search for: nr_subkey

...you must find every child with hivex_node_children, which is a relatively expensive operation. So, I have created a function called hivex_node_num_children that isolates the first few lines of hivex_node_children to simply return the number of child nodes a node has by accessing ntreg_nk_record->nr_subkeys. I'm a bit of a newer developer, so I'm not incredibly familiar with the patching process through mailing lists, nor do I have any history with libguestfs. Please let me know if I am doing anything wrong or what can be improved. This is the git branch: https://github.com/kupiakos/hivex/t...

...gt;name_len = htole16 (recoded_name_len); + memcpy (nk->name, recoded_name, recoded_name_len); + free (recoded_name); /* Inherit parent sk. */ struct ntreg_nk_record *parent_nk = @@ -719,9 +731,9 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) parent_nk->nr_subkeys = htole32 (nr_subkeys_in_parent_nk); /* Update max_subkey_name_len in parent nk. */ - uint16_t max = le16toh (parent_nk->max_subkey_name_len); - if (max < strlen (name) * 2) /* *2 because "recoded" in UTF16-LE. */ - parent_nk->max_subkey_name_len = htole16 (strlen (na...

...eturning EFAULT because node name" + " is too long (%zu, %zu)\n", len, seg_len); errno = EFAULT; return NULL; @@ -733,7 +736,8 @@ get_children (hive_h *h, hive_node_h node, /* Arbitrarily limit the number of subkeys we will ever deal with. */ if (nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS) { if (h->msglvl >= 2) - fprintf (stderr, "hivex: get_children: returning ERANGE because nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS (%zu > %d)\n", + fprintf (stderr, "hivex: get_children: returning ERANGE because " + &quo...

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

...1.psych.purdue.edu/~zpizlo/rsteinma/Bob-FOR%20CV/Epelboim%20et%20al%201997%20Fillers%20in%20Reading.pdf > /* Inherit parent sk. */ > struct ntreg_nk_record *parent_nk = > @@ -719,9 +731,9 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) > parent_nk->nr_subkeys = htole32 (nr_subkeys_in_parent_nk); > > /* Update max_subkey_name_len in parent nk. */ > - uint16_t max = le16toh (parent_nk->max_subkey_name_len); > - if (max < strlen (name) * 2) /* *2 because "recoded" in UTF16-LE. */ > - parent_nk->max_subkey_name_...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

--- lib/hivex-internal.h | 8 +++++--- lib/utf16.c | 11 +++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 4135f58..64fd49a 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,11 +268,13 @@ extern size_t * _hivex_return_offset_list (offset_list *list); extern void _hivex_print_offset_list

...>name_len = htole16 (recoded_name_len); + memcpy (nk->name, recoded_name, recoded_name_len); + free(recoded_name); /* Inherit parent sk. */ struct ntreg_nk_record *parent_nk = @@ -719,9 +731,9 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) parent_nk->nr_subkeys = htole32 (nr_subkeys_in_parent_nk); /* Update max_subkey_name_len in parent nk. */ - uint16_t max = le16toh (parent_nk->max_subkey_name_len); - if (max < strlen (name) * 2) /* *2 because "recoded" in UTF16-LE. */ - parent_nk->max_subkey_name_len = htole16 (strlen (na...

[This email is either empty or too large to be displayed at this time]

...eg_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2]; /* "nk" */ uint16_t flags; - char timestamp[8]; + int64_t timestamp; uint32_t unknown1; uint32_t parent; /* offset of owner/parent */ uint32_t nr_subkeys; /* number of subkeys */ @@ -359,6 +360,9 @@ hivex_open (const char *filename, int flags) goto error; } + /* Last-modified time. */ + h->last_modified = le64toh ((int64_t) h->hdr->last_modified); + if (h->msglvl >= 2) { char *name = windows_utf16_to_utf8...

...g_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2]; /* "nk" */ uint16_t flags; - char timestamp[8]; + uint64_t timestamp; uint32_t unknown1; uint32_t parent; /* offset of owner/parent */ uint32_t nr_subkeys; /* number of subkeys */ @@ -265,7 +227,34 @@ header_checksum (const hive_h *h) return sum; } +#define WINDOWS_TICK 10000000LL +#define SEC_TO_UNIX_EPOCH 11644473600LL +/** + * Convert Windows filetime to ISO 8601 format. + * Source for filetime->time_t conversion: http://stacko...

...g_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2]; /* "nk" */ uint16_t flags; - char timestamp[8]; + uint64_t timestamp; uint32_t unknown1; uint32_t parent; /* offset of owner/parent */ uint32_t nr_subkeys; /* number of subkeys */ @@ -265,7 +267,34 @@ header_checksum (const hive_h *h) return sum; } +#define WINDOWS_TICK 10000000LL +#define SEC_TO_UNIX_EPOCH 11644473600LL +/** + * Convert Windows filetime to ISO 8601 format. + * Source for filetime->time_t conversion: http://stacko...