/* Retrieves the size of the UTF-8 encoded user security identifier
* The returned size includes the end of string character
* Returns 1 if successful, 0 if not available or -1 on error
*/
int libevt_record_get_utf8_user_security_identifier_size(
libevt_record_t *record,
size_t *utf8_string_size,
libcerror_error_t **error )
{
libevt_internal_record_t *internal_record = NULL;
static char *function = "libevt_record_get_utf8_user_security_identifier_size";
if( record == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record.",
function );
return( -1 );
}
internal_record = (libevt_internal_record_t *) record;
if( internal_record->record_values == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid internal record - missing record values.",
function );
return( -1 );
}
if( internal_record->record_values->user_security_identifier == NULL )
{
return( 0 );
}
if( libfvalue_value_get_utf8_string_size(
internal_record->record_values->user_security_identifier,
0,
utf8_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve UTF-8 string size.",
function );
return( -1 );
}
return( 1 );
}
/* Retrieves the size of a specific UTF-8 formatted string
* Returns 1 if successful or -1 on error
*/
int libwrc_string_get_utf8_string_size(
libwrc_resource_t *resource,
uint32_t language_identifier,
int string_index,
size_t *utf8_string_size,
libcerror_error_t **error )
{
libfvalue_value_t *string_values = NULL;
static char *function = "libwrc_string_get_utf8_string_size";
if( libwrc_resource_get_value_by_language_identifier(
resource,
LIBWRC_RESOURCE_TYPE_STRING,
language_identifier,
string_index,
(intptr_t **) &string_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve string values.",
function );
return( -1 );
}
if( libfvalue_value_get_utf8_string_size(
string_values,
0,
utf8_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve UTF-8 string size of string value: %d.",
function,
string_index );
return( -1 );
}
return( 1 );
}
/* Generate an xhash
* Sets xhash and xhash size
* Returns 1 if successful or -1 on error
*/
int libewf_hash_values_generate_xhash(
libfvalue_table_t *hash_values,
uint8_t **xhash,
size_t *xhash_size,
libcerror_error_t **error )
{
libfvalue_value_t *hash_value = NULL;
uint8_t *identifier = NULL;
char *xml_head = NULL;
char *xml_xhash_close_tag = NULL;
char *xml_xhash_open_tag = NULL;
static char *function = "libewf_hash_values_generate_xhash";
size_t xhash_index = 0;
size_t identifier_size = 0;
size_t value_string_size = 0;
size_t xml_head_length = 0;
size_t xml_xhash_close_tag_length = 0;
size_t xml_xhash_open_tag_length = 0;
int hash_value_index = 0;
int number_of_hash_values = 0;
int result = 0;
if( xhash == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid xhash.",
function );
return( -1 );
}
if( *xhash != NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: xhash already created.",
function );
return( -1 );
}
if( xhash_size == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid xhash size.",
function );
return( -1 );
}
if( libfvalue_table_get_number_of_values(
hash_values,
&number_of_hash_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve number of hash values.",
function );
goto on_error;
}
xml_head = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n";
xml_head_length = libcstring_narrow_string_length(
xml_head );
xml_xhash_open_tag = "<xhash>\n";
xml_xhash_open_tag_length = libcstring_narrow_string_length(
xml_xhash_open_tag );
xml_xhash_close_tag = "</xhash>\n\n";
xml_xhash_close_tag_length = libcstring_narrow_string_length(
xml_xhash_close_tag );
/* Reserve space for the UTF-8 byte order mark and the XML skeleton data
*/
*xhash_size = 3 + xml_head_length + xml_xhash_open_tag_length + xml_xhash_close_tag_length;
for( hash_value_index = 0;
hash_value_index < number_of_hash_values;
hash_value_index++ )
{
if( libfvalue_table_get_value_by_index(
hash_values,
hash_value_index,
&hash_value,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve hash value: %d.",
function,
hash_value_index );
goto on_error;
}
if( libfvalue_value_get_identifier(
hash_value,
&identifier,
&identifier_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve identifier of hash value: %d.",
function,
hash_value_index );
goto on_error;
}
if( ( identifier == NULL )
|| ( identifier_size == 0 ) )
{
#if defined( HAVE_VERBOSE_OUTPUT )
if( libcnotify_verbose != 0 )
{
libcnotify_printf(
"%s: missing identifier for hash value: %d.\n",
function,
hash_value_index );
}
#endif
continue;
}
result = libfvalue_value_get_utf8_string_size(
hash_value,
0,
&value_string_size,
error );
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve string size of hash value: %s.",
function,
(char *) identifier );
goto on_error;
}
if( ( result != 0 )
&& ( value_string_size > 1 ) )
{
/* Reserve space for a leading tab, <identifier>value</identifier> and a newline
*/
*xhash_size += 7 + ( 2 * ( identifier_size - 1 ) ) + ( value_string_size - 1 );
}
}
/* Reserve space for the end-of-string character
*/
*xhash_size += 1;
*xhash = (uint8_t *) memory_allocate(
sizeof( uint8_t ) * *xhash_size );
