Changeset 172 for trunk


Ignore:
Timestamp:
03/07/10 22:04:34 (15 years ago)
Author:
tim
Message:

reorganized name interpretation code to correct issues in reglookup-recover

Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/regfi.h

    r169 r172  
    14421442
    14431443
     1444void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK_REC* nk,
     1445                             REGFI_ENCODING output_encoding, bool strict);
     1446void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK_REC* vk,
     1447                               REGFI_ENCODING output_encoding, bool strict);
     1448
     1449
    14441450#endif  /* _REGFI_H */

  • trunk/lib/regfi.c

    r169 r172  
    978978
    979979
    980 
    981 /******************************************************************************
    982  ******************************************************************************/
    983 REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32_t offset,
     980void regfi_interpret_valuename(REGFI_FILE* file, REGFI_VK_REC* vk,
    984981                               REGFI_ENCODING output_encoding, bool strict)
    985982{
    986   REGFI_VK_REC* ret_val = NULL;
    987   int32_t max_size, tmp_size;
    988   REGFI_ENCODING from_encoding;
    989 
    990   max_size = regfi_calc_maxsize(file, offset);
    991   if(max_size < 0)
    992     return NULL;
    993  
    994   ret_val = regfi_parse_vk(file, offset, max_size, strict);
    995   if(ret_val == NULL)
    996     return NULL;
    997 
    998983  /* XXX: Registry value names are supposedly limited to 16383 characters
    999984   *      according to:
    … …  
    1004989   *      when recovering deleted VK records.
    1005990   */
    1006 
    1007   from_encoding = (ret_val->flags & REGFI_VK_FLAG_ASCIINAME)
     991  int32_t tmp_size;
     992  REGFI_ENCODING from_encoding = (vk->flags & REGFI_VK_FLAG_ASCIINAME)
    1008993    ? REGFI_ENCODING_ASCII : REGFI_ENCODING_UTF16LE;
    1009994
    1010995  if(from_encoding == output_encoding)
    1011996  {
    1012     ret_val->valuename_raw = talloc_realloc(ret_val, ret_val->valuename_raw,
    1013                                             uint8_t, ret_val->name_length+1);
    1014     ret_val->valuename_raw[ret_val->name_length] = '\0';
    1015     ret_val->valuename = (char*)ret_val->valuename_raw;
     997    vk->valuename_raw = talloc_realloc(vk, vk->valuename_raw,
     998                                            uint8_t, vk->name_length+1);
     999    vk->valuename_raw[vk->name_length] = '\0';
     1000    vk->valuename = (char*)vk->valuename_raw;
    10161001  }
    10171002  else
    10181003  {
    1019     ret_val->valuename = talloc_array(ret_val, char, ret_val->name_length+1);
    1020     if(ret_val->valuename == NULL)
    1021     {
    1022       regfi_free_value(ret_val);
    1023       return NULL;
     1004    vk->valuename = talloc_array(vk, char, vk->name_length+1);
     1005    if(vk->valuename == NULL)
     1006    {
     1007      regfi_free_value(vk);
     1008      return;
    10241009    }
    10251010
    10261011    tmp_size = regfi_conv_charset(regfi_encoding_int2str(from_encoding),
    10271012                                  regfi_encoding_int2str(output_encoding),
    1028                                   ret_val->valuename_raw, ret_val->valuename,
    1029                                   ret_val->name_length, ret_val->name_length+1);
     1013                                  vk->valuename_raw, vk->valuename,
     1014                                  vk->name_length, vk->name_length+1);
    10301015    if(tmp_size < 0)
    10311016    {
    … …  
    10341019                        regfi_encoding_int2str(output_encoding),
    10351020                        strerror(-tmp_size));
    1036       talloc_free(ret_val->valuename);
    1037       ret_val->valuename = NULL;
