search for: value_value

Hello, Here''s the context: I read a number either pure integer or float with eventually up to 12 digits after the decimal point from a YAML file. The number is injected into a FXTextField with the following code: @value_sel = FXDataTarget.new(@value.to_s) @value_value = FXTextField.new(@matrix_mem_value, 20, at value_sel, :opts =>TEXTFIELD_NORMAL|JUSTIFY_RIGHT, :selector => FXDataTarget::ID_VALUE) where @value is the number as read from the YAML file. If I use a TEXTFIELD_NORMAL, I get all the digits after the decimal point, but then it become...

...+h.node_set_value (B, value1) value1 = { "key": "Key1", "t": 3, "value": "JKL" } -h.node_set_value (b, value1) +h.node_set_value (B, value1) -val = h.node_get_value (b, "Key1") +val = h.node_get_value (B, "Key1") t_data = h.value_value (val) assert t_data[0] == 3 -assert t_data[1] == "JKL" +assert t_data[1] == b("JKL") -val = h.node_get_value (b, "Key3") +val = h.node_get_value (B, "Key3") t_data = h.value_value (val) assert t_data[0] == 3 -assert t_data[1] == "GHI" +assert t...

Hi, I have been working on a Python application that uses hivex. Meanwhile I have encountered some Python bindings issues which could be fixed. The next issue I see now is about the value_value function. This is briefly documented as: "return data length, data type and data of a value". For Perl, Python and OCaml, this is not true. A tuple is returned for both without the length (as this can be calculated from the data value). Ruby is the outlier here that uses a dictionary...

..., 20 insertions(+), 20 deletions(-) diff --git a/ruby/tests/tc_120_rlenvalue.rb b/ruby/tests/tc_120_rlenvalue.rb index 6c03f43..6a2fb72 100644 --- a/ruby/tests/tc_120_rlenvalue.rb +++ b/ruby/tests/tc_120_rlenvalue.rb @@ -37,7 +37,7 @@ class TestRLenValue < MiniTest::Unit::TestCase moderate_value_value = h.node_get_value(moderate_value_node, "33Bytes") r = h.value_data_cell_offset(moderate_value_value) - assert_equal(r[:len], 37) - assert_equal(r[:off], 8712) + assert_equal(37, r[:len]) + assert_equal(8712, r[:off]) end end diff --git a/ruby/tests/tc_130_special.r...

(renaming subject as I am partially getting off-topic) On Sunday 10 August 2014 16:26:07 Richard W.M. Jones wrote: > > The next issue I see now is about the value_value function. This is > > briefly documented as: "return data length, data type and data of a > > value". > > > > For Perl, Python and OCaml, this is not true. A tuple is returned > > for both without the length (as this can be calculated from the data > &gt...

...as a string. In Python3, it is -# returned as bytes. Provide a function to convert either to a string. -def to_string (data): - if sys.version_info[0] == 2: - return data - else: - return str (data, "utf-8") - val = h.node_get_value (b, "Key1") t_data = h.value_value (val) assert t_data[0] == 3 -assert to_string (t_data[1]) == "JKL" +assert t_data[1] == "JKL" val = h.node_get_value (b, "Key3") t_data = h.value_value (val) assert t_data[0] == 3 -assert to_string (t_data[1]) == "GHI" +assert t_data[1] == "GHI&quo...

Hello, thanks for answer, it works pretty good. I'm still little bit confused about saving binary values. I understand that there can be risk, to write wrong sequence of bites to hive but in regular MS Regedit this posibility is and when someone really know what he does, it should be able to change bites directly. So how achieve that with hivex? I noticed that hivex return binary data

...eturns 0 +and sets errno on error."; + + "value_struct_length", (RSize, [AHive; AValue "val"]), + "return the length of a value data structure", + "\ +Return the length of the value data structure. Returns 0 +and sets errno on error."; + "value_value", (RLenTypeVal, [AHive; AValue "val"]), "return data length, data type and data of a value", "\ diff --git a/lib/hivex.c b/lib/hivex.c index 61177d3..d8ffa63 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -585,6 +585,30 @@ hivex_root (hive_h *h) return ret;...

