Changeset 138 for trunk


Ignore:
Timestamp:
02/08/09 14:53:48 (16 years ago)
Author:
tim
Message:

extended error message logging to allow for message type filtering

fine tuned message verbosity to more reasonable default levels for reglookup and reglookup-recover

updated related documentation

Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/doc/reglookup-recover.1.docbook

    r119 r138  
    2626        reglookup-recover attempts to scour a Windows registry hive for
    2727        deleted data structures and outputs those found in a CSV-like format.
    28         print them out to stdout in a CSV-like format.
    2928    </para>
    3029  </refsect1>
    … …  
    4342        <listitem>
    4443          <para>
    45             Verbose output. (Currently does little to nothing.)
     44            Verbose output.
    4645          </para>
    4746        </listitem>

  • trunk/doc/reglookup.1.docbook

    r125 r138  
    137137        <listitem>
    138138          <para>
    139             Verbose output. (Currently does little to nothing.)
     139            Verbose output.
    140140          </para>
    141141        </listitem>
    … …  
    298298    </para>
    299299    <para>
    300       Verbose output is not working.
    301     </para>
    302     <para>
    303300      The SID conversions haven't been carefully checked for accuracy.
    304301    </para>

  • trunk/include/regfi.h

    r137 r138  
    5353
    5454/******************************************************************************/
    55 /* Macros */
    56  
     55
     56/* regfi library error message types */
     57#define REGFI_MSG_INFO  0x0001
     58#define REGFI_MSG_WARN  0x0004
     59#define REGFI_MSG_ERROR 0x0010
     60
    5761/* Registry data types */
    5862#define REG_NONE                       0
    … …  
    281285  /* Run-time information */
    282286  /************************/
    283   int fd;         /* file descriptor */
    284 
    285   /* Experimental hbin lists */
     287  /* file descriptor */
     288  int fd;
     289
     290  /* For sanity checking (not part of the registry header) */
     291  uint32 file_length;
     292
     293  /* Metadata about hbins */
    286294  range_list* hbins;
    287295
    … …  
    289297  char* last_message;
    290298
    291   /* For sanity checking (not part of the registry header) */
    292   uint32 file_length;
     299  /* Mask for error message types that will be stored. */
     300  uint16 msg_mask;
    293301
    294302
    … …  
    359367 */
    360368char*                 regfi_get_messages(REGFI_FILE* file);
     369void                  regfi_set_message_mask(REGFI_FILE* file, uint16 mask);
    361370
    362371REGFI_ITERATOR*       regfi_iterator_new(REGFI_FILE* fh);
    … …  
    458467                                              REGFI_SUBKEY_LIST** lists,
    459468                                              bool strict);
    460 void                  regfi_add_message(REGFI_FILE* file, const char* fmt, ...);
     469void                  regfi_add_message(REGFI_FILE* file, uint16 msg_type,
     470                                        const char* fmt, ...);
    461471#endif  /* _REGFI_H */

