summaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* hivex: Added gnulib includes from builddir, as suggested by the Gnulib ↵Hilko Bengen2011-12-011-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | documentation; link hivexml against libgnu. Since some modules (`getopt', for example) may copy files into the build directory, `top_builddir/lib' is needed as well as `top_srcdir/lib'. -- GNU Gnulib manual, section 2.2 Initial import This fixes an in-tree build failure on a Debian/sid system (see below). hivexml could be built out-of-tree, but it turned out that due to a missing include path, in this case the system's getopt implementation was used insted of Gnulib's. make[2]: Entering directory `«SRCDIR»/xml' gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I.. -DLOCALEBASEDIR=\""/usr/local/share/locale"\" -I../gnulib/lib -I../lib -I/usr/include/libxml2 -g -O2 -MT hivexml-hivexml.o -MD -MP -MF .deps/hivexml-hivexml.Tpo -c -o hivexml-hivexml.o `test -f 'hivexml.c' || echo './'`hivexml.c mv -f .deps/hivexml-hivexml.Tpo .deps/hivexml-hivexml.Po /bin/bash ../libtool --tag=CC --mode=link gcc -std=gnu99 -DLOCALEBASEDIR=\""/usr/local/share/locale"\" -I../gnulib/lib -I../lib -I/usr/include/libxml2 -g -O2 -o hivexml hivexml-hivexml.o ../lib/libhivex.la -lxml2 libtool: link: gcc -std=gnu99 -DLOCALEBASEDIR=\"/usr/local/share/locale\" -I../gnulib/lib -I../lib -I/usr/include/libxml2 -g -O2 -o .libs/hivexml hivexml-hivexml.o ../lib/.libs/libhivex.so /usr/lib/libxml2.so hivexml-hivexml.o: In function `main': «SRCDIR»/xml/hivexml.c:96: undefined reference to `rpl_getopt' «SRCDIR»/xml/hivexml.c:110: undefined reference to `rpl_optind' «SRCDIR»/xml/hivexml.c:154: undefined reference to `rpl_optind' collect2: ld returned 1 exit status make[2]: *** [hivexml] Error 1 make[2]: Leaving directory `«SRCDIR»/xml'
* Replacement mmap function for Win32.Gillen Daniel2011-09-075-2/+157
| | | | (Updates by RWMJ)
* Add an internal hivex header file.Richard W.M. Jones2011-09-073-50/+76
|
* hivex: Add metadata length functions for nodes and valuesAlex Nelson2011-09-061-0/+38
| | | | | | | | | | This patch adds hivex_node_struct_length and hivex_value_struct_length to the hivex ABI, to report the amount of hive space used for each stored structure. Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu> A fix added by RWMJ.
* hivex: Split value_key function into value_key and value_key_lenAlex Nelson2011-09-061-11/+27
| | | | | | | | | | This function breaks the value name calculation out so the name does not need to be fetched and immediately thrown away when one only needs the name. Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu> RWMJ fixed hivex_value_key handling of errno.
* lib/byte_conversions.h: Use bswap* functions instead of __bswap* functions.Gillen Daniel2011-09-061-10/+10
|
* hivex: Fix building on platforms without O_CLOEXEC such as FreeBSDHilko Bengen2011-08-241-0/+7
|
* Prevent warning about unused variable in test.Richard W.M. Jones2011-08-151-1/+1
|
* Fix incorrect printf format specifier in error string.Richard W.M. Jones2011-08-151-1/+2
|
* hivex(3): Fix link to CSS.Richard W.M. Jones2011-08-151-1/+1
|
* header: Fix including just <hivex.h>.Richard W.M. Jones2011-08-152-1/+44
| | | | Also this adds a regression test so we don't break it in future.
* Report last-modified time of hive root and nodesAlex Nelson2011-08-131-3/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | The infrastructure for modified-time reporting has been essentially unused. These changes report the registry time by treating the time fields as Windows filetime fields stored in little-Endian (which means they can be treated as a single 64-bit little-Endian integer). This patch adds to the hivex ABI: * int64_t hivex_last_modified (hive_h *) * int64_t hivex_node_timestamp (hive_h *, hive_node_h) These two functions return the hive's last-modified time and a particular node's last-modified time, respectively. Credit to Richard Jones for the ABI suggestion, and for the tip on Microsoft's filetime time span. hivexml employs these two functions to produce mtime elements for a hive and all of its nodes, producing ISO-8601 formatted time. Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu> A lot of code cleanup by RWMJ.
* hivex: A few tweaks to enable building in a separate directoryHilko Bengen2011-08-111-7/+7
| | | | A couple of fixes by RWMJ so it still works in the same directory case.
* Close the file descriptor along the writable path.Michael Huang2011-07-111-1/+11
| | | | | Since the file has been completely read into memory, there is no reason to keep the file descriptor open.
* maint: remove trailing blanksJim Meyering2011-06-281-4/+4
|
* maint: remove now-unnecessary #ifdef HAVE_BYTESWAP_H guardJim Meyering2011-06-281-2/+0
| | | | | | * lib/byte_conversions.h: Remove #ifdef HAVE_BYTESWAP_H guard. With gnulib, we're guaranteed to have that header file. * bootstrap (modules): Use the byteswap module.
