Libguestfs - Jan 2014 - Re: [PATCH] Add a minimal hive with "special" keys and values

---
 images/README          |  15 +++++++++++++++
 images/mkzero/Makefile |   7 +++++++
 images/mkzero/mkzero.c |  48 ++++++++++++++++++++++++++++++++++++++++++++++++
 images/special         | Bin 0 -> 8192 bytes
 4 files changed, 70 insertions(+)
 create mode 100644 images/mkzero/Makefile
 create mode 100644 images/mkzero/mkzero.c
 create mode 100644 images/special

diff --git a/images/README b/images/README
index 2131885..34c65f3 100644
--- a/images/README
+++ b/images/README
@@ -11,3 +11,18 @@ hand-crafted binary blob.
 tests.
 
 - Richard W.M. Jones 2010-02-24.
+
+'special' was created by importing 'minimal' into a VM running
Windows
+XP and loading it into HKEY_LOCAL_MACHINE\minimal using regedit.exe
+(File/Load Hive...)
+
+- A subkey 'asdf_äöüß' was created in the root node
+  - An empty REG_STRING value 'asdf_äöüß' was created within that node.
+- A subkey 'weird™' was created in the root node.
+  - An empty REG_STRING value 'symbols $£₤₧€' (SMALL DOLLAR SIGN,
+    FULLWIDTH POUND SIGN, PESETA SIGN, EURO SIGN) was created within
+    that node.
+- A subkey 'zero\0key' with an REG_DWORD value 'zero\0val'
+  was created using the 'mkzero/mkzero.c'. (\0 = zero character) 
+
+- Hilko Bengen 2014-01-10.
diff --git a/images/mkzero/Makefile b/images/mkzero/Makefile
new file mode 100644
index 0000000..4d33ade
--- /dev/null
+++ b/images/mkzero/Makefile
@@ -0,0 +1,7 @@
+CROSS=i686-w64-mingw32-
+
+all: mkzero.exe
+mkzero.exe: mkzero.o
+	$(CROSS)gcc -o $@ $< -lntdll
+%.o: %.c
+	$(CROSS)gcc -o $@ -c $<
diff --git a/images/mkzero/mkzero.c b/images/mkzero/mkzero.c
new file mode 100644
index 0000000..1b50b22
--- /dev/null
+++ b/images/mkzero/mkzero.c
@@ -0,0 +1,48 @@
+/* use the NT native API to create registry key and value that contain
+   a zero character */
+
+#include <ntdef.h>
+#include <stdio.h>
+#include <ddk/wdm.h>
+#include <windef.h>
+
+int main (int argc, char **argv)
+{
+  NTSTATUS rc;
+
+  UNICODE_STRING root_key_name;
+  RtlInitUnicodeString(&root_key_name,
L"\\Registry\\Machine\\minimal");
+  OBJECT_ATTRIBUTES root_key_obj;
+  InitializeObjectAttributes (&root_key_obj, &root_key_name,
+                              OBJ_OPENIF | OBJ_CASE_INSENSITIVE,
+                              NULL, NULL);
+  HANDLE minimal_key_handle;
+  rc = ZwCreateKey (&minimal_key_handle, KEY_ALL_ACCESS, &root_key_obj,
+                    0, NULL, REG_OPTION_NON_VOLATILE, NULL);
+  if (!NT_SUCCESS (rc)) {
+    printf("error: CreateKey <HKLM\\minimal>: 0x%08x\n", rc);
+    exit(1);
+  }
+
+  UNICODE_STRING key_name = {16, 16, L"zero\0key"};
+  OBJECT_ATTRIBUTES key_obj;
+  InitializeObjectAttributes (&key_obj, &key_name, 
+                              OBJ_OPENIF | OBJ_CASE_INSENSITIVE,
+                              minimal_key_handle, NULL);
+  HANDLE key_handle;
+  rc = ZwCreateKey (&key_handle, KEY_ALL_ACCESS, &key_obj,
+                    0, NULL, REG_OPTION_NON_VOLATILE, NULL);
+  if (!NT_SUCCESS (rc)) {
+    printf("error: CreateKey: 0x%08x\n", rc);
+    exit(1);
+  }
+
+  UNICODE_STRING value_name = {16, 16, L"zero\0val"};
+  DWORD value = 0;
+  rc = ZwSetValueKey (key_handle, &value_name, 0,
+                      REG_DWORD, &value, sizeof(value));
+  if (!NT_SUCCESS (rc)) {
+    printf("error: SetValueKey: 0x%08x\n", rc);
+    exit(1);
+  }
+}
diff --git a/images/special b/images/special
new file mode 100644
index
0000000000000000000000000000000000000000..8aa4f2254af7b52f0a79061a7288c2128eee7b63
GIT binary patch
literal 8192
zcmeHLziU%b6h28COhb#$Ul4=fYx@MLKL!^^6)M(2Dk4tBk~GnVmnM=(q~Z`n)IUHs
zhkyk;I61kvcM)}{1Q$C94muRkP^1{Y@7_GxmnJ$170!YC?z!ijckape-TNS?oV$K)
zEF!{jqOm&ic<4<8s>CoT)Lkl$)hjY3XCy0gl9wVzMQ%!2(s-6IPszCCVDruT2G&8`
z9AXO0qq1!fXx39_w@ooxh$5f}C<2OrBA^H;0*Zhlpa>`eioicbU^bI4nho&(K9Haf
zz;(UVY8CyX^5XN4gX|5^c6x_M9~H=AzX(EF)H&DM^IjS{WDsl5^DbVRygYe);`|l5
zmwvTc6<;J7wSyZRz#}64kJx;0%#I?=7nQG);7gK}{a8it4kYH{F-$#?#6xOZ>|NqV
zd&C<%;!nxWP=0qK-r1br*ioH{x3$K0vx<a4z%k7f)M#uy^M+y#w4Hl|^N6ef>#83Y
zz+dBbm`$(dcCK8KYPzrn|4Y=<FmVGw%f_)pj&x=wJN>D-{t;aqV!DdB6*xGaxzF8t
zo0l4V94u-aKJapH5c6RSisfa^^5XR1CDntMF7XEcF7d{W_^!Oz_^rG+U3f`_u(rH7
zp3Q5UUa@`nU5h8*=k9#*hDN7n{O|m&;rA>@e~6Ft@U?kmJ59(>9P_z7$1d1=Ci3&h
zu4c7;&s_Kd0X;?x>>!)>g@(ZILg5jm@Sfd5A1;rMTvkSgX(I!L*{Io*`#r=jSYEha
zBJU3JaZr}9uKKCad7-@`^XTPe(B&&Ycg2&Zvf%Qh&>MUwTv>ne?$F)8)E`Hoo%OT6
zp#A~q8|RbR?Kv*Y_Q?e5yt@40bx{9XtY3ZeKG-PmhWd-X8~R?kffF;_Mu=krkIp*C
oOB)Kqjk!;LZoXkZJexA9st70oihv@Z2q*%IfFhs>{C^1i23(Tu`2YX_

