Changeset 116 for trunk/src/reglookup-recover.c

Timestamp:

08/03/08 15:34:27 (16 years ago)

Author:

tim

Message:

fixed major bug in reglookup-recover; now recovers much more data
rolled back release version to 0.9.0
added date range checking in regfi's NK parsing for deleted records

File:

• trunk/src/reglookup-recover.c (modified) (8 diffs)

trunk/src/reglookup-recover.c

@@ -148 +148 @@
    *   http://msdn2.microsoft.com/en-us/library/ms724872.aspx
    */
-  /* TODO: should probably do something different here for this tool.*/
+  /* XXX: Should probably do something different here for this tool.
+   *      Also, It would be really nice if this message somehow included the
+   *      name of the current value we're having trouble with, since
+   *      stderr/stdout don't always sync nicely.
+   */
   if(size > VK_MAX_DATA_LENGTH)
   {
@@ -277 +281 @@
  * Paths returned must be free()d.
  */
-/* TODO: This is not terribly efficient, as it may reparse many keys 
- *       repeatedly.  Should try to add caching.  Also, piecing the path 
- *       together is slow and redundant.
+/* XXX: This is not terribly efficient, as it may reparse many keys 
+ *      repeatedly.  Should try to add caching.  Also, piecing the path 
+ *      together is slow and redundant.
  */
 char* getParentPath(REGF_FILE* f, REGF_NK_REC* nk)
@@ -425 +429 @@
   rm_idx = range_list_find(rl, offset);
   if(rm_idx < 0)
+  {
+    fprintf(stderr, "DEBUG: removeRange: rm_idx < 0; (%d)\n", rm_idx);
     return false;
+  }
 
   cur_elem = range_list_get(rl, rm_idx);
   if(cur_elem == NULL)
   {
-    printf("removeRange: cur_elem == NULL.  rm_idx=%d\n", rm_idx);
+    fprintf(stderr, "DEBUG: removeRange: cur_elem == NULL.  rm_idx=%d\n", rm_idx);
     return false;
   }
@@ -438 +445 @@
     if(!range_list_split_element(rl, rm_idx, offset))
     {
-      printf("removeRange: first split failed\n");
+      fprintf(stderr, "DEBUG: removeRange: first split failed\n");
       return false;
     }
     rm_idx++;
+    cur_elem = range_list_get(rl, rm_idx);
+    if(cur_elem == NULL)
+    {
+      fprintf(stderr, 
+              "DEBUG: removeRange: cur_elem == NULL after first split.  rm_idx=%d\n",
+              rm_idx);
+      return false;
+    }
   }
   
@@ -448 +463 @@
     if(!range_list_split_element(rl, rm_idx, offset+length))
     {
-      printf("removeRange: second split failed\n");
+      fprintf(stderr, "DEBUG: removeRange: second split failed\n");
       return false;
     }
@@ -455 +470 @@
   if(!range_list_remove(rl, rm_idx))
   {
-    printf("removeRange: remove failed\n");
+    fprintf(stderr, "DEBUG: removeRange: remove failed\n");
     return false;
   }
@@ -487 +502 @@
           return 20;
         }
-        
-        if(removeRange(unalloc_cells, key->offset, key->cell_size))
-        {
-          /* TODO: This ugly hack is needed because unalloc_cells is changing
-           *       underneath us when we find things.  Need a better approach
-           *       so we can parse things single-pass.
-           */
-          i=0;
-          break;
-        }
-        else
-          return 30;
+        j+=key->cell_size-8;
       }
     }
+  }
+
+  for(i=0; i<range_list_size(unalloc_keys); i++)
+  {
+    cur_elem = range_list_get(unalloc_keys, i);
+    if(!removeRange(unalloc_cells, cur_elem->offset, cur_elem->length))
+      return 30;
   }
 
@@ -743 +754 @@
   REGF_NK_REC* tmp_key;
   REGF_VK_REC* tmp_value;
-  uint32 argi, arge, i, j, k, ret, num_unalloc_keys;
+  uint32 argi, arge, i, j, ret, num_unalloc_keys;
   /* uint32 test_offset;*/