973 lines
25 KiB
C
973 lines
25 KiB
C
//Copyright (c) 1998 - 1999 Microsoft Corporation
|
|
/*++
|
|
|
|
Copyright (c) 1998 Citrix Systems
|
|
|
|
Module Name:
|
|
|
|
regfix.c
|
|
|
|
Abstract:
|
|
|
|
Reads hv (low) level structures in a hive and rewrites the hive structs after applying
|
|
ACL fixes. Reads in the hive in block sizes. Scans for and processes security keys.
|
|
Extracts the SECURITY_DESCRIPTOR structure form a cell and checks consistency of sizes
|
|
of ACEs and ACLs.
|
|
|
|
Usage: regfix in_filename out_filename
|
|
|
|
Author:
|
|
|
|
Maris Kurens (v-marisk (MS), marisk (CTXS)) Apr 1998
|
|
|
|
Revision History:
|
|
Created - Apr 23, 1998
|
|
|
|
--*/
|
|
|
|
|
|
/*
|
|
|
|
NOTE: This hive/registry tool does not read the
|
|
entire hive into memory, but will read the hive file
|
|
on a block by block basis, process each block and
|
|
write out the block to a new file using file I/O.
|
|
|
|
*/
|
|
|
|
// Include NT headers
|
|
#include <nt.h>
|
|
#include <ntrtl.h>
|
|
#include <nturtl.h>
|
|
#include <ntseapi.h>
|
|
|
|
#include "cmp.h"
|
|
#include "regfix.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <windows.h>
|
|
|
|
#define INFILE 0x01
|
|
#define OUTFILE 0x02
|
|
#define BOTHFILE 0x03
|
|
|
|
|
|
int __cdecl main (int argc, char *argv[]);
|
|
void openFile (void);
|
|
void closeFile (unsigned which);
|
|
void ScanHive (void);
|
|
void DoKeySD (IN PCM_KEY_SECURITY Security, IN ULONG CellSize);
|
|
void ScanCell (PHCELL Cell, ULONG CellSize);
|
|
|
|
void DumpSecurityDescriptor (PSECURITY_DESCRIPTOR pSD);
|
|
void CtxDumpSid (PSID, PCHAR, PULONG);
|
|
void DumpAcl (PACL, PCHAR, PULONG);
|
|
void DumpAce (PACE_HEADER, PCHAR, PULONG);
|
|
BOOL AreWeRunningTerminalServices(void);
|
|
|
|
|
|
VOID WINAPI ErrorPrintf (int nErrorResourceID, ...);
|
|
|
|
|
|
LPCTSTR inFileName = NULL;
|
|
LPCTSTR outFileName = NULL;
|
|
|
|
HANDLE infilehandle;
|
|
HANDLE outfilehandle;
|
|
|
|
ULONG HiveVersion;
|
|
|
|
//
|
|
// SUMMARY TOTALS
|
|
//
|
|
ULONG SizeSDData=0;
|
|
ULONG NumSDData=0;
|
|
|
|
ULONG BlockNumb = 0;
|
|
ULONG BadACL = 0;
|
|
ULONG BadACE = 0;
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Basic arg check, arg echo, process calls and result dump
|
|
//
|
|
// Args :
|
|
// if you have to ask ...