literal 0
HcmV?d00001

-- 
1.8.5.2

On Fri, Jan 10, 2014 at 01:14:51AM +0100, Hilko Bengen
wrote:
> +  was created using the 'mkzero/mkzero.c'. (\0 = zero character) 
Extra whitespace at the end of this ^ line ...
> +  InitializeObjectAttributes (&key_obj, &key_name, 
.. and this line.

---

So there's no problem with adding this test data, but are you
planning to also add some tests :-?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

* Richard W.M. Jones:
> So there's no problem with adding this test data, but are you planning
> to also add some tests :-?
Sure. Working on it.

Good that you asked for tests, btw. Another bugfix patch or two will be
on the way. :-)

Cheers,
-Hilko

---
 images/README          |  14 ++++++++++++
 images/mkzero/Makefile |   9 ++++++++
 images/mkzero/mkzero.c |  59 +++++++++++++++++++++++++++++++++++++++++++++++++
 images/special         | Bin 0 -> 8192 bytes
 4 files changed, 82 insertions(+)
 create mode 100644 images/mkzero/Makefile
 create mode 100644 images/mkzero/mkzero.c
 create mode 100644 images/special

diff --git a/images/README b/images/README
index 2131885..b01e5a2 100644
--- a/images/README
+++ b/images/README
@@ -11,3 +11,17 @@ hand-crafted binary blob.
 tests.
 
