search for: value_key

...ex 8bd944d..48b6e3a 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -229,6 +229,17 @@ string C<\"\"> here. The default key is often written C<\"@\">, but inside hives that has no meaning and won't give you the default key."; + "value_key_len", (RSize, [AHive; AValue "val"]), + "return the length of a value's key", + "\ +Return the length of the key (name) of a (key, value) pair. The +length can legitimately be 0, so errno is the necesary mechanism +to check for errors. + +In the context of W...

...t root -ns = [ n for n in h.node_children (root) if h.node_name(n) == u"abcd_äöüß" ] +# "abcd_äöüß" +ns = [ n for n in h.node_children (root) if h.node_name(n) == u("abcd_\u00e4\u00f6\u00fc\u00df") ] assert len (ns) == 1 -vs = [ v for v in h.node_values (ns[0]) if h.value_key(v) == u"abcd_äöüß" ] +# "abcd_äöüß" +vs = [ v for v in h.node_values (ns[0]) if h.value_key(v) == u("abcd_\u00e4\u00f6\u00fc\u00df") ] assert len (vs) == 1 -ns = [ n for n in h.node_children (root) if h.node_name(n) == u"zero\0key" ] +ns = [ n for n in h.nod...

--- configure.ac | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 6785037..203f34f 100644 --- a/configure.ac +++ b/configure.ac @@ -329,8 +329,8 @@ AS_IF([test "x$enable_python" != "xno"], AC_MSG_CHECKING([for Python extension suffix (PEP-3149)]) if test -z "$PYTHON_EXT_SUFFIX"; then

...ruby/tests/tc_130_special.rb @@ -13,17 +13,17 @@ class TestRLenValue < MiniTest::Unit::TestCase nodes = h.node_children (root) node = nodes.find { |n| h.node_name(n) == "abcd_äöüß" } - assert node != nil + refute_nil(node) value = h.node_values(node).find { |v| h.value_key(v) == "abcd_äöüß" } - assert value != nil + refute_nil(value) node = nodes.find { |n| h.node_name(n) == "zero\0key" } - assert node != nil + refute_nil(node) value = h.node_values(node).find { |v| h.value_key(v) == "zero\0val" } - assert value...

...Charlie, 2009-12-11, available at <http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>. hive: C:/WINDOWS/system32/config/SECURITY Address 12624 is processed as a value, but it has a node signature. Alex Nelson (7): generator: Add new return type to ABI: RSize hivex: Split value_key function into value_key and value_key_len generator: Add new return types to ABI: RLenNode and RLenValue hivex: Add metadata length functions for nodes and values hivex: Add offset-&-length function for long value data hivexml: Report attributes in values instead of text. hivexml: Add...

--- configure.ac | 1 + ruby/run-ruby-tests | 27 --------------------------- ruby/run-ruby-tests.in | 27 +++++++++++++++++++++++++++ ruby/tests/tc_010_load.rb | 2 -- ruby/tests/tc_021_close.rb | 2 -- ruby/tests/tc_120_rlenvalue.rb | 4 +--- ruby/tests/tc_200_write.rb | 2 -- ruby/tests/tc_210_setvalue.rb | 2 -- run.in

--- images/README | 14 ++++++++++++ images/mkzero/Makefile | 9 ++++++++ images/mkzero/mkzero.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ images/special | Bin 0 -> 8192 bytes 4 files changed, 82 insertions(+) create mode 100644 images/mkzero/Makefile create mode 100644 images/mkzero/mkzero.c create mode 100644 images/special diff --git a/images/README

...'; +my $root = $h->root; +ok $root, 'root node found'; +my ($node, $value); + +my @nodes = $h->node_children( $root ); + +($node) = grep { $h->node_name($_) eq 'abcd_äöüß' } @nodes; +ok $node, q<'abcd_äöüß' (node) has been found>; +($value) = grep { $h->value_key($_) eq 'abcd_äöüß' } $h->node_values($node); +ok $value, q<'abcd_äöüß\abcd_äöüß' (value) has been found>; + +($node) = grep { $h->node_name($_) eq "zero\0key" } @nodes; +ok $node, 'key has been found'; +($value) = grep { $h->value_key($_) eq "ze...

