1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
|
/*
Unix SMB/Netbios implementation.
Version 1.9.
SMB parameters and setup
Copyright (C) Andrew Tridgell 1992-1997
Copyright (C) Luke Kenneth Casson Leighton 1996-1997
Copyright (C) Paul Ashton 1997
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#ifndef _RPC_REG_H /* _RPC_REG_H */
#define _RPC_REG_H
/* winreg pipe defines */
#define REG_OPEN_HKLM 0x02
#define REG_OPEN_HKU 0x04
#define REG_FLUSH_KEY 0x0B
#define REG_UNK_1A 0x1a
#define REG_QUERY_KEY 0x10
#define REG_ENUM_KEY 0x09
#define REG_CREATE_KEY 0x06
#define REG_DELETE_KEY 0x07
#define REG_DELETE_VALUE 0x08
#define REG_CREATE_VALUE 0x16
#define REG_GET_KEY_SEC 0x0c
#define REG_ENUM_VALUE 0x0a
#define REG_OPEN_ENTRY 0x0f
#define REG_INFO 0x11
#define REG_CLOSE 0x05
/* REG_Q_OPEN_HKLM */
typedef struct q_reg_open_policy_info
{
uint32 ptr;
uint16 unknown_0; /* 0xE084 - 16 bit unknown */
uint16 unknown_1; /* random. changes */
uint32 level; /* 0x0000 0002 - 32 bit unknown */
} REG_Q_OPEN_HKLM ;
/* REG_R_OPEN_HKLM */
typedef struct r_reg_open_policy_info
{
POLICY_HND pol; /* policy handle */
uint32 status; /* return status */
} REG_R_OPEN_HKLM;
/* REG_Q_OPEN_HKU */
typedef struct q_reg_open_unk4_info
{
uint32 ptr;
uint16 unknown_0; /* 0xE084 - 16 bit unknown */
uint16 unknown_1; /* random. changes */
uint32 level; /* 0x0000 0002 - 32 bit unknown */
} REG_Q_OPEN_HKU;
/* REG_R_OPEN_HKU */
typedef struct r_reg_open_unk4_info
{
POLICY_HND pol; /* policy handle */
uint32 status; /* return status */
} REG_R_OPEN_HKU;
/* REG_Q_FLUSH_KEY */
typedef struct q_reg_open_flush_key_info
{
POLICY_HND pol; /* policy handle */
} REG_Q_FLUSH_KEY;
/* REG_R_FLUSH_KEY */
typedef struct r_reg_open_flush_key_info
{
uint32 status; /* return status */
} REG_R_FLUSH_KEY;
/* REG_Q_GET_KEY_SEC */
typedef struct q_reg_get_key_sec_info
{
POLICY_HND pol; /* policy handle */
uint32 unknown; /* 0x0000 0007 */
uint32 ptr; /* pointer */
BUFHDR hdr_sec; /* header for security data */
SEC_DESC_BUF *data; /* security data */
} REG_Q_GET_KEY_SEC;
/* REG_R_GET_KEY_SEC */
typedef struct r_reg_get_key_sec_info
{
uint32 unknown; /* 0x0000 0007 */
uint32 ptr; /* pointer */
BUFHDR hdr_sec; /* header for security data */
SEC_DESC_BUF *data; /* security data */
uint32 status;
} REG_R_GET_KEY_SEC;
/* REG_Q_CREATE_VALUE */
typedef struct q_reg_create_value_info
{
POLICY_HND pol; /* policy handle */
UNIHDR hdr_name; /* name of value */
UNISTR2 uni_name;
uint32 type; /* 1 = UNISTR, 3 = BYTES, 4 = DWORD, 7 = MULTI_UNISTR */
BUFFER3 *buf_value; /* value, in byte buffer */
} REG_Q_CREATE_VALUE;
/* REG_R_CREATE_VALUE */
typedef struct r_reg_create_value_info
{
uint32 status; /* return status */
} REG_R_CREATE_VALUE;
/* REG_Q_ENUM_VALUE */
typedef struct q_reg_query_value_info
{
POLICY_HND pol; /* policy handle */
uint32 val_index; /* index */
UNIHDR hdr_name; /* name of value */
UNISTR2 uni_name;
uint32 ptr_type; /* pointer */
uint32 type; /* 1 = UNISTR, 3 = BYTES, 4 = DWORD, 7 = MULTI_UNISTR */
