xref: /reactos/boot/environ/lib/misc/bootreg.c (revision bbccad0e) 
1 /*
2  * COPYRIGHT:       See COPYING.ARM in the top level directory
3  * PROJECT:         ReactOS UEFI Boot Library
4  * FILE:            boot/environ/lib/misc/bootreg.c
5  * PURPOSE:         Boot Library Boot Registry Wrapper for CMLIB
6  * PROGRAMMER:      Alex Ionescu (alex.ionescu@reactos.org)
7  */
8 
9 /* INCLUDES ******************************************************************/
10 
11 #include "bl.h"
12 #include <bcd.h>
13 
14 /* DEFINITIONS ***************************************************************/
15 
16 #define BI_FLUSH_HIVE       0x01
17 #define BI_HIVE_WRITEABLE   0x02
18 
19 /* DATA STRUCTURES ***********************************************************/
20 
21 typedef struct _BI_KEY_HIVE
22 {
23     PHBASE_BLOCK BaseBlock;
24     ULONG HiveSize;
25     PBL_FILE_PATH_DESCRIPTOR FilePath;
26     CMHIVE Hive;
27     LONG ReferenceCount;
28     ULONG Flags;
29     PCM_KEY_NODE RootNode;
30 } BI_KEY_HIVE, *PBI_KEY_HIVE;
31 
32 typedef struct _BI_KEY_OBJECT
33 {
34     PBI_KEY_HIVE KeyHive;
35     PCM_KEY_NODE KeyNode;
36     HCELL_INDEX KeyCell;
37     PWCHAR KeyName;
38 } BI_KEY_OBJECT, *PBI_KEY_OBJECT;
39 
40 /* GLOBALS *******************************************************************/
41 
42 BOOLEAN BiHiveHashLibraryInitialized;
43 ULONGLONG HvSymcryptSeed;
44 
45 /* FUNCTIONS *****************************************************************/
46 
47 BOOLEAN
48 HvIsInPlaceBaseBlockValid (
49     _In_ PHBASE_BLOCK BaseBlock
50     )
51 {
52     ULONG HiveLength, HeaderSum;
53     BOOLEAN Valid;
54 
55     /* Assume failure */
56     Valid = FALSE;
57 
58     /* Check for incorrect signature, type, version, or format */
59     if ((BaseBlock->Signature == 'fger') &&
60         (BaseBlock->Type == 0) &&
61         (BaseBlock->Major <= 1) &&
62         (BaseBlock->Minor <= 5) &&
63         (BaseBlock->Minor >= 3) &&
64         (BaseBlock->Format == 1))
65     {
66         /* Check for invalid hive size */
67         HiveLength = BaseBlock->Length;
68         if (HiveLength)
69         {
70             /* Check for misaligned or too large hive size */
71             if (!(HiveLength & 0xFFF) && HiveLength <= 0x7FFFE000)
72             {
73                 /* Check for invalid header checksum */
74                 HeaderSum = HvpHiveHeaderChecksum(BaseBlock);
75                 if (HeaderSum == BaseBlock->CheckSum)
76                 {
77                     /* All good */
78                     Valid = TRUE;
79                 }
80             }
81         }
82     }
83 
84     /* Return validity */
85     return Valid;
86 }
87 
88 PVOID
89 NTAPI
90 CmpAllocate (
91     _In_ SIZE_T Size,
92     _In_ BOOLEAN Paged,
93     _In_ ULONG Tag
94     )
95 {
96     UNREFERENCED_PARAMETER(Paged);
97     UNREFERENCED_PARAMETER(Tag);
98 
99     /* Call the heap allocator */
100     return BlMmAllocateHeap(Size);
101 }
102 
103 VOID
104 NTAPI
105 CmpFree (
106     _In_ PVOID Ptr,
107     _In_ ULONG Quota
108     )
109 {
110     UNREFERENCED_PARAMETER(Quota);
111 
112     /* Call the heap allocator */
113     BlMmFreeHeap(Ptr);
114 }
115 
116 VOID
117 BiDereferenceHive (
118     _In_ HANDLE KeyHandle
119     )
120 {
121     PBI_KEY_OBJECT KeyObject;
122 
123     /* Get the key object */
124     KeyObject = (PBI_KEY_OBJECT)KeyHandle;
125 
126     /* Drop a reference on the parent hive */
127     --KeyObject->KeyHive->ReferenceCount;
128 }
129 
130 VOID
131 BiFlushHive (
132     _In_ HANDLE KeyHandle
133     )
134 {
135     /* Not yet implemented */
136     EfiPrintf(L"NO reg flush\r\n");
137     return;
138 }
139 
140 VOID
141 BiCloseKey (
142     _In_ HANDLE KeyHandle
143     )
144 {
