Index: /trunk/doc/devel/references.txt
===================================================================
--- /trunk/doc/devel/references.txt	(revision 76)
+++ /trunk/doc/devel/references.txt	(revision 77)
@@ -8,4 +8,7 @@
   http://www.microsoft.com/technet/archive/winntas/tips/winntmag/inreg.mspx
 
+- Registry key, value, and depth limits:
+  http://msdn2.microsoft.com/en-us/library/ms724872.aspx
+
 - Misc references for windows registry permissions and ownership:
   http://msdn2.microsoft.com/en-gb/library/ms724878.aspx
@@ -16,2 +19,5 @@
   http://support.microsoft.com/kb/220167
   http://msdn2.microsoft.com/en-us/library/aa772242.aspx
+
+- Info on SAM hive, syskey, and hash extraction (with tools bkhive and samdump2):
+  http://www.studenti.unina.it/~ncuomo/syskey/
Index: /trunk/include/regfio.h
===================================================================
--- /trunk/include/regfio.h	(revision 76)
+++ /trunk/include/regfio.h	(revision 77)
@@ -86,4 +86,5 @@
 #define VK_FLAG_NAME_PRESENT	0x0001
 #define VK_DATA_IN_OFFSET	0x80000000
+#define VK_MAX_DATA_LENGTH      1024*1024
 
 /* NK record macros */
Index: /trunk/lib/regfio.c
===================================================================
--- /trunk/lib/regfio.c	(revision 76)
+++ /trunk/lib/regfio.c	(revision 77)
@@ -1085,4 +1085,5 @@
 
   data_size = ((start_off - end_off ) & 0xfffffff8 );
+  /* XXX: should probably print a warning here */
   /*if ( data_size !=  vk->rec_size )
     DEBUG(10,("prs_vk_rec: data_size check failed (0x%x < 0x%x)\n", data_size, vk->rec_size));*/
Index: /trunk/src/reglookup.c
===================================================================
--- /trunk/src/reglookup.c	(revision 76)
+++ /trunk/src/reglookup.c	(revision 77)
@@ -179,5 +179,5 @@
  * value, and a non-NULL (*error_msg).
  */
-static char* data_to_ascii(unsigned char *datap, int len, int type, 
+static char* data_to_ascii(unsigned char *datap, uint32 len, uint32 type, 
 			   char** error_msg)
 {
@@ -189,8 +189,8 @@
   char* tmp_err;
   const char* str_type;
-  unsigned int i;
-  unsigned int cur_str_len;
-  unsigned int ascii_max, cur_str_max;
-  unsigned int str_rem, cur_str_rem, alen;
+  uint32 i;
+  uint32 cur_str_len;
+  uint32 ascii_max, cur_str_max;
+  uint32 str_rem, cur_str_rem, alen;
   int ret_err;
   unsigned short num_nulls;
@@ -365,4 +365,7 @@
 
   /* XXX: Dont know what to do with these yet, just print as binary... */
+  default:
+    fprintf(stderr, "WARNING: Unrecognized registry data type (0x%.8X); quoting as binary.\n", type);
+    
   case REG_NONE:
   case REG_RESOURCE_LIST:
@@ -374,10 +377,4 @@
     break;
   }
-
-
-  /* Invalid type */
-  *error_msg = (char*)malloc(33+11+1);
-  if(*error_msg != NULL)
-    sprintf(*error_msg, "Unrecognized registry data type: %d", type);
 
   return NULL;
@@ -483,9 +480,10 @@
 void printValue(REGF_VK_REC* vk, char* prefix)
 {
-  uint32 size;
-  uint8 tmp_buf[4];
   char* quoted_value = NULL;
   char* quoted_name = NULL;
   char* conv_error = NULL;
+  const char* str_type = NULL;
+  uint32 size;
+  uint8 tmp_buf[4];
 
   /* Thanks Microsoft for making this process so straight-forward!!! */
@@ -498,4 +496,7 @@
     tmp_buf[3] = (uint8)(vk->data_off & 0xFF);
     if(size > 4)
+      /* XXX: should we kick out a warning here?  If it is in the 
+       *      offset and longer than four, file could be corrupt 
+       *      or malicious... */
       size = 4;
     quoted_value = data_to_ascii(tmp_buf, 4, vk->type, &conv_error);
@@ -503,13 +504,15 @@
   else
   {
-    /* XXX: This is a safety hack.  No data fields have yet been found
-     * larger, but length limits are probably better got from fields
-     * in the registry itself, within reason.
+    /* Microsoft's documentation indicates that "available memory" is 
+     * the limit on value sizes.  Annoying.  We limit it to 1M which 
+     * should rarely be exceeded, unless the file is corrupt or 
+     * malicious. For more info, see:
+     *   http://msdn2.microsoft.com/en-us/library/ms724872.aspx
      */
-    if(size > 16384)
-    {
-      fprintf(stderr, "WARNING: key size %d larger than "
-	      "16384, truncating...\n", size);
-      size = 16384;
+    if(size > VK_MAX_DATA_LENGTH)
+    {
+      fprintf(stderr, "WARNING: value data size %d larger than "
+	      "%d, truncating...\n", size, VK_MAX_DATA_LENGTH);
+      size = VK_MAX_DATA_LENGTH;
     }
 
@@ -538,11 +541,24 @@
 	      "warning returned: %s\n", prefix, quoted_name, conv_error);
 
+  str_type = regfio_type_val2str(vk->type);
   if(print_security)
-    printf("%s/%s,%s,%s,,,,,\n", prefix, quoted_name,
-	   regfio_type_val2str(vk->type), quoted_value);
+  {
+    if(str_type == NULL)
+      printf("%s/%s,0x%.8X,%s,,,,,\n", prefix, quoted_name,
+	     vk->type, quoted_value);
+    else
+      printf("%s/%s,%s,%s,,,,,\n", prefix, quoted_name,
+	     str_type, quoted_value);
+  }
   else
-    printf("%s/%s,%s,%s,\n", prefix, quoted_name,
-	   regfio_type_val2str(vk->type), quoted_value);
-  
+  {
+    if(str_type == NULL)
+      printf("%s/%s,0x%.8X,%s,\n", prefix, quoted_name,
+	     vk->type, quoted_value);
+    else
+      printf("%s/%s,%s,%s,\n", prefix, quoted_name,
+	     str_type, quoted_value);
+  }
+
   if(quoted_value != NULL)
     free(quoted_value);