uint32 ptr_value; /* pointer */
BUFFER2 buf_value; /* value, in byte buffer */
uint32 ptr1; /* pointer */
uint32 len_value1; /* */
uint32 ptr2; /* pointer */
uint32 len_value2; /* */
} REG_Q_ENUM_VALUE;
/* REG_R_ENUM_VALUE */
typedef struct r_reg_enum_value_info
{
UNIHDR hdr_name; /* name of value */
UNISTR2 uni_name;
uint32 ptr_type; /* pointer */
uint32 type; /* 1 = UNISTR, 3 = BYTES, 4 = DWORD, 7 = MULTI_UNISTR */
uint32 ptr_value; /* pointer */
BUFFER2 *buf_value; /* value, in byte buffer */
uint32 ptr1; /* pointer */
uint32 len_value1; /* */
uint32 ptr2; /* pointer */
uint32 len_value2; /* */
uint32 status; /* return status */
} REG_R_ENUM_VALUE;
/* REG_Q_CREATE_KEY */
typedef struct q_reg_create_key_info
{
POLICY_HND pnt_pol; /* parent key policy handle */
UNIHDR hdr_name;
UNISTR2 uni_name;
UNIHDR hdr_class;
UNISTR2 uni_class;
uint32 reserved; /* 0x0000 0000 */
SEC_INFO sam_access; /* access rights flags, see rpc_secdes.h */
uint32 ptr1;
uint32 unknown_0; /* 0x0000 000C */
uint32 ptr2;
uint32 sec_len1; /* 0x14 - length of security descriptor, bytes */
uint32 sec_len2; /* 0x14 - length of security descriptor, bytes */
uint32 sec_len3; /* 0x0 - length of security descriptor, bytes */
uint32 sec_len4; /* 0x14 - length of security descriptor, bytes */
uint32 sec_len5; /* 0x0 - length of security descriptor, bytes */
uint32 sec_len6; /* 0x14 - length of security descriptor, bytes */
#if 0
SEC_DES sec_desc;
#else
uint8 buf_unk[20]; /* 01 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 */
#endif
uint32 unknown_2; /* 0x0000 0000 */
} REG_Q_CREATE_KEY;
/* REG_R_CREATE_KEY */
typedef struct r_reg_create_key_info
{
POLICY_HND key_pol; /* policy handle */
uint32 unknown; /* 0x0000 0000 */
uint32 status; /* return status */
} REG_R_CREATE_KEY;
/* REG_Q_DELETE_KEY */
typedef struct q_reg_delete_key_info
{
POLICY_HND pnt_pol; /* parent key policy handle */
UNIHDR hdr_name;
UNISTR2 uni_name;
} REG_Q_DELETE_KEY;
/* REG_R_DELETE_KEY */
typedef struct r_reg_delete_key_info
{
POLICY_HND key_pol; /* policy handle */
uint32 status; /* return status */
} REG_R_DELETE_KEY;
/* REG_Q_DELETE_VALUE */
typedef struct q_reg_delete_val_info
{
POLICY_HND pnt_pol; /* parent key policy handle */
UNIHDR hdr_name;
UNISTR2 uni_name;
} REG_Q_DELETE_VALUE;
/* REG_R_DELETE_VALUE */
typedef struct r_reg_delete_val_info
{
POLICY_HND key_pol; /* policy handle */
uint32 status; /* return status */
} REG_R_DELETE_VALUE;
/* REG_Q_QUERY_KEY */
typedef struct q_reg_query_info
{
POLICY_HND pol; /* policy handle */
UNIHDR hdr_class;
UNISTR2 uni_class;
} REG_Q_QUERY_KEY;
/* REG_R_QUERY_KEY */
typedef struct r_reg_query_key_info
{
UNIHDR hdr_class;
UNISTR2 uni_class;
uint32 num_subkeys;
uint32 max_subkeylen;
uint32 max_subkeysize; /* 0x0000 0000 */
uint32 num_values;
uint32 max_valnamelen;
uint32 max_valbufsize;
uint32 sec_desc; /* 0x0000 0078 */
NTTIME mod_time; /* modified time */
uint32 status; /* return status */
