1 jmh associates © 2004, all rights reserved chapter 2-3 supplement registry programming
Post on 21-Dec-2015
218 views
TRANSCRIPT
1JMH Associates © 2004, All rights reserved
Chapter 2-3 SupplementChapter 2-3 SupplementChapter 2-3 SupplementChapter 2-3 Supplement
Registry Programming
2JMH Associates © 2004, All rights reserved
OBJECTIVESOBJECTIVESOBJECTIVESOBJECTIVES
Upon completion of this chapter, you will be able to: Describe the Windows NT registry and its use Understand registry contents and how to interpret them Describe the registry management API Use the registry API to examine and modify registry
contents and structure
3JMH Associates © 2004, All rights reserved
OVERVIEW (1 of 2)OVERVIEW (1 of 2)OVERVIEW (1 of 2)OVERVIEW (1 of 2)
System management requires the ability to utilize and modify system information
Hardware configuration Amount of memory, processor types, …
Installed software Versions, vendors, install directories, …
User information Account names, passwords, home directories, …
4JMH Associates © 2004, All rights reserved
OVERVIEW (2 of 2)OVERVIEW (2 of 2)OVERVIEW (2 of 2)OVERVIEW (2 of 2)
UNIX’s solution – examples /etc/passwd for user accounts /etc/hosts for network names and addresses User home directories for user preferences
Editors, …
Windows 3.1 solution .INI files
Do not scale well, not centralized, …
5JMH Associates © 2004, All rights reserved
REGISTRY OVERVIEW (1 of 3)REGISTRY OVERVIEW (1 of 3)REGISTRY OVERVIEW (1 of 3)REGISTRY OVERVIEW (1 of 3)
Centralized, hierarchical, securable database for application and system configuration information
Access is through “registry keys” A key can contain other keys or name/value pairs
The user or administrator can view and edit the registry contents through the “registry editor”
Accessed by the REGEDIT command from the command prompt
Programs can manage the registry through the registry API functions
6JMH Associates © 2004, All rights reserved
REGISTRY OVERVIEW (2 of 3)REGISTRY OVERVIEW (2 of 3)REGISTRY OVERVIEW (2 of 3)REGISTRY OVERVIEW (2 of 3)
The registry name/value pairs contain information such as:
Operating system version number, build number, and registered user
Similar information for every properly installed application Computer’s processor type, system memory, … User-specific information:
Home directory, application preferences, …
7JMH Associates © 2004, All rights reserved
REGISTRY OVERVIEW (3 of 3)REGISTRY OVERVIEW (3 of 3)REGISTRY OVERVIEW (3 of 3)REGISTRY OVERVIEW (3 of 3)
Security information — user account names, … Mappings from file name extensions to executable
programs Used by the user interface shell when the user clicks on a file
name icon Mappings from network addresses to host machine names
8JMH Associates © 2004, All rights reserved
REGISTRY KEYSREGISTRY KEYSREGISTRY KEYSREGISTRY KEYS
Key: Similar to a files system directory
Each key can contain: Other keys A sequence of name/value pairs
Registry is accessed through keys Four predefined keys
9JMH Associates © 2004, All rights reserved
PREDEFINED KEYS (1 of 2)PREDEFINED KEYS (1 of 2)PREDEFINED KEYS (1 of 2)PREDEFINED KEYS (1 of 2)
HKEY_LOCAL_MACHINE Information about the machine, installed software, … Installed software information is created in subkeys of the
form SOFTWARE\CompanyName\ProductName\Version
HKEY_USERS User configuration information
10JMH Associates © 2004, All rights reserved
PREDEFINED KEYS (2 of 2)PREDEFINED KEYS (2 of 2)PREDEFINED KEYS (2 of 2)PREDEFINED KEYS (2 of 2)
HKEY_CLASSES_ROOT Subordinate entries of this key define mappings from file
