search for: value_key_len

...ex 8bd944d..48b6e3a 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -229,6 +229,17 @@ string C<\"\"> here. The default key is often written C<\"@\">, but inside hives that has no meaning and won't give you the default key."; + "value_key_len", (RSize, [AHive; AValue "val"]), + "return the length of a value's key", + "\ +Return the length of the key (name) of a (key, value) pair. The +length can legitimately be 0, so errno is the necesary mechanism +to check for errors. + +In the context of Windo...

...;http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>. hive: C:/WINDOWS/system32/config/SECURITY Address 12624 is processed as a value, but it has a node signature. Alex Nelson (7): generator: Add new return type to ABI: RSize hivex: Split value_key function into value_key and value_key_len generator: Add new return types to ABI: RLenNode and RLenValue hivex: Add metadata length functions for nodes and values hivex: Add offset-&-length function for long value data hivexml: Report attributes in values instead of text. hivexml: Add byte run reporting functions generator/...

...e default key."; + "node_nr_values", (RSize, [AHive; ANode "node"]), + "return the number of values attached to a node", + "\ +Return the number of (key, value) pairs attached to this node +as produced by C<hivex_node_values>."; + "value_key_len", (RSize, [AHive; AValue "val"]), "return the length of a value's key", "\ diff --git a/lib/value.c b/lib/value.c index 43e89f9..2dfe006 100644 --- a/lib/value.c +++ b/lib/value.c @@ -159,6 +159,22 @@ hivex_node_get_value (hive_h *h, hive_node_h node, con...

...m. Each byte run represents the offset and length of a data structure within the hive, one per node, and one or two per value depending on the length of the value data. In order to add this metadata reporting, the following changes were put in place: * Split value_key function into value_key and value_key_len. * Add return types to the generator: RSize, RLenNode, and RLenValue. * Add support for the new return types to all language bindings, including an extra OCaml and Python function. * Add metadata length functions for nodes and values: hivex_{node,value} _struct_length. * Add an offset-&-length...

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to