Changeset 170 for trunk/src/reglookup.c

Timestamp:

03/05/10 23:40:25 (14 years ago)

Author:

tim

Message:

merged Tobias Mueller's patch with some changes
updated version number

File:

• trunk/src/reglookup.c (modified) (6 diffs)

trunk/src/reglookup.c

@@ -2 +2 @@
  * A utility to read a Windows NT and later registry files.
  *
- * Copyright (C) 2005-2009 Timothy D. Morgan
+ * Copyright (C) 2005-2010 Timothy D. Morgan
+ * Copyright (C) 2010 Tobias Mueller (portions of '-i' code)
  * Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
  *
@@ -31 +32 @@
 
 /* Globals, influenced by command line parameters */
+bool print_value_mtime = false;
 bool print_verbose = false;
 bool print_security = false;
@@ -57 +59 @@
   char* conv_error = NULL;
   const char* str_type = NULL;
+  char mtime[20];
+  time_t tmp_time[1];
+  struct tm* tmp_time_s = NULL;
 
   if(vk->valuename == NULL)
@@ -97 +102 @@
   }
 
+  if(print_value_mtime)
+  {
+    *tmp_time = regfi_nt2unix_time(&iter->cur_key->mtime);
+    tmp_time_s = gmtime(tmp_time);
+    strftime(mtime, sizeof(mtime), "%Y-%m-%d %H:%M:%S", tmp_time_s);
+  }
+  else
+    mtime[0] = '\0';
+
   str_type = regfi_type_val2str(vk->type);
   if(print_security)
   {
     if(str_type == NULL)
-      printf("%s/%s,0x%.8X,%s,,,,,\n", prefix, quoted_name,
-             vk->type, quoted_value);
-    else
-      printf("%s/%s,%s,%s,,,,,\n", prefix, quoted_name,
-             str_type, quoted_value);
+      printf("%s/%s,0x%.8X,%s,%s,,,,\n", prefix, quoted_name,
+             vk->type, quoted_value, mtime);
+    else
+      printf("%s/%s,%s,%s,%s,,,,\n", prefix, quoted_name,
+             str_type, quoted_value, mtime);
   }
   else
   {
     if(str_type == NULL)
-      printf("%s/%s,0x%.8X,%s,\n", prefix, quoted_name,
-             vk->type, quoted_value);
-    else
-      printf("%s/%s,%s,%s,\n", prefix, quoted_name,
-             str_type, quoted_value);
+      printf("%s/%s,0x%.8X,%s,%s\n", prefix, quoted_name,
+             vk->type, quoted_value, mtime);
+    else
+      printf("%s/%s,%s,%s,%s\n", prefix, quoted_name,
+             str_type, quoted_value, mtime);
   }
 
@@ -548 +562 @@
   fprintf(stderr, "\t-p\t restrict output to elements below this path.\n");
   fprintf(stderr, "\t-t\t restrict results to this specific data type.\n");
+  fprintf(stderr, "\t-i\t includes parent key modification times with child values.\n");
   fprintf(stderr, "\n");
 }
@@ -605 +620 @@
     else if (strcmp("-v", argv[argi]) == 0)
       print_verbose = true;
+    else if (strcmp("-i", argv[argi]) == 0)
+      print_value_mtime = true;
     else
     {