Hide keyboard shortcuts

Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved. 

# 

# This software is provided under under a slightly modified version 

# of the Apache Software License. See the accompanying LICENSE file 

# for more information. 

# 

# Author: Alberto Solino (@agsolino) 

# 

# Description: A Windows Registry Library Parser 

# 

# Data taken from https://bazaar.launchpad.net/~guadalinex-members/dumphive/trunk/view/head:/winreg.txt 

# http://sentinelchicken.com/data/TheWindowsNTRegistryFileFormat.pdf 

# 

# 

# ToDo: 

# 

# [ ] Parse li records, probable the same as the ri but couldn't find any to probe 

 

from __future__ import division 

from __future__ import print_function 

import sys 

from struct import unpack 

import ntpath 

from six import b 

 

from impacket import LOG 

from impacket.structure import Structure, hexdump 

 

 

# Constants 

 

ROOT_KEY = 0x2c 

REG_NONE = 0x00 

REG_SZ = 0x01 

REG_EXPAND_SZ = 0x02 

REG_BINARY = 0x03 

REG_DWORD = 0x04 

REG_MULTISZ = 0x07 

REG_QWORD = 0x0b 

 

# Structs 

class REG_REGF(Structure): 

structure = ( 

('Magic','"regf'), 

('Unknown','<L=0'), 

('Unknown2','<L=0'), 

('lastChange','<Q=0'), 

('MajorVersion','<L=0'), 

('MinorVersion','<L=0'), 

('0','<L=0'), 

('11','<L=0'), 

('OffsetFirstRecord','<L=0'), 

('DataSize','<L=0'), 

('1111','<L=0'), 

('Name','48s=""'), 

('Remaining1','411s=b""'), 

('CheckSum','<L=0xffffffff'), # Sum of all DWORDs from 0x0 to 0x1FB 

('Remaining2','3585s=b""'), 

) 

 

class REG_HBIN(Structure): 

structure = ( 

('Magic','"hbin'), 

('OffsetFirstHBin','<L=0'), 

('OffsetNextHBin','<L=0'), 

('BlockSize','<L=0'), 

) 

 

class REG_HBINBLOCK(Structure): 

structure = ( 

('DataBlockSize','<l=0'), 

('_Data','_-Data','self["DataBlockSize"]*(-1)-4'), 

('Data',':'), 

) 

 

class REG_NK(Structure): 

structure = ( 

('Magic','"nk'), 

('Type','<H=0'), 

('lastChange','<Q=0'), 

('Unknown','<L=0'), 

('OffsetParent','<l=0'), 

('NumSubKeys','<L=0'), 

('Unknown2','<L=0'), 

('OffsetSubKeyLf','<l=0'), 

('Unknown3','<L=0'), 

('NumValues','<L=0'), 

('OffsetValueList','<l=0'), 

('OffsetSkRecord','<l=0'), 

('OffsetClassName','<l=0'), 

('UnUsed','20s=b""'), 

('NameLength','<H=0'), 

('ClassNameLength','<H=0'), 

('_KeyName','_-KeyName','self["NameLength"]'), 

('KeyName',':'), 

) 

 

class REG_VK(Structure): 

structure = ( 

('Magic','"vk'), 

('NameLength','<H=0'), 

('DataLen','<l=0'), 

('OffsetData','<L=0'), 

('ValueType','<L=0'), 

('Flag','<H=0'), 

('UnUsed','<H=0'), 

('_Name','_-Name','self["NameLength"]'), 

('Name',':'), 

) 

 

class REG_LF(Structure): 

structure = ( 

('Magic','"lf'), 

('NumKeys','<H=0'), 

('HashRecords',':'), 

) 

 

class REG_LH(Structure): 

structure = ( 

('Magic','"lh'), 

('NumKeys','<H=0'), 

('HashRecords',':'), 

) 

 

class REG_RI(Structure): 

structure = ( 

('Magic','"ri'), 

('NumKeys','<H=0'), 

('HashRecords',':'), 

) 

 

class REG_SK(Structure): 

structure = ( 

('Magic','"sk'), 

('UnUsed','<H=0'), 

('OffsetPreviousSk','<l=0'), 

('OffsetNextSk','<l=0'), 

('UsageCounter','<L=0'), 

('SizeSk','<L=0'), 

('Data',':'), 

) 