145     PBI_KEY_HIVE KeyHive;
146     PBI_KEY_OBJECT KeyObject;
147 
148     /* Get the key object and hive */
149     KeyObject = (PBI_KEY_OBJECT)KeyHandle;
150     KeyHive = KeyObject->KeyHive;
151 
152     /* Check if we have a hive, or name, or key node */
153     if ((KeyHive) || (KeyObject->KeyNode) || (KeyObject->KeyName))
154     {
155         /* Drop a reference, see if it's the last one */
156         BiDereferenceHive(KeyHandle);
157         if (!KeyHive->ReferenceCount)
158         {
159             /* Check if we should flush it */
160             if (KeyHive->Flags & BI_FLUSH_HIVE)
161             {
162                 BiFlushHive(KeyHandle);
163             }
164 
165             /* Unmap the hive */
166             MmPapFreePages(KeyHive->BaseBlock, BL_MM_INCLUDE_MAPPED_ALLOCATED);
167 
168             /* Free the hive and hive path */
169             BlMmFreeHeap(KeyHive->FilePath);
170             BlMmFreeHeap(KeyHive);
171         }
172 
173         /* Check if a key name is present */
174         if (KeyObject->KeyName)
175         {
176             /* Free it */
177             BlMmFreeHeap(KeyObject->KeyName);
178         }
179     }
180 
181     /* Free the object */
182     BlMmFreeHeap(KeyObject);
183 }
184 
185 NTSTATUS
186 BiOpenKey(
187     _In_ HANDLE ParentHandle,
188     _In_ PWCHAR KeyName,
189     _Out_ PHANDLE Handle
190     )
191 {
192     PBI_KEY_OBJECT ParentKey, NewKey;
193     PBI_KEY_HIVE ParentHive;
194     NTSTATUS Status;
195     SIZE_T NameLength, SubNameLength, NameBytes;
196     PWCHAR NameStart, NameBuffer;
197     UNICODE_STRING KeyString;
198     HCELL_INDEX KeyCell;
199     PHHIVE Hive;
200     PCM_KEY_NODE ParentNode;
201 
202     /* Convert from a handle to our key object */
203     ParentKey = (PBI_KEY_OBJECT)ParentHandle;
204 
205     /* Extract the hive and node information */
206     ParentHive = ParentKey->KeyHive;
207     ParentNode = ParentKey->KeyNode;
208     Hive = &ParentKey->KeyHive->Hive.Hive;
209 
210     /* Initialize variables */
211     KeyCell = HCELL_NIL;
212     Status = STATUS_SUCCESS;
213     NameBuffer = NULL;
214 
215     /* Loop as long as there's still portions of the key name in play */
216     NameLength = wcslen(KeyName);
217     while (NameLength)
218     {
219         /* Find the first path separator */
220         NameStart = wcschr(KeyName, OBJ_NAME_PATH_SEPARATOR);
221         if (NameStart)
222         {
223             /* Look only at the key before the separator */
224             SubNameLength = NameStart - KeyName;
225             ++NameStart;
226         }
227         else
228         {
229             /* No path separator, this is the final leaf key */
230             SubNameLength = NameLength;
231         }
232 
233         /* Free the name buffer from the previous pass if needed */
234         if (NameBuffer)
235         {
236             BlMmFreeHeap(NameBuffer);
237         }
238 
239         /* Allocate a buffer to hold the name of this specific subkey only */
240         NameBytes = SubNameLength * sizeof(WCHAR);
241         NameBuffer = BlMmAllocateHeap(NameBytes + sizeof(UNICODE_NULL));
242         if (!NameBuffer)
243         {
244             Status = STATUS_NO_MEMORY;
245             goto Quickie;
246         }
247 
248         /* Copy and null-terminate the name of the subkey */
249         RtlCopyMemory(NameBuffer, KeyName, NameBytes);
250         NameBuffer[SubNameLength] = UNICODE_NULL;
251 
252         /* Convert it into a UNICODE_STRING and try to find it */
253         RtlInitUnicodeString(&KeyString, NameBuffer);
254         KeyCell = CmpFindSubKeyByName(Hive, ParentNode, &KeyString);
255         if (KeyCell == HCELL_NIL)
256         {
257             Status = STATUS_OBJECT_NAME_NOT_FOUND;