|
|
//
|
|
// Return :
|
|
//
|
|
//---------------------------------------------------------
|
|
|
|
int __cdecl main (int argc, char *argv[])
|
|
{
|
|
|
|
//Check if we are running under Terminal Server
|
|
if(!AreWeRunningTerminalServices())
|
|
{
|
|
ErrorPrintf(IDS_ERROR_NOT_TS);
|
|
return(1);
|
|
}
|
|
|
|
if (argc < 3)
|
|
{
|
|
ErrorPrintf (IDS_ERROR_USAGE);
|
|
exit (1);
|
|
}
|
|
|
|
inFileName = argv [1];
|
|
outFileName = argv [2];
|
|
|
|
//
|
|
// echo the args
|
|
//
|
|
ErrorPrintf (IDS_WORKING);
|
|
|
|
//
|
|
// open the in and out files
|
|
//
|
|
openFile ();
|
|
|
|
//
|
|
// and process it
|
|
//
|
|
ScanHive ();
|
|
|
|
ErrorPrintf (IDS_DONE);
|
|
ErrorPrintf (IDS_SD_NUMBER, NumSDData);
|
|
ErrorPrintf (IDS_BAD_ACL_NUMBER, BadACL);
|
|
ErrorPrintf (IDS_BAD_ACE_NUMBER, BadACE);
|
|
|
|
return (0);
|
|
}
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Closes file handles based on input args
|
|
//
|
|
// Args :
|
|
// which - signals if input or output or both files should be closed
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void closeFile (unsigned which)
|
|
{
|
|
if (which & INFILE)
|
|
{
|
|
if (infilehandle != INVALID_HANDLE_VALUE)
|
|
{
|
|
CloseHandle (infilehandle);
|
|
infilehandle = INVALID_HANDLE_VALUE;
|
|
}
|
|
}
|
|
|
|
if (which & OUTFILE)
|
|
{
|
|
if (infilehandle != INVALID_HANDLE_VALUE)
|
|
{
|
|
CloseHandle (outfilehandle);
|
|
outfilehandle = INVALID_HANDLE_VALUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Opens input and output files
|
|
//
|
|
// Args : Nada
|
|
//
|
|
// Return : Nada
|
|
//
|
|
//---------------------------------------------------------
|
|
void openFile (void)
|
|
{
|
|
//
|
|
// open the input file
|
|
//
|
|
infilehandle = CreateFile (inFileName, GENERIC_READ, FILE_SHARE_READ, NULL,
|
|
OPEN_EXISTING, FILE_FLAG_SEQUENTIAL_SCAN, NULL);
|
|
|
|
if (infilehandle == INVALID_HANDLE_VALUE)
|
|
{
|
|
fprintf (stderr,
|
|
"regfix: Could not open file '%s' error = %08lx\n",
|
|
inFileName, GetLastError());
|
|
exit(1);
|
|
}
|
|
|
|
//
|
|
// open the output file
|
|
//
|
|
outfilehandle = CreateFile (outFileName, GENERIC_WRITE, FILE_SHARE_WRITE, NULL,
|
|
CREATE_ALWAYS, FILE_FLAG_SEQUENTIAL_SCAN, NULL);
|
|
|
|
if (outfilehandle == INVALID_HANDLE_VALUE)
|
|
{
|
|
closeFile (INFILE);
|
|
fprintf (stderr,
|
|
"hivestat: Could not create file '%s' error = %08lx\n",
|
|
outFileName, GetLastError());
|
|
exit(1);
|
|
}
|
|
}
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Scan the hive, looking for security cells. Load the
|
|
// hive block by block and write each block to the output
|
|
// file after processing it.
|
|
//
|
|
// Args : None
|
|
//
|
|
// Return : Nyet
|
|
//
|
|
//---------------------------------------------------------
|
|
void ScanHive (void)
|
|
{
|
|
static char buffer[HBLOCK_SIZE];
|
|
PHBASE_BLOCK bbp;
|
|
BOOL rf;
|
|
BOOL wf;
|
|
ULONG readcount;
|
|
ULONG writecount;
|
|
ULONG hivelength;
|
|
ULONG hiveposition;
|
|
PHCELL cp;
|
|
PHCELL guard;
|
|
PHBIN hbp;
|
|
ULONG hoff;
|
|
ULONG binread;
|
|
ULONG binsize;
|
|
ULONG cellsize;
|
|
ULONG boff;
|
|
ULONG lboff;
|
|
ULONG SizeTotal;
|
|
|
|
//
|
|
// read the header
|
|
//
|
|
rf = ReadFile (infilehandle, buffer, HBLOCK_SIZE, &readcount, NULL);
