hive_value_h * hivex_node_values (hive_h *h, hive_node_h node) { hive_value_h *values; size_t *blocks; if (_hivex_get_values (h, node, &values, &blocks) == -1) return NULL; free (blocks); return values; }
/* Delete all existing values at this node. */ static int delete_values (hive_h *h, hive_node_h node) { assert (h->writable); hive_value_h *values; size_t *blocks; if (_hivex_get_values (h, node, &values, &blocks) == -1) return -1; size_t i; for (i = 0; blocks[i] != 0; ++i) mark_block_unused (h, blocks[i]); free (blocks); for (i = 0; values[i] != 0; ++i) { struct ntreg_vk_record *vk = (struct ntreg_vk_record *) ((char *) h->addr + values[i]); size_t len; int is_inline; len = le32toh (vk->data_len); is_inline = !!(len & 0x80000000); /* top bit indicates is inline */ if (!is_inline) { /* non-inline, so remove data block */ size_t data_offset = le32toh (vk->data_offset); data_offset += 0x1000; mark_block_unused (h, data_offset); } /* remove vk record */ mark_block_unused (h, values[i]); } free (values); struct ntreg_nk_record *nk = (struct ntreg_nk_record *) ((char *) h->addr + node); nk->nr_values = htole32 (0); nk->vallist = htole32 (0xffffffff); return 0; }