  • trunk/lib/regfi.c

    r137 r138  
    3737/******************************************************************************
    3838 ******************************************************************************/
    39 void regfi_add_message(REGFI_FILE* file, const char* fmt, ...)
     39void regfi_add_message(REGFI_FILE* file, uint16 msg_type, const char* fmt, ...)
    4040{
    4141  /* XXX: This function is not particularly efficient,
    4242   *      but then it is mostly used during errors.
    4343   */
    44   /* XXX: Should we add support for filtering by levels of severity? */
    4544  uint32 buf_size, buf_used;
    4645  char* new_msg;
    4746  va_list args;
    4847
    49   if(file->last_message == NULL)
    50     buf_used = 0;
    51   else
    52     buf_used = strlen(file->last_message);
    53 
    54   buf_size = buf_used+strlen(fmt)+2+128;
    55   new_msg = realloc(file->last_message, buf_size);
    56   if(new_msg == NULL)
    57     /* XXX: should we report this? */
    58     return;
    59  
    60   va_start(args, fmt);
    61   vsnprintf(new_msg+buf_used, buf_size-buf_used, fmt, args);
    62   va_end(args);
    63   strncat(new_msg, "\n", buf_size-1);
    64 
    65   file->last_message = new_msg;
     48  if((file->msg_mask & msg_type) != 0)
     49  {
     50    if(file->last_message == NULL)
     51      buf_used = 0;
     52    else
     53      buf_used = strlen(file->last_message);
     54   
     55    buf_size = buf_used+strlen(fmt)+160;
     56    new_msg = realloc(file->last_message, buf_size);
     57    if(new_msg == NULL)
     58      /* XXX: should we report this? */
     59      return;
     60
     61    switch (msg_type)
     62    {
     63    case REGFI_MSG_INFO:
     64      strcpy(new_msg+buf_used, "INFO: ");
     65      buf_used += 6;
     66      break;
     67    case REGFI_MSG_WARN:
     68      strcpy(new_msg+buf_used, "WARN: ");
     69      buf_used += 6;
     70      break;
     71    case REGFI_MSG_ERROR:
     72      strcpy(new_msg+buf_used, "ERROR: ");
     73      buf_used += 7;
     74      break;
     75    }
     76
     77    va_start(args, fmt);
     78    vsnprintf(new_msg+buf_used, buf_size-buf_used, fmt, args);
     79    va_end(args);
     80    strncat(new_msg, "\n", buf_size-1);
     81   
     82    file->last_message = new_msg;
     83  }
    6684}
    6785
    … …  
    7593
    7694  return ret_val;
     95}
     96
     97
     98void regfi_set_message_mask(REGFI_FILE* file, uint16 mask)
     99{
     100  file->msg_mask = mask;
    77101}
    78102
    … …  
    702726                       &cell_length, &unalloc))
    703727  {
    704     regfi_add_message(file, "ERROR: Could not parse SK record cell"
     728    regfi_add_message(file, REGFI_MSG_WARN, "Could not parse SK record cell"
    705729                      " at offset 0x%.8X.", offset);
    706730    return NULL;
    … …  
    709733  if(sk_header[0] != 's' || sk_header[1] != 'k')
    710734  {
    711     regfi_add_message(file, "ERROR: Magic number mismatch in parsing SK record"
    712                       " at offset 0x%.8X.", offset);
     735    regfi_add_message(file, REGFI_MSG_WARN, "Magic number mismatch in parsing"
     736                      " SK record at offset 0x%.8X.", offset);
    713737    return NULL;
    714738  }
    … …  
    729753     || (strict && ret_val->cell_size != (ret_val->cell_size & 0xFFFFFFF8)))
    730754  {
    731     regfi_add_message(file, "ERROR: Invalid cell size found while parsing SK"
    732                       " record at offset 0x%.8X.", offset);
     755    regfi_add_message(file, REGFI_MSG_WARN, "Invalid cell size found while"
     756                      " parsing SK record at offset 0x%.8X.", offset);
    733757    free(ret_val);
    734758    return NULL;
    … …  
    747771  if(ret_val->desc_size + REGFI_SK_MIN_LENGTH > ret_val->cell_size)
    748772  {
    749     regfi_add_message(file, "ERROR: Security descriptor too large for cell"
    750                       " while parsing SK record at offset 0x%.8X.", offset);
     773    regfi_add_message(file, REGFI_MSG_ERROR, "Security descriptor too large for"
     774                      " cell while parsing SK record at offset 0x%.8X.",
     775                      offset);
    751776    free(ret_val);