extension names to classes and to applications used by the shell to access objects with the specified extension
HKEY_CURRENT_USER User-specific information (environment variables, printers,
and application preferences) is subordinate to this key Actually a subkey of HKEY_USERS
11JMH Associates © 2004, All rights reserved
REGISTRY MANAGEMENTREGISTRY MANAGEMENTREGISTRY MANAGEMENTREGISTRY MANAGEMENT
Key “handles” of type HKEY are used Both to specify a key and to obtain new keys
Values are typed; there are several types to select from: Strings Double words Expandable strings with parameters that can be replaced
with environment variables Many more
12JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (1 of 9)KEY MANAGEMENT (1 of 9)KEY MANAGEMENT (1 of 9)KEY MANAGEMENT (1 of 9)
RegOpenKeyEx opens a subkey Starting from a predefined reserved key handle Traverses the registry and obtains a handle to any
subordinate key
13JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (2 of 9)KEY MANAGEMENT (2 of 9)KEY MANAGEMENT (2 of 9)KEY MANAGEMENT (2 of 9)
LONG RegOpenKeyEx (HKEY hKey,LPCTSTR lpSubKey,DWORD ulOptions,REGSAM SAMDesired,PHKEY phkResult)
The return value is normally ERROR_SUCCESS Any other value indicates an error
14JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (3 of 9)KEY MANAGEMENT (3 of 9)KEY MANAGEMENT (3 of 9)KEY MANAGEMENT (3 of 9)
hKey Currently open key or one of the four predefined reserved
key handle values
*phkResult Variable of type HKEY to receive the handle of the newly
opened key
lpSubKey — name of the subkey Can be a path, such as Microsoft\WindowsNT\CurrentVersion
A NULL value causes a new, duplicate, key for hKey to be opened
15JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (4 of 9)KEY MANAGEMENT (4 of 9)KEY MANAGEMENT (4 of 9)KEY MANAGEMENT (4 of 9)
ulOptions must be zero
samDesired Access mask describing new key’s security/rights:
KEY_ALL_ACCESS
KEY_WRITE, KEY_QUERY_VALUE, and
KEY_ENUMERATE_SUBKEYS
16JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (5 of 9)KEY MANAGEMENT (5 of 9)KEY MANAGEMENT (5 of 9)KEY MANAGEMENT (5 of 9)
Close an open key handle with RegCloseKey Takes the handle as its single parameter
You can obtain names of subkeys By specifying an index to RegEnumKeyEx By specifying a name to RegQueryInfoKey
17JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (6 of 9)KEY MANAGEMENT (6 of 9)KEY MANAGEMENT (6 of 9)KEY MANAGEMENT (6 of 9)
Key enumeration
LONG RegEnumKeyEx (HKEY hKey,DWORD dwIndex, LPTSTR lpName,LPDWORD lpcbName, LPDWORD lpReserved,LPTSTR lpClass, LPDWORD lpcbClassPFILETIME lpftLastWriteTime)
18JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (7 of 9)KEY MANAGEMENT (7 of 9)KEY MANAGEMENT (7 of 9)KEY MANAGEMENT (7 of 9)
Include Ex suffix as shown Omit if not shown
Enumerates subkeys Start dwIndex at 0 Increment until NULL
Alternative: RegQueryInfoKey to access from known name
19JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (8 of 9)KEY MANAGEMENT (8 of 9)KEY MANAGEMENT (8 of 9)KEY MANAGEMENT (8 of 9)
Create new keys They can have security attributes
LONG RegCreateKeyEx (HKEY hKey,LPCTSTR lpSubKey, DWORD Reserved,LPTSTR lpClass, DWORD dwOptions,REGSAM samDesired,LPSECURITY_ATTRIBUTES lpSecurityAttributes,PHKEY phkResult)
20JMH Associates © 2004, All rights reserved
KEY MANAGEMENT (9 of 9)KEY MANAGEMENT (9 of 9)KEY MANAGEMENT (9 of 9)KEY MANAGEMENT (9 of 9)
Class Key class (object type)
Beyond scope
DwOptions REG_OPTION_[NON]VOLATILE
RegDeleteKey to remove key Key handle and subkey name