if( *xhash == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: unable to create xhash.",
function );
goto on_error;
}
( *xhash )[ xhash_index++ ] = 0xef;
( *xhash )[ xhash_index++ ] = 0xbb;
( *xhash )[ xhash_index++ ] = 0xbf;
if( libcstring_narrow_string_copy(
(char *) &( ( *xhash )[ xhash_index ] ),
xml_head,
xml_head_length ) == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy XML head string.",
function );
goto on_error;
}
xhash_index += xml_head_length;
if( libcstring_narrow_string_copy(
(char *) &( ( *xhash )[ xhash_index ] ),
xml_xhash_open_tag,
xml_xhash_open_tag_length ) == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy xhash open tag string.",
function );
goto on_error;
}
xhash_index += xml_xhash_open_tag_length;
for( hash_value_index = 0;
hash_value_index < number_of_hash_values;
hash_value_index++ )
{
if( libfvalue_table_get_value_by_index(
hash_values,
hash_value_index,
&hash_value,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve hash value: %d.",
function,
hash_value_index );
goto on_error;
}
if( libfvalue_value_get_identifier(
hash_value,
&identifier,
&identifier_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve identifier of hash value: %d.",
function,
hash_value_index );
goto on_error;
}
if( ( identifier == NULL )
|| ( identifier_size == 0 ) )
{
#if defined( HAVE_VERBOSE_OUTPUT )
if( libcnotify_verbose != 0 )
{
libcnotify_printf(
"%s: missing identifier for hash value: %d.\n",
function,
hash_value_index );
}
#endif
continue;
}
result = libfvalue_value_get_utf8_string_size(
hash_value,
0,
&value_string_size,
error );
if( result == -1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve string size of hash value: %s.",
function,
(char *) identifier );
goto on_error;
}
if( ( result != 0 )
&& ( value_string_size > 1 ) )
{
( *xhash )[ xhash_index++ ] = (uint8_t) '\t';
( *xhash )[ xhash_index++ ] = (uint8_t) '<';
if( libcstring_narrow_string_copy(
(char *) &( ( *xhash )[ xhash_index ] ),
(char *) identifier,
identifier_size - 1 ) == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy %s open tag string.",
function,
(char *) identifier );
goto on_error;
}
xhash_index += identifier_size - 1;
( *xhash )[ xhash_index++ ] = (uint8_t) '>';
if( libfvalue_value_copy_to_utf8_string_with_index(
hash_value,
0,
*xhash,
*xhash_size,
&xhash_index,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy string of hash value: %s.",
function,
(char *) identifier );
goto on_error;
}
( *xhash )[ xhash_index - 1 ] = (uint8_t) '<';
( *xhash )[ xhash_index++ ] = (uint8_t) '/';
if( libcstring_narrow_string_copy(
(char *) &( ( *xhash )[ xhash_index ] ),
(char *) identifier,
identifier_size - 1 ) == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy %s close tag string.",
function,
(char *) identifier );
goto on_error;
}
xhash_index += identifier_size - 1;
( *xhash )[ xhash_index++ ] = (uint8_t) '>';
( *xhash )[ xhash_index++ ] = (uint8_t) '\n';
}
}
if( libcstring_narrow_string_copy(
(char *) &( ( *xhash )[ xhash_index ] ),
xml_xhash_close_tag,
xml_xhash_close_tag_length ) == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy xhash close tag string.",
function );
goto on_error;
}
xhash_index += xml_xhash_close_tag_length;
/* Make sure the string is terminated
*/
( *xhash )[ xhash_index ] = 0;
return( 1 );
on_error:
if( *xhash != NULL )
{
memory_free(
*xhash );
*xhash = NULL;
}
*xhash_size = 0;
return( -1 );
}
/* Retrieves the size of a specific UTF-8 encoded string
* The returned size includes the end of string character
* Returns 1 if successful or -1 on error
*/
int libevt_record_get_utf8_string_size(
libevt_record_t *record,
int string_index,
size_t *utf8_string_size,
libcerror_error_t **error )
{
libevt_internal_record_t *internal_record = NULL;
static char *function = "libevt_record_get_utf8_string_size";
if( record == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record.",
function );
return( -1 );
}
internal_record = (libevt_internal_record_t *) record;
if( internal_record->record_values == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid internal record - missing record values.",
function );
return( -1 );
}
if( internal_record->record_values->strings == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid string index value out of bounds.",
function );
return( -1 );
}
if( libfvalue_value_get_utf8_string_size(
internal_record->record_values->strings,
string_index,
utf8_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve UTF-8 string size of strings value entry: %d.",
function,
string_index );
return( -1 );
}
return( 1 );
}
/* Retrieves the size of the UTF-8 encoded location
* The returned size includes the end of string character
* Returns 1 if successful, 0 if no location or -1 on error
*/
int libmsiecf_redirected_get_utf8_location_size(
libmsiecf_item_t *redirected,
size_t *utf8_string_size,
libcerror_error_t **error )
{
libmsiecf_internal_item_t *internal_item = NULL;
static char *function = "libmsiecf_redirected_get_utf8_location_size";
if( redirected == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid redirected.",
function );
return( -1 );
}
internal_item = (libmsiecf_internal_item_t *) redirected;
