[Libguestfs] [PATCH 9/12] hivex: Begin implementation of writing to hives.

[Richard W.M. Jones]

On Fri, Feb 05, 2010 at 01:20:44PM +0000, Matthew Booth wrote:
> On 05/02/10 12:46, Richard W.M. Jones wrote:
> > On Thu, Feb 04, 2010 at 04:54:53PM +0000, Matthew Booth wrote:
> >>> +    size_t len;
> >>> +    len = le32toh (vk->data_len);
> >>> +    if (len == 0x80000000)      /* special case */
> >>> +      len = 4;
> >>> +    len &= 0x7fffffff;
> >>
> >> Comment, please. What's going on with this record length?
> > 
> > This is a mysterious and undocumented part of the format.  I don't
> > claim to understand why, but it is necessary.
> 
> Hehe, ok. Can you at least put in a comment to that effect, preferrably
> with a pointer to your source.

Alright I've looked into this further:

The MSB (vk->data_len & 0x80000000) indicates whether the data is
inline.

In all existing registry hives, the data is always stored inline if
the data length <= 4 (ie. the data_len field would be stored in those
cases as 0x80000004 or whatever).

I am updating the code accordingly ...

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://et.redhat.com/~rjones/libguestfs/
See what it can do: http://et.redhat.com/~rjones/libguestfs/recipes.html