[Libguestfs] [PATCH 0/7] hivex + hivexml: Add byte runs for nodes and values

Alex Nelson ajnelson at cs.ucsc.edu
Fri Sep 2 01:17:08 UTC 2011


This changeset adds byte run reporters for node and value metadata in the
hivexml program.    This location reporting required several new ABI
functions, which required new ABI return types.  One benefit to the byte
run functions is additional sanity checks, which have revealed new data
or parsing errors when run on M57 patents images.  An example error:
Image:  Charlie, 2009-12-11, available at <http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>.
hive:  C:/WINDOWS/system32/config/SECURITY
Address 12624 is processed as a value, but it has a node signature.

Alex Nelson (7):
  generator: Add new return type to ABI: RSize
  hivex: Split value_key function into value_key and value_key_len
  generator: Add new return types to ABI: RLenNode and RLenValue
  hivex: Add metadata length functions for nodes and values
  hivex: Add offset-&-length function for long value data
  hivexml: Report attributes in values instead of text.
  hivexml: Add byte run reporting functions

 generator/generator.ml |  169 +++++++++++++++++++++++++++++++++++++++++++++++-
 lib/hivex.c            |  115 +++++++++++++++++++++++++++++---
 xml/hivexml.c          |  127 ++++++++++++++++++++++++++++++++----
 3 files changed, 385 insertions(+), 26 deletions(-)

-- 
1.7.6






More information about the Libguestfs mailing list