 

class REG_HASH(Structure): 

structure = ( 

('OffsetNk','<L=0'), 

('KeyName','4s=b""'), 

) 

 

StructMappings = {b'nk': REG_NK, 

b'vk': REG_VK, 

b'lf': REG_LF, 

b'lh': REG_LH, 

b'ri': REG_RI, 

b'sk': REG_SK, 

} 

 

class Registry: 

def __init__(self, hive, isRemote = False): 

self.__hive = hive 

160 ↛ 164line 160 didn't jump to line 164, because the condition on line 160 was never false if isRemote is True: 

self.fd = self.__hive 

self.__hive.open() 

else: 

self.fd = open(hive,'rb') 

data = self.fd.read(4096) 

self.__regf = REG_REGF(data) 

self.indent = '' 

self.rootKey = self.__findRootKey() 

169 ↛ 170line 169 didn't jump to line 170, because the condition on line 169 was never true if self.rootKey is None: 

LOG.error("Can't find root key!") 

171 ↛ 172line 171 didn't jump to line 172, because the condition on line 171 was never true elif self.__regf['MajorVersion'] != 1 and self.__regf['MinorVersion'] > 5: 

LOG.warning("Unsupported version (%d.%d) - things might not work!" % (self.__regf['MajorVersion'], self.__regf['MinorVersion'])) 

 

def close(self): 

self.fd.close() 

 

def __del__(self): 

self.close() 

 

def __findRootKey(self): 

self.fd.seek(0,0) 

data = self.fd.read(4096) 

183 ↛ 198line 183 didn't jump to line 198, because the condition on line 183 was never false while len(data) > 0: 

try: 

hbin = REG_HBIN(data[:0x20]) 

# Read the remaining bytes for this hbin 

data += self.fd.read(hbin['OffsetNextHBin']-4096) 

data = data[0x20:] 

blocks = self.__processDataBlocks(data) 

190 ↛ 196line 190 didn't jump to line 196, because the loop on line 190 didn't complete for block in blocks: 

191 ↛ 190line 191 didn't jump to line 190, because the condition on line 191 was never false if isinstance(block, REG_NK): 

192 ↛ 190line 192 didn't jump to line 190, because the condition on line 192 was never false if block['Type'] == ROOT_KEY: 

return block 

except Exception as e: 

pass 

data = self.fd.read(4096) 

 

return None 

 

 

def __getBlock(self, offset): 

self.fd.seek(4096+offset,0) 

sizeBytes = self.fd.read(4) 

data = sizeBytes + self.fd.read(unpack('<l',sizeBytes)[0]*-1-4) 

205 ↛ 206line 205 didn't jump to line 206, because the condition on line 205 was never true if len(data) == 0: 

return None 

else: 

block = REG_HBINBLOCK(data) 

209 ↛ 212line 209 didn't jump to line 212, because the condition on line 209 was never false if block['Data'][:2] in StructMappings: 

return StructMappings[block['Data'][:2]](block['Data']) 

else: 

LOG.debug("Unknown type 0x%s" % block['Data'][:2]) 

return block 

return None 

 

def __getValueBlocks(self, offset, count): 

valueList = [] 

res = [] 

self.fd.seek(4096+offset,0) 

for i in range(count): 

valueList.append(unpack('<l',self.fd.read(4))[0]) 

 

for valueOffset in valueList: 

if valueOffset > 0: 

block = self.__getBlock(valueOffset) 

res.append(block) 

return res 

 

def __getData(self, offset, count): 

self.fd.seek(4096+offset, 0) 

return self.fd.read(count)[4:] 

 

def __processDataBlocks(self,data): 

res = [] 

while len(data) > 0: 

#blockSize = unpack('<l',data[:calcsize('l')])[0] 

blockSize = unpack('<l',data[:4])[0] 

block = REG_HBINBLOCK() 

if blockSize > 0: 

tmpList = list(block.structure) 

tmpList[1] = ('_Data','_-Data','self["DataBlockSize"]-4') 

block.structure = tuple(tmpList) 

 

block.fromString(data) 

blockLen = len(block) 

 

if block['Data'][:2] in StructMappings: 

block = StructMappings[block['Data'][:2]](block['Data']) 

 

res.append(block) 

data = data[blockLen:] 

return res 

 

def __getValueData(self, rec): 