 - Richard W.M. Jones 2010-02-24.
+
+'special' was created by importing 'minimal' into a VM running
Windows
+XP, loading it into HKEY_LOCAL_MACHINE\minimal using regedit.exe
+(File/Load Hive...), and running 'mkzero.exe'.
+
+'mkzero.exe' creates the following keys and values:
+
+- A key 'zero\0key' containing a REG_DWORD value 'zero\0val'
(\0 = zero
+  character)
+- A key 'asdf_äöüß' containing a REG_DWORD value 'asdf_äöüß'
+- A key 'weird™' containing a REG_DWORD value 'symbols $£₤₧€'
(SMALL
+  DOLLAR SIGN, FULLWIDTH POUND SIGN, PESETA SIGN, EURO SIGN)
+
+- Hilko Bengen 2014-01-10.
diff --git a/images/mkzero/Makefile b/images/mkzero/Makefile
new file mode 100644
index 0000000..affe52b
--- /dev/null
+++ b/images/mkzero/Makefile
@@ -0,0 +1,9 @@
+CROSS=i686-w64-mingw32-
+CFLAGS=--std=c99
+all: mkzero.exe
+clean:
+	rm -f *.exe *.o
+mkzero.exe: mkzero.o
+	$(CROSS)gcc -o $@ $< -lntdll
+%.o: %.c
+	$(CROSS)gcc $(CFLAGS) -Wpedantic -Wall -o $@ -c $<
diff --git a/images/mkzero/mkzero.c b/images/mkzero/mkzero.c
new file mode 100644
index 0000000..a95794a
--- /dev/null
+++ b/images/mkzero/mkzero.c
@@ -0,0 +1,59 @@
+/* use the NT native API to create registry key and value that contain
+   a zero character */
+
+#include <ntdef.h>
+#include <stdio.h>
+#include <ddk/wdm.h>
+#include <windef.h>
+
+void create_key_value (PHANDLE handle, WCHAR* key, int key_len, WCHAR* val, int
val_len)
+{
+  UNICODE_STRING key_name = { key_len, key_len, key };
+  UNICODE_STRING value_name = { val_len, val_len, val };
+  OBJECT_ATTRIBUTES key_obj;
+  InitializeObjectAttributes (&key_obj, &key_name,
+                              OBJ_OPENIF | OBJ_CASE_INSENSITIVE,
+                              *handle, NULL);
+  HANDLE key_handle;
+  NTSTATUS rc;
+  rc = ZwCreateKey (&key_handle, KEY_ALL_ACCESS, &key_obj,
+                    0, NULL, REG_OPTION_NON_VOLATILE, NULL);
+  if (!NT_SUCCESS (rc)) {
+    wprintf(L"error: CreateKey %s: 0x%08x\n", key, rc);
+    exit(1);
+  }
+  DWORD value = 0;
+  rc = ZwSetValueKey (key_handle, &value_name, 0,
+                      REG_DWORD, &value, sizeof(value));
+  if (!NT_SUCCESS (rc)) {
+    wprintf(L"error: SetValueKey %s: 0x%08x\n", val, rc);
+    exit(1);
+  }
+}
+
+int main (int argc, char **argv)
+{
+  UNICODE_STRING root_key_name;
+  RtlInitUnicodeString(&root_key_name,
L"\\Registry\\Machine\\minimal");
+  OBJECT_ATTRIBUTES root_key_obj;
+  InitializeObjectAttributes (&root_key_obj, &root_key_name,
+                              OBJ_OPENIF | OBJ_CASE_INSENSITIVE,
+                              NULL, NULL);
+  HANDLE minimal_key_handle;
+  NTSTATUS rc = ZwCreateKey (&minimal_key_handle, KEY_ALL_ACCESS,
&root_key_obj,
+                    0, NULL, REG_OPTION_NON_VOLATILE, NULL);
+  if (!NT_SUCCESS (rc)) {
+    wprintf(L"error: CreateKey <HKLM\\minimal>: 0x%08x\n", rc);
+    exit(1);
+  }
+  WCHAR k1[] = L"zero\0key";
+  WCHAR v1[] = L"zero\0val";
+  create_key_value (&minimal_key_handle, k1, sizeof (k1)-2, v1, sizeof
(v1)-2);
+  WCHAR k2[] = L"abcd_äöüß";
+  WCHAR v2[] = L"abcd_äöüß";
+  create_key_value (&minimal_key_handle, k2, sizeof (k2)-2, v2, sizeof
(v2)-2);
+  WCHAR k3[] = L"weird™";
+  WCHAR v3[] = L"symbols $£₤₧€";
+  create_key_value (&minimal_key_handle, k3, sizeof (k3)-2, v3, sizeof
(v3)-2);
+  return 0;
+}
diff --git a/images/special b/images/special
new file mode 100644
index
0000000000000000000000000000000000000000..8a5ff5f34f32f0e56c1e1e9abf49bd3a8857c5e7
GIT binary patch
literal 8192
zcmeHLziU%b6h28CZ9~<EDAeHa+P=XdxC$;R6s%K4L=cN5X`%@)O-drwio+ZH@elY1
z1T2`rMJE?Ghc2Q^L|k-m(@8`sh|ll4H&6SLm(oQjat_>k?mh3^bH4X|uYulX`TDgz
zDG`p7(@(o+_rFeIDH#kJ*De>1UAJUG&PYj?r7CrdmfVo06fig77i3n-i1}u}f_;>?
zjGP+lsO=gC@|UkX+cjVmh%%rIC<DrXGN2471ImChpbRJj%D_Kmpi->XO#}RYA6aw{
zz<oOm!@8fB{JkG9c{jk=>AfN&T);Y`B1j3jrVo1lAOn3ifxYK>=P%4(oIgHy?h+qw
z{0hUCkL!iB9c*wEQ%Xi3^76qk9Yqcyo|Z3?<sq4rBiN;I29|L#O>v!_#3aE$JRyH(
zNWO_9|CAhv)p!5qJ6r3UIMA7Vi#223Jxj!Zzcn_rZY<YO+utKz2fTypy6?txaoMqF
z)PlzLZB!(`+(*wTH>5K*hWU26*$}_H*6!&MAjUy3vnT>R?oPlTv+vW>W7F#44ACPu
zM301g!+S!$i6cKz51T)zhm)X3F2=Fd$nk7ld)bvajCbvvcw4^n+1od>xa5E1yT;F1
zZMMlz4SCknQ#PT23*zbDz<-2a^~b11fNu2s?5!TFg&Ok$bZx`$RPU7pz4=YDHf<cE
zP+Tf4e)|6NgNg7jN~BgvO9yAKb|1WY4iGQCdhg#EeB%T7`p;W@vZL?uRsy~p`bYTq
zJ8={Dh*jJumSlR05Q(E!8To^64$0m1`;7=Eb7&g|Z!U(H@s_ONF0zPQ${N<Lc=AZr
k-N)_|mrtRG{b8{ios|J)Kp9X5lmTTx8Bhk4f&Y|&-#+)~(*OVf