    1038     }
    1039   }
     1021      talloc_free(vk->valuename);
     1022      vk->valuename = NULL;
     1023    }
     1024  }
     1025}
     1026
     1027
     1028/******************************************************************************
     1029 ******************************************************************************/
     1030REGFI_VK_REC* regfi_load_value(REGFI_FILE* file, uint32_t offset,
     1031                               REGFI_ENCODING output_encoding, bool strict)
     1032{
     1033  REGFI_VK_REC* ret_val = NULL;
     1034  int32_t max_size;
     1035
     1036  max_size = regfi_calc_maxsize(file, offset);
     1037  if(max_size < 0)
     1038    return NULL;
     1039 
     1040  ret_val = regfi_parse_vk(file, offset, max_size, strict);
     1041  if(ret_val == NULL)
     1042    return NULL;
     1043
     1044  regfi_interpret_valuename(file, ret_val, output_encoding, strict);
    10401045
    10411046  return ret_val;
    … …  
    10691074
    10701075
    1071 
    1072 /******************************************************************************
    1073  *
    1074  ******************************************************************************/
    1075 REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32_t offset,
     1076void regfi_interpret_keyname(REGFI_FILE* file, REGFI_NK_REC* nk,
    10761077                             REGFI_ENCODING output_encoding, bool strict)
    10771078{
    1078   REGFI_NK_REC* nk;
    1079   uint32_t off;
    1080   int32_t max_size, tmp_size;
    1081   REGFI_ENCODING from_encoding;
    1082 
    1083   max_size = regfi_calc_maxsize(file, offset);
    1084   if (max_size < 0)
    1085     return NULL;
    1086 
    1087   /* get the initial nk record */
    1088   if((nk = regfi_parse_nk(file, offset, max_size, true)) == NULL)
    1089   {
    1090     regfi_add_message(file, REGFI_MSG_ERROR, "Could not load NK record at"
    1091                       " offset 0x%.8X.", offset);
    1092     return NULL;
    1093   }
    1094 
    10951079  /* XXX: Registry key names are supposedly limited to 255 characters according to:
    10961080   *      http://msdn.microsoft.com/en-us/library/ms724872%28VS.85%29.aspx
    … …  
    11001084   *      when recovering deleted NK records.
    11011085   */
    1102   from_encoding = (nk->flags & REGFI_NK_FLAG_ASCIINAME)
     1086  int32_t tmp_size;
     1087  REGFI_ENCODING from_encoding = (nk->flags & REGFI_NK_FLAG_ASCIINAME)
    11031088    ? REGFI_ENCODING_ASCII : REGFI_ENCODING_UTF16LE;
    1104 
     1089 
    11051090  if(from_encoding == output_encoding)
    11061091  {
    … …  
    11151100    {
    11161101      regfi_free_key(nk);
    1117       return NULL;
     1102      return;
    11181103    }
    11191104
    … …  
    11321117    }
    11331118  }
    1134 
     1119}
     1120
     1121
     1122/******************************************************************************
     1123 *
     1124 ******************************************************************************/
     1125REGFI_NK_REC* regfi_load_key(REGFI_FILE* file, uint32_t offset,
     1126                             REGFI_ENCODING output_encoding, bool strict)
     1127{
     1128  REGFI_NK_REC* nk;
     1129  uint32_t off;
     1130  int32_t max_size;
     1131
     1132  max_size = regfi_calc_maxsize(file, offset);
     1133  if (max_size < 0)
     1134    return NULL;
     1135
     1136  /* get the initial nk record */
     1137  if((nk = regfi_parse_nk(file, offset, max_size, true)) == NULL)
     1138  {
     1139    regfi_add_message(file, REGFI_MSG_ERROR, "Could not load NK record at"
     1140                      " offset 0x%.8X.", offset);
     1141    return NULL;
     1142  }
     1143
     1144  regfi_interpret_keyname(file, nk, output_encoding, strict);
    11351145
    11361146  /* get value list */