...srcdir: + srcdir = "." + +h = hivex.Hivex ("%s/../images/special" % srcdir) +assert h + +root = h.root () +assert root + +ns = [ n for n in h.node_children (root) if h.node_name(n) == u"abcd_äöüß" ] +assert len (ns) == 1 +vs = [ v for v in h.node_values (ns[0]) if h.value_key(v) == u"abcd_äöüß" ] +assert len (vs) == 1 +ns = [ n for n in h.node_children (root) if h.node_name(n) == u"zero\0key" ] +assert len (ns) == 1 +vs = [ v for v in h.node_values (ns[0]) if h.value_key(v) == u"zero\0val" ] +assert len (vs) == 1 +ns = [ n for n in h.node_c...

...', 'images', 'special'), {}) + assert_not_nil(h) + + root = h.root() + assert_not_nil(root) + + nodes = h.node_children (root) + node = nodes.find { |n| h.node_name(n) == "abcd_äöüß" } + assert node != nil + value = h.node_values(node).find { |v| h.value_key(v) == "abcd_äöüß" } + assert value != nil + node = nodes.find { |n| h.node_name(n) == "zero\0key" } + assert node != nil + value = h.node_values(node).find { |v| h.value_key(v) == "zero\0val" } + assert value != nil + node = nodes.find { |n| h.node_na...

...', 'CurrentVersion') { + $node = $h->node_get_child($node, $_); + } + + # Update DevicePath, but leave everything else as is + my @new; + my $append = ';%SystemRoot%\Drivers\VirtIO'; + foreach my $v ($h->node_values($node)) { + my $key = $h->value_key($v); + my ($type, $data) = $h->value_value($v); + + # Decode the string from utf16le to perl native + my $value = decode('UTF-16LE', $data); + + # Append the driver location if it's not there already + if ($key eq 'DevicePath' && ind...

...quot;CurrentVersion" ] in + let node = get_node h root path in + let values = Hivex.node_values h node in + let values = Array.to_list values in + (* Convert to a list of (key, value) to make the following easier. *) + let values = List.map (fun v -> Hivex.value_key h v, v) values in + + (* Look for ProductName key. *) + (try + let v = List.assoc "ProductName" values in + data.product_name <- Some (hivex_value_as_utf8 h v) + with + Not_found -> () + ); + + (* Version is complicat...

--- lib/hivex.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index 13d7556..8a774de 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -543,6 +543,9 @@ hivex_close (hive_h *h) free (h->filename); free (h); + if (h->msglvl >= 1) + fprintf (stderr, "hivex_close\n"); + return r; } -- 1.7.2.1

...d value metadata in the hivexml program. Each byte run represents the offset and length of a data structure within the hive, one per node, and one or two per value depending on the length of the value data. In order to add this metadata reporting, the following changes were put in place: * Split value_key function into value_key and value_key_len. * Add return types to the generator: RSize, RLenNode, and RLenValue. * Add support for the new return types to all language bindings, including an extra OCaml and Python function. * Add metadata length functions for nodes and values: hivex_{node,value} _s...

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

v10: https://www.redhat.com/archives/libguestfs/2017-July/msg00245.html No actual change here, but I rebased and retested. Also this series now does not depend on any other patch series since everything else needed is upstream. Rich.

v2 -> v3: - Renamed List.assoc_ -> List.assoc_lbl. - Rebased on top of current master branch. Rich.

In Std_utils we already extend Char and String. These commits take it a little further by extending List and adding a new Option submodule. All basically simple refactoring. Rich.

This time including the first commit ...