Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

hivedmp.c File Reference

#include "regutil.h"
#include "edithive.h"

Go to the source code of this file.

Functions

void DumpValues (HANDLE HiveHandle, HANDLE KeyHandle, ULONG IndentLevel)
void DumpKeys (HANDLE HiveHandle, HANDLE KeyHandle, PUNICODE_STRING KeyName, ULONG IndentLevel)
void RegDumpKeyValueR (FILE *fh, PKEY_VALUE_FULL_INFORMATION KeyValueInformation, ULONG IndentLevel)
void Usage (void)
void __cdecl main (int argc, char *argv[])

Variables

PVOID ValueBuffer
ULONG ValueBufferSize
BOOLEAN RawOutput = FALSE


Function Documentation

void DumpKeys HANDLE  HiveHandle,
HANDLE  KeyHandle,
PUNICODE_STRING  KeyName,
ULONG  IndentLevel
 

Definition at line 163 of file hivedmp.c.

References DumpValues(), EhEnumerateKey(), EhOpenChildByName(), exit, KeyName, NT_SUCCESS, NTSTATUS(), ObjectAttributes, Status, TRUE, and USHORT.

Referenced by main().

00169 { 00170 NTSTATUS Status; 00171 HANDLE SubKeyHandle; 00172 WCHAR KeyBuffer[ 512 ]; 00173 PKEY_BASIC_INFORMATION KeyInformation; 00174 OBJECT_ATTRIBUTES ObjectAttributes; 00175 ULONG SubKeyIndex; 00176 UNICODE_STRING SubKeyName; 00177 ULONG ResultLength; 00178 00179 00180 // 00181 // Print name of node we are about to dump out 00182 // 00183 printf( "%.*s%wZ\n", 00184 IndentLevel, 00185 " ", 00186 KeyName 00187 ); 00188 00189 // 00190 // Print out node's values 00191 // 00192 DumpValues( HiveHandle, KeyHandle, IndentLevel+4 ); 00193 00194 // 00195 // Enumerate node's children and apply ourselves to each one 00196 // 00197 00198 KeyInformation = (PKEY_BASIC_INFORMATION)KeyBuffer; 00199 for (SubKeyIndex = 0; TRUE; SubKeyIndex++) { 00200 Status = EhEnumerateKey( HiveHandle, 00201 KeyHandle, 00202 SubKeyIndex, 00203 KeyBasicInformation, 00204 KeyInformation, 00205 sizeof( KeyBuffer ), 00206 &ResultLength 00207 ); 00208 00209 if (Status == STATUS_NO_MORE_ENTRIES) { 00210 return; 00211 } 00212 else 00213 if (!NT_SUCCESS( Status )) { 00214 fprintf( stderr, 00215 "REGDMP: NtEnumerateKey failed - Status ==%08lx\n", 00216 Status 00217 ); 00218 exit( 1 ); 00219 } 00220 00221 SubKeyName.Buffer = (PWSTR)&(KeyInformation->Name[0]); 00222 SubKeyName.Length = (USHORT)KeyInformation->NameLength; 00223 SubKeyName.MaximumLength = (USHORT)KeyInformation->NameLength; 00224 00225 Status = EhOpenChildByName( HiveHandle, 00226 KeyHandle, 00227 &SubKeyName, 00228 &SubKeyHandle ); 00229 if (NT_SUCCESS(Status)) { 00230 DumpKeys( HiveHandle, SubKeyHandle, &SubKeyName, IndentLevel+4 ); 00231 } 00232 } 00233 00234 }

void DumpValues HANDLE  HiveHandle,
HANDLE  KeyHandle,
ULONG  IndentLevel
 

Definition at line 238 of file hivedmp.c.

References EhEnumerateValueKey(), exit, NT_SUCCESS, NTSTATUS(), RawOutput, RegDumpKeyValue(), RegDumpKeyValueR(), Status, TRUE, ValueBuffer, and ValueBufferSize.