258             goto Quickie;
259         }
260 
261         /* We found it -- get the key node out of it */
262         ParentNode = (PCM_KEY_NODE)HvGetCell(Hive, KeyCell);
263         if (!ParentNode)
264         {
265             Status = STATUS_REGISTRY_CORRUPT;
266             goto Quickie;
267         }
268 
269         /* Update the key name to the next remaining path element */
270         KeyName = NameStart;
271         if (NameStart)
272         {
273             /* Update the length to the remainder of the path */
274             NameLength += -1 - SubNameLength;
275         }
276         else
277         {
278             /* There's nothing left, this was the leaf key */
279             NameLength = 0;
280         }
281     }
282 
283     /* Allocate a key object */
284     NewKey = BlMmAllocateHeap(sizeof(*NewKey));
285     if (!NewKey)
286     {
287         /* Bail out if we had no memory for it */
288         Status = STATUS_NO_MEMORY;
289         goto Quickie;
290     }
291 
292     /* Fill out the key object data */
293     NewKey->KeyNode = ParentNode;
294     NewKey->KeyHive = ParentHive;
295     NewKey->KeyName = NameBuffer;
296     NewKey->KeyCell = KeyCell;
297 
298     /* Add a reference to the hive */
299     ++ParentHive->ReferenceCount;
300 
301     /* Return the object back to the caller */
302     *Handle = NewKey;
303 
304 Quickie:
305     /* If we had a name buffer, free it */
306     if (NameBuffer)
307     {
308         BlMmFreeHeap(NameBuffer);
309     }
310 
311     /* Return status of the open operation */
312     return Status;
313 }
314 
315 NTSTATUS
316 BiInitializeAndValidateHive (
317     _In_ PBI_KEY_HIVE Hive
318     )
319 {
320     ULONG HiveSize;
321     NTSTATUS Status;
322 
323     /* Make sure the hive is at least the size of a base block */
324     if (Hive->HiveSize < sizeof(HBASE_BLOCK))
325     {
326         return STATUS_REGISTRY_CORRUPT;
327     }
328 
329     /* Make sure that the base block accurately describes the size of the hive */
330     HiveSize = Hive->BaseBlock->Length + sizeof(HBASE_BLOCK);
331     if ((HiveSize < sizeof(HBASE_BLOCK)) || (HiveSize > Hive->HiveSize))
332     {
333         return STATUS_REGISTRY_CORRUPT;
334     }
335 
336     /* Initialize a flat memory hive */
337     RtlZeroMemory(&Hive->Hive, sizeof(Hive->Hive));
338     Status = HvInitialize(&Hive->Hive.Hive,
339                           HINIT_FLAT,
340                           0,
341                           0,
342                           Hive->BaseBlock,
343                           CmpAllocate,
344                           CmpFree,
345                           NULL,
346                           NULL,
347                           NULL,
348                           NULL,
349                           0,
350                           NULL);
351     if (NT_SUCCESS(Status))
352     {
353         /* Cleanup volatile/old data */
354         CmPrepareHive(&Hive->Hive.Hive); // CmCheckRegistry
355         Status = STATUS_SUCCESS;
356     }
357 
358     /* Return the final status */
359     return Status;
360 }
361 
362 NTSTATUS
363 BiLoadHive (
364     _In_ PBL_FILE_PATH_DESCRIPTOR FilePath,
365     _Out_ PHANDLE HiveHandle
366     )
367 {
368     ULONG DeviceId;
369     PHBASE_BLOCK BaseBlock, NewBaseBlock;
370     PBI_KEY_OBJECT KeyObject;
371     PBI_KEY_HIVE BcdHive;
372     PBL_DEVICE_DESCRIPTOR BcdDevice;
373     ULONG PathLength, DeviceLength, HiveSize, HiveLength, NewHiveSize;
374     PWCHAR HiveName, LogName;
375     BOOLEAN HaveWriteAccess;
376     NTSTATUS Status;
377     PVOID LogData;
378     PHHIVE Hive;
379     UNICODE_STRING KeyString;
380     PCM_KEY_NODE RootNode;
381     HCELL_INDEX CellIndex;