|
|
if ((!rf) || (readcount != HBLOCK_SIZE) )
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf (stderr, "regfix: '%s' - cannot read base block!\n", inFileName);
|
|
exit(1);
|
|
}
|
|
|
|
BlockNumb++;
|
|
|
|
bbp = (PHBASE_BLOCK)(&(buffer[0]));
|
|
|
|
if ((bbp->Major != HSYS_MAJOR) ||
|
|
(bbp->Minor > HSYS_MINOR))
|
|
{
|
|
|
|
closeFile (BOTHFILE);
|
|
|
|
fprintf(stderr,
|
|
"hivestat: major/minor != %d/%d get newer hivestat\n",
|
|
HSYS_MAJOR, HSYS_MINOR
|
|
);
|
|
exit(1);
|
|
}
|
|
|
|
HiveVersion = bbp->Minor;
|
|
|
|
hivelength = bbp->Length + HBLOCK_SIZE;
|
|
hiveposition = HBLOCK_SIZE;
|
|
hoff = 0;
|
|
|
|
|
|
//
|
|
// scan the hive
|
|
//
|
|
guard = (PHCELL)(&(buffer[0]) + HBLOCK_SIZE);
|
|
|
|
wf = WriteFile (outfilehandle, buffer, HBLOCK_SIZE, &writecount, NULL);
|
|
if ((!wf) || (writecount != HBLOCK_SIZE) )
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf (stderr, "regfix: '%s' - cannot write base block!\n", outFileName);
|
|
exit(1);
|
|
}
|
|
|
|
//
|
|
// hiveposition is file relative offset of next block we will read
|
|
//
|
|
// hoff is the file relative offset of the last block we read
|
|
//
|
|
// hivelength is actual length of file (header's recorded length plus
|
|
// the size of the header.
|
|
//
|
|
// cp is pointer into memory, within range of buffer, it's a cell pointer
|
|
//
|
|
while (hiveposition < hivelength)
|
|
{
|
|
|
|
//
|
|
// read in first block of bin, check signature, determine key type
|
|
//
|
|
rf = ReadFile (infilehandle, buffer, HBLOCK_SIZE, &readcount, NULL);
|
|
if ((! rf) || (readcount != HBLOCK_SIZE))
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf (stderr, "hivestat: '%s' read error @%08lx\n", inFileName, hiveposition);
|
|
exit (1);
|
|
}
|
|
BlockNumb++;
|
|
|
|
hbp = (PHBIN)(&(buffer[0]));
|
|
|
|
if (hbp->Signature != HBIN_SIGNATURE)
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf(stderr,
|
|
"hivestat: '%s' bad bin sign. @%08lx\n", inFileName, hiveposition);
|
|
exit(1);
|
|
}
|
|
|
|
hiveposition += HBLOCK_SIZE;
|
|
hoff += HBLOCK_SIZE;
|
|
ASSERT (hoff+HBLOCK_SIZE == hiveposition);
|
|
|
|
binsize = hbp->Size;
|
|
//
|
|
// scan the bin
|
|
//
|
|
// cp = pointer to cell we are looking at
|
|
// boff = offset within bin
|
|
// lboff = last offset within bin, used only for consistency checks
|
|
// binread = number of bytes of bin we've read so far
|
|
//
|
|
cp = (PHCELL)((PUCHAR)hbp + sizeof(HBIN));
|
|
boff = sizeof(HBIN);
|
|
lboff = (ULONG)-1;
|
|
binread = HBLOCK_SIZE;
|
|
|
|
while (binread <= binsize)
|
|
{
|
|
|
|
//
|
|
// if free, update pointer only
|
|
// else scan it
|
|
//
|
|
if (cp->Size > 0)
|
|
{
|
|
cellsize = cp->Size;
|
|
}
|
|
else
|
|
{
|
|
cellsize = -1 * cp->Size;
|
|
ScanCell (cp, cellsize);
|
|
}
|
|
|
|
//
|
|
// do basic consistency check
|
|
//
|
|
#if 0
|
|
if (cp->Last != lboff) {
|
|
printf("e!,x%08lx bad LAST pointer %08lx\n",
|
|
hoff+((PUCHAR)cp - &(buffer[0])), cp->Last);
|
|
}
|
|
#endif
|
|
|
|
//
|
|
// advance to next cell
|
|
//
|
|
lboff = boff;
|
|
cp = (PHCELL)((PUCHAR)cp + cellsize);
|
|
boff += cellsize;
|
|
|
|
//
|
|
// scan ahead in bin, if cp has reached off end of block,
|
|
// AND there's bin left to read.
