Changeset 116 for trunk/src

Timestamp:

08/03/08 15:34:27 (16 years ago)

Author:

tim

Message:

fixed major bug in reglookup-recover; now recovers much more data
rolled back release version to 0.9.0
added date range checking in regfi's NK parsing for deleted records

Location:

trunk/src

Files:

• common.c (modified) (2 diffs)
• reglookup-recover.c (modified) (8 diffs)
• reglookup.c (modified) (1 diff)

trunk/src/common.c

@@ -29 +29 @@
 const char* common_special_chars = ",\"\\";
 
-#define REGLOOKUP_VERSION "1.0.0"
+#define REGLOOKUP_VERSION "0.9.0"
 
 
@@ -357 +357 @@
   /* XXX: Dont know what to do with these yet, just print as binary... */
   default:
+    /* XXX: It would be really nice if this message somehow included the
+     *      name of the current value we're having trouble with, since
+     *      stderr/stdout don't always sync nicely.
+     */
     fprintf(stderr, "WARNING: Unrecognized registry data type (0x%.8X); quoting as binary.\n", type);
     

trunk/src/reglookup-recover.c

@@ -148 +148 @@
    *   http://msdn2.microsoft.com/en-us/library/ms724872.aspx
    */
-  /* TODO: should probably do something different here for this tool.*/
+  /* XXX: Should probably do something different here for this tool.
+   *      Also, It would be really nice if this message somehow included the
+   *      name of the current value we're having trouble with, since
+   *      stderr/stdout don't always sync nicely.
+   */
   if(size > VK_MAX_DATA_LENGTH)
   {
@@ -277 +281 @@
  * Paths returned must be free()d.
  */
-/* TODO: This is not terribly efficient, as it may reparse many keys 
- *       repeatedly.  Should try to add caching.  Also, piecing the path 
- *       together is slow and redundant.
+/* XXX: This is not terribly efficient, as it may reparse many keys 
+ *      repeatedly.  Should try to add caching.  Also, piecing the path 
+ *      together is slow and redundant.
  */
 char* getParentPath(REGF_FILE* f, REGF_NK_REC* nk)
@@ -425 +429 @@
   rm_idx = range_list_find(rl, offset);
   if(rm_idx < 0)
+  {
+    fprintf(stderr, "DEBUG: removeRange: rm_idx < 0; (%d)\n", rm_idx);
     return false;
+  }
 
   cur_elem = range_list_get(rl, rm_idx);
   if(cur_elem == NULL)
   {
-    printf("removeRange: cur_elem == NULL.  rm_idx=%d\n", rm_idx);
+    fprintf(stderr, "DEBUG: removeRange: cur_elem == NULL.  rm_idx=%d\n", rm_idx);
     return false;
   }
@@ -438 +445 @@
     if(!range_list_split_element(rl, rm_idx, offset))
     {
-      printf("removeRange: first split failed\n");
+      fprintf(stderr, "DEBUG: removeRange: first split failed\n");
       return false;
     }
     rm_idx++;
+    cur_elem = range_list_get(rl, rm_idx);
+    if(cur_elem == NULL)
+    {
+      fprintf(stderr, 
+              "DEBUG: removeRange: cur_elem == NULL after first split.  rm_idx=%d\n",
+              rm_idx);
+      return false;
+    }
   }
   
@@ -448 +463 @@
     if(!range_list_split_element(rl, rm_idx, offset+length))
     {
-      printf("removeRange: second split failed\n");
+      fprintf(stderr, "DEBUG: removeRange: second split failed\n");
       return false;
     }
@@ -455 +470 @@
   if(!range_list_remove(rl, rm_idx))
   {
-    printf("removeRange: remove failed\n");
+    fprintf(stderr, "DEBUG: removeRange: remove failed\n");
     return false;
   }
@@ -487 +502 @@
           return 20;
         }
-        
-        if(removeRange(unalloc_cells, key->offset, key->cell_size))
-        {
-          /* TODO: This ugly hack is needed because unalloc_cells is changing
-           *       underneath us when we find things.  Need a better approach
-           *       so we can parse things single-pass.
-           */
-          i=0;
-          break;
-        }
-        else
-          return 30;
+        j+=key->cell_size-8;
       }
     }
+  }
+
+  for(i=0; i<range_list_size(unalloc_keys); i++)
+  {
+    cur_elem = range_list_get(unalloc_keys, i);
+    if(!removeRange(unalloc_cells, cur_elem->offset, cur_elem->length))
+      return 30;
   }
 
@@ -743 +754 @@
   REGF_NK_REC* tmp_key;
   REGF_VK_REC* tmp_value;
-  uint32 argi, arge, i, j, k, ret, num_unalloc_keys;
+  uint32 argi, arge, i, j, ret, num_unalloc_keys;
   /* uint32 test_offset;*/
   

trunk/src/reglookup.c

@@ -46 +46 @@
 
 
-/* TODO: a hack to share some functions with reglookup-recover.c.
- *       Should move these into a properly library at some point.
+/* XXX: A hack to share some functions with reglookup-recover.c.
+ *      Should move these into a properly library at some point.
  */
 #include "common.c"