[Libguestfs] [PATCH 9/12] hivex: Begin implementation of writing to hives.
Richard W.M. Jones
rjones at redhat.com
Fri Feb 5 14:38:05 UTC 2010
On Fri, Feb 05, 2010 at 01:20:44PM +0000, Matthew Booth wrote:
> On 05/02/10 12:46, Richard W.M. Jones wrote:
> > On Thu, Feb 04, 2010 at 04:54:53PM +0000, Matthew Booth wrote:
> >>> + size_t len;
> >>> + len = le32toh (vk->data_len);
> >>> + if (len == 0x80000000) /* special case */
> >>> + len = 4;
> >>> + len &= 0x7fffffff;
> >>
> >> Comment, please. What's going on with this record length?
> >
> > This is a mysterious and undocumented part of the format. I don't
> > claim to understand why, but it is necessary.
>
> Hehe, ok. Can you at least put in a comment to that effect, preferrably
> with a pointer to your source.
Alright I've looked into this further:
The MSB (vk->data_len & 0x80000000) indicates whether the data is
inline.
In all existing registry hives, the data is always stored inline if
the data length <= 4 (ie. the data_len field would be stored in those
cases as 0x80000004 or whatever).
I am updating the code accordingly ...
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines. Supports shell scripting,
bindings from many languages. http://et.redhat.com/~rjones/libguestfs/
See what it can do: http://et.redhat.com/~rjones/libguestfs/recipes.html
More information about the Libguestfs
mailing list