382 
383     /* Initialize variables */
384     DeviceId = -1;
385     BaseBlock = NULL;
386     BcdHive = NULL;
387     KeyObject = NULL;
388     LogData = NULL;
389     LogName = NULL;
390 
391     /* Initialize the crypto seed */
392     if (!BiHiveHashLibraryInitialized)
393     {
394         HvSymcryptSeed = 0x82EF4D887A4E55C5;
395         BiHiveHashLibraryInitialized = TRUE;
396     }
397 
398     /* Extract and validate the input path */
399     BcdDevice = (PBL_DEVICE_DESCRIPTOR)&FilePath->Path;
400     PathLength = FilePath->Length;
401     DeviceLength = BcdDevice->Size;
402     HiveName = (PWCHAR)((ULONG_PTR)BcdDevice + BcdDevice->Size);
403     if (PathLength <= DeviceLength)
404     {
405         /* Doesn't make sense, bail out */
406         Status = STATUS_INVALID_PARAMETER;
407         goto Quickie;
408     }
409 
410     /* Attempt to open the underlying device for RW access */
411     HaveWriteAccess = TRUE;
412     Status = BlpDeviceOpen(BcdDevice,
413                            BL_DEVICE_READ_ACCESS | BL_DEVICE_WRITE_ACCESS,
414                            0,
415                            &DeviceId);
416     if (!NT_SUCCESS(Status))
417     {
418         /* Try for RO access instead */
419         HaveWriteAccess = FALSE;
420         Status = BlpDeviceOpen(BcdDevice, BL_DEVICE_READ_ACCESS, 0, &DeviceId);
421         if (!NT_SUCCESS(Status))
422         {
423             /* No access at all -- bail out */
424             goto Quickie;
425         }
426     }
427 
428     /* Now try to load the hive on disk */
429     Status = BlImgLoadImageWithProgress2(DeviceId,
430                                          BlLoaderRegistry,
431                                          HiveName,
432                                          (PVOID*)&BaseBlock,
433                                          &HiveSize,
434                                          0,
435                                          FALSE,
436                                          NULL,
437                                          NULL);
438     if (!NT_SUCCESS(Status))
439     {
440         EfiPrintf(L"Hive read failure: % lx\r\n", Status);
441         goto Quickie;
442     }
443 
444     /* Allocate a hive structure */
445     BcdHive = BlMmAllocateHeap(sizeof(*BcdHive));
446     if (!BcdHive)
447     {
448         Status = STATUS_NO_MEMORY;
449         goto Quickie;
450     }
451 
452     /* Initialize it */
453     RtlZeroMemory(BcdHive, sizeof(*BcdHive));
454     BcdHive->BaseBlock = BaseBlock;
455     BcdHive->HiveSize = HiveSize;
456     if (HaveWriteAccess)
457     {
458         BcdHive->Flags |= BI_HIVE_WRITEABLE;
459     }
460 
461     /* Make sure the hive was at least one bin long */
462     if (HiveSize < sizeof(*BaseBlock))
463     {
464         Status = STATUS_REGISTRY_CORRUPT;
465         goto Quickie;
466     }
467 
468     /* Make sure the hive contents are at least one bin long */
469     HiveLength = BaseBlock->Length;
470     if (BaseBlock->Length < sizeof(*BaseBlock))
471     {
472         Status = STATUS_REGISTRY_CORRUPT;
473         goto Quickie;
474     }
475 
476     /* Validate the initial bin (the base block) */
477     if (!HvIsInPlaceBaseBlockValid(BaseBlock))
478     {
479         EfiPrintf(L"Recovery not implemented\r\n");
480         Status = STATUS_REGISTRY_CORRUPT;
481         goto Quickie;
482     }
483 
484     /* Check if there's log recovery that needs to happen */
485     if (BaseBlock->Sequence1 != BaseBlock->Sequence2)
486     {
487         EfiPrintf(L"Log fix not implemented: %lx %lx\r\n");
488         Status = STATUS_REGISTRY_CORRUPT;
489         goto Quickie;
490     }
491 
492     /*
493      * Check if the whole hive doesn't fit in the buffer.