|
|
// do this BEFORE breaking out for boff at end.
|
|
//
|
|
while ((cp >= guard) && (binread < binsize))
|
|
{
|
|
|
|
// write out the currently loaded block
|
|
wf = WriteFile (outfilehandle, buffer, HBLOCK_SIZE, &writecount, NULL);
|
|
if ((!wf) || (writecount != HBLOCK_SIZE) )
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf (stderr, "regfix: '%s' - cannot write block %d!\n", BlockNumb, outFileName);
|
|
exit(1);
|
|
}
|
|
|
|
|
|
rf = ReadFile(infilehandle, buffer, HBLOCK_SIZE, &readcount, NULL);
|
|
if ((!rf) || (readcount != HBLOCK_SIZE))
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf(stderr, "hivestat: '%s' read error @%08lx\n", inFileName, hiveposition);
|
|
exit(1);
|
|
}
|
|
BlockNumb++;
|
|
|
|
cp = (PHCELL)((PUCHAR)cp - HBLOCK_SIZE);
|
|
hiveposition += HBLOCK_SIZE;
|
|
hoff += HBLOCK_SIZE;
|
|
binread += HBLOCK_SIZE;
|
|
ASSERT (hoff+HBLOCK_SIZE == hiveposition);
|
|
}
|
|
|
|
if (boff >= binsize)
|
|
{
|
|
break; // we are done with this bin
|
|
}
|
|
}
|
|
|
|
wf = WriteFile (outfilehandle, buffer, HBLOCK_SIZE, &writecount, NULL);
|
|
if ((!wf) || (writecount != HBLOCK_SIZE) )
|
|
{
|
|
closeFile (BOTHFILE);
|
|
fprintf (stderr, "regfix: '%s' - cannot write block %d!\n", BlockNumb, outFileName);
|
|
exit(1);
|
|
}
|
|
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Given a pointer to an HCELL, check the SD type cell signature
|
|
// If it is pass to the SD processing routines.
|
|
// Note : framework is in place to handle other cell types
|
|
//
|
|
// Args :
|
|
// Cell - Supplies a pointer to the HCELL
|
|
//
|
|
// CellSize - Supplies the size of the HCELL
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void ScanCell (IN PHCELL Cell, IN ULONG CellSize)
|
|
{
|
|
PCELL_DATA Data;
|
|
|
|
if (HiveVersion==1)
|
|
{
|
|
Data = (PCELL_DATA)&Cell->u.OldCell.u.UserData;
|
|
}
|
|
else
|
|
{
|
|
Data = (PCELL_DATA)&Cell->u.NewCell.u.UserData;
|
|
}
|
|
|
|
//
|
|
// grovel through the data, see if we can find the SD keys
|
|
//
|
|
if ((Data->u.KeyNode.Signature == CM_KEY_NODE_SIGNATURE) &&
|
|
(CellSize > sizeof(CM_KEY_NODE)))
|
|
{
|
|
//
|
|
// probably a key node
|
|
//
|
|
return;
|
|
}
|
|
else if ((Data->u.KeyValue.Signature == CM_KEY_VALUE_SIGNATURE) &&
|
|
(CellSize > sizeof(CM_KEY_VALUE)))
|
|
{
|
|
|
|
//
|
|
// probably a key value
|
|
//
|
|
return;
|
|
|
|
}
|
|
else if ((Data->u.KeySecurity.Signature == CM_KEY_SECURITY_SIGNATURE) &&
|
|
(CellSize > sizeof(CM_KEY_SECURITY)))
|
|
{
|
|
|
|
//
|
|
// probably a security descriptor
|
|
//
|
|
DoKeySD (&Data->u.KeySecurity, CellSize);
|
|
|
|
}
|
|
else if ((Data->u.KeyIndex.Signature == CM_KEY_INDEX_ROOT) ||
|
|
(Data->u.KeyIndex.Signature == CM_KEY_INDEX_LEAF))
|
|
{
|
|
//
|
|
// probably a key index
|
|
//
|
|
return;
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Nothing with a signature, could be either
|
|
// name
|
|
// key list
|
|
// value data
|
|
//
|
|
return;
|
|
|
|
}
|
|
}
|
|
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Expects an SD cell pointer. Extracts the SD descriptor