# We should receive a VK record 

256 ↛ 257line 256 didn't jump to line 257, because the condition on line 256 was never true if rec['DataLen'] == 0: 

return '' 

if rec['DataLen'] < 0: 

# if DataLen < 5 the value itself is stored in the Offset field 

return rec['OffsetData'] 

else: 

return self.__getData(rec['OffsetData'], rec['DataLen']+4) 

 

def __getLhHash(self, key): 

res = 0 

for bb in key.upper(): 

res *= 37 

res += ord(bb) 

return res % 0x100000000 

 

def __compareHash(self, magic, hashData, key): 

272 ↛ 276line 272 didn't jump to line 276, because the condition on line 272 was never false if magic == 'lf': 

hashRec = REG_HASH(hashData) 

if hashRec['KeyName'].strip(b'\x00') == b(key[:4]): 

return hashRec['OffsetNk'] 

elif magic == 'lh': 

hashRec = REG_HASH(hashData) 

if unpack('<L',hashRec['KeyName'])[0] == self.__getLhHash(key): 

return hashRec['OffsetNk'] 

elif magic == 'ri': 

# Special case here, don't know exactly why, an ri pointing to a NK :-o 

offset = unpack('<L', hashData[:4])[0] 

nk = self.__getBlock(offset) 

if nk['KeyName'] == key: 

return offset 

else: 

LOG.critical("UNKNOWN Magic %s" % magic) 

sys.exit(1) 

 

return None 

 

def __findSubKey(self, parentKey, subKey): 

lf = self.__getBlock(parentKey['OffsetSubKeyLf']) 

294 ↛ 318line 294 didn't jump to line 318, because the condition on line 294 was never false if lf is not None: 

data = lf['HashRecords'] 

# Let's search the hash records for the name 

297 ↛ 299line 297 didn't jump to line 299, because the condition on line 297 was never true if lf['Magic'] == 'ri': 

# ri points to lf/lh records, so we must parse them before 

records = b'' 

for i in range(lf['NumKeys']): 

offset = unpack('<L', data[:4])[0] 

l = self.__getBlock(offset) 

records = records + l['HashRecords'][:l['NumKeys']*8] 

data = data[4:] 

data = records 

 

#for record in range(lf['NumKeys']): 

308 ↛ 318line 308 didn't jump to line 318, because the loop on line 308 didn't complete for record in range(parentKey['NumSubKeys']): 

hashRec = data[:8] 

res = self.__compareHash(lf['Magic'], hashRec, subKey) 

if res is not None: 

# We have a match, now let's check the whole record 

nk = self.__getBlock(res) 

if nk['KeyName'].decode('utf-8') == subKey: 

return nk 

data = data[8:] 

 

return None 

 

def __walkSubNodes(self, rec): 

nk = self.__getBlock(rec['OffsetNk']) 

if isinstance(nk, REG_NK): 

print("%s%s" % (self.indent, nk['KeyName'].decode('utf-8'))) 

self.indent += ' ' 

if nk['OffsetSubKeyLf'] < 0: 

self.indent = self.indent[:-2] 

return 

lf = self.__getBlock(nk['OffsetSubKeyLf']) 

else: 

lf = nk 

 

data = lf['HashRecords'] 

 

if lf['Magic'] == 'ri': 

# ri points to lf/lh records, so we must parse them before 

records = '' 

for i in range(lf['NumKeys']): 

offset = unpack('<L', data[:4])[0] 

l = self.__getBlock(offset) 

records = records + l['HashRecords'][:l['NumKeys']*8] 

data = data[4:] 

data = records 

 

for key in range(lf['NumKeys']): 

hashRec = REG_HASH(data[:8]) 

self.__walkSubNodes(hashRec) 

data = data[8:] 

 

if isinstance(nk, REG_NK): 

self.indent = self.indent[:-2] 

 

def walk(self, parentKey): 

key = self.findKey(parentKey) 

 

if key is None or key['OffsetSubKeyLf'] < 0: 

return 

 

lf = self.__getBlock(key['OffsetSubKeyLf']) 

data = lf['HashRecords'] 

for record in range(lf['NumKeys']): 

hashRec = REG_HASH(data[:8]) 

self.__walkSubNodes(hashRec) 

data = data[8:] 

 

def findKey(self, key): 

# Let's strip '\' from the beginning, except for the case of 

# only asking for the root node 

if key[0] == '\\' and len(key) > 1: 

key = key[1:] 