    752777    return NULL;
    … …  
    764789     || length != ret_val->desc_size)
    765790  {
    766     regfi_add_message(file, "ERROR: Failed to read security descriptor"
    767                       " while parsing SK record at offset 0x%.8X.", offset);
     791    regfi_add_message(file, REGFI_MSG_ERROR, "Failed to read security"
     792                      " descriptor while parsing SK record at offset 0x%.8X.",
     793                      offset);
    768794    free(ret_val);
    769795    return NULL;
    … …  
    772798  if(!(ret_val->sec_desc = winsec_parse_desc(sec_desc_buf, ret_val->desc_size)))
    773799  {
    774     regfi_add_message(file, "ERROR: Failed to parse security descriptor"
    775                       " while parsing SK record at offset 0x%.8X.", offset);
     800    regfi_add_message(file, REGFI_MSG_ERROR, "Failed to parse security"
     801                      " descriptor while parsing SK record at offset 0x%.8X.",
     802                      offset);
    776803    free(sec_desc_buf);
    777804    free(ret_val);
    … …  
    794821  if(!regfi_parse_cell(file->fd, offset, NULL, 0, &cell_length, &unalloc))
    795822  {
    796     regfi_add_message(file, "ERROR: Failed to read cell header"
     823    regfi_add_message(file, REGFI_MSG_ERROR, "Failed to read cell header"
    797824                      " while parsing value list at offset 0x%.8X.", offset);
    798825    return NULL;
    … …  
    807834  if((num_values * sizeof(uint32)) > cell_length-sizeof(uint32))
    808835  {
    809     regfi_add_message(file, "ERROR: Too many values found"
     836    regfi_add_message(file, REGFI_MSG_ERROR, "Too many values found"
    810837                      " while parsing value list at offset 0x%.8X.", offset);
    811838    return NULL;
    … …  
    820847  if((regfi_read(file->fd, (uint8*)ret_val, &length) != 0) || length != read_len)
    821848  {
    822     regfi_add_message(file, "ERROR: Failed to read value pointers"
     849    regfi_add_message(file, REGFI_MSG_ERROR, "Failed to read value pointers"
    823850                      " while parsing value list at offset 0x%.8X.", offset);
    824851    free(ret_val);
    … …  
    837864         || ((ret_val[i] & 0xFFFFFFF8) != ret_val[i]))
    838865      {
    839         regfi_add_message(file, "ERROR: Invalid value pointer (0x%.8X) found"
    840                           " while parsing value list at offset 0x%.8X.",
    841                           ret_val[i], offset);
     866        regfi_add_message(file, REGFI_MSG_ERROR, "Invalid value pointer"
     867                          " (0x%.8X) found while parsing value list at offset"
     868                          " 0x%.8X.", ret_val[i], offset);
    842869        free(ret_val);
    843870        return NULL;
    … …  
    934961  if ((nk = regfi_parse_nk(file, offset, max_length, true)) == NULL)
    935962  {
    936     regfi_add_message(file, "ERROR: Could not load NK record at"
     963    regfi_add_message(file, REGFI_MSG_ERROR, "Could not load NK record at"
    937964                      " offset 0x%.8X.", offset);
    938965    return NULL;
    … …  
    965992      if(strict && nk->values == NULL)
    966993      {
    967         regfi_add_message(file, "ERROR: Could not load value list"
     994        regfi_add_message(file, REGFI_MSG_ERROR, "Could not load value list"
    968995                          " for NK record at offset 0x%.8X.",
    969996                          offset);
    … …  
    11111138    rla = range_list_add(rb->hbins, hbin->file_off, hbin->block_size, hbin);
    11121139    hbin_off = hbin->file_off + hbin->block_size;
    1113     /*fprintf(stderr, "file_length=%.8X,hbin_off=%.8X,hbin->block_size=%.8X,hbin->next_block=%.8X\n",
    1114       file_length, hbin_off, hbin->block_size, hbin->next_block);*/
    11151140    hbin = regfi_parse_hbin(rb, hbin_off, true);
    11161141  }
     1142
     1143  /* Default message mask */
     1144  rb->msg_mask = REGFI_MSG_ERROR|REGFI_MSG_WARN;
    11171145
    11181146  /* success */
    … …  
    16611689  if(lseek(file->fd, offset, SEEK_SET) == -1)
    16621690  {
    1663     regfi_add_message(file, "ERROR: Seek failed"
     1691    regfi_add_message(file, REGFI_MSG_ERROR, "Seek failed"
    16641692                      " while parsing hbin at offset 0x%.8X.", offset);
