[chrome_elf] NTRegistry - added wow64 redirection support.

chrome_elf/nt_registry/nt_registry.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This API is a usability layer for direct registry access via NTDLL.
 // It allows for "advapi32-free" registry access, which is especially
 // useful for accessing registy from DllMain (holding loader lock),
 // or if a dependency on/linkage of ADVAPI32.dll is not desired.
 
 // The implementation of this API should only use ntdll and kernel32 system
@@ skipping 20 matching lines @@
 // These globals are only used in test suites that use reg redirection
 // of HKLM and/or HKCU.
 extern const size_t g_kRegMaxPathLen;
 extern wchar_t HKLM_override[];
 extern wchar_t HKCU_override[];
 
 // AUTO will choose depending on system install or not.
 // Use HKLM or HKCU to override.
 typedef enum _ROOT_KEY { AUTO = 0, HKLM, HKCU } ROOT_KEY;
 
+// Used with wrapper functions to request registry redirection override.
+// Maps to KEY_WOW64_32KEY and KEY_WOW64_64KEY access flags.
+typedef enum _WOW64_OVERRIDE {

[grt (UTC plus 2), 2016/09/20 10:39:54]

could you use modern "enum WOW64_OVERRIDE {...};" style rather than old-school
typedef?

[penny, 2016/09/23 23:50:59]

Done. I am old-school.  #sorrynotsorry, #thanksforcatching!  :D

+  NONE = 0L,
+  WOW6432 = KEY_WOW64_32KEY,
+  WOW6464 = KEY_WOW64_64KEY
+} WOW64_OVERRIDE;
+
+//------------------------------------------------------------------------------
+// Create, open, delete, close functions
+//------------------------------------------------------------------------------
+
 // Create and/or open a registry key.
 // - This function will recursively create multiple sub-keys if required for
 //   |key_path|.
 // - If the key doesn't need to be left open, pass in nullptr for |out_handle|.
 // - This function will happily succeed if the key already exists.
 // - Optional |out_handle|.  If nullptr, function will close handle when done.
 //   Otherwise, will hold the open handle to the deepest subkey.
 // - Caller must call CloseRegKey on returned handle (on success).
 bool CreateRegKey(ROOT_KEY root,
                   const wchar_t* key_path,
                   ACCESS_MASK access,
                   HANDLE* out_handle OPTIONAL);
 
 // Open existing registry key.
 // - Caller must call CloseRegKey on returned handle (on success).
 // - Optional error code can be returned on failure for extra detail.
 bool OpenRegKey(ROOT_KEY root,
                 const wchar_t* key_path,
                 ACCESS_MASK access,
                 HANDLE* out_handle,
                 NTSTATUS* error_code OPTIONAL);
 
 // Delete a registry key.
 // - Caller must still call CloseRegKey after the delete.
 bool DeleteRegKey(HANDLE key);
 
 // Delete a registry key.
 // - WRAPPER: Function opens and closes the target key for caller.
-bool DeleteRegKey(ROOT_KEY root, const wchar_t* key_path);
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
+bool DeleteRegKey(ROOT_KEY root,
+                  WOW64_OVERRIDE wow64_override,
+                  const wchar_t* key_path);
 
 // Close a registry key handle that was opened with CreateRegKey or OpenRegKey.
 void CloseRegKey(HANDLE key);
 
 //------------------------------------------------------------------------------
 // Getter functions
 //------------------------------------------------------------------------------
 
 // Main function to query a registry value.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Types defined in winnt.h.  E.g.: REG_DWORD, REG_SZ.
 // - Caller is responsible for calling "delete[] *out_buffer" (on success).
 bool QueryRegKeyValue(HANDLE key,
                       const wchar_t* value_name,
                       ULONG* out_type,
                       BYTE** out_buffer,
                       DWORD* out_size);
 
 // Query DWORD value.
 // - WRAPPER: Function works with DWORD data type.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Handle will be left open.  Caller must still call CloseRegKey when done.
 bool QueryRegValueDWORD(HANDLE key,
                         const wchar_t* value_name,
                         DWORD* out_dword);
 
 // Query DWORD value.
 // - WRAPPER: Function opens and closes the target key for caller, and works
 // with DWORD data type.
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
 bool QueryRegValueDWORD(ROOT_KEY root,
+                        WOW64_OVERRIDE wow64_override,
                         const wchar_t* key_path,
                         const wchar_t* value_name,
                         DWORD* out_dword);
 
 // Query SZ (string) value.
 // - WRAPPER: Function works with SZ data type.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Handle will be left open.  Caller must still call CloseRegKey when done.
 bool QueryRegValueSZ(HANDLE key,
                      const wchar_t* value_name,
                      std::wstring* out_sz);
 