Referenced by Dump(), and DumpKeys().

00243 { 00244 NTSTATUS Status; 00245 PKEY_VALUE_FULL_INFORMATION KeyValueInformation; 00246 ULONG ValueIndex; 00247 ULONG ResultLength; 00248 00249 KeyValueInformation = (PKEY_VALUE_FULL_INFORMATION)ValueBuffer; 00250 for (ValueIndex = 0; TRUE; ValueIndex++) { 00251 Status = EhEnumerateValueKey( HiveHandle, 00252 KeyHandle, 00253 ValueIndex, 00254 KeyValueFullInformation, 00255 KeyValueInformation, 00256 ValueBufferSize, 00257 &ResultLength 00258 ); 00259 if (Status == STATUS_NO_MORE_ENTRIES) { 00260 return; 00261 } else if (!NT_SUCCESS( Status )) { 00262 fprintf( stderr, 00263 "REGDMP: NtEnumerateValueKey failed - Status == %08lx\n", 00264 Status 00265 ); 00266 exit( 1 ); 00267 } 00268 00269 if (RawOutput == TRUE) { 00270 RegDumpKeyValueR( stdout, KeyValueInformation, IndentLevel ); 00271 } else { 00272 RegDumpKeyValue( stdout, KeyValueInformation, IndentLevel ); 00273 } 00274 } 00275 }

void __cdecl main int  argc,
char *  argv[]
 

Definition at line 74 of file hivedmp.c.

References DebugOutput, DumpKeys(), EhOpenHive(), exit, FALSE, FileName, KeyName, NULL, RawOutput, RtlAnsiStringToUnicodeString(), RtlDosPathNameToNtPathName_U(), RtlInitString(), SummaryOutput, TRUE, TYPE_SIMPLE, Usage(), VALUE_BUFFER_SIZE, ValueBuffer, and ValueBufferSize.

00078 { 00079 char *s; 00080 ANSI_STRING AnsiString; 00081 UNICODE_STRING KeyName; 00082 UNICODE_STRING DosName; 00083 UNICODE_STRING FileName; 00084 UNICODE_STRING RootName; 00085 HANDLE HiveHandle = NULL; 00086 HANDLE RootKey = NULL; 00087 BOOLEAN ArgumentSeen; 00088 LPSTR HiveFile=NULL; 00089 00090 ValueBufferSize = VALUE_BUFFER_SIZE; 00091 ValueBuffer = VirtualAlloc( NULL, ValueBufferSize, MEM_COMMIT, PAGE_READWRITE ); 00092 if (ValueBuffer == NULL) { 00093 fprintf( stderr, "REGDMP: Unable to allocate value buffer.\n" ); 00094 exit( 1 ); 00095 } 00096 00097 ArgumentSeen = FALSE; 00098 while (--argc) { 00099 s = *++argv; 00100 if (*s == '-' || *s == '/') { 00101 while (*++s) { 00102 switch( tolower( *s ) ) { 00103 case 'd': 00104 DebugOutput = TRUE; 00105 break; 00106 00107 case 's': 00108 SummaryOutput = TRUE; 00109 break; 00110 00111 case 'r': 00112 RawOutput = TRUE; 00113 break; 00114 00115 case 'f': 00116 if (argc--) { 00117 RtlInitString( &AnsiString, *++argv ); 00118 RtlAnsiStringToUnicodeString( &DosName, 00119 &AnsiString, 00120 TRUE ); 00121 RtlDosPathNameToNtPathName_U( DosName.Buffer, 00122 &FileName, 00123 NULL, 00124 NULL ); 00125 HiveHandle = EhOpenHive( &FileName, 00126 &RootKey, 00127 &RootName, 00128 TYPE_SIMPLE ); 00129 ArgumentSeen = TRUE; 00130 break; 00131 } 00132 00133 default: Usage(); 00134 } 00135 } 00136 } 00137 #if 0 00138 else { 00139 RtlInitString( &AnsiString, s ); 00140 RtlAnsiStringToUnicodeString( &KeyName, &AnsiString, TRUE ); 00141 DumpKeys( HiveHandle, RootKey, &KeyName, 0 ); 00142 ArgumentSeen = TRUE; 00143 } 00144 #endif 00145 } 00146 00147 if (ArgumentSeen) { 00148 if (HiveHandle != NULL) { 00149 DumpKeys( HiveHandle, RootKey, &RootName, 0 ); 00150 } else { 00151 fprintf(stderr, "Couldn't open hive file %wZ\n",&DosName); 00152 } 00153 } else { 00154 Usage(); 00155 } 00156 00157 00158 exit( 0 ); 00159 }