494      * Note: HiveLength does not include the size of the baseblock itself
495      */
496     if (HiveSize < (HiveLength + sizeof(*BaseBlock)))
497     {
498         EfiPrintf(L"Need bigger hive buffer path\r\n");
499 
500         /* Allocate a slightly bigger buffer */
501         NewHiveSize = HiveLength + sizeof(*BaseBlock);
502         Status = MmPapAllocatePagesInRange((PVOID*)&NewBaseBlock,
503                                            BlLoaderRegistry,
504                                            NewHiveSize >> PAGE_SHIFT,
505                                            0,
506                                            0,
507                                            NULL,
508                                            0);
509         if (!NT_SUCCESS(Status))
510         {
511             goto Quickie;
512         }
513 
514         /* Copy the current data in there */
515         RtlCopyMemory(NewBaseBlock, BaseBlock, HiveSize);
516 
517         /* Free the old data */
518         MmPapFreePages(BaseBlock, BL_MM_INCLUDE_MAPPED_ALLOCATED);
519 
520         /* Update our pointers */
521         BaseBlock = NewBaseBlock;
522         HiveSize = NewHiveSize;
523         BcdHive->BaseBlock = BaseBlock;
524         BcdHive->HiveSize = HiveSize;
525     }
526 
527     /* Check if any log stuff needs to happen */
528     if (LogData)
529     {
530         EfiPrintf(L"Log fix not implemented: %lx %lx\r\n");
531         Status = STATUS_REGISTRY_CORRUPT;
532         goto Quickie;
533     }
534 
535     /* Call Hv to setup the hive library */
536     Status = BiInitializeAndValidateHive(BcdHive);
537     if (!NT_SUCCESS(Status))
538     {
539         goto Quickie;
540     }
541 
542     /* Now get the root node */
543     Hive = &BcdHive->Hive.Hive;
544     RootNode = (PCM_KEY_NODE)HvGetCell(Hive, Hive->BaseBlock->RootCell);
545     if (!RootNode)
546     {
547         Status = STATUS_OBJECT_NAME_NOT_FOUND;
548         goto Quickie;
549     }
550 
551     /* Find the Objects subkey under it to see if it's a real BCD hive */
552     RtlInitUnicodeString(&KeyString, L"Objects");
553     CellIndex = CmpFindSubKeyByName(Hive, RootNode, &KeyString);
554     if (CellIndex == HCELL_NIL)
555     {
556         EfiPrintf(L"No OBJECTS subkey found!\r\n");
557         Status = STATUS_OBJECT_NAME_NOT_FOUND;
558         goto Quickie;
559     }
560 
561     /* This is a valid BCD hive, store its root node here */
562     BcdHive->RootNode = RootNode;
563 
564     /* Allocate a copy of the file path */
565     BcdHive->FilePath = BlMmAllocateHeap(FilePath->Length);
566     if (!BcdHive->FilePath)
567     {
568         Status = STATUS_NO_MEMORY;
569         goto Quickie;
570     }
571 
572     /* Make a copy of it */
573     RtlCopyMemory(BcdHive->FilePath, FilePath, FilePath->Length);
574 
575     /* Create a key object to describe the rot */
576     KeyObject = BlMmAllocateHeap(sizeof(*KeyObject));
577     if (!KeyObject)
578     {
579         Status = STATUS_NO_MEMORY;
580         goto Quickie;
581     }
582 
583     /* Fill out the details */
584     KeyObject->KeyNode = RootNode;
585     KeyObject->KeyHive = BcdHive;
586     KeyObject->KeyName = NULL;
587     KeyObject->KeyCell = Hive->BaseBlock->RootCell;
588 
589     /* One reference for the key object, plus one lifetime reference */
590     BcdHive->ReferenceCount = 2;
591 
592     /* This is the hive handle */
593     *HiveHandle  = KeyObject;
594 