 

parentKey = self.rootKey 

372 ↛ 381line 372 didn't jump to line 381, because the condition on line 372 was never false if len(key) > 0 and key[0]!='\\': 

for subKey in key.split('\\'): 

res = self.__findSubKey(parentKey, subKey) 

375 ↛ 379line 375 didn't jump to line 379, because the condition on line 375 was never false if res is not None: 

parentKey = res 

else: 

#LOG.error("Key %s not found!" % key) 

return None 

 

return parentKey 

 

def printValue(self, valueType, valueData): 

if valueType == REG_SZ or valueType == REG_EXPAND_SZ: 

if type(valueData) is int: 

print('NULL') 

else: 

print("%s" % (valueData.decode('utf-16le'))) 

elif valueType == REG_BINARY: 

print('') 

hexdump(valueData, self.indent) 

elif valueType == REG_DWORD: 

print("%d" % valueData) 

elif valueType == REG_QWORD: 

print("%d" % (unpack('<Q',valueData)[0])) 

elif valueType == REG_NONE: 

try: 

if len(valueData) > 1: 

print('') 

hexdump(valueData, self.indent) 

else: 

print(" NULL") 

except: 

print(" NULL") 

elif valueType == REG_MULTISZ: 

print("%s" % (valueData.decode('utf-16le'))) 

else: 

print("Unknown Type 0x%x!" % valueType) 

hexdump(valueData) 

 

def enumKey(self, parentKey): 

res = [] 

# If we're here.. we have a valid NK record for the key 

# Now let's searcht the subkeys 

415 ↛ 434line 415 didn't jump to line 434, because the condition on line 415 was never false if parentKey['NumSubKeys'] > 0: 

lf = self.__getBlock(parentKey['OffsetSubKeyLf']) 

data = lf['HashRecords'] 

 

419 ↛ 421line 419 didn't jump to line 421, because the condition on line 419 was never true if lf['Magic'] == 'ri': 

# ri points to lf/lh records, so we must parse them before 

records = '' 

for i in range(lf['NumKeys']): 

offset = unpack('<L', data[:4])[0] 

l = self.__getBlock(offset) 

records = records + l['HashRecords'][:l['NumKeys']*8] 

data = data[4:] 

data = records 

 

for i in range(parentKey['NumSubKeys']): 

hashRec = REG_HASH(data[:8]) 

nk = self.__getBlock(hashRec['OffsetNk']) 

data = data[8:] 

res.append('%s'%nk['KeyName'].decode('utf-8')) 

return res 

 

def enumValues(self,key): 

# If we're here.. we have a valid NK record for the key 

# Now let's search its values 

resp = [] 

440 ↛ 449line 440 didn't jump to line 449, because the condition on line 440 was never false if key['NumValues'] > 0: 

valueList = self.__getValueBlocks(key['OffsetValueList'], key['NumValues']+1) 

 

for value in valueList: 

444 ↛ 447line 444 didn't jump to line 447, because the condition on line 444 was never false if value['Flag'] > 0: 

resp.append(value['Name']) 

else: 

resp.append(b'default') 

 

return resp 

 

def getValue(self, keyValue): 

# returns a tuple with (ValueType, ValueData) for the requested keyValue 

regKey = ntpath.dirname(keyValue) 

regValue = ntpath.basename(keyValue) 

 

key = self.findKey(regKey) 

 

458 ↛ 459line 458 didn't jump to line 459, because the condition on line 458 was never true if key is None: 

return None 

 

461 ↛ 470line 461 didn't jump to line 470, because the condition on line 461 was never false if key['NumValues'] > 0: 

valueList = self.__getValueBlocks(key['OffsetValueList'], key['NumValues']+1) 

 

464 ↛ 470line 464 didn't jump to line 470, because the loop on line 464 didn't complete for value in valueList: 

if value['Name'] == b(regValue): 

return value['ValueType'], self.__getValueData(value) 

elif regValue == 'default' and value['Flag'] <=0: 

return value['ValueType'], self.__getValueData(value) 

 

return None 

 

def getClass(self, className): 

 

key = self.findKey(className) 

 

if key is None: 

return None 

 

#print key.dump() 

if key['OffsetClassName'] > 0: 

value = self.__getBlock(key['OffsetClassName']) 

return value['Data']