void RegDumpKeyValueR FILE *  fh,
PKEY_VALUE_FULL_INFORMATION  KeyValueInformation,
ULONG  IndentLevel
 

Definition at line 279 of file hivedmp.c.

References USHORT, and ValueName.

Referenced by DumpValues().

00284 { 00285 PULONG p; 00286 PWSTR pw, pw1; 00287 ULONG i, j, k, m, cbPrefix; 00288 UNICODE_STRING ValueName; 00289 PUCHAR pbyte; 00290 00291 cbPrefix = fprintf( fh, "%.*s", 00292 IndentLevel, 00293 " " 00294 ); 00295 ValueName.Buffer = (PWSTR)&(KeyValueInformation->Name[0]); 00296 ValueName.Length = (USHORT)KeyValueInformation->NameLength; 00297 ValueName.MaximumLength = (USHORT)KeyValueInformation->NameLength; 00298 00299 if (ValueName.Length) { 00300 cbPrefix += fprintf( fh, "%wS ", &ValueName ); 00301 } 00302 cbPrefix += fprintf( fh, "= " ); 00303 00304 if (KeyValueInformation->DataLength == 0) { 00305 fprintf( fh, " [no data] \n"); 00306 return; 00307 } 00308 00309 fprintf( fh, "REG_BINARY 0x%08lx", KeyValueInformation->DataLength ); 00310 p = (PULONG)((PCHAR)KeyValueInformation + KeyValueInformation->DataOffset); 00311 i = (KeyValueInformation->DataLength + 3) / sizeof( ULONG ); 00312 for (j=0; j<i; j++) { 00313 if ((j % 8) == 0) { 00314 fprintf( fh, "\n%.*s", 00315 IndentLevel+4, 00316 " " 00317 ); 00318 } 00319 00320 fprintf( fh, "0x%08lx ", *p++ ); 00321 } 00322 fprintf( fh, "\n" ); 00323 00324 fprintf( fh, "\n" ); 00325 return; 00326 }

void Usage void   ) 
 

Definition at line 66 of file hivedmp.c.

References exit.

Referenced by main(), PrivMain(), processargs(), RtlDebugUsageHeap(), RtlpDebugPageHeapUsage(), and RtlUsageHeap().

00067 { 00068 fprintf( stderr, "usage: HIVEDMP [-f hivefile]\n" ); 00069 exit( 1 ); 00070 }


Variable Documentation

BOOLEAN RawOutput = FALSE
 

Definition at line 63 of file hivedmp.c.

Referenced by DumpValues(), and main().

PVOID ValueBuffer
 

Definition at line 60 of file hivedmp.c.

Referenced by CliReadRegistryValue(), CmpCreateControlSet(), CmpSetVersionData(), CmQueryMultipleValueKey(), DoTest(), DumpValues(), KeUserModeCallback(), main(), NtQueryMultipleValueKey(), NtQuerySystemEnvironmentValue(), NtW32Call(), RegGetKeyValue(), RegReadBinaryFile(), RegReadMultiSzFile(), and RiInitializeRegistryFromAsciiFile().

ULONG ValueBufferSize
 

Definition at line 61 of file hivedmp.c.

Referenced by DumpValues(), and main().


Generated on Sat May 15 19:44:05 2004 for test by doxygen 1.3.7