search for: node_children

...-in-python-3-and-2 +import sys +if sys.version < '3': + import codecs + def u(x): + return codecs.unicode_escape_decode(x)[0] +else: + def u(x): + return x import os import hivex @@ -13,16 +22,20 @@ assert h root = h.root () assert root -ns = [ n for n in h.node_children (root) if h.node_name(n) == u"abcd_äöüß" ] +# "abcd_äöüß" +ns = [ n for n in h.node_children (root) if h.node_name(n) == u("abcd_\u00e4\u00f6\u00fc\u00df") ] assert len (ns) == 1 -vs = [ v for v in h.node_values (ns[0]) if h.value_key(v) == u"abcd_äöüß" ] +#...

--- configure.ac | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 6785037..203f34f 100644 --- a/configure.ac +++ b/configure.ac @@ -329,8 +329,8 @@ AS_IF([test "x$enable_python" != "xno"], AC_MSG_CHECKING([for Python extension suffix (PEP-3149)]) if test -z "$PYTHON_EXT_SUFFIX"; then

...ython/t/130-special.py @@ -0,0 +1,28 @@ +# coding: utf-8 + +import os +import hivex + +srcdir = os.environ["srcdir"] +if not srcdir: + srcdir = "." + +h = hivex.Hivex ("%s/../images/special" % srcdir) +assert h + +root = h.root () +assert root + +ns = [ n for n in h.node_children (root) if h.node_name(n) == u"abcd_äöüß" ] +assert len (ns) == 1 +vs = [ v for v in h.node_values (ns[0]) if h.value_key(v) == u"abcd_äöüß" ] +assert len (vs) == 1 +ns = [ n for n in h.node_children (root) if h.node_name(n) == u"zero\0key" ] +assert len (ns) == 1 +vs =...

--- images/README | 14 ++++++++++++ images/mkzero/Makefile | 9 ++++++++ images/mkzero/mkzero.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ images/special | Bin 0 -> 8192 bytes 4 files changed, 82 insertions(+) create mode 100644 images/mkzero/Makefile create mode 100644 images/mkzero/mkzero.c create mode 100644 images/special diff --git a/images/README

...assert_equal(8712, r[:off]) end end diff --git a/ruby/tests/tc_130_special.rb b/ruby/tests/tc_130_special.rb index 282b288..7570824 100644 --- a/ruby/tests/tc_130_special.rb +++ b/ruby/tests/tc_130_special.rb @@ -13,17 +13,17 @@ class TestRLenValue < MiniTest::Unit::TestCase nodes = h.node_children (root) node = nodes.find { |n| h.node_name(n) == "abcd_äöüß" } - assert node != nil + refute_nil(node) value = h.node_values(node).find { |v| h.value_key(v) == "abcd_äöüß" } - assert value != nil + refute_nil(value) node = nodes.find { |n| h.node_name(...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

--- configure.ac | 1 + ruby/run-ruby-tests | 27 --------------------------- ruby/run-ruby-tests.in | 27 +++++++++++++++++++++++++++ ruby/tests/tc_010_load.rb | 2 -- ruby/tests/tc_021_close.rb | 2 -- ruby/tests/tc_120_rlenvalue.rb | 4 +--- ruby/tests/tc_200_write.rb | 2 -- ruby/tests/tc_210_setvalue.rb | 2 -- run.in

...+use Test::More; + +use Win::Hivex; + +my $srcdir = $ENV{srcdir} || "."; +my $h = Win::Hivex->open ("$srcdir/../images/special"); +ok $h, 'hive opened correctly'; +my $root = $h->root; +ok $root, 'root node found'; +my ($node, $value); + +my @nodes = $h->node_children( $root ); + +($node) = grep { $h->node_name($_) eq 'abcd_äöüß' } @nodes; +ok $node, q<'abcd_äöüß' (node) has been found>; +($value) = grep { $h->value_key($_) eq 'abcd_äöüß' } $h->node_values($node); +ok $value, q<'abcd_äöüß\abcd_äöüß' (value) has b...

...+require 'hivex' + +class TestRLenValue < Test::Unit::TestCase + def test_RLenValue + h = Hivex::open(File::join(ENV['abs_srcdir'], '..', 'images', 'special'), {}) + assert_not_nil(h) + + root = h.root() + assert_not_nil(root) + + nodes = h.node_children (root) + node = nodes.find { |n| h.node_name(n) == "abcd_äöüß" } + assert node != nil + value = h.node_values(node).find { |v| h.value_key(v) == "abcd_äöüß" } + assert value != nil + node = nodes.find { |n| h.node_name(n) == "zero\0key" } + assert nod...

--- generator/generator.ml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index 31478cd..de911f1 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -1771,7 +1771,7 @@ static void raise_closed (const char *) Noreturn; pr " rv = copy_type_value (r, len, t);\n"; pr "

...odification time of the node. Output is an Endian-correct +64-bit signed number. + +Though Windows' filetime struct looks like it should be an unsigned +64-bit int, Microsoft only guarantees FILETIME through 9999-12-31, due +to conversion limitations with .Net's DateTime."; + "node_children", (RNodeList, [AHive; ANode "node"]), "return children of node", "\ @@ -708,6 +725,9 @@ typedef size_t hive_value_h; # define HIVEX_NO_KEY ENOENT #endif +#include <time.h> +#define TIMESTAMP_BUF_LEN 32 + /* Pre-defined types. */ enum hive_type {...