    16651693    return NULL;
    … …  
    16731701  if(lseek(file->fd, offset, SEEK_SET) == -1)
    16741702  {
    1675     regfi_add_message(file, "ERROR: Seek failed"
     1703    regfi_add_message(file, REGFI_MSG_ERROR, "Seek failed"
    16761704                      " while parsing hbin at offset 0x%.8X.", offset);
    16771705    return NULL;
    … …  
    16851713  if(strict && (memcmp(hbin->magic, "hbin", 4) != 0))
    16861714  {
    1687     /* XXX: add this back in when we have configurable verbosity. */
    1688     /*    regfi_add_message(file, "INFO: Magic number mismatch (%.2X %.2X %.2X %.2X)"
    1689                       " while parsing hbin at offset 0x%.8X.", hbin->magic[0],
    1690                       hbin->magic[1], hbin->magic[2], hbin->magic[3], offset); */
     1715    regfi_add_message(file, REGFI_MSG_INFO, "Magic number mismatch "
     1716                      "(%.2X %.2X %.2X %.2X) while parsing hbin at offset"
     1717                      " 0x%.8X.", hbin->magic[0], hbin->magic[1],
     1718                      hbin->magic[2], hbin->magic[3], offset);
    16911719    free(hbin);
    16921720    return NULL;
    … …  
    16951723  hbin->first_hbin_off = IVAL(hbin_header, 0x4);
    16961724  hbin->block_size = IVAL(hbin_header, 0x8);
    1697     /*fprintf(stderr, "hbin->block_size field => %.8X\n", IVAL(hbin_header, 0x8));*/
    1698   /*  hbin->block_size = IVAL(hbin_header, 0x8);*/
    16991725  /* this should be the same thing as hbin->block_size but just in case */
    17001726  hbin->next_block = IVAL(hbin_header, 0x1C);
    … …  
    17101736     || (hbin->block_size & 0xFFFFF000) != hbin->block_size)
    17111737  {
    1712     regfi_add_message(file, "ERROR: The hbin offset is not aligned"
     1738    regfi_add_message(file, REGFI_MSG_ERROR, "The hbin offset is not aligned"
    17131739                      " or runs off the end of the file"
    17141740                      " while parsing hbin at offset 0x%.8X.", offset);
    … …  
    17361762                       &cell_length, &unalloc))
    17371763  {
    1738     regfi_add_message(file, "ERROR: Could not parse cell header"
     1764    regfi_add_message(file, REGFI_MSG_WARN, "Could not parse cell header"
    17391765                      " while parsing NK record at offset 0x%.8X.", offset);
    17401766    return NULL;
    … …  
    17441770  if((nk_header[0x0] != 'n') || (nk_header[0x1] != 'k'))
    17451771  {
    1746     regfi_add_message(file, "ERROR: Magic number mismatch in parsing NK record"
    1747                       " at offset 0x%.8X.", offset);
     1772    regfi_add_message(file, REGFI_MSG_WARN, "Magic number mismatch in parsing"
     1773                      " NK record at offset 0x%.8X.", offset);
    17481774    return NULL;
    17491775  }
    … …  
    17521778  if(ret_val == NULL)
    17531779  {
    1754     regfi_add_message(file, "ERROR: Failed to allocate memory while"
     1780    regfi_add_message(file, REGFI_MSG_ERROR, "Failed to allocate memory while"
    17551781                      " parsing NK record at offset 0x%.8X.", offset);
    17561782    return NULL;
    … …  
    17651791     || (strict && ret_val->cell_size != (ret_val->cell_size & 0xFFFFFFF8)))
    17661792  {
    1767     regfi_add_message(file, "ERROR: A length check failed while parsing"
    1768                       " NK record at offset 0x%.8X.", offset);
     1793    regfi_add_message(file, REGFI_MSG_ERROR, "A length check failed while"
     1794                      " parsing NK record at offset 0x%.8X.", offset);
    17691795    free(ret_val);
    17701796    return NULL;
    … …  
    17821808     && (ret_val->key_type != REGFI_NK_TYPE_UNKNOWN3))
    17831809  {
    1784     regfi_add_message(file, "WARN: Unknown key type (0x%.4X) while parsing"
    1785                       " NK record at offset 0x%.8X.", ret_val->key_type,
    1786                       offset);
     1810    regfi_add_message(file, REGFI_MSG_WARN, "Unknown key type (0x%.4X) while"
     1811                      " parsing NK record at offset 0x%.8X.",
     1812                      ret_val->key_type, offset);
    17871813  }
    17881814
    … …  
    18251851    if(strict)
    18261852    {
    1827       regfi_add_message(file, "ERROR: Contents too large for cell"