--- configure.ac | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 6785037..203f34f 100644 --- a/configure.ac +++ b/configure.ac @@ -329,8 +329,8 @@ AS_IF([test "x$enable_python" != "xno"], AC_MSG_CHECKING([for Python extension suffix (PEP-3149)]) if test -z "$PYTHON_EXT_SUFFIX"; then

Hallo, I working on GUI interface for users to manipulate Windows Registry. For that I choose to use really excellent library hivex3. Just now I'm performing same test to see, if everything is saved correctly. Most of things work really well, but there is problem with saving some values and his types. Description of problem: For saving values is used function : node_set_values or

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

...$h->node_get_child($node, $_); + } + + # Update DevicePath, but leave everything else as is + my @new; + my $append = ';%SystemRoot%\Drivers\VirtIO'; + foreach my $v ($h->node_values($node)) { + my $key = $h->value_key($v); + my ($type, $data) = $h->value_value($v); + + # Decode the string from utf16le to perl native + my $value = decode('UTF-16LE', $data); + + # Append the driver location if it's not there already + if ($key eq 'DevicePath' && index($value, $append) == -1) { + # Remove th...

Hi, This patch series is based on a prior patch[1], splitting off changes as requested and incorporating feedback from Richard Jones. It introduces type validation to avoid segmentation faults (instead, it reports an exception) and fixes handling of the bytes type in Python 3. Major changes since that series: - Drop newly introduced support for integer types for DWORD/QWORDS - Reject Unicode

...lsval hivexsh: lsval: Invalid or incomplete multibyte or wide character "MyPlayLists"=software\Microsoft\MediaPlayer\Preferences> Same for LcnStartLocation key in HKLM\\SOFTWARE\\Microsoft\\Dfrg\\BootOptimizeFunction (it starts with 30 00 00 00 .. some garbage). Printing the key with value_value shows this, which would be fine if hivex stopped parsing after the first 00 00: 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 5C 00 44...

Hello all, I am in the process of adding a new return type for the hivex ABI, and I found what I think is an error. I'm not sure, because I don't understand the OCaml binding data structures. Can somebody inform me if the patch below actually corrects a problem? --Alex --- generator/generator.ml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git

...ot;32Bytes", "t": 3, "value": moderate_value*2 }, + { "key": "33Bytes", "t": 3, "value": (moderate_value*3)[:33] }, +] +h.node_set_values (mvp, values) + +new_moderate_value = h.node_get_value (mvp, "16Bytes") + +assert h.value_value (new_moderate_value)[1] == moderate_value + +h.commit ("%s/../images/rlenvalue_test_hive" % srcdir) diff --git a/images/rlenvalue_test_hive b/images/rlenvalue_test_hive new file mode 100644 index 0000000000000000000000000000000000000000..87cbec5d93f39f2f3821e631b6bc2d41ae885a72 GIT binary...

...be 10, +and the offset would be to a value data cell, which houses the data +prefixed with 4 bytes describing the size. If the data length is not +greater than 4, then 0 is returned as offset and length, as the data +are inline in the value. + +Returns 0 and sets errno on error."; + "value_value", (RLenTypeVal, [AHive; AValue "val"]), "return data length, data type and data of a value", "\ diff --git a/lib/hivex.c b/lib/hivex.c index bf1a860..df313bf 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -1257,6 +1257,66 @@ hivex_value_type (hive_h *h, hive_v...

...be 10, +and the offset would be to a value data cell, which houses the data +prefixed with 4 bytes describing the size. If the data length is not +greater than 4, then 0 is returned as offset and length, as the data +are inline in the value. + +Returns 0 and sets errno on error."; + "value_value", (RLenTypeVal, [AHive; AValue "val"]), "return data length, data type and data of a value", "\ diff --git a/lib/hivex.c b/lib/hivex.c index bf1a860..df313bf 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -1257,6 +1257,66 @@ hivex_value_type (hive_h *h, hive_v...

...bar\" then the length would be 6, and the +offset would be to a value data cell, which is the data prefixed with +4 bytes describing the size. If the length is not greater than 4, +then 0 is returned, as the data are inline in the value. + +Returns 0 and sets errno on error."; + "value_value", (RLenTypeVal, [AHive; AValue "val"]), "return data length, data type and data of a value", "\ diff --git a/lib/hivex.c b/lib/hivex.c index d8ffa63..04ceed3 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -1294,6 +1294,51 @@ hivex_value_type (hive_h *h, hive_v...

--- lib/hivex.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index 13d7556..8a774de 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -543,6 +543,9 @@ hivex_close (hive_h *h) free (h->filename); free (h); + if (h->msglvl >= 1) + fprintf (stderr, "hivex_close\n"); + return r; } -- 1.7.2.1