Libguestfs - Sep 2011 - [PATCH 0/7] hivex + hivexml: Add byte runs for nodes and values

This changeset adds byte run reporters for node and value metadata in the
hivexml program.    This location reporting required several new ABI
functions, which required new ABI return types.  One benefit to the byte
run functions is additional sanity checks, which have revealed new data
or parsing errors when run on M57 patents images.  An example error:
Image:  Charlie, 2009-12-11, available at
<http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>.
hive:  C:/WINDOWS/system32/config/SECURITY
Address 12624 is processed as a value, but it has a node signature.

Alex Nelson (7):
  generator: Add new return type to ABI: RSize
  hivex: Split value_key function into value_key and value_key_len
  generator: Add new return types to ABI: RLenNode and RLenValue
  hivex: Add metadata length functions for nodes and values
  hivex: Add offset-&-length function for long value data
  hivexml: Report attributes in values instead of text.
  hivexml: Add byte run reporting functions

 generator/generator.ml |  169 +++++++++++++++++++++++++++++++++++++++++++++++-
 lib/hivex.c            |  115 +++++++++++++++++++++++++++++---
 xml/hivexml.c          |  127 ++++++++++++++++++++++++++++++++----
 3 files changed, 385 insertions(+), 26 deletions(-)

-- 
1.7.6

Hi all,

I apologize, the disk images' links appear to be broken at the moment.  I
have informed the maintainer, and he has acknowledged the problem and will fix
that soon.

--Alex


On Sep 1, 2011, at 18:17 , Alex Nelson wrote:
> This changeset adds byte run reporters for node and value metadata in the
> hivexml program.    This location reporting required several new ABI
> functions, which required new ABI return types.  One benefit to the byte
> run functions is additional sanity checks, which have revealed new data
> or parsing errors when run on M57 patents images.  An example error:
> Image:  Charlie, 2009-12-11, available at
<http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>.
> hive:  C:/WINDOWS/system32/config/SECURITY
> Address 12624 is processed as a value, but it has a node signature.
> 
> Alex Nelson (7):
>  generator: Add new return type to ABI: RSize
>  hivex: Split value_key function into value_key and value_key_len
>  generator: Add new return types to ABI: RLenNode and RLenValue
>  hivex: Add metadata length functions for nodes and values
>  hivex: Add offset-&-length function for long value data
>  hivexml: Report attributes in values instead of text.
>  hivexml: Add byte run reporting functions
> 
> generator/generator.ml |  169
+++++++++++++++++++++++++++++++++++++++++++++++-
> lib/hivex.c            |  115 +++++++++++++++++++++++++++++---
> xml/hivexml.c          |  127 ++++++++++++++++++++++++++++++++----
> 3 files changed, 385 insertions(+), 26 deletions(-)
> 
> -- 
> 1.7.6
> 
> 
> 
> _______________________________________________
> Libguestfs mailing list
> Libguestfs at redhat.com
> https://www.redhat.com/mailman/listinfo/libguestfs