     1853      regfi_add_message(file, REGFI_MSG_ERROR, "Contents too large for cell"
    18281854                        " while parsing NK record at offset 0x%.8X.", offset);
    18291855      free(ret_val);
    … …  
    18571883     || length != ret_val->name_length)
    18581884  {
    1859     regfi_add_message(file, "ERROR: Failed to read key name"
     1885    regfi_add_message(file, REGFI_MSG_ERROR, "Failed to read key name"
    18601886                      " while parsing NK record at offset 0x%.8X.", offset);
    18611887    free(ret_val->keyname);
    … …  
    18791905    {
    18801906      ret_val->classname = NULL;
    1881       regfi_add_message(file, "WARN: Could not find hbin for class name"
    1882                         " while parsing NK record at offset 0x%.8X.", offset);
     1907      regfi_add_message(file, REGFI_MSG_WARN, "Could not find hbin for class"
     1908                        " name while parsing NK record at offset 0x%.8X.",
     1909                        offset);
    18831910    }
    18841911    /* XXX: Should add this back and make it more strict?
    … …  
    18871914    */
    18881915  }
    1889   /*
    1890 if(ret_val->key_type == 0x0000 || ret_val->key_type == 0x4020)
    1891 {
    1892   fprintf(stderr, "INFO: keyname=%s,classname=%s,unalloc=%d,num_subkeys=%d,num_values=%d\n",
    1893           ret_val->keyname,ret_val->classname,unalloc,ret_val->num_subkeys,ret_val->num_values);
    1894 }
    1895   */
     1916
    18961917  return ret_val;
    18971918}
    … …  
    19111932    if(!regfi_parse_cell(file->fd, offset, NULL, 0, &cell_length, &unalloc))
    19121933    {
    1913       regfi_add_message(file, "ERROR: Could not parse cell header"
     1934      regfi_add_message(file, REGFI_MSG_WARN, "Could not parse cell header"
    19141935                        " while parsing class name at offset 0x%.8X.", offset);
    19151936        return NULL;
    … …  
    19181939    if((cell_length & 0xFFFFFFF8) != cell_length)
    19191940    {
    1920       regfi_add_message(file, "ERROR: Cell length not a multiple of 8"
     1941      regfi_add_message(file, REGFI_MSG_ERROR, "Cell length not a multiple of 8"
    19211942                        " while parsing class name at offset 0x%.8X.", offset);
    19221943      return NULL;
    … …  
    19251946    if(cell_length > max_size)
    19261947    {
    1927       regfi_add_message(file, "WARN: Cell stretches past hbin boundary"
    1928                         " while parsing class name at offset 0x%.8X.", offset);
     1948      regfi_add_message(file, REGFI_MSG_WARN, "Cell stretches past hbin "
     1949                        "boundary while parsing class name at offset 0x%.8X.",
     1950                        offset);
    19291951      if(strict)
    19301952        return NULL;
    … …  
    19341956    if((cell_length - 4) < *name_length)
    19351957    {
    1936       regfi_add_message(file, "WARN: Class name is larger than cell_length"
    1937                         " while parsing class name at offset 0x%.8X.", offset);
     1958      regfi_add_message(file, REGFI_MSG_WARN, "Class name is larger than"
     1959                        " cell_length while parsing class name at offset"
     1960                        " 0x%.8X.", offset);
    19381961      if(strict)
    19391962        return NULL;
    … …  
    19481971         || length != *name_length)
    19491972      {
    1950         regfi_add_message(file, "ERROR: Could not read class name"
     1973        regfi_add_message(file, REGFI_MSG_ERROR, "Could not read class name"
    19511974                          " while parsing class name at offset 0x%.8X.", offset);
    19521975        free(ret_val);
    … …  
    19751998                       &cell_length, &unalloc))
    19761999  {
    1977     regfi_add_message(file, "ERROR: Could not parse cell header"
     2000    regfi_add_message(file, REGFI_MSG_WARN, "Could not parse cell header"
    19782001                      " while parsing VK record at offset 0x%.8X.", offset);
    19792002    return NULL;
    … …  
    19922015     || ret_val->cell_size != (ret_val->cell_size & 0xFFFFFFF8))
    19932016  {
    1994     regfi_add_message(file, "ERROR: Invalid cell size encountered"
     2017    regfi_add_message(file, REGFI_MSG_WARN, "Invalid cell size encountered"
