search for: hivex_last_modifi

...er +is responsible for freeing returned string."; + "major_version", (RInt32, [AHive]), "return the major version of the hive", "\ diff --git a/lib/hivex.c b/lib/hivex.c index 455202f..11468f9 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -634,6 +634,12 @@ hivex_last_modified (hive_h *h) return timestamp_check (h, 0, h->last_modified); } +char * +hivex_name (hive_h *h) +{ + return (h && h->hdr) ? windows_utf16_to_utf8 (h->hdr->name, 64) : NULL; +} + int32_t hivex_major_version (hive_h *h) { diff --git a/xml/hivexml.c b/xml/hivexml.c index...

...for modified-time reporting has been essentially unused. These changes report the registry time by treating the time fields as Windows filetime fields stored in little-Endian (which means they can be treated as a single 64-bit little-Endian integer). This patch adds to the hivex ABI: * int64_t hivex_last_modified (hive_h *) * int64_t hivex_node_timestamp (hive_h *, hive_node_h) These two functions return the hive's last-modified time and a particular node's last-modified time, respectively. Credit to Richard Jones for the ABI suggestion, and for the tip on Microsoft's filetime time span. h...

...;, - major_ver, le32toh (h->hdr->minor_ver), + major_ver, minor_ver, le32toh (h->hdr->sequence1), le32toh (h->hdr->sequence2), h->last_modified, name ? name : "(conversion failed)", @@ -624,6 +634,18 @@ hivex_last_modified (hive_h *h) return timestamp_check (h, 0, h->last_modified); } +int32_t +hivex_major_version (hive_h *h) +{ + return (h && h->hdr) ? (int32_t) le32toh (h->hdr->major_ver) : -1; +} + +int32_t +hivex_minor_version (hive_h *h) +{ + return (h && h->hdr) ? (int32...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.