00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050
#include "cmp.h"
00051
#include <stdio.h>
00052
#include <stdlib.h>
00053
#include <string.h>
00054
00055 #define WORK_SIZE 16384
00056
00057
void __cdecl
main(
int,
char *);
00058
void processargs();
00059
00060
void print(PUNICODE_STRING);
00061
00062
void
00063
DumpValues(
00064 HANDLE Handle
00065 );
00066
00067
void
00068
Dump(
00069 HANDLE Handle
00070 );
00071
00072 UNICODE_STRING
WorkName;
00073 WCHAR
workbuffer[
WORK_SIZE];
00074
00075
void
00076 __cdecl
main(
00077
int argc,
00078
char *argv[]
00079 )
00080 {
00081
NTSTATUS status;
00082 OBJECT_ATTRIBUTES
ObjectAttributes;
00083 HANDLE BaseHandle;
00084
00085
00086
00087
00088
00089
WorkName.MaximumLength =
WORK_SIZE;
00090
WorkName.Length = 0
L;
00091
WorkName.Buffer = &(
workbuffer[0]);
00092
00093
processargs(argc, argv);
00094
00095
00096
00097
00098
00099
00100 printf(
"rtdmp: starting\n");
00101
00102 InitializeObjectAttributes(
00103 &
ObjectAttributes,
00104 &
WorkName,
00105 0,
00106 (HANDLE)
NULL,
00107
NULL
00108 );
00109
ObjectAttributes.Attributes |= OBJ_CASE_INSENSITIVE;
00110
00111 status =
NtOpenKey(
00112 &BaseHandle,
00113 MAXIMUM_ALLOWED,
00114 &
ObjectAttributes
00115 );
00116
if (!
NT_SUCCESS(status)) {
00117 printf(
"rtdmp: t0: %08lx\n", status);
00118
exit(1);
00119 }
00120
00121
Dump(BaseHandle);
00122 }
00123
00124
00125
void
00126
Dump(
00127 HANDLE Handle
00128 )
00129 {
00130
NTSTATUS status;
00131 PKEY_BASIC_INFORMATION KeyInformation;
00132 OBJECT_ATTRIBUTES
ObjectAttributes;
00133 ULONG NamePos;
00134 ULONG index;
00135 STRING enumname;
00136 HANDLE WorkHandle;
00137 ULONG ResultLength;
00138
static char buffer[
WORK_SIZE];
00139 PUCHAR p;
00140
00141 KeyInformation = (PKEY_BASIC_INFORMATION)buffer;
00142 NamePos =
WorkName.Length;
00143
00144
00145
00146
00147
print(&WorkName);
00148 printf(
"::\n\n");
00149
00150
00151
00152
00153
DumpValues(Handle);
00154
00155
00156
00157
00158
00159
for (index = 0;
TRUE; index++) {
00160
00161 RtlZeroMemory(KeyInformation, WORK_SIZE);
00162 status =
NtEnumerateKey(
00163 Handle,
00164 index,
00165 KeyBasicInformation,
00166 KeyInformation,
00167 WORK_SIZE,
00168 &ResultLength
00169 );
00170
00171
if (status == STATUS_NO_MORE_ENTRIES) {
00172
00173
WorkName.Length = NamePos;
00174
return;
00175
00176 }
else if (!
NT_SUCCESS(status)) {
00177
00178 printf(
"rtdmp: dump1: status = %08lx\n", status);
00179
exit(1);
00180
00181 }
00182
00183 enumname.Buffer = &(KeyInformation->Name[0]);
00184 enumname.Length = KeyInformation->NameLength;
00185 enumname.MaximumLength = KeyInformation->NameLength;
00186
00187 p =
WorkName.Buffer;
00188 p +=
WorkName.Length;
00189 *p =
'\\';
00190 p++;
00191 *p =
'\0';
00192
WorkName.Length += 2;
00193
00194
RtlAppendStringToString((PSTRING)&WorkName, (PSTRING)&enumname);
00195
00196 InitializeObjectAttributes(
00197 &ObjectAttributes,
00198 &enumname,
00199 0,
00200 Handle,
00201 NULL
00202 );
00203
ObjectAttributes.Attributes |= OBJ_CASE_INSENSITIVE;
00204
00205 status =
NtOpenKey(
00206 &WorkHandle,
00207 MAXIMUM_ALLOWED,
00208 &ObjectAttributes
00209 );
00210
if (!