    19952018                      " while parsing VK record at offset 0x%.8X.", offset);
    19962019    free(ret_val);
    … …  
    20062029     *      0xFFFF.
    20072030     */
    2008     regfi_add_message(file, "ERROR: Magic number mismatch"
     2031    regfi_add_message(file, REGFI_MSG_WARN, "Magic number mismatch"
    20092032                      " while parsing VK record at offset 0x%.8X.", offset);
    20102033    free(ret_val);
    … …  
    20252048    if(ret_val->name_length + REGFI_VK_MIN_LENGTH + 4 > ret_val->cell_size)
    20262049    {
    2027       regfi_add_message(file, "WARN: Name too long for remaining cell space"
    2028                         " while parsing VK record at offset 0x%.8X.", offset);
     2050      regfi_add_message(file, REGFI_MSG_WARN, "Name too long for remaining cell"
     2051                        " space while parsing VK record at offset 0x%.8X.",
     2052                        offset);
    20292053      if(strict)
    20302054      {
    … …  
    20522076       || length != ret_val->name_length)
    20532077    {
    2054       regfi_add_message(file, "ERROR: Could not read value name"
     2078      regfi_add_message(file, REGFI_MSG_ERROR, "Could not read value name"
    20552079                        " while parsing VK record at offset 0x%.8X.", offset);
    20562080      free(ret_val->valuename);
    … …  
    20932117      else
    20942118      {
    2095         regfi_add_message(file, "WARN: Could not find hbin for data"
     2119        regfi_add_message(file, REGFI_MSG_WARN, "Could not find hbin for data"
    20962120                          " while parsing VK record at offset 0x%.8X.", offset);
    20972121        ret_val->data = NULL;
    … …  
    21012125    if(ret_val->data == NULL)
    21022126    {
    2103       regfi_add_message(file, "WARN: Could not parse data record"
     2127      regfi_add_message(file, REGFI_MSG_WARN, "Could not parse data record"
    21042128                        " while parsing VK record at offset 0x%.8X.", offset);
    21052129    }
    … …  
    21242148    if(length > 4)
    21252149    {
    2126       regfi_add_message(file, "ERROR: Data in offset but length > 4"
     2150      regfi_add_message(file, REGFI_MSG_ERROR, "Data in offset but length > 4"
    21272151                        " while parsing data record at offset 0x%.8X.",
    21282152                        offset);
    … …  
    21412165                         &cell_length, &unalloc))
    21422166    {
    2143       regfi_add_message(file, "ERROR: Could not parse cell while"
     2167      regfi_add_message(file, REGFI_MSG_WARN, "Could not parse cell while"
    21442168                        " parsing data record at offset 0x%.8X.", offset);
    21452169      return NULL;
    … …  
    21482172    if((cell_length & 0xFFFFFFF8) != cell_length)
    21492173    {
    2150       regfi_add_message(file, "ERROR: Cell length not multiple of 8"
     2174      regfi_add_message(file, REGFI_MSG_WARN, "Cell length not multiple of 8"
    21512175                        " while parsing data record at offset 0x%.8X.",
    21522176                        offset);
    … …  
    21562180    if(cell_length > max_size)
    21572181    {
    2158       regfi_add_message(file, "WARN: Cell extends past hbin boundary"
     2182      regfi_add_message(file, REGFI_MSG_WARN, "Cell extends past hbin boundary"
    21592183                        " while parsing data record at offset 0x%.8X.",
    21602184                        offset);
    … …  
    21712195       *      such as 53392.
    21722196       */
    2173       regfi_add_message(file, "WARN: Data length (0x%.8X) larger than"
     2197      regfi_add_message(file, REGFI_MSG_WARN, "Data length (0x%.8X) larger than"
    21742198                        " remaining cell length (0x%.8X)"
    21752199                        " while parsing data record at offset 0x%.8X.",
    … …  
    21882212       || read_length != length)
    21892213    {
    2190       regfi_add_message(file, "ERROR: Could not read data block while"
     2214      regfi_add_message(file, REGFI_MSG_ERROR, "Could not read data block while"
    21912215                        " parsing data record at offset 0x%.8X.", offset);
    21922216      free(ret_val);