 // Query SZ (string) value.
 // - WRAPPER: Function opens and closes the target key for caller, and works
 // with SZ data type.
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
 bool QueryRegValueSZ(ROOT_KEY root,
+                     WOW64_OVERRIDE wow64_override,
                      const wchar_t* key_path,
                      const wchar_t* value_name,
                      std::wstring* out_sz);
 
 // Query MULTI_SZ (multiple strings) value.
 // - WRAPPER: Function works with MULTI_SZ data type.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Handle will be left open.  Caller must still call CloseRegKey when done.
 bool QueryRegValueMULTISZ(HANDLE key,
                           const wchar_t* value_name,
                           std::vector<std::wstring>* out_multi_sz);
 
 // Query MULTI_SZ (multiple strings) value.
 // - WRAPPER: Function opens and closes the target key for caller, and works
 // with MULTI_SZ data type.
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
 bool QueryRegValueMULTISZ(ROOT_KEY root,
+                          WOW64_OVERRIDE wow64_override,
                           const wchar_t* key_path,
                           const wchar_t* value_name,
                           std::vector<std::wstring>* out_multi_sz);
 
 //------------------------------------------------------------------------------
 // Setter functions
 //------------------------------------------------------------------------------
 
 // Main function to set a registry value.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Types defined in winnt.h.  E.g.: REG_DWORD, REG_SZ.
 bool SetRegKeyValue(HANDLE key,
                     const wchar_t* value_name,
                     ULONG type,
                     const BYTE* data,
                     DWORD data_size);
 
 // Set DWORD value.
 // - WRAPPER: Function works with DWORD data type.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Handle will be left open.  Caller must still call CloseRegKey when done.
 bool SetRegValueDWORD(HANDLE key, const wchar_t* value_name, DWORD value);
 
 // Set DWORD value.
 // - WRAPPER: Function opens and closes the target key for caller, and works
 // with DWORD data type.
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
 bool SetRegValueDWORD(ROOT_KEY root,
+                      WOW64_OVERRIDE wow64_override,
                       const wchar_t* key_path,
                       const wchar_t* value_name,
                       DWORD value);
 
 // Set SZ (string) value.
 // - WRAPPER: Function works with SZ data type.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Handle will be left open.  Caller must still call CloseRegKey when done.
 bool SetRegValueSZ(HANDLE key,
                    const wchar_t* value_name,
                    const std::wstring& value);
 
 // Set SZ (string) value.
 // - WRAPPER: Function opens and closes the target key for caller, and works
 // with SZ data type.
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
 bool SetRegValueSZ(ROOT_KEY root,
+                   WOW64_OVERRIDE wow64_override,
                    const wchar_t* key_path,
                    const wchar_t* value_name,
                    const std::wstring& value);
 
 // Set MULTI_SZ (multiple strings) value.
 // - WRAPPER: Function works with MULTI_SZ data type.
 // - Key handle should have been opened with CreateRegKey or OpenRegKey.
 // - Handle will be left open.  Caller must still call CloseRegKey when done.
 bool SetRegValueMULTISZ(HANDLE key,
                         const wchar_t* value_name,
                         const std::vector<std::wstring>& values);
 
 // Set MULTI_SZ (multiple strings) value.
 // - WRAPPER: Function opens and closes the target key for caller, and works
 // with MULTI_SZ data type.
+// - Use |wow64_override| to force redirection behaviour, or pass 0/nt::NONE.
 bool SetRegValueMULTISZ(ROOT_KEY root,
+                        WOW64_OVERRIDE wow64_override,
                         const wchar_t* key_path,
                         const wchar_t* value_name,
                         const std::vector<std::wstring>& values);
 
 //------------------------------------------------------------------------------
 // Utils
 //------------------------------------------------------------------------------
 
 // Returns the current user SID in string form.
 const wchar_t* GetCurrentUserSidString();
 
+// Change global setting for WOW64 redirection behaviour.
+// - Affects 64-bit machines only.
+// - By default, this global setting is OFF.
+// - Turning this on will result in WOW64-process registry accesses being
+//   redirected the way ADVAPI32 would do.
+// NOTE: KEY_WOW64_32KEY and KEY_WOW64_64KEY override access flags are
+//       respected regardless.
+void ChangeDefaultWow64Redirection(bool default_on);

[grt (UTC plus 2), 2016/09/20 10:39:55]

in keeping with the principle of least surprise, i think that the default should
be to mimic advapi32's redirection. i imagine most programmers using the api
will expect it to work like the other registry api they're familiar with.

[penny, 2016/09/23 23:50:59]

Done.  The "principle of least surprise" to me would be to have NtRegistry
behave the way you expect ntdll to behave.

See new comments in nt_registry.cc about wow64 redirection.

+
 };  // namespace nt
 
 #endif  // CHROME_ELF_NT_REGISTRY_NT_REGISTRY_H_