literal 0
HcmV?d00001

-- 
1.8.5.2

---
 configure.ac                   |  1 +
 ruby/run-ruby-tests            | 27 ---------------------------
 ruby/run-ruby-tests.in         | 27 +++++++++++++++++++++++++++
 ruby/tests/tc_010_load.rb      |  2 --
 ruby/tests/tc_021_close.rb     |  2 --
 ruby/tests/tc_120_rlenvalue.rb |  4 +---
 ruby/tests/tc_200_write.rb     |  2 --
 ruby/tests/tc_210_setvalue.rb  |  2 --
 run.in                         |  4 ++--
 9 files changed, 31 insertions(+), 40 deletions(-)
 delete mode 100755 ruby/run-ruby-tests
 create mode 100755 ruby/run-ruby-tests.in

diff --git a/configure.ac b/configure.ac
index 4066ca5..6785037 100644
--- a/configure.ac
+++ b/configure.ac
@@ -564,6 +564,7 @@ AC_CONFIG_FILES([Makefile
                  sh/Makefile
                  xml/Makefile])
 AC_CONFIG_FILES([python/run-python-tests], [chmod +x python/run-python-tests])
+AC_CONFIG_FILES([ruby/run-ruby-tests], [chmod +x ruby/run-ruby-tests])
 AC_CONFIG_FILES([run], [chmod +x,-w run])
 AC_OUTPUT
 
diff --git a/ruby/run-ruby-tests b/ruby/run-ruby-tests
deleted file mode 100755
index 2efd890..0000000
--- a/ruby/run-ruby-tests
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/sh -
-# hivex Ruby bindings
-# Copyright (C) 2009-2011 Red Hat Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
-set -e
-
-# Run them one at a time, otherwise rake runs them in parallel (which
-# is bound to fail because they all use a single test image file).
-
-for f in tests/tc_*.rb; do
-    echo $RAKE test "$@" TEST="$f"
-    $RAKE test "$@" TEST="$f"
-done
diff --git a/ruby/run-ruby-tests.in b/ruby/run-ruby-tests.in
new file mode 100755
index 0000000..b61699e
--- /dev/null
+++ b/ruby/run-ruby-tests.in
@@ -0,0 +1,27 @@
+#!/bin/sh -
+# hivex Ruby bindings
+# Copyright (C) 2009-2011 Red Hat Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+set -e
+
+# Run them one at a time, otherwise rake runs them in parallel (which
+# is bound to fail because they all use a single test image file).
+export abs_srcdir=@abs_srcdir@
+for f in @srcdir@/tests/tc_*.rb; do
+    echo $RAKE test "$@" TEST="$f"
+    $RAKE test "$@" TEST="$f"
+done
diff --git a/ruby/tests/tc_010_load.rb b/ruby/tests/tc_010_load.rb
index 113ab69..8a8ae51 100644
--- a/ruby/tests/tc_010_load.rb
+++ b/ruby/tests/tc_010_load.rb
@@ -16,8 +16,6 @@
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
 require 'test/unit'
-$:.unshift(File::join(File::dirname(__FILE__), "..",
"lib"))
-$:.unshift(File::join(File::dirname(__FILE__), "..", "ext",
"hivex"))
 require 'hivex'
 