  • trunk/src/common.c

    r137 r138  
    3838}
    3939
    40 void printMsgs(REGFI_ITERATOR* iter)
    41 {
    42   char* msgs = regfi_get_messages(iter->f);
     40void printMsgs(REGFI_FILE* f)
     41{
     42  char* msgs = regfi_get_messages(f);
    4343  if(msgs != NULL)
    4444  {
    … …  
    4646    free(msgs);
    4747  }
     48}
     49
     50void clearMsgs(REGFI_FILE* f)
     51{
     52  char* msgs = regfi_get_messages(f);
     53  if(msgs != NULL)
     54    free(msgs);
    4855}
    4956

  • trunk/src/reglookup-recover.c

    r136 r138  
    22 * This program attempts to recover deleted data structures in a registry hive.
    33 *
    4  * Copyright (C) 2008 Timothy D. Morgan
     4 * Copyright (C) 2008-2009 Timothy D. Morgan
    55 *
    66 * This program is free software; you can redistribute it and/or modify
    … …  
    8787    quoted_name[0] = '\0';
    8888
    89     fprintf(stderr, "WARNING: NULL key name in NK record at offset %.8X.\n",
     89    fprintf(stderr, "WARN: NULL key name in NK record at offset %.8X.\n",
    9090            nk->offset);
    9191  }
    … …  
    125125  if(size > REGFI_VK_MAX_DATA_LENGTH)
    126126  {
    127     fprintf(stderr, "WARNING: value data size %d larger than "
     127    fprintf(stderr, "WARN: value data size %d larger than "
    128128            "%d, truncating...\n", size, REGFI_VK_MAX_DATA_LENGTH);
    129129    size = REGFI_VK_MAX_DATA_LENGTH;
    … …  
    153153
    154154    if(conv_error == NULL)
    155       fprintf(stderr, "WARNING: Could not quote value for '%s/%s'.  "
     155      fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
    156156              "Memory allocation failure likely.\n", prefix, quoted_name);
    157157    else if(print_verbose)
    158       fprintf(stderr, "WARNING: Could not quote value for '%s/%s'.  "
     158      fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
    159159              "Returned error: %s\n", prefix, quoted_name, conv_error);
    160160  }
    161161  /* XXX: should these always be printed? */
    162162  else if(conv_error != NULL && print_verbose)
    163     fprintf(stderr, "VERBOSE: While quoting value for '%s/%s', "
     163    fprintf(stderr, "INFO: While quoting value for '%s/%s', "
    164164            "warning returned: %s\n", prefix, quoted_name, conv_error);
    165165
    … …  
    279279      cur_ancestor = regfi_parse_nk(f, virt_offset+REGFI_REGF_SIZE,
    280280                                    max_length, true);
     281      printMsgs(f);
     282
    281283      if(cur_ancestor == NULL)
    282284        virt_offset = REGFI_OFFSET_NONE;
    … …  
    426428  for(i=0; i < range_list_size(unalloc_cells); i++)
    427429  {
     430    printMsgs(f);
    428431    cur_elem = range_list_get(unalloc_cells, i);
    429432    for(j=0; cur_elem->length > REGFI_NK_MIN_LENGTH
    … …  
    432435      key = regfi_parse_nk(f, cur_elem->offset+j,
    433436                           cur_elem->length-j, false);
     437      printMsgs(f);
     438
    434439      if(key != NULL)
    435440      {
    … …  
    587592  for(i=0; i < range_list_size(unalloc_cells); i++)
    588593  {
     594    printMsgs(f);
    589595    cur_elem = range_list_get(unalloc_cells, i);
    590596    for(j=0; j <= cur_elem->length; j+=8)
    … …  
    592598      vk = regfi_parse_vk(f, cur_elem->offset+j,
    593599                           cur_elem->length-j, false);
     600      printMsgs(f);
     601
    594602      if(vk != NULL)
    595603      {
    … …  
    654662  for(i=0; i < range_list_size(unalloc_cells); i++)
    655663  {
     664    printMsgs(f);
    656665    cur_elem = range_list_get(unalloc_cells, i);
    657666    for(j=0; j <= cur_elem->length; j+=8)
    … …  
    659668      sk = regfi_parse_sk(f, cur_elem->offset+j,
    660669                          cur_elem->length-j, false);
     670      printMsgs(f);
     671
    661672      if(sk != NULL)
    662673      {
    … …  
    741752    bailOut(EX_NOINPUT, "");
    742753  }
     754  if(print_verbose)
     755    regfi_set_message_mask(f, REGFI_MSG_ERROR|REGFI_MSG_WARN|REGFI_MSG_INFO);
     756  else
     757    regfi_set_message_mask(f, REGFI_MSG_ERROR);
    743758
    744759  if(print_header)