21JMH Associates © 2004, All rights reserved
VALUE MANAGEMENT (1 of 5)VALUE MANAGEMENT (1 of 5)VALUE MANAGEMENT (1 of 5)VALUE MANAGEMENT (1 of 5)
Similar to key management:
LONG RegEnumValue (HEKY hKey,DWORD dwIndex,LPTSTR lpValueName,LPDWORD lpcbValueName,LPDWORD lpReserved,LPDWORD lpType,LPBYTE lpData, LPDWORD lpcbData)
22JMH Associates © 2004, All rights reserved
VALUE MANAGEMENT (2 of 5)VALUE MANAGEMENT (2 of 5)VALUE MANAGEMENT (2 of 5)VALUE MANAGEMENT (2 of 5)
LONG RegSetValueEx (HKEY lpValueName,DWORD Reserved, DWORD dwType,CONST BYTE * lpData, CONST cbData)
23JMH Associates © 2004, All rights reserved
VALUE MANAGEMENT (3 of 5)VALUE MANAGEMENT (3 of 5)VALUE MANAGEMENT (3 of 5)VALUE MANAGEMENT (3 of 5)
You can enumerate the values for a specified open key using RegEnumValue
Specify an index, originally zero, which is incremented in subsequent calls
On return, you get the string with the value name as well as its size
You also get the value and its type
The actual value is returned in the buffer indicated by lpData
The size of the result can be found from lpcbData
24JMH Associates © 2004, All rights reserved
VALUE MANAGEMENT (4 of 5)VALUE MANAGEMENT (4 of 5)VALUE MANAGEMENT (4 of 5)VALUE MANAGEMENT (4 of 5)
The data type, pointed to by lpType, has numerous possibilities, including:
REG_BINARY REG_DWORD, REG_SZ (a string) REG_EXPAND_SZ (an expandable string with parameters
replaced by environment variables) See the on-line help for a full list of all the value types
Return value: ERROR_SUCCESS if you have found a valid key
25JMH Associates © 2004, All rights reserved
VALUE MANAGEMENT (5 of 5)VALUE MANAGEMENT (5 of 5)VALUE MANAGEMENT (5 of 5)VALUE MANAGEMENT (5 of 5)
RegQueryValueEx is similar Specify a value name rather than an index If you know the value names, you can use this function If you do not know the names, you can scan with
RegEnumValueEx
Set a value within an open key using RegSetValueEx Supply the value name, value type, and actual value data
Delete named values using the function RegDeleteValue
26JMH Associates © 2004, All rights reserved
REGISTRY PROCESSING (1 of 2)REGISTRY PROCESSING (1 of 2)REGISTRY PROCESSING (1 of 2)REGISTRY PROCESSING (1 of 2)
Pseudocode to scan a registry key Assume that we first open a key that is known to have
numerous subkeys Each of those subkeys only has name/value pairs Enumerate and list all these pairs
Or use recursion, as in ls
27JMH Associates © 2004, All rights reserved
REGISTRY PROCESSING (2 of 2)REGISTRY PROCESSING (2 of 2)REGISTRY PROCESSING (2 of 2)REGISTRY PROCESSING (2 of 2)
RegOpenKeyEx (hKeyKnown, "MyKey", …, &hMyKey); for (i = 0; RegEnumKeyEx (hMyKey, i, SubName, …) == ERROR_SUCCESS; i++) { RegOpenKeyEx (hMyKey, SubName, …, &hSubK); for (j = 0; RegEnumValue (hSubK, j, VName, Data, &Count) == ERROR_SUCCESS; j++) printf (… j, Vname, Data); RegCloseKey (hSubK); }RegCloseKey (hMyKey);
28JMH Associates © 2004, All rights reserved
LAB C–1 (Part 1)LAB C–1 (Part 1)LAB C–1 (Part 1)LAB C–1 (Part 1)
Modify the ls program from the Module 2 labs so that it scans and lists the registry rather than the file system
Retain the -l (long) and -R (recursive) options The -l option will list the value You will need to format each value type appropriately
29JMH Associates © 2004, All rights reserved
LAB C–1 (Part 2)LAB C–1 (Part 2)LAB C–1 (Part 2)LAB C–1 (Part 2)
Extend lsFP and chmod so as to set and list registry security attributes
Replace the GENERIC_READ [WRITE, EXECUTE] rights with the ones that are appropriate