|
|
// and passes it on for further processing
|
|
//
|
|
// Args :
|
|
// Security - Pointer to PCM_KEY_SECURITY type cell
|
|
//
|
|
// CellSize - size of the HCELL
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void DoKeySD (IN PCM_KEY_SECURITY Security, IN ULONG CellSize)
|
|
{
|
|
PSECURITY_DESCRIPTOR pSD;
|
|
|
|
SizeSDData += CellSize;
|
|
NumSDData++;
|
|
|
|
pSD = &Security->Descriptor;
|
|
DumpSecurityDescriptor (pSD);
|
|
}
|
|
|
|
//---------------------------------------------------------
|
|
// ** The following routines are hacks of the dumpsd
|
|
// ** lib code in private\citrix\syslib
|
|
// ** This util can easily be modified as a standalone
|
|
// ** utility for a variety of hive security processing
|
|
//---------------------------------------------------------
|
|
|
|
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Unfolds an SD descriptor passing SID and ACL pointers
|
|
// for further processing
|
|
//
|
|
// Args :
|
|
// pSD - Pointer to SECURITY_DESCRIPTOR structure
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void DumpSecurityDescriptor (PSECURITY_DESCRIPTOR pSD)
|
|
{
|
|
PISECURITY_DESCRIPTOR p = (PISECURITY_DESCRIPTOR)pSD;
|
|
PSID pSid;
|
|
PACL pAcl;
|
|
PCHAR pTmp;
|
|
ULONG Size;
|
|
|
|
/*
|
|
DbgPrint ("DUMP_SECURITY_DESCRIPTOR: Revision %d, Sbz1 %d, Control 0x%x\n",
|
|
p->Revision, p->Sbz1, p->Control );
|
|
|
|
if (p->Control & SE_SELF_RELATIVE )
|
|
{
|
|
DbgPrint("Self Relative\n");
|
|
}
|
|
|
|
DbgPrint("PSID Owner 0x%x\n",p->Owner);
|
|
*/
|
|
|
|
// If this is self relative, must offset the pointers
|
|
if( p->Owner != NULL )
|
|
{
|
|
if (p->Control & SE_SELF_RELATIVE)
|
|
{
|
|
pTmp = (PCHAR)pSD;
|
|
pTmp += (ULONG)p->Owner;
|
|
CtxDumpSid ((PSID)pTmp, (PCHAR)p, &Size );
|
|
}
|
|
else
|
|
{
|
|
// can reference it directly
|
|
CtxDumpSid (p->Owner, (PCHAR)p, &Size );
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
DbgPrint("PSID Group 0x%x\n",p->Group);
|
|
*/
|
|
// If this is self relative, must offset the pointers
|
|
if (p->Group != NULL)
|
|
{
|
|
if (p->Control & SE_SELF_RELATIVE)
|
|
{
|
|
pTmp = (PCHAR)pSD;
|
|
pTmp += (ULONG)p->Group;
|
|
CtxDumpSid( (PSID)pTmp, (PCHAR)p, &Size );
|
|
}
|
|
else
|
|
{
|
|
// can reference it directly
|
|
CtxDumpSid( p->Group, (PCHAR)p, &Size );
|
|
}
|
|
}
|
|
|
|
// DbgPrint("\n");
|
|
|
|
// DbgPrint("PACL Sacl 0x%x\n",p->Sacl);
|
|
|
|
// If this is self relative, must offset the pointers
|
|
if (p->Sacl != NULL)
|
|
{
|
|
if (p->Control & SE_SELF_RELATIVE)
|
|
{
|
|
pTmp = (PCHAR)pSD;
|
|
pTmp += (ULONG)p->Sacl;
|
|
DumpAcl( (PSID)pTmp, (PCHAR)p, &Size );
|
|
}
|
|
else
|
|
{
|
|
// can reference it directly
|
|
DumpAcl (p->Sacl, (PCHAR)p, &Size);
|
|
}
|
|
}
|
|
|
|
// DbgPrint("\n");
|
|
|
|
// DbgPrint ("PACL Dacl 0x%x\n",p->Dacl);
|
|
|
|
// If this is self relative, must offset the pointers
|
|
if (p->Dacl != NULL)
|
|
{
|
|
if (p->Control & SE_SELF_RELATIVE)
|
|
{
|
|
pTmp = (PCHAR)pSD;
|
|
pTmp += (ULONG)p->Dacl;
|
|
