hive中的subkeylist的结构详解。。

在网上找了一圈。。也没有找到相关的资料。。一点都没有。。。  还有有大米公开的代码供参考。。。 赶紧把学习的成果记录下来。。

CM_KEY_NODE 的结构：

 +0x014 SubKeyCounts      : [2] Uint4B                 //SubKeyCounts[0]子键的个数

 +0x01c SubKeyLists       : [2] Uint4B              //SubKeyLists[0]子键列表相差本BIN的偏移

这里的subKeyList是一个偏移。。指向 CM_KEY_INDEX结构。。最复杂的也是这个结构。。

他有好几种变形。。。

可以是：

lf 结构

    + lf

    +lh

li 结构

ri 结构

可以根据 signature判断当前的index 属于那种结构。。对于每一种结构都有对应的 格式

struct lf_key {

  short id;         /* 0x0000 Word ID: ASCII-"lf" = 0x666C or "lh" = 0x686c */
  short no_keys;    /* 0x0002 Word number of keys          */
                    /* 0x0004 ???? Hash-Records            */
 
 union {

    struct lf_hash {
      long ofs_nk;    /* 0x0000 D-Word Offset of corresponding "nk"-Record  */
      char name[4];   /* 0x0004 D-Word ASCII: the first 4 characters of the key-name,  */
    } hash[1];

      /* WinXP uses a more real hash instead (base 37 of uppercase name chars)  */
      /*   padded with 0's. Case sensitiv!                         */

    struct lh_hash {
      long ofs_nk;    /* 0x0000 D-Word Offset of corresponding "nk"-Record  */
      long hash;      /* 0x0004 D-Word ASCII: the first 4 characters of the key-name,  */
    } lh_hash[1];
  };

};

/* 3.x version of the above, contains only offset table, NOT
 * any start of names "hash". Thus needs 'nk' lookups for searches.
 */
struct li_key {

  short id;         /* 0x0000 Word ID: ASCII-"li" = 0x696C */
  short no_keys;    /* 0x0002 Word number of keys          */
                    /* 0x0004 ???? Hash-Records            */
  struct li_hash {
    long ofs_nk;    /* 0x0000 D-Word Offset of corresponding "nk"-Record  */
  } hash[1];
};

/* This is a list of pointers to struct li_key, ie
 * an extention record if many li's.
 * This happens in NT4&5 when the lf hashlist grows larger
 * than about 400-500 entries/subkeys??, then the nk_key->ofs_lf points to this
 * instead of directly to an lf.
 * The sub-indices this points to seems to be li (yes!) in NT4 and 2k.
 * In XP and newer they point to lh which is more efficient.
 * Likely to happen in HKLM\Software\classes (file extention list) and
 * in SAM when many users.
 */
struct ri_key {

  short id;         /* 0x0000 Word ID: ASCII-"ri" = 0x6972 */
  short no_lis;    /* 0x0002 Word number of pointers to li */
                    /* 0x0004 ???? Hash-Records            */
  struct ri_hash {
      long ofs_li;    /* 0x0000 D-Word Offset of corresponding "li"-Record  */
  } hash[1];
};

 

当subkey的数量大约500时。。是ri结构。。ri结构保存了li结构或lf结构的索引。。

 

枚举一个Key的subKey的code：

 

    if (key->no_subkeys > 0) // If it has subkeys, loop through the hash
    {    
        lfofs = key->ofs_lf + 0x1004;    // lf (hash) record
        lfkey = (struct lf_key *)(buf + lfofs);
        
        if (lfkey->id == 0x6972) // ri struct need special parsing.Prime loop state
        { 
            rikey = (struct ri_key *)lfkey;
            ricnt = rikey->no_lis;
            r = 0;
            likey = (struct li_key *)( hdesc->buffer + rikey->hash[r].ofs_li + 0x1004 ) ;
            subs = likey->no_keys;
            if (likey->id != 0x696c) 
            {  // Bwah, not li anyway, XP uses lh usually which is actually smarter
                lfkey = (struct lf_key *)( hdesc->buffer + rikey->hash[r].ofs_li + 0x1004 ) ;
                likey = NULL;
            }
        } 
        else 
        {
            if (lfkey->id == 0x696c) {    // li?
                likey = (struct li_key *)(buf + lfofs);
            } else {
                likey = NULL;
            }

            ricnt = 0; 
            r = 0; 
            subs = key->no_subkeys;
        }
        
        do 
        {
            // 遍历子键,找到与截取的名字相匹配的键
            for( g_nIndex_xx = 0; g_nIndex_xx < subs; g_nIndex_xx++ ) 
            {
                if (likey) 
                    newnkofs = likey->hash[g_nIndex_xx].ofs_nk + 0x1004;
                else 
                    newnkofs = lfkey->hash[g_nIndex_xx].ofs_nk + 0x1004;
                
                newnkkey = (struct nk_key *)(buf + newnkofs);
                if (newnkkey->id != 0x6b6e) 
                {
                    printf("ERROR: not 'nk' node! (strange?)\n");
                } 
                else
                {
                    if (newnkkey->len_name <= 0) 
                    {
                        printf("[No name]\n");
                    } 
                    else 
                    {
                                               // get subkey name or do other things 
                    }
                } /* if id OK */
            } /* hash loop */

            r++;
            if (ricnt && r < ricnt) 
            {
                newnkofs = rikey->hash[r].ofs_li;
                likey = (struct li_key *)( hdesc->buffer + newnkofs + 0x1004 ) ;
                subs = likey->no_keys;
                if (likey->id != 0x696c)
                {  // Bwah, not li anyway, XP uses lh usually which is actually smarter
                    lfkey = (struct lf_key *)( hdesc->buffer + rikey->hash[r].ofs_li + 0x1004 ) ;
                    likey = NULL;
                }
            }
        } while (r < ricnt && ricnt);

 

如果没有ri结构：找到subkey的 CM_Key_NODE结构的过程是这样的：

                                                  index.hash[i].ofs_nk

1.subKeyList--------》index结构----------------------------》key_Node

 

有ri结构：

                                                         rikey->hash[r].ofs_li                            index.hash[i].ofs_nk   

subkeylist ----------------> ri_index--------------------------------->li/lf结构----------------------------------》 Key_node

 

真日啊 。。。费劲。。