Libguestfs - Feb 2016 - hivex lib: Add function hivex_node_num_children

Hello,

I've been working on a graphical registry hive editing tool in Qt
using the hivex C library.
While creating it, I noticed that in order to determine if an
expansion element should be shown on a node, you have to determine if
a node has any children.
Currently, in order to determine if a node has any children, you must
find every child with hivex_node_children, which is a relatively
expensive operation.
So, I have created a function called hivex_node_num_children that
isolates the first few lines of hivex_node_children to simply return
the number of child nodes a node has by accessing
ntreg_nk_record->nr_subkeys.

I'm a bit of a newer developer, so I'm not incredibly familiar with
the patching process through mailing lists, nor do I have any history
with libguestfs.
Please let me know if I am doing anything wrong or what can be improved.

This is the git branch:
https://github.com/kupiakos/hivex/tree/node_children_count
This is a patch of the difference:

diff --git a/generator/generator.ml b/generator/generator.ml
index be783ae..4f878ff 100755
--- a/generator/generator.ml
+++ b/generator/generator.ml
@@ -210,6 +210,11 @@ Return the child of node with the name C<name>,
if it exists.

 The name is matched case insensitively.";

+  "node_num_children", (RSize, [AHive; ANode "node"]),
+    "return the number of children of a node",
+    "\
+Return the number of nodes as produced by C<hivex_node_children>.";
+
   "node_parent", (RNode, [AHive; ANode "node"]),
     "return the parent of node",
     "\
diff --git a/lib/node.c b/lib/node.c
index 1fb48cf..fc3ca71 100644
--- a/lib/node.c
+++ b/lib/node.c
@@ -513,6 +513,22 @@ hivex_node_children (hive_h *h, hive_node_h node)
   return children;
 }

+size_t
+hivex_node_num_children (hive_h *h, hive_node_h node)
+{
+  if (!IS_VALID_BLOCK (h, node) || !block_id_eq(h, node, "nk")) {
+    SET_ERRNO( EINVAL, "invalid block or not an 'nk' block");
+    return 0;
+  }
+
+  struct ntreg_nk_record *nk +    (struct ntreg_nk_record *) ((char *)
h->addr + node);
+
+  size_t nr_subkeys_in_nk = le32toh(nk->nr_subkeys);
+
+  return nr_subkeys_in_nk;
+}
+
 /* Very inefficient, but at least having a separate API call
  * allows us to make it more efficient in future.
  */

--
 - Kevin Haroldsen (kupiakos)

On Sat, Feb 13, 2016 at 10:18:22PM -0800, Kevin Haroldsen
wrote:
> Hello,
> 
> I've been working on a graphical registry hive editing tool in Qt
> using the hivex C library.
> While creating it, I noticed that in order to determine if an
> expansion element should be shown on a node, you have to determine if
> a node has any children.
> Currently, in order to determine if a node has any children, you must
> find every child with hivex_node_children, which is a relatively
> expensive operation.
> So, I have created a function called hivex_node_num_children that
> isolates the first few lines of hivex_node_children to simply return
> the number of child nodes a node has by accessing
> ntreg_nk_record->nr_subkeys.
> 
> I'm a bit of a newer developer, so I'm not incredibly familiar with
> the patching process through mailing lists, nor do I have any history
> with libguestfs.
> Please let me know if I am doing anything wrong or what can be improved.
You've come to the right place!  The patch looks fine at first glance
but I'll have to have a proper look at it tomorrow.

Thanks, Rich.
> This is the git branch:
> https://github.com/kupiakos/hivex/tree/node_children_count
> This is a patch of the difference:
> 
> diff --git a/generator/generator.ml b/generator/generator.ml
> index be783ae..4f878ff 100755
> --- a/generator/generator.ml
> +++ b/generator/generator.ml
> @@ -210,6 +210,11 @@ Return the child of node with the name C<name>,
> if it exists.
> 
>  The name is matched case insensitively.";
> 
> +  "node_num_children", (RSize, [AHive; ANode "node"]),
> +    "return the number of children of a node",
> +    "\
> +Return the number of nodes as produced by
C<hivex_node_children>.";
> +
>    "node_parent", (RNode, [AHive; ANode "node"]),
>      "return the parent of node",
>      "\
> diff --git a/lib/node.c b/lib/node.c
> index 1fb48cf..fc3ca71 100644
> --- a/lib/node.c
> +++ b/lib/node.c
> @@ -513,6 +513,22 @@ hivex_node_children (hive_h *h, hive_node_h node)
>    return children;
>  }
> 
> +size_t
> +hivex_node_num_children (hive_h *h, hive_node_h node)
> +{
> +  if (!IS_VALID_BLOCK (h, node) || !block_id_eq(h, node, "nk"))
{
> +    SET_ERRNO( EINVAL, "invalid block or not an 'nk'
block");
> +    return 0;
> +  }
> +
> +  struct ntreg_nk_record *nk > +    (struct ntreg_nk_record *) ((char
*) h->addr + node);
> +
> +  size_t nr_subkeys_in_nk = le32toh(nk->nr_subkeys);
> +
> +  return nr_subkeys_in_nk;
> +}
> +
>  /* Very inefficient, but at least having a separate API call
>   * allows us to make it more efficient in future.
>   */
> 
> --
>  - Kevin Haroldsen (kupiakos)
> 
> _______________________________________________
> Libguestfs mailing list
> Libguestfs@redhat.com
> https://www.redhat.com/mailman/listinfo/libguestfs
-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

I have pushed this.  I changed the name of the API to
'node_nr_children' (in a follow-up commit).

Note to use the API safely from C you will need to set and check
errno:

  errno = 0;
  size_t nr = hivex_node_nr_children (h, node);
  if (nr == 0 && errno != 0) {
    perror ("hivex_node_nr_children");
    exit (1);
  }

Thanks,

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html