DumpAcl( (PSID)pTmp, (PCHAR)p, &Size );
|
|
}
|
|
else
|
|
{
|
|
// can reference it directly
|
|
DumpAcl( p->Dacl, (PCHAR)p, &Size );
|
|
}
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Examine an SD descriptor for subauthority and owner
|
|
// info
|
|
//
|
|
// Args :
|
|
// pSid - Pointer to SID structure
|
|
// pBase - not used (kept for historical reasons)
|
|
// pSize - holds the SID size on return
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void CtxDumpSid (
|
|
PSID pSid,
|
|
PCHAR pBase,
|
|
PULONG pSize)
|
|
{
|
|
PISID p;
|
|
ULONG i;
|
|
BOOL OK;
|
|
DWORD szUserName;
|
|
DWORD szDomain;
|
|
SID_NAME_USE UserSidType;
|
|
WCHAR UserName[256];
|
|
WCHAR Domain[256];
|
|
ULONG Size = 0;
|
|
|
|
p = (PISID)pSid;
|
|
|
|
// DbgPrint("Revision %d, SubAuthorityCount %d\n", p->Revision, p->SubAuthorityCount);
|
|
|
|
Size += 2; // Revision, SubAuthorityCount
|
|
|
|
/*
|
|
DbgPrint("IdentifierAuthority: %x %x %x %x %x %x\n",
|
|
p->IdentifierAuthority.Value[0],
|
|
p->IdentifierAuthority.Value[1],
|
|
p->IdentifierAuthority.Value[2],
|
|
p->IdentifierAuthority.Value[3],
|
|
p->IdentifierAuthority.Value[4],
|
|
p->IdentifierAuthority.Value[5] );
|
|
*/
|
|
Size += 6; // IdentifierAuthority
|
|
|
|
for (i=0; i < p->SubAuthorityCount; i++)
|
|
{
|
|
|
|
// DbgPrint("SubAuthority[%d] 0x%x\n", i, p->SubAuthority[i]);
|
|
|
|
Size += sizeof(ULONG);
|
|
}
|
|
|
|
if (pSize)
|
|
{
|
|
*pSize = Size;
|
|
}
|
|
|
|
szUserName = sizeof (UserName);
|
|
szDomain = sizeof (Domain);
|
|
|
|
// Now print its account
|
|
/*
|
|
OK = LookupAccountSidW (
|
|
NULL, // Computer Name
|
|
pSid,
|
|
UserName,
|
|
&szUserName,
|
|
Domain,
|
|
&szDomain,
|
|
&UserSidType);
|
|
*/
|
|
|
|
// if (OK)
|
|
// {
|
|
// DbgPrint("Account Name %ws, Domain %ws, Type %d, SidSize %d\n",UserName,Domain,UserSidType,Size);
|
|
// }
|
|
// else
|
|
// {
|
|
// DbgPrint("Error looking up account name %d, SizeSid %d\n",GetLastError(),Size);
|
|
// }
|
|
|
|
}
|
|
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Unfolds an ACL dumping all the ACEs in the process
|
|
// checking consistency by tracking the actual size
|
|
//
|
|
// Args :
|
|
// pAcl - Pointer to ACL structure
|
|
// pBase - not used (kept for historical reasons)
|
|
// pSize - holds the size on return
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void DumpAcl (PACL pAcl, PCHAR pBase, PULONG pSize)
|
|
{
|
|
USHORT i;
|
|
PCHAR pTmp;
|
|
ULONG Size, MySize;
|
|
PACL p = pAcl;
|
|
PCHAR pCur = (PCHAR)pAcl;
|
|
|
|
MySize = 0;
|
|
|
|
// DbgPrint ("AclRevision %d, Sbz1 %d, AclSize %d, AceCount %d, Sbz2 %d\n",
|
|
// p->AclRevision, p->Sbz1, p->AclSize, p->AceCount, p->Sbz2);
|
|
|
|
// bump over the ACL header to point to the first ACE
|
|
pCur += sizeof (ACL);
|
|
|
|
MySize += sizeof (ACL);
|
|
|
|
for (i=0; i < p->AceCount; i++)
|
|
{
|
|
DumpAce ((PACE_HEADER)pCur, pBase, &Size );
|
|
|
|
pCur += Size;
|
|
MySize += Size;
|
|
}
|
|
|
|
// ACL consistency check
|
|
if( p->AclSize != MySize )
|
|
{
|
|
//
|
|
// HACK!HACK!HACK!
