Changeset 162

Timestamp:

12/07/09 15:12:13 (14 years ago)

Author:

tim

Message:

added UTF-16LE support for value names

Location:

trunk

Files:

• include/regfi.h (modified) (3 diffs)
• lib/regfi.c (modified) (8 diffs)
• src/reglookup.c (modified) (1 diff)

trunk/include/regfi.h

@@ -137 +137 @@
 
 /* Flags for the vk records */
-/* XXX: This next flag may be incorrect.  According to Jeffrey Muir,
-*       this may actually indicate that the value name is stored in
-*       UTF-16LE.
-*/
-#define REGFI_VK_FLAG_NAME_PRESENT 0x0001
+#define REGFI_VK_FLAG_ASCIINAME    0x0001
 #define REGFI_VK_DATA_IN_OFFSET    0x80000000
 #define REGFI_VK_MAX_DATA_LENGTH   1024*1024  /* XXX: This is arbitrary */
@@ -331 +327 @@
   uint32 type;
   uint8  magic[REGFI_CELL_MAGIC_SIZE];
-  uint16 flag;
+  uint16 flags;
   uint16 unknown1;
   bool data_in_offset;
@@ -591 +587 @@
                                      bool strict);
 REGFI_VK_REC*         regfi_load_value(REGFI_FILE* file, uint32 offset, 
+                                       REGFI_ENCODING output_encoding, 
                                        bool strict);
 REGFI_SUBKEY_LIST*    regfi_load_subkeylist(REGFI_FILE* file, uint32 offset,

trunk/lib/regfi.c

@@ -973 +973 @@
 /******************************************************************************
  ******************************************************************************/
-REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32 offset, bool strict)
+REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32 offset, 
+                               REGFI_ENCODING output_encoding, bool strict)
 {
   REGFI_VK_REC* ret_val = NULL;
-  int32 max_size;
+  int32 max_size, tmp_size;
+  REGFI_ENCODING from_encoding;
 
   max_size = regfi_calc_maxsize(file, offset);
@@ -986 +988 @@
     return NULL;
 
-  /* XXX: convert valuename to proper encoding if necessary */
+  from_encoding = (ret_val->flags & REGFI_VK_FLAG_ASCIINAME)
+    ? REGFI_ENCODING_ASCII : REGFI_ENCODING_UTF16LE;
+
+  if(from_encoding == output_encoding)
+  {
+    ret_val->valuename_raw = talloc_realloc(ret_val, ret_val->valuename_raw,
+                                            uint8, ret_val->name_length+1);
+    ret_val->valuename_raw[ret_val->name_length] = '\0';
+    ret_val->valuename = (char*)ret_val->valuename_raw;
+  }
+  else
+  {
+    ret_val->valuename = talloc_array(ret_val, char, ret_val->name_length+1);
+    if(ret_val->valuename == NULL)
+    {
+      regfi_free_value(ret_val);
+      return NULL;
+    }
+
+    tmp_size = regfi_conv_charset(regfi_encoding_int2str(from_encoding),
+                                  regfi_encoding_int2str(output_encoding),
+                                  ret_val->valuename_raw, ret_val->valuename,
+                                  ret_val->name_length, ret_val->name_length+1);
+    if(tmp_size < 0)
+    {
+      regfi_add_message(file, REGFI_MSG_WARN, "Error occurred while converting"
+                        " valuename to encoding %s.  Error message: %s",
+                        regfi_encoding_int2str(output_encoding), 
+                        strerror(-tmp_size));
+      talloc_free(ret_val->valuename);
+      ret_val->valuename = NULL;
+    }
+  }
 
   return ret_val;
@@ -1685 +1719 @@
     {
       voffset = i->cur_key->values->elements[i->cur_value];
-      ret_val = regfi_load_value(i->f, voffset+REGFI_REGF_SIZE, true);
+      ret_val = regfi_load_value(i->f, voffset+REGFI_REGF_SIZE, 
+                                 i->string_encoding, true);
     }
   }
@@ -2467 +2502 @@
   ret_val->data = NULL;
   ret_val->valuename = NULL;
+  ret_val->valuename_raw = NULL;
   
   if(ret_val->cell_size > max_size)
@@ -2502 +2538 @@
   ret_val->data_off = IVAL(vk_header, 0x8);
   ret_val->type = IVAL(vk_header, 0xC);
-  ret_val->flag = SVAL(vk_header, 0x10);
+  ret_val->flags = SVAL(vk_header, 0x10);
   ret_val->unknown1 = SVAL(vk_header, 0x12);
 
-  if(ret_val->flag & REGFI_VK_FLAG_NAME_PRESENT)
+  if(ret_val->name_length > 0)
   {
     if(ret_val->name_length + REGFI_VK_MIN_LENGTH + 4 > ret_val->cell_size)
@@ -2526 +2562 @@
       cell_length+=8;
 
-    ret_val->valuename = talloc_array(ret_val, char, ret_val->name_length+1);
-    if(ret_val->valuename == NULL)
+    ret_val->valuename_raw = talloc_array(ret_val, uint8, ret_val->name_length);
+    if(ret_val->valuename_raw == NULL)
     {
       talloc_free(ret_val);
@@ -2534 +2570 @@
 
     length = ret_val->name_length;
-    if((regfi_read(file->fd, (uint8*)ret_val->valuename, &length) != 0)
+    if((regfi_read(file->fd, (uint8*)ret_val->valuename_raw, &length) != 0)
        || length != ret_val->name_length)
     {
@@ -2542 +2578 @@
       return NULL;
     }
-    ret_val->valuename[ret_val->name_length] = '\0';
-
   }
   else

trunk/src/reglookup.c

@@ -58 +58 @@
   const char* str_type = NULL;
 
-  quoted_name = quote_string(vk->valuename, key_special_chars);
+  if(vk->valuename == NULL)
+    quoted_name = quote_buffer(vk->valuename_raw, vk->name_length, 
+                               key_special_chars);
+  else
+    quoted_name = quote_string(vk->valuename, key_special_chars);
   if (quoted_name == NULL)
   { /* Value names are NULL when we're looking at the "(default)" value.