NT_SUCCESS(status)) {
00211 printf(
"rtdmp: dump2: %08lx\n", status);
00212
exit(1);
00213 }
00214
00215
Dump(WorkHandle);
00216
NtClose(WorkHandle);
00217
WorkName.Length = NamePos;
00218 }
00219 }
00220
00221
00222
void
00223
DumpValues(
00224 HANDLE Handle
00225 )
00226 {
00227
NTSTATUS status;
00228
static char tempbuffer[
WORK_SIZE];
00229 PKEY_VALUE_FULL_INFORMATION KeyValueInformation;
00230 ULONG index;
00231 ULONG ResultLength;
00232 PULONG p;
00233 ULONG i;
00234 UNICODE_STRING valname;
00235
00236 KeyValueInformation = (PKEY_VALUE_FULL_INFORMATION)tempbuffer;
00237
00238
for (index = 0;
TRUE; index++) {
00239
00240 RtlZeroMemory(KeyValueInformation, WORK_SIZE);
00241 status =
NtEnumerateValueKey(
00242 Handle,
00243 index,
00244 KeyValueFullInformation,
00245 KeyValueInformation,
00246 WORK_SIZE,
00247 &ResultLength
00248 );
00249
if (status == STATUS_NO_MORE_ENTRIES) {
00250
00251
return;
00252
00253 }
else if (!
NT_SUCCESS(status)) {
00254
00255 printf(
"rtdmp: dumpvalues: status = %08lx\n", status);
00256
exit(1);
00257
00258 }
00259
00260 printf(
"\t");
00261 valname.Length = KeyValueInformation->NameLength;
00262 valname.MaximumLength = KeyValueInformation->NameLength;
00263 valname.Buffer = (PWSTR)&(KeyValueInformation->Name[0]);
00264 printf(
"'");
00265
print(&valname);
00266 printf(
"'\n");
00267 printf(
00268
"\ttitle index = %d\ttype = ",
00269 KeyValueInformation->TitleIndex
00270 );
00271 printf(
"REG_BINARY\n\tValue = (%lx)\n", KeyValueInformation->DataLength);
00272 p = (PULONG)KeyValueInformation + KeyValueInformation->DataOffset;
00273 i = 1;
00274
while (i <= KeyValueInformation->DataLength) {
00275 printf(
" %08lx", *p++ );
00276
if ((i % 8) == 0) {
00277 printf(
"\n" );
00278 }
00279 i +=
sizeof( ULONG );
00280 }
00281 printf(
"\n\n");
00282 }
00283 }
00284
00285
00286
void
00287
print(
00288 PUNICODE_STRING String
00289 )
00290 {
00291
static ANSI_STRING temp;
00292
static char tempbuffer[
WORK_SIZE];
00293
00294 temp.MaximumLength =
WORK_SIZE;
00295 temp.Length = 0
L;
00296 temp.Buffer = tempbuffer;
00297
00298
RtlUnicodeStringToAnsiString(&temp, String, FALSE);
00299 printf(
"%s", temp.Buffer);
00300
return;
00301 }
00302
00303
00304
void
00305 processargs(
00306
int argc,
00307
char *argv[]
00308 )
00309 {
00310 ANSI_STRING temp;
00311
00312
if ( (argc != 2) )
00313 {
00314 printf(
"Usage: %s <KeyPath>\n",
00315 argv[0]);
00316
exit(1);
00317 }
00318
00319
RtlInitAnsiString(
00320 &temp,
00321 argv[1]
00322 );
00323
00324
RtlAnsiStringToUnicodeString(
00325 &
WorkName,
00326 &temp,
00327
FALSE
00328 );
00329
00330
return;
00331 }