search for: 6bc8638

...assumes that iconv doesn't actually modify the input buffer, even though it is declared as char *. --- lib/hivex-internal.h | 6 +++--- lib/utf16.c | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 7a548c0..6bc8638 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,9 +268,9 @@ extern size_t * _hivex_return_offset_list (offset_list *list); extern void _hivex_print_offset_list (offset_list *list, FILE *fp); /* utf16.c */ -extern char* _hivex_recode (char *input_encoding, -...

--- lib/hivex-internal.h | 1 + lib/utf16.c | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 6bc8638..7f4cc3c 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -277,6 +277,7 @@ extern char * _hivex_recode (const char *input_encoding, _hivex_recode ("LATIN1", _input, _len, "UTF-8", NULL) extern char* _hivex_encode_string(const char *str, size_t *size, int *utf1...

--- lib/write.c | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/write.c b/lib/write.c index 8c4dd8e..384c6b2 100644 --- a/lib/write.c +++ b/lib/write.c @@ -954,7 +954,6 @@ hivex_node_set_values (hive_h *h, hive_node_h node, for (i = 0; i < nr_values; ++i) { /* Allocate vk record to store this (key, value) pair. */ static const char vk_id[2] = { 'v', 'k' }; -

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to