Changeset 268 for trunk

Timestamp:

07/10/11 14:09:35 (13 years ago)

Author:

tim

Message:

fixed some problems interpreting key/value names

Location:

trunk

Files:

• lib/regfi.c (modified) (1 diff)
• python/pyregfi/__init__.py (modified) (5 diffs)
• python/pyregfi/structures.py (modified) (1 diff)

trunk/lib/regfi.c

@@ -47 +47 @@
 
 const char* regfi_encoding_names[] =
-  {"US-ASCII//TRANSLIT", "UTF-8//TRANSLIT", "UTF-16LE//TRANSLIT"};
+  {"US-ASCII", "UTF-8", "UTF-16LE"};
 
 

trunk/python/pyregfi/__init__.py

@@ -514 +514 @@
     name = "..."
     
+    ## The string encoding used to store the Key's name ("ascii" or "utf-16-le")
+    name_encoding = "ascii"
+
     ## The absolute file offset of the Key record's cell in the Hive file
     offset = 0xCAFEBABE
@@ -535 +538 @@
             if not ret_val:
                 ret_val = self.name_raw
+                if ret_val != None:
+                    ret_val = ret_val.decode(self.name_encoding, 'replace')
             else:
                 ret_val = ret_val.decode('utf-8', 'replace')
                 
+        elif name == "name_encoding":
+            flags = super(Key, self).__getattr__("flags")
+            if (flags & structures.REGFI_NK_FLAG_ASCIINAME) > 0:
+                ret_val = "ascii"
+            ret_val = "utf-16-le"
+
         elif name == "name_raw":
             ret_val = super(Key, self).__getattr__(name)
             length = super(Key, self).__getattr__('name_length')
             ret_val = _buffer2bytearray(ret_val, length)
-        
+
         elif name == "modified":
             ret_val = regfi.regfi_nt2unix_time(self._base.contents.mtime)
@@ -617 +628 @@
     name = "..."
     
+    ## The string encoding used to store the Value's name ("ascii" or "utf-16-le")
+    name_encoding = "ascii"
+
     ## The absolute file offset of the Value record's cell in the Hive file
     offset = 0xCAFEBABE
@@ -702 +716 @@
             if not ret_val:
                 ret_val = self.name_raw
+                if ret_val != None:
+                    ret_val = ret_val.decode(self.name_encoding, 'replace')
             else:
                 ret_val = ret_val.decode('utf-8', 'replace')
+
+        elif name == "name_encoding":
+            flags = super(Key, self).__getattr__("flags")
+            if (flags & structures.REGFI_VK_FLAG_ASCIINAME) > 0:
+                ret_val = "ascii"
+            ret_val = "utf-16-le"
 
         elif name == "name_raw":
@@ -1106 +1128 @@
     def current_path(self):
         ancestry = self.ancestry()
-        return [str(a.name) for a in ancestry]
+        return [a.name for a in ancestry]
 
 
 # Freeing symbols defined for the sake of documentation
-del Value.name,Value.name_raw,Value.offset,Value.data_size,Value.type,Value.flags
-del Key.name,Key.name_raw,Key.offset,Key.modified,Key.flags
+del Value.name,Value.name_encoding,Value.name_raw,Value.offset,Value.data_size,Value.type,Value.flags
+del Key.name,Key.name_encoding,Key.name_raw,Key.offset,Key.modified,Key.flags
 del Hive.root,Hive.modified,Hive.sequence1,Hive.sequence2,Hive.major_version,Hive.minor_version
 del Security.ref_count,Security.offset,Security.descriptor

trunk/python/pyregfi/structures.py

@@ -35 +35 @@
 REGFI_ENCODING = c_uint32
 REGFI_ENCODING_UTF8 = REGFI_ENCODING(1)
+
+REGFI_NK_FLAG_ASCIINAME = 0x0020
+REGFI_VK_FLAG_ASCIINAME = 0x0001
 
 REGFI_DATA_TYPE = c_uint32