  • trunk/src/common.c

    r171 r172  
    310310  return NULL;
    311311}
     312
     313
     314static char* get_quoted_keyname(const REGFI_NK_REC* nk)
     315{
     316  char* ret_val;
     317
     318  if(nk->keyname == NULL)
     319    ret_val = quote_buffer(nk->keyname_raw, nk->name_length, key_special_chars);
     320  else
     321    ret_val = quote_string(nk->keyname, key_special_chars);
     322
     323  return ret_val;
     324}
     325
     326
     327static char* get_quoted_valuename(const REGFI_VK_REC* vk)
     328{
     329  char* ret_val;
     330
     331  if(vk->valuename == NULL)
     332    ret_val = quote_buffer(vk->valuename_raw, vk->name_length,
     333                           key_special_chars);
     334  else
     335    ret_val = quote_string(vk->valuename, key_special_chars);
     336
     337  return ret_val;
     338}

  • trunk/src/reglookup-recover.c

    r168 r172  
    7979  strftime(mtime, sizeof(mtime), "%Y-%m-%d %H:%M:%S", tmp_time_s);
    8080
    81   quoted_name = quote_string(nk->keyname, key_special_chars);
     81  /* XXX: Add command line option to choose output encoding */
     82  regfi_interpret_keyname(f, nk, REGFI_ENCODING_ASCII, true);
     83
     84  quoted_name = get_quoted_keyname(nk);
    8285  if (quoted_name == NULL)
    8386  {
    … …  
    104107
    105108
    106 void printValue(REGFI_FILE* f, const REGFI_VK_REC* vk, const char* prefix)
     109void printValue(REGFI_FILE* f, REGFI_VK_REC* vk, const char* prefix)
    107110{
    108111  char* quoted_value = NULL;
    … …  
    112115  const char* str_type = NULL;
    113116
    114   quoted_name = quote_string(vk->valuename, key_special_chars);
     117  /* XXX: Add command line option to choose output encoding */
     118  regfi_interpret_valuename(f, vk, REGFI_ENCODING_ASCII, true);
     119 
     120  quoted_name = get_quoted_valuename(vk);
    115121  if (quoted_name == NULL)
    116122  { /* Value names are NULL when we're looking at the "(default)" value.
    … …  
    120126     * this value.
    121127     */
    122     quoted_name = malloc(1*sizeof(char));
     128    quoted_name = strdup("");
    123129    if(quoted_name == NULL)
    124130      bailOut(REGLOOKUP_EXIT_OSERR, "ERROR: Could not allocate sufficient memory.\n");
    125     quoted_name[0] = '\0';
    126   }
     131  }
     132
    127133  /* XXX: Add command line option to choose output encoding */
    128134  if(vk->data != NULL
    … …  
    278284        path_element = talloc(path_stack, REGFI_BUFFER);
    279285        if(path_element != NULL)
    280           path_element->buf = (uint8_t*)quote_string(cur_ancestor->keyname,
    281                                                    key_special_chars);
     286        {
     287          /* XXX: Add command line option to choose output encoding */
     288          regfi_interpret_keyname(f, cur_ancestor, REGFI_ENCODING_ASCII, true);
    282289         
     290          path_element->buf = (uint8_t*)get_quoted_keyname(cur_ancestor);
     291        }
     292 
    283293        if(path_element == NULL || path_element->buf == NULL
    284294           || !void_stack_push(path_stack, path_element))
    … …  
    929939    if(tmp_key->num_values > 0 && tmp_key->values != NULL)
    930940    {
    931       tmp_name = quote_string(tmp_key->keyname, key_special_chars);
     941      /* XXX: Add command line option to choose output encoding */
     942      regfi_interpret_keyname(f, tmp_key, REGFI_ENCODING_ASCII, true);
     943
     944      tmp_name = get_quoted_keyname(tmp_key);
    932945      tmp_path = (char*)malloc(strlen(parent_paths[i])+strlen(tmp_name)+2);
    933946      if(tmp_path == NULL)

  • trunk/src/reglookup.c

    r170 r172  
    6363  struct tm* tmp_time_s = NULL;
    6464
    65   if(vk->valuename == NULL)
    66     quoted_name = quote_buffer(vk->valuename_raw, vk->name_length,
    67                                key_special_chars);
    68   else
    69     quoted_name = quote_string(vk->valuename, key_special_chars);
     65  quoted_name = get_quoted_valuename(vk);
    7066  if (quoted_name == NULL)
    7167  { /* Value names are NULL when we're looking at the "(default)" value.
    … …  
    248244      tmp_key = cur->nk;
    249245
    250     if(tmp_key->keyname == NULL)
    251       name = quote_buffer(i->cur_key->keyname_raw, i->cur_key->name_length,
    252                           key_special_chars);
    253     else
    254       name = quote_string(tmp_key->keyname, key_special_chars);
     246    name = get_quoted_keyname(tmp_key);
    255247
    256248    buf[buf_len-buf_left-1] = '/';
Note: See TracChangeset for help on using the changeset viewer.