search for: hivex_node_timestamp

...ntially unused. These changes report the registry time by treating the time fields as Windows filetime fields stored in little-Endian (which means they can be treated as a single 64-bit little-Endian integer). This patch adds to the hivex ABI: * int64_t hivex_last_modified (hive_h *) * int64_t hivex_node_timestamp (hive_h *, hive_node_h) These two functions return the hive's last-modified time and a particular node's last-modified time, respectively. Credit to Richard Jones for the ABI suggestion, and for the tip on Microsoft's filetime time span. hivexml employs these two functions to produce...

...riter, BAD_CAST "node")); XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "name", BAD_CAST name)); + if (node == hivex_root (h)) { + XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "root", BAD_CAST "1")); + } + last_modified = hivex_node_timestamp (h, node); if (last_modified >= 0) { timebuf = filetime_to_8601 (last_modified); -- 1.7.6

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18

...modified); } +int32_t +hivex_major_version (hive_h *h) +{ + return (h && h->hdr) ? (int32_t) le32toh (h->hdr->major_ver) : -1; +} + +int32_t +hivex_minor_version (hive_h *h) +{ + return (h && h->hdr) ? (int32_t) le32toh (h->hdr->minor_ver) : -1; +} + int64_t hivex_node_timestamp (hive_h *h, hive_node_h node) { diff --git a/xml/hivexml.c b/xml/hivexml.c index d38e9d4..3a4d9b7 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -136,6 +136,30 @@ main (int argc, char *argv[]) XML_CHECK (xmlTextWriterStartDocument, (writer, NULL, "utf-8", NULL)); XML_CHECK (xmlT...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.