if( internal_item->item_descriptor == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid item - missing item descriptor.",
function );
return( -1 );
}
if( internal_item->item_descriptor->type != LIBMSIECF_ITEM_TYPE_REDIRECTED )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
"%s: unsupported item type: %" PRIu8 ".",
function,
internal_item->item_descriptor->type );
return( -1 );
}
if( internal_item->value == NULL )
{
if( libmsiecf_item_read_values(
internal_item,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_READ_FAILED,
"%s: unable to read item values.",
function );
return( -1 );
}
if( internal_item->value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid item values.",
function );
return( -1 );
}
}
if( ( (libmsiecf_redirected_values_t *) internal_item->value )->location == NULL )
{
return( 0 );
}
if( libfvalue_value_get_utf8_string_size(
( (libmsiecf_redirected_values_t *) internal_item->value )->location,
0,
utf8_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve location UTF-8 string size.",
function );
return( -1 );
}
return( 1 );
}
/* Retrieves the size of an UTF-8 string
* The returned size includes the end of string character
* Returns 1 if successful, 0 if value is NULL or -1 on error
*/
int libesedb_record_value_get_utf8_string_size(
libfvalue_value_t *record_value,
size_t *utf8_string_size,
libcerror_error_t **error )
{
uint8_t *entry_data = NULL;
static char *function = "libesedb_record_value_get_utf8_string_size";
size_t entry_data_size = 0;
uint32_t data_flags = 0;
int encoding = 0;
int result = 0;
if( record_value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record value.",
function );
return( -1 );
}
result = libfvalue_value_has_data(
record_value,
error );
if( result == -1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to determine if record value has data.",
function );
return( -1 );
}
else if( result != 0 )
{
if( libfvalue_value_get_data_flags(
record_value,
&data_flags,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve data flags.",
function );
return( -1 );
}
if( ( data_flags & LIBESEDB_VALUE_FLAG_MULTI_VALUE ) != 0 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
"%s: unsupported data flags: 0x%02" PRIx32 ".",
function,
data_flags );
return( -1 );
}
if( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 )
{
if( libfvalue_value_get_entry_data(
record_value,
0,
&entry_data,
&entry_data_size,
&encoding,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve record value entry data.",
function );
return( -1 );
}
result = libesedb_compression_get_utf8_string_size(
entry_data,
entry_data_size,
utf8_string_size,
error );
}
else
{
result = libfvalue_value_get_utf8_string_size(
record_value,
0,
utf8_string_size,
error );
}
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable retrieve UTF-8 string size.",
function );
return( -1 );
}
}
return( result );
}
/* Retrieves the size of the UTF-8 encoded string of a specific value of the multi value
* The returned size includes the end of string character
* Returns 1 if successful or -1 on error
*/
int libesedb_multi_value_get_value_utf8_string_size(
libesedb_multi_value_t *multi_value,
int multi_value_index,
size_t *utf8_string_size,
libcerror_error_t **error )
{
libesedb_internal_multi_value_t *internal_multi_value = NULL;
uint8_t *entry_data = NULL;
static char *function = "libesedb_multi_value_get_value_utf8_string_size";
size_t entry_data_size = 0;
uint32_t column_type = 0;
uint32_t data_flags = 0;
int encoding = 0;
int result = 0;
if( multi_value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid multi value.",
function );
return( -1 );
}
internal_multi_value = (libesedb_internal_multi_value_t *) multi_value;
if( libesedb_catalog_definition_get_column_type(
internal_multi_value->column_catalog_definition,
&column_type,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve catalog definition column type.",
function );
return( -1 );
}
if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT )
&& ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
"%s: unsupported column type: %" PRIu32 ".",
function,
column_type );
return( -1 );
}
if( libfvalue_value_get_data_flags(
internal_multi_value->record_value,
&data_flags,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve value data flags.",
function );
return( -1 );
}
if( ( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 )
&& ( multi_value_index == 0 ) )
{
if( libfvalue_value_get_entry_data(
internal_multi_value->record_value,
multi_value_index,
&entry_data,
&entry_data_size,
&encoding,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve record value entry: %d data.",
function,
multi_value_index );
return( -1 );
}
result = libesedb_compression_get_utf8_string_size(
entry_data,
entry_data_size,
utf8_string_size,
error );
}
else
{
result = libfvalue_value_get_utf8_string_size(
internal_multi_value->record_value,
multi_value_index,
utf8_string_size,
error );
}
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable retrieve UTF-8 string size: %d.",
function,
multi_value_index );
return( -1 );
}
return( 1 );
}