595     /* We're all good */
596     Status = STATUS_SUCCESS;
597 
598 Quickie:
599     /* If we had a log name, free it */
600     if (LogName)
601     {
602         BlMmFreeHeap(LogName);
603     }
604 
605     /* If we had logging data, free it */
606     if (LogData)
607     {
608         MmPapFreePages(LogData, BL_MM_INCLUDE_MAPPED_ALLOCATED);
609     }
610 
611     /* Check if this is the failure path */
612     if (!NT_SUCCESS(Status))
613     {
614         /* If we mapped the hive, free it */
615         if (BaseBlock)
616         {
617             MmPapFreePages(BaseBlock, BL_MM_INCLUDE_MAPPED_ALLOCATED);
618         }
619 
620         /* If we opened the device, close it */
621         if (DeviceId != -1)
622         {
623             BlDeviceClose(DeviceId);
624         }
625 
626         /* Did we create a hive object? */
627         if (BcdHive)
628         {
629             /* Free the file path if we made a copy of it */
630             if (BcdHive->FilePath)
631             {
632                 BlMmFreeHeap(BcdHive->FilePath);
633             }
634 
635             /* Free the hive itself */
636             BlMmFreeHeap(BcdHive);
637         }
638 
639         /* Finally, free the root key object if we created one */
640         if (KeyObject)
641         {
642             BlMmFreeHeap(KeyObject);
643         }
644     }
645 
646     /* Return the final status */
647     return Status;
648 }
649 
650 NTSTATUS
651 BiGetRegistryValue (
652     _In_ HANDLE KeyHandle,
653     _In_ PWCHAR ValueName,
654     _In_ ULONG Type,
655     _Out_ PVOID* Buffer,
656     _Out_ PULONG ValueLength
657     )
658 {
659     PCM_KEY_NODE KeyNode;
660     PHHIVE KeyHive;
661     UNICODE_STRING ValueString;
662     PBI_KEY_OBJECT KeyObject;
663     PCM_KEY_VALUE KeyValue;
664     PVOID ValueCopy;
665     ULONG Size;
666     HCELL_INDEX CellIndex;
667     PCELL_DATA ValueData;
668 
669     /* Get the key object, node,and hive */
670     KeyObject = (PBI_KEY_OBJECT)KeyHandle;
671     KeyNode = KeyObject->KeyNode;
672     KeyHive = &KeyObject->KeyHive->Hive.Hive;
673 
674     /* Find the value cell index in the list of values */
675     RtlInitUnicodeString(&ValueString, ValueName);
676     CmpFindNameInList(KeyHive,
677                       &KeyNode->ValueList,
678                       &ValueString,
679                       NULL,
680                       &CellIndex);
681     if (CellIndex == HCELL_NIL)
682     {
683         return STATUS_OBJECT_NAME_NOT_FOUND;
684     }
685 
686     /* Get the cell data for it */
687     KeyValue = (PCM_KEY_VALUE)HvGetCell(KeyHive, CellIndex);
688     if (!KeyValue)
689     {
690         return STATUS_REGISTRY_CORRUPT;
691     }
692 
693     /* Make sure the type matches */
694     if (KeyValue->Type != Type)
695     {
696         return STATUS_OBJECT_TYPE_MISMATCH;
697     }
698 
699     /* Now get the data cell */
700     ValueData = CmpValueToData(KeyHive, KeyValue, &Size);
701 
702     /* Make a copy of it */
703     ValueCopy = BlMmAllocateHeap(Size);
704     if (!ValueCopy)
705     {
706         return STATUS_NO_MEMORY;
707     }
708 
709     /* Copy it in the buffer, and return it and its size */
710     RtlCopyMemory(ValueCopy, ValueData, Size);
711     *Buffer = ValueCopy;
712     *ValueLength = Size;
713     return STATUS_SUCCESS;
714 }
715 
716 NTSTATUS
717 BiEnumerateSubKeys (
718     _In_ HANDLE KeyHandle,
719     _Out_ PWCHAR** SubKeyList,
720     _Out_ PULONG SubKeyCount