  • trunk/src/reglookup.c

    r137 r138  
    8686  }
    8787
    88   quoted_value = data_to_ascii(vk->data, size, vk->type, &conv_error);
    89   if(quoted_value == NULL)
    90   {
    91     if(conv_error == NULL)
    92       fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
    93               "Memory allocation failure likely.\n", prefix, quoted_name);
    94     else if(print_verbose)
    95       fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
    96               "Returned error: %s\n", prefix, quoted_name, conv_error);
    97   }
    98   else if(conv_error != NULL && print_verbose)
    99     fprintf(stderr, "VERBOSE: While quoting value for '%s/%s', "
    100             "warning returned: %s\n", prefix, quoted_name, conv_error);
     88  if(vk->data == NULL)
     89  {
     90    if(print_verbose)
     91      fprintf(stderr, "INFO: While quoting value for '%s/%s', "
     92              "data pointer was NULL.\n", prefix, quoted_name);
     93  }
     94  else
     95  {
     96    quoted_value = data_to_ascii(vk->data, size, vk->type, &conv_error);
     97    if(quoted_value == NULL)
     98    {
     99      if(conv_error == NULL)
     100        fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
     101                "Memory allocation failure likely.\n", prefix, quoted_name);
     102      else
     103        fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
     104                "Returned error: %s\n", prefix, quoted_name, conv_error);
     105    }
     106    else if(conv_error != NULL && print_verbose)
     107      fprintf(stderr, "INFO: While quoting value for '%s/%s', "
     108              "warning returned: %s\n", prefix, quoted_name, conv_error);
     109  }
    101110
    102111  str_type = regfi_type_val2str(vk->type);
    … …  
    275284      printValue(value, prefix);
    276285    value = regfi_iterator_next_value(iter);
    277     printMsgs(iter);
     286    printMsgs(iter->f);
    278287  }
    279288}
    … …  
    333342      {
    334343        if(print_verbose)
    335           fprintf(stderr, "WARN: While converting classname"
     344          fprintf(stderr, "INFO: While converting classname"
    336345                  " for key '%s': %s.\n", full_path, error_msg);
    337346        free(error_msg);
    … …  
    341350      quoted_classname = empty_str;
    342351
    343     printMsgs(iter);
     352    printMsgs(iter->f);
    344353    printf("%s,KEY,,%s,%s,%s,%s,%s,%s\n", full_path, mtime,
    345354           owner, group, sacl, dacl, quoted_classname);
    … …  
    372381  root = cur = regfi_iterator_cur_key(iter);
    373382  sub = regfi_iterator_first_subkey(iter);
    374   printMsgs(iter);
     383  printMsgs(iter->f);
    375384
    376385  if(root == NULL)
    … …  
    400409        if(!regfi_iterator_up(iter))
    401410        {
    402           printMsgs(iter);
     411          printMsgs(iter->f);
    403412          bailOut(EX_DATAERR, "ERROR: could not traverse iterator upward.\n");
    404413        }
    … …  
    407416        if(cur == NULL)
    408417        {
    409           printMsgs(iter);
     418          printMsgs(iter->f);
    410419          bailOut(EX_DATAERR, "ERROR: unexpected NULL for key.\n");
    411420        }
    … …  
    421430      if(!regfi_iterator_down(iter))
    422431      {
    423         printMsgs(iter);
     432        printMsgs(iter->f);
    424433        bailOut(EX_DATAERR, "ERROR: could not traverse iterator downward.\n");
    425434      }
    … …  
    429438      print_this = true;
    430439    }
    431     printMsgs(iter);
     440    printMsgs(iter->f);
    432441  } while(!((cur == root) && (sub == NULL)));
    433442
    434443  if(print_verbose)
    435     fprintf(stderr, "VERBOSE: Finished printing key tree.\n");
     444    fprintf(stderr, "INFO: Finished printing key tree.\n");
    436445}
    437446
    … …  
    467476
    468477  if(print_verbose)
    469     fprintf(stderr, "VERBOSE: Attempting to retrieve specified path: %s\n",
     478    fprintf(stderr, "INFO: Attempting to retrieve specified path: %s\n",
    470479            path_filter);
    471480
    … …  
    474483  {
    475484    if(print_verbose)
    476       fprintf(stderr, "VERBOSE: Found final path element as root key.\n");
     485      fprintf(stderr, "INFO: Found final path element as root key.\n");
    477486    free(tmp_path);
    478487    return 2;
    … …  
    481490  if(!regfi_iterator_walk_path(iter, tmp_path))
    482491  {
    483     printMsgs(iter);
     492    printMsgs(iter->f);
    484493    free(tmp_path);
    485494    return 0;
    … …  
    489498  {
    490499    if(print_verbose)
    491       fprintf(stderr, "VERBOSE: Found final path element as value.\n");
     500      fprintf(stderr, "INFO: Found final path element as value.\n");
    492501
    493502    value = regfi_iterator_cur_value(iter);
    494     printMsgs(iter);
     503    printMsgs(iter->f);
    495504    tmp_path_joined = iter2Path(iter);
    496505
    … …  
    507516  else if(regfi_iterator_find_subkey(iter, path[i]))
    508517  {
    509     printMsgs(iter);
     518    printMsgs(iter->f);
    510519    if(print_verbose)
    511       fprintf(stderr, "VERBOSE: Found final path element as key.\n");
     520      fprintf(stderr, "INFO: Found final path element as key.\n");
    512521
    513522    if(!regfi_iterator_down(iter))
    514523    {
    515       printMsgs(iter);
     524      printMsgs(iter->f);
    516525      bailOut(EX_DATAERR, "ERROR: Unexpected error on traversing path filter key.\n");
    517526    }
    … …  
    519528    return 2;
    520529  }
    521   printMsgs(iter);
     530  printMsgs(iter->f);
    522531
    523532  if(print_verbose)
    524     fprintf(stderr, "VERBOSE: Could not find last element of path.\n");
     533    fprintf(stderr, "INFO: Could not find last element of path.\n");
    525534
    526535  return 0;
    … …  
    616625  }
    617626
     627  if(print_verbose)
     628    regfi_set_message_mask(f, REGFI_MSG_INFO|REGFI_MSG_WARN|REGFI_MSG_ERROR);
     629
    618630  iter = regfi_iterator_new(f);
    619631  if(iter == NULL)
    … …  
    634646  {
    635647    retr_path_ret = retrievePath(iter, path);
    636     printMsgs(iter);
     648    printMsgs(iter->f);
    637649    freePath(path);
    638650
Note: See TracChangeset for help on using the changeset viewer.