search for: node_start

...ields as Windows filetime fields stored in little-Endian (which means they can be treated as a single 64-bit little-Endian integer). Some of the code changes necessary include: * Exposing the hive_h structure in the hivex header file (via generator.ml) * Adding an additional argument to the node_start function, which should cause no complications since the change is specific to the C API. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- generator/generator.ml | 44 ++++++++++++++++- lib/hivex.c | 124 +++++++++++++++++++++++++++++++----------------- xml/hivexm...

...ta, 0, strlen(attr_data))); + XML_CHECK (xmlTextWriterEndAttribute, (writer)); + } else { + fprintf (stderr, "safe_print_string_attribute: Unexpected encoding to use (won't print here).\n"); + ret = -1; + } + } else + ret = -1; + return ret; +} + static int node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) { @@ -210,7 +257,10 @@ node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v; XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")...

...n skip_bad ? 0 : -1; + + /* Report extra for hive's root node. */ + if (node == hivex_root (h)) { + //Produce mtime for hive, not present node + if (vtor->node_mtime && vtor->node_mtime (h, opaque, node, h->last_modified) == -1) + goto error; + } + if (vtor->node_start && vtor->node_start (h, opaque, node, name) == -1) goto error; + if (vtor->node_mtime && vtor->node_mtime (h, opaque, node, last_modified) == -1) + goto error; + values = hivex_node_values (h, node); if (!values) { ret = skip_bad ? 0 : -1; @@ -1764,6 +...

...snprintf (buf, 1+BYTE_RUN_BUF_LEN, "%zu", node_struct_length); + XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "len", BAD_CAST buf)); + XML_CHECK (xmlTextWriterEndElement, (writer)); + XML_CHECK (xmlTextWriterEndElement, (writer)); + return 0; +} + static int node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) { int64_t last_modified; char *timebuf; + int ret = 0; xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v; XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")); @@ -235,7 +264,8 @@ node_start (h...

...> + int pos = 0; > + int charlen = len; > + while ((c = xmlGetUTF8Char(string+pos, &charlen)) >= 0) { > + if (xmlIsCharQ(c) == 0) > + return 0; > + pos += charlen; > + charlen = len - pos; > + } > + return 1; > +} > + > +static int > node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) > { > int64_t last_modified; > @@ -265,6 +282,20 @@ end_value (xmlTextWriterPtr writer) > XML_CHECK (xmlTextWriterEndElement, (writer)); > } > > +static void > +start_string(xmlTextWriterPtr writer, con...

...+ snprintf (buf, 1+BYTE_RUN_BUF_LEN, "%d", node_struct_length); + XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "len", BAD_CAST buf)); + XML_CHECK (xmlTextWriterEndElement, (writer)); + XML_CHECK (xmlTextWriterEndElement, (writer)); + return 0; +} + static int node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) { @@ -236,7 +264,8 @@ node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) } } - return 0; + ret = node_byte_runs (h, writer_v, node); + return ret; } static int @@ -268,11 +297,53 @@ end_value (...

...lue root="1". Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- xml/hivexml.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/xml/hivexml.c b/xml/hivexml.c index 2967ac9..f29c80c 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -204,6 +204,10 @@ node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")); XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "name", BAD_CAST name)); + if (node == hivex_root (h)) { + XML_CHECK (xmlTextWr...

...s. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- xml/hivexml.c | 25 ++++++++++++++++++++----- 1 files changed, 20 insertions(+), 5 deletions(-) diff --git a/xml/hivexml.c b/xml/hivexml.c index f29c80c..4789dbc 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -199,6 +199,7 @@ node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) { int64_t last_modified; char *timebuf; + int ret = 0; xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v; XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")); @@ -278,7 +279,9 @@ value_string...

...ns: %" PRIu64 ").\n", windows_ticks); + goto error_cleanup; + } + if (strftime (ret, TIMESTAMP_BUF_LEN, "%FT%TZ", &time_tm) == 0) + goto error_cleanup; + return ret; + +error_cleanup: + free (ret); + ret = NULL; +error_other: + return NULL; +} + static int node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) { + int ret = 0; + int64_t last_modified; + char *timebuf; + xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v; XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")); XML_CHECK (xmlTextWriterWriteA...

...+ snprintf (buf, 1+BYTE_RUN_BUF_LEN, "%d", node_struct_length); + XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "len", BAD_CAST buf)); + XML_CHECK (xmlTextWriterEndElement, (writer)); + XML_CHECK (xmlTextWriterEndElement, (writer)); + return 0; +} + static int node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) { int64_t last_modified; char *timebuf; + int ret = 0; xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v; XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")); @@ -219,7 +247,8 @@ node_start (h...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.