; Marshal.WriteInt32(KeyInformation_, offset, 0); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, 44); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, sizeof(char) * info.Class.Length); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.SubKeysNumber)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxSubKeyLength)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxClassLength)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.ValuesNumber)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxValueNameLength)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxValueLength)); offset += 4; PInvokeHelper.CopyStringUni(info.Class, (IntPtr)((Int64)KeyInformation_ + offset), info.Class.Length); } return true; case Win32Api.KeyInformationClass.KeyNameInformation: ResultLength_ = unchecked((uint)(4 + sizeof(char) * name.Length)); if (Length_ < ResultLength_) { throw Win32Exception.Create((int)Win32Api.Status.STATUS_BUFFER_TOO_SMALL); } if (KeyInformation_ != IntPtr.Zero) { Marshal.WriteInt32(KeyInformation_, sizeof(char) * name.Length); offset += 4; PInvokeHelper.CopyStringUni(name, (IntPtr)((Int64)KeyInformation_ + offset), name.Length); } return true; case Win32Api.KeyInformationClass.KeyCachedInformation: ResultLength_ = 36; if (Length_ < ResultLength_) { throw Win32Exception.Create((int)Win32Api.Status.STATUS_BUFFER_TOO_SMALL); } if (KeyInformation_ != IntPtr.Zero) { Marshal.StructureToPtr(info.LastWriteTime, KeyInformation_, false); offset += 8; Marshal.WriteInt32(KeyInformation_, offset, 0); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.SubKeysNumber)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxSubKeyLength)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.ValuesNumber)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxValueNameLength)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, unchecked((int)info.MaxValueLength)); offset += 4; Marshal.WriteInt32(KeyInformation_, offset, name.Length); } return true; case Win32Api.KeyInformationClass.KeyFlagsInformation: // Reserved break; case Win32Api.KeyInformationClass.KeyVirtualizationInformation: // Not implemented break; case Win32Api.KeyInformationClass.KeyHandleTagsInformation: // Reserved break; } return false; }