721     )
722 {
723     PCM_KEY_NODE KeyNode, Node;
724     PBI_KEY_OBJECT KeyObject;
725     ULONG KeyCount;
726     ULONG NameLength, NewTotalNameLength, FinalLength, TotalNameLength;
727     PHHIVE Hive;
728     PWCHAR KeyName, NameEnd;
729     HCELL_INDEX CellIndex;
730     PWCHAR* SubKeys;
731     NTSTATUS Status;
732     ULONG i;
733 
734     /* Get the key object, node, and hive */
735     KeyObject = (PBI_KEY_OBJECT)KeyHandle;
736     KeyNode = KeyObject->KeyNode;
737     Hive = &KeyObject->KeyHive->Hive.Hive;
738 
739     /* Assume it's empty */
740     *SubKeyList = 0;
741     *SubKeyCount = 0;
742 
743     /* Initialize locals */
744     KeyCount = 0;
745     SubKeys = 0;
746     TotalNameLength = 0;
747 
748     /* Find the first subkey cell index */
749     CellIndex = CmpFindSubKeyByNumber(Hive, KeyNode, KeyCount);
750     while (CellIndex != HCELL_NIL)
751     {
752         /* Move to the next one */
753         KeyCount++;
754 
755         /* Get the cell data for it */
756         Node = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
757         if (!Node)
758         {
759             return STATUS_REGISTRY_CORRUPT;
760         }
761 
762         /* Check if the value is compressed */
763         if (Node->Flags & KEY_COMP_NAME)
764         {
765             /* Get the compressed name size */
766             NameLength = CmpCompressedNameSize(Node->Name, Node->NameLength);
767         }
768         else
769         {
770             /* Get the real size */
771             NameLength = Node->NameLength;
772         }
773 
774         /* Add up the new length, protecting against overflow */
775         NewTotalNameLength = TotalNameLength + NameLength + sizeof(UNICODE_NULL);
776         if (NewTotalNameLength < TotalNameLength)
777         {
778             Status = STATUS_NAME_TOO_LONG;
779             goto Quickie;
780         }
781 
782         /* We're good, use the new length */
783         TotalNameLength = NewTotalNameLength;
784 
785         /* Find the next subkey cell index */
786         CellIndex = CmpFindSubKeyByNumber(Hive, KeyNode, KeyCount);
787     }
788 
789     /* Were there no keys? We're done, if so */
790     if (!KeyCount)
791     {
792         return STATUS_SUCCESS;
793     }
794 
795     /* Safely compute the size of the array needed */
796     Status = RtlULongLongToULong(sizeof(PWCHAR) * KeyCount, &FinalLength);
797     if (!NT_SUCCESS(Status))
798     {
799         goto Quickie;
800     }
801 
802     /* Safely add that to the name length */
803     Status = RtlULongAdd(TotalNameLength, FinalLength, &FinalLength);
804     if (!NT_SUCCESS(Status))
805     {
806         goto Quickie;
807     }
808 
809     /* Allocate an array big enough for the names and pointers */
810     SubKeys = BlMmAllocateHeap(FinalLength);
811     if (!SubKeys)
812     {
813         Status = STATUS_NO_MEMORY;
814         goto Quickie;
815     }
816 
817     /* Go over each key again */
818     NameEnd = (PWCHAR)&SubKeys[KeyCount];
819     for (i = 0; i < KeyCount; i++)
820     {
821         /* Get the cell index for this subkey */
822         CellIndex = CmpFindSubKeyByNumber(Hive, KeyNode, i);
823         if (CellIndex == HCELL_NIL)
824         {
825             break;
826         }
827 
828         /* Get the cell data for it */
829         Node = (PCM_KEY_NODE)HvGetCell(Hive, CellIndex);
830         if (!Node)
831         {
832             Status = STATUS_REGISTRY_CORRUPT;
