Changeset 159 for trunk/src/reglookup-recover.c

Timestamp:

12/06/09 15:09:01 (14 years ago)

Author:

tim

Message:

began rearranging data parsing. Moved charater set conversion and basic parsing logic into regfi

File:

• trunk/src/reglookup-recover.c (modified) (4 diffs)

trunk/src/reglookup-recover.c

@@ -111 +111 @@
   char* conv_error = NULL;
   const char* str_type = NULL;
-  uint32 size = vk->data_size;
-
-  /* Microsoft's documentation indicates that "available memory" is 
-   * the limit on value sizes.  Annoying.  We limit it to 1M which 
-   * should rarely be exceeded, unless the file is corrupt or 
-   * malicious. For more info, see:
-   *   http://msdn2.microsoft.com/en-us/library/ms724872.aspx
-   */
-  /* XXX: Should probably do something different here for this tool.
-   *      Also, It would be really nice if this message somehow included the
-   *      name of the current value we're having trouble with, since
-   *      stderr/stdout don't always sync nicely.
-   */
-  if(size > REGFI_VK_MAX_DATA_LENGTH)
-  {
-    fprintf(stderr, "WARN: value data size %d larger than "
-            "%d, truncating...\n", size, REGFI_VK_MAX_DATA_LENGTH);
-    size = REGFI_VK_MAX_DATA_LENGTH;
-  }
-  
+
   quoted_name = quote_string(vk->valuename, key_special_chars);
   if (quoted_name == NULL)
@@ -144 +125 @@
     quoted_name[0] = '\0';
   }
-
-  quoted_value = data_to_ascii(vk->data, size, vk->type, &conv_error);
+  /* XXX: Add command line option to choose output encoding */
+  if(vk->data != NULL 
+     && !regfi_interpret_data(f, "US-ASCII//TRANSLIT", vk->type, vk->data))
+  {
+    fprintf(stderr, "WARN: Error occurred while interpreting data for VK record"
+            " at offset 0x%.8X.\n", vk->offset);
+  }
+  printMsgs(f);
+
+  quoted_value = data_to_ascii(vk->data, &conv_error);
   if(quoted_value == NULL)
   {
@@ -469 +458 @@
     return 10;
 
+  data.buf = NULL;
+  data.len = 0;
   for(i=0; i<range_list_size(unalloc_values); i++)
   {
@@ -571 +562 @@
           }
         }
-
-        vk->data = data.buf;
-        vk->data_size = data.len;
+        /* XXX: Need to come up with a different way to link these so the
+         *      vk->data item can be removed from the structure.
+         */
+        vk->data = regfi_buffer_to_data(data);
+        talloc_steal(vk, vk->data);
       }
     }