 class TestLoad < Test::Unit::TestCase
diff --git a/ruby/tests/tc_021_close.rb b/ruby/tests/tc_021_close.rb
index a089cf3..9c5ea65 100644
--- a/ruby/tests/tc_021_close.rb
+++ b/ruby/tests/tc_021_close.rb
@@ -16,8 +16,6 @@
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
 require 'test/unit'
-$:.unshift(File::join(File::dirname(__FILE__), "..",
"lib"))
-$:.unshift(File::join(File::dirname(__FILE__), "..", "ext",
"hivex"))
 require 'hivex'
 
 class TestClose < Test::Unit::TestCase
diff --git a/ruby/tests/tc_120_rlenvalue.rb b/ruby/tests/tc_120_rlenvalue.rb
index 368cb19..5cb0a80 100644
--- a/ruby/tests/tc_120_rlenvalue.rb
+++ b/ruby/tests/tc_120_rlenvalue.rb
@@ -22,13 +22,11 @@
 # 8712.
 
 require 'test/unit'
-$:.unshift(File::join(File::dirname(__FILE__), "..",
"lib"))
-$:.unshift(File::join(File::dirname(__FILE__), "..", "ext",
"hivex"))
 require 'hivex'
 
 class TestRLenValue < Test::Unit::TestCase
   def test_RLenValue
-    h = Hivex::open("../images/rlenvalue_test_hive", {})
+    h = Hivex::open(File::join(ENV['abs_srcdir'], '..',
'images', 'rlenvalue_test_hive'), {})
     assert_not_nil(h)
 
     root = h.root()
diff --git a/ruby/tests/tc_200_write.rb b/ruby/tests/tc_200_write.rb
index b46dc7b..6ae239e 100644
--- a/ruby/tests/tc_200_write.rb
+++ b/ruby/tests/tc_200_write.rb
@@ -16,8 +16,6 @@
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
 require 'test/unit'
-$:.unshift(File::join(File::dirname(__FILE__), "..",
"lib"))
-$:.unshift(File::join(File::dirname(__FILE__), "..", "ext",
"hivex"))
 require 'hivex'
 
 class TestWrite < Test::Unit::TestCase
diff --git a/ruby/tests/tc_210_setvalue.rb b/ruby/tests/tc_210_setvalue.rb
index e55e5fe..4d1aa7e 100644
--- a/ruby/tests/tc_210_setvalue.rb
+++ b/ruby/tests/tc_210_setvalue.rb
@@ -16,8 +16,6 @@
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
 require 'test/unit'
-$:.unshift(File::join(File::dirname(__FILE__), "..",
"lib"))
-$:.unshift(File::join(File::dirname(__FILE__), "..", "ext",
"hivex"))
 require 'hivex'
 
 class TestSetValue < Test::Unit::TestCase
diff --git a/run.in b/run.in
index 9592e38..46b3df6 100755
--- a/run.in
+++ b/run.in
@@ -70,9 +70,9 @@ export PYTHONPATH
 export RUBY=@RUBY@
 export RAKE=@RAKE@
 if [ -z "$RUBYLIB" ]; then
-    RUBYLIB="$b/ruby/lib:$b/ruby/ext/hivex"
+    RUBYLIB="$s/ruby/lib:$b/ruby/ext/hivex"
 else
-    RUBYLIB="$b/ruby/lib:$b/ruby/ext/hivex:$RUBYLIB"
+    RUBYLIB="$s/ruby/lib:$b/ruby/ext/hivex:$RUBYLIB"
 fi
 export RUBYLIB
 export LD_LIBRARY_PATH="$b/ruby/ext/hivex:$LD_LIBRARY_PATH"
-- 
1.8.5.2