* maint: remove definition of O_CLOEXEC, ...Jim Meyering2011-06-281-4/+0
| | | | | | | | now that we're using gnulib's fcntl module, which ensures that we use a conforming <fcntl.h>. * lib/hivex.c (O_CLOEXEC): Remove definition. * bootstrap (modules): Add fcntl for its guaranteed definition of O_CLOEXEC.
* maint: remove unnecessary test-before-freeJim Meyering2011-06-281-2/+1
| | | | | * lib/hivex.c (hivex_node_set_value): Remove unnecessary test-before-free.
* hivex_root: Return errno == HIVEX_NO_KEY when root key is missing.Richard W.M. Jones2011-05-131-1/+1
| | | | | | | | | | Previously we returned errno == ENOKEY. However this was an unfortunate choice of error code since it is not defined in POSIX. As a result it is missing on several platforms. HIVEX_NO_KEY is defined as ENOKEY on platforms where this symbol exists (thus maintaining backwards ABI compatibility), and defined as another POSIX error code otherwise.
* hivex: Fix for endianess bug.Hilko Bengen2011-05-121-1/+1
| | | | | | | | | | | | * Richard W.M. Jones: > > Both size_t and int are 32 bit values. An endianess issue, maybe? > I guess it might be. We're supposed to be doing le32toh / be32toh > everywhere as appropriate, but we might be missing one. The code is > mainly tested on little endian arches. Found it. Now "make check" completes successfully on Sparc and PowerPC.
* maint: Split long lines.Jim Meyering2011-04-131-52/+96
| | | | * lib/hivex.c: Split lines longer than 80 columns.
* Remove no longer used internal function utf16_string_len_in_bytes.Richard W.M. Jones2011-04-131-16/+2
|
* hivex_value_multiple_strings: Don't read uninitialized data.Richard W.M. Jones2011-04-131-1/+2
| | | | | | | | | If hivex_value_multiple_strings was given a value which had an odd length or if the data in the value was unterminated, hivex_value_multiple_strings could read uninitialized data. Potentially (although very unlikely) this could cause a non-exploitable segfault in the calling program.
* Handle odd-length "UTF16" strings.Richard W.M. Jones2011-04-131-1/+1
| | | | | If the length of the buffer is not even, then this would read a byte of uninitialized data. Fix the length check to avoid this.
* Return real length of buffer from hivex_value_value.Richard W.M. Jones2011-04-131-0/+4
| | | | | | | | | | | | | | | | | In real registries, often the length declared in the header does not match the length of the block. In this case hivex_value_value would only allocate a value with a size which is the shorter of the two length values, which is correct and safe. However user code could do: buf = hivex_value_value (h, v, &t, &len); memcpy (somewhere, buf, len); which would copy uninitialized data. If hivex_value_value truncates a value like this, we also need to return the shorter length to the user as well.
* Really fix the case where a UTF-16 string contains junk after the string.Richard W.M. Jones2011-04-131-1/+1
| | | | | | The previous commit b71b88f588f8660935a7d462e97b84aa2d669249 attempted to fix this, but got the test the wrong way round so the length would never be shorter.
* Fix use-after-free in hivex_close.Richard W.M. Jones2011-04-121-3/+3
| | | | Found using valgrind.
* Add debug output to hivex_close.Matthew Booth2010-08-131-0/+3
|
* Don't try to process junk after a string value as UTF-16.Richard Jones2010-07-121-0/+31
| | | | | Thanks to Hilko Bengen for characterizing the issue and providing an initial version of this patch.
* Call iconv_close along error path out of function.Hilko Bengen2010-07-121-1/+5
|
* Add hivex_set_value API call, and ocaml and perl bindings, and tests.Conrad Meyer2010-07-081-0/+80
|
* Add a linker script to limit visibility to exported symbols.Richard Jones2010-04-031-3/+9
|
* Add CLEANFILES rules.TJ2010-04-021-0/+2
|
* Zero all new block allocations.Richard Jones2010-03-291-0/+2
| | | | | | | | | | Make sure all new block allocations (from allocate_block) are zeroed. It can happen that junk from previous hive pages can end up in new block allocations, if the hive previously shrank. (Thanks to Marko Myllynen for finding an example where this happened).
* Increase HIVEX_MAX_VALUES from 1000 to 10000.Richard Jones2010-03-291-1/+1
| | | | | I was sent a genuine Windows XP hive by Marko Myllynen which had a key with > 1000 values attached.
* Increase HIVEX_MAX_SUBKEYS to 15000.Richard Jones2010-03-261-1/+1
| | | | | | Windows 7 registry has a hive key which contains 11908 subkeys, larger than the existing limit (10000). The key is: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners
* hivex: Add debugging message when returning ERANGE error.Richard Jones2010-03-261-0/+9
|
* Create separate toplevel directories for hivexsh and hivexml.Richard Jones2010-02-2413-2371/+3
|
* Rename hivex/ -> lib/Richard Jones2010-02-2425-0/+7068
generated by cgit (git 2.34.1) at 2025-09-27 18:41:38 +0000