|
|
// |
|
|
// |
|
|
// |
|
|
// v
|
|
if (p->AclSize == 1023) // This hack is in response to MS bug #1607. The hive load fails on ACL
|
|
{ // size alignment check. The sw hive file that causes this problem has
|
|
p->AclSize = 1024; // about 3k SD entries of ACL size 1023. This hack adjusts this.
|
|
}
|
|
// ^
|
|
// |
|
|
// |
|
|
// |
|
|
// |
|
|
// HACK!HACK!HACK!
|
|
|
|
// DbgPrint("Inconsistent ACL Entry! p->AclSize %d, RealSize %d\n",p->AclSize,MySize);
|
|
// p->AclSize = MySize;
|
|
BadACL++;
|
|
}
|
|
|
|
// return the size of this ACL
|
|
*pSize = MySize;
|
|
return;
|
|
}
|
|
|
|
|
|
//---------------------------------------------------------
|
|
// Description :
|
|
// Unfolds an ACE descriptor checking consistency by
|
|
// tracking the actual size
|
|
//
|
|
// Args :
|
|
// pAce - Pointer to ACE structure
|
|
// pBase - not used (kept for historical reasons)
|
|
// pSize - holds the size on return
|
|
//
|
|
// Return : Nothing
|
|
//
|
|
//---------------------------------------------------------
|
|
void DumpAce (PACE_HEADER pAce,
|
|
PCHAR pBase,
|
|
PULONG pSize)
|
|
{
|
|
PACE_HEADER p = pAce;
|
|
PACCESS_ALLOWED_ACE pAl;
|
|
PACCESS_DENIED_ACE pAd;
|
|
PSYSTEM_AUDIT_ACE pSa;
|
|
PSYSTEM_ALARM_ACE pSl;
|
|
PCHAR pTmp;
|
|
ULONG MySize, Size, saveSize;
|
|
|
|
|
|
// DbgPrint ("ACE_HEADER: Type %d, Flags 0x%x, Size %d\n",
|
|
// p->AceType, p->AceFlags, p->AceSize );
|
|
|
|
|
|
switch (p->AceType)
|
|
{
|
|
|
|
case ACCESS_ALLOWED_ACE_TYPE:
|
|
pAl = (PACCESS_ALLOWED_ACE)p;
|
|
// DbgPrint("ACCESS_ALLOWED_ACE: AccessMask 0x%x, Sid 0x%x\n",pAl->Mask,pAl->SidStart);
|
|
|
|
MySize = sizeof(ACCESS_ALLOWED_ACE);
|
|
|
|
if (pAl->SidStart)
|
|
{
|
|
pTmp = (PCHAR)&pAl->SidStart;
|
|
CtxDumpSid( (PSID)pTmp, pBase, &Size );
|
|
MySize += Size;
|
|
// Adjust for the first ULONG of the ACE
|
|
// being part of the Sid
|
|
MySize -= sizeof(ULONG);
|
|
}
|
|
break;
|
|
|
|
case ACCESS_DENIED_ACE_TYPE:
|
|
pAd = (PACCESS_DENIED_ACE)p;
|
|
// DbgPrint("ACCESS_DENIED_ACE: AccessMask 0x%x, Sid 0x%x\n",pAd->Mask,pAd->SidStart);
|
|
MySize = sizeof(ACCESS_DENIED_ACE);
|
|
|
|
if (pAd->SidStart)
|
|
{
|
|
pTmp = (PCHAR)&pAd->SidStart;
|
|
CtxDumpSid( (PSID)pTmp, pBase, &Size );
|
|
MySize += Size;
|
|
// Adjust for the first ULONG of the ACE
|
|
// being part of the Sid