} REG_R_QUERY_KEY;
/* REG_Q_UNK_1A */
typedef struct q_reg_unk_1a_info
{
POLICY_HND pol; /* policy handle */
} REG_Q_UNK_1A;
/* REG_R_UNK_1A */
typedef struct r_reg_unk_1a_info
{
uint32 unknown; /* 0x0500 0000 */
uint32 status; /* return status */
} REG_R_UNK_1A;
/* REG_Q_CLOSE */
typedef struct reg_q_close_info
{
POLICY_HND pol; /* policy handle */
} REG_Q_CLOSE;
/* REG_R_CLOSE */
typedef struct reg_r_close_info
{
POLICY_HND pol; /* policy handle. should be all zeros. */
uint32 status; /* return code */
} REG_R_CLOSE;
/* REG_Q_ENUM_KEY */
typedef struct q_reg_enum_value_info
{
POLICY_HND pol; /* policy handle */
uint32 key_index;
uint16 key_name_len; /* 0x0000 */
uint16 unknown_1; /* 0x0414 */
uint32 ptr1; /* pointer */
uint32 unknown_2; /* 0x0000 020A */
uint8 pad1[8]; /* padding - zeros */
uint32 ptr2; /* pointer */
uint8 pad2[8]; /* padding - zeros */
uint32 ptr3; /* pointer */
NTTIME time; /* current time? */
} REG_Q_ENUM_KEY;
/* REG_R_ENUM_KEY */
typedef struct r_reg_enum_key_info
{
uint16 key_name_len; /* number of bytes in key name */
uint16 unknown_1; /* 0x0414 - matches with query unknown_1 */
uint32 ptr1; /* pointer */
uint32 unknown_2; /* 0x0000 020A */
uint32 unknown_3; /* 0x0000 0000 */
UNISTR3 key_name;
uint32 ptr2; /* pointer */
uint8 pad2[8]; /* padding - zeros */
uint32 ptr3; /* pointer */
NTTIME time; /* current time? */
uint32 status; /* return status */
} REG_R_ENUM_KEY;
/* REG_Q_INFO */
typedef struct q_reg_info_info
{
POLICY_HND pol; /* policy handle */
UNIHDR hdr_type; /* unicode product type header */
UNISTR2 uni_type; /* unicode product type - "ProductType" */
uint32 ptr1; /* pointer */
NTTIME time; /* current time? */
uint8 major_version1; /* 0x4 - os major version? */
uint8 minor_version1; /* 0x1 - os minor version? */
uint8 pad1[10]; /* padding - zeros */
uint32 ptr2; /* pointer */
uint8 major_version2; /* 0x4 - os major version? */
uint8 minor_version2; /* 0x1 - os minor version? */
uint8 pad2[2]; /* padding - zeros */
uint32 ptr3; /* pointer */
uint32 unknown; /* 0x0000 0000 */
} REG_Q_INFO;
/* REG_R_INFO */
typedef struct r_reg_info_info
{
uint32 ptr1; /* buffer pointer */
uint32 level; /* 0x1 - info level? */
uint32 ptr_type; /* pointer to o/s type */
BUFFER2 uni_type; /* unicode string o/s type - "LanmanNT" */
uint32 ptr2; /* pointer to unknown_0 */
uint32 unknown_0; /* 0x12 */
uint32 ptr3; /* pointer to unknown_1 */
uint32 unknown_1; /* 0x12 */
uint32 status; /* return status */
} REG_R_INFO;
/* REG_Q_OPEN_ENTRY */
typedef struct q_reg_open_entry_info
{
POLICY_HND pol; /* policy handle */
UNIHDR hdr_name; /* unicode registry string header */
UNISTR2 uni_name; /* unicode registry string name */
uint32 unknown_0; /* 32 bit unknown - 0x0000 0000 */
uint32 unknown_1; /* 32 bit unknown - 0x0200 0000 */
} REG_Q_OPEN_ENTRY;
/* REG_R_OPEN_ENTRY */
typedef struct r_reg_open_entry_info
{
POLICY_HND pol; /* policy handle */
uint32 status; /* return status */
} REG_R_OPEN_ENTRY;
#endif /* _RPC_REG_H */
|