833             goto Quickie;
834         }
835 
836         /* Check if the value is compressed */
837         KeyName = Node->Name;
838         if (Node->Flags & KEY_COMP_NAME)
839         {
840             /* Get the compressed name size */
841             NameLength = CmpCompressedNameSize(KeyName, Node->NameLength);
842             CmpCopyCompressedName(NameEnd, NameLength, KeyName, Node->NameLength);
843         }
844         else
845         {
846             /* Get the real size */
847             NameLength = Node->NameLength;
848             RtlCopyMemory(NameEnd, KeyName, NameLength);
849         }
850 
851         /* Move the name buffer to the next spot, and NULL-terminate */
852         SubKeys[i] = NameEnd;
853         NameEnd += (NameLength / sizeof(WCHAR));
854         *NameEnd = UNICODE_NULL;
855 
856         /* Keep going */
857         NameEnd++;
858     }
859 
860     /* Check if the subkeys were empty */
861     if (i == 0)
862     {
863         /* They disappeared in the middle of enumeration */
864         Status = STATUS_OBJECT_NAME_NOT_FOUND;
865         goto Quickie;
866     }
867 
868     /* Return the count and the array of names */
869     *SubKeyList = SubKeys;
870     *SubKeyCount = i;
871     SubKeys = NULL;
872     Status = STATUS_SUCCESS;
873 
874 Quickie:
875     /* On the failure path, free the subkeys if any exist */
876     if (SubKeys)
877     {
878         BlMmFreeHeap(SubKeys);
879     }
880 
881     /* All done, return the result */
882     return Status;
883 }
884 
885 NTSTATUS
886 BiDeleteKey (
887     _In_ HANDLE KeyHandle
888     )
889 {
890     NTSTATUS Status;
891     PBI_KEY_OBJECT KeyObject;
892     PHHIVE Hive;
893     ULONG SubKeyCount, i;
894     PWCHAR* SubKeyList;
895     HANDLE SubKeyHandle;
896 
897     /* Get the key object and hive */
898     KeyObject = (PBI_KEY_OBJECT)KeyHandle;
899     Hive = &KeyObject->KeyHive->Hive.Hive;
900 
901     /* Make sure the hive is writeable */
902     if (!(KeyObject->KeyHive->Flags & BI_HIVE_WRITEABLE))
903     {
904         return STATUS_MEDIA_WRITE_PROTECTED;
905     }
906 
907     /* Enumerate all of the subkeys */
908     Status = BiEnumerateSubKeys(KeyHandle, &SubKeyList, &SubKeyCount);
909     if ((NT_SUCCESS(Status)) && (SubKeyCount > 0))
910     {
911         /* Loop through each one */
912         for (i = 0; i < SubKeyCount; i++)
913         {
914             /* Open a handle to it */
915             Status = BiOpenKey(KeyHandle, SubKeyList[i], &SubKeyHandle);
916             if (NT_SUCCESS(Status))
917             {
918                 /* Recursively call us to delete it */
919                 Status = BiDeleteKey(SubKeyHandle);
920                 if (Status != STATUS_SUCCESS)
921                 {
922                     /* Close the key on failure */
923                     BiCloseKey(SubKeyHandle);
924                 }
925             }
926         }
927     }
928 
929     /* Check if we had a list of subkeys */
930     if (SubKeyList)
931     {
932         /* Free it */
933         BlMmFreeHeap(SubKeyList);
934     }
935 
936     /* Delete this key cell */
937     Status = CmpFreeKeyByCell(Hive, KeyObject->KeyCell, TRUE);
938     if (NT_SUCCESS(Status))
939     {
940         /* Mark the hive as requiring a flush */
941         KeyObject->KeyHive->Flags |= BI_FLUSH_HIVE;
942         BiCloseKey(KeyHandle);
943     }
944 
945     /* All done */
946     return Status;
947 }