|
|
MySize -= sizeof(ULONG);
|
|
}
|
|
break;
|
|
|
|
case SYSTEM_AUDIT_ACE_TYPE:
|
|
pSa = (PSYSTEM_AUDIT_ACE)p;
|
|
// DbgPrint("SYSTEM_AUDIT_ACE: AccessMask 0x%x, Sid 0x%x\n",pSa->Mask,pSa->SidStart);
|
|
|
|
MySize = sizeof(SYSTEM_AUDIT_ACE);
|
|
|
|
if ( pSa->SidStart )
|
|
{
|
|
pTmp = (PCHAR)&pSa->SidStart;
|
|
CtxDumpSid( (PSID)pTmp, pBase, &Size );
|
|
MySize += Size;
|
|
// Adjust for the first ULONG of the ACE
|
|
// being part of the Sid
|
|
MySize -= sizeof(ULONG);
|
|
}
|
|
break;
|
|
|
|
case SYSTEM_ALARM_ACE_TYPE:
|
|
pSl = (PSYSTEM_ALARM_ACE)p;
|
|
// DbgPrint("SYSTEM_ALARM_ACE: AccessMask 0x%x, Sid 0x%x\n",pSl->Mask,pSl->SidStart);
|
|
|
|
MySize = sizeof(SYSTEM_ALARM_ACE);
|
|
|
|
if (pSl->SidStart)
|
|
{
|
|
pTmp = (PCHAR)&pSl->SidStart;
|
|
CtxDumpSid( (PSID)pTmp, pBase, &Size );
|
|
MySize += Size;
|
|
// Adjust for the first ULONG of the ACE
|
|
// being part of the Sid
|
|
MySize -= sizeof(ULONG);
|
|
}
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
|
|
// DbgPrint("Unknown ACE type %d\n", p->AceType);
|
|
}
|
|
|
|
saveSize = p->AceSize;
|
|
// Check its consistency
|
|
if ( p->AceSize != MySize )
|
|
{
|
|
// DbgPrint("Inconsistent ACE Entry! p->AceSize %d, RealSize %d\n",p->AceSize,MySize);
|
|
// p->AceSize = MySize;
|
|
BadACE++;
|
|
}
|
|
|
|
// return the size so the caller can update the pointer
|
|
// *pSize = p->AceSize;
|
|
*pSize = saveSize;
|
|
|
|
// DbgPrint("\n");
|
|
|
|
return;
|
|
}
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* AreWeRunningTerminalServices
|
|
*
|
|
* Check if we are running terminal server
|
|
*
|
|
* ENTRY:
|
|
*
|
|
* EXIT: BOOL: True if we are running Terminal Services False if we
|
|
* are not running Terminal Services
|
|
*
|
|
*
|
|
******************************************************************************/
|
|
|
|
BOOL AreWeRunningTerminalServices(void)
|
|
{
|
|
OSVERSIONINFOEX osVersionInfo;
|
|
DWORDLONG dwlConditionMask = 0;
|
|
|
|
ZeroMemory(&osVersionInfo, sizeof(OSVERSIONINFOEX));
|
|
osVersionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
|
|
osVersionInfo.wSuiteMask = VER_SUITE_TERMINAL;
|
|
|
|
VER_SET_CONDITION( dwlConditionMask, VER_SUITENAME, VER_AND );
|
|
|
|
return VerifyVersionInfo(
|
|
&osVersionInfo,
|
|
VER_SUITENAME,
|
|
dwlConditionMask
|
|
);
|
|
}
|
|
|
|
|