/* Prints an UTF-16 string value * Returns 1 if successful or -1 on error */ int libregf_debug_print_utf16_string_value( const char *function_name, const char *value_name, const uint8_t *byte_stream, size_t byte_stream_size, int byte_order, libcerror_error_t **error ) { system_character_t *string = NULL; static char *function = "libregf_debug_print_utf16_string_value"; size_t string_size = 0; int result = 0; if( ( byte_stream == NULL ) || ( byte_stream_size == 0 ) ) { libcnotify_printf( "%s: %s: \n", function_name, value_name ); return( 1 ); } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libuna_utf16_string_size_from_utf16_stream( byte_stream, byte_stream_size, byte_order, &string_size, error ); #else result = libuna_utf8_string_size_from_utf16_stream( byte_stream, byte_stream_size, byte_order, &string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to determine size of string.", function ); goto on_error; } if( ( string_size > (size_t) SSIZE_MAX ) || ( ( sizeof( system_character_t ) * string_size ) > (size_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid string size value exceeds maximum.", function ); goto on_error; } string = system_string_allocate( string_size ); if( string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libuna_utf16_string_copy_from_utf16_stream( (libuna_utf16_character_t *) string, string_size, byte_stream, byte_stream_size, byte_order, error ); #else result = libuna_utf8_string_copy_from_utf16_stream( (libuna_utf8_character_t *) string, string_size, byte_stream, byte_stream_size, byte_order, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to set string.", function ); goto on_error; } libcnotify_printf( "%s: %s: %s\n", function_name, value_name, string ); memory_free( string ); return( 1 ); on_error: if( string != NULL ) { memory_free( string ); } return( -1 ); }
/* Sets the path prefix * Returns 1 if successful or -1 on error */ int mount_file_system_set_path_prefix( mount_file_system_t *file_system, const system_character_t *path_prefix, size_t path_prefix_size, libcerror_error_t **error ) { static char *function = "mount_file_system_set_path_prefix"; if( file_system == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid file system.", function ); return( -1 ); } if( file_system->path_prefix != NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, "%s: invalid file system - path prefix value already set.", function ); return( -1 ); } if( path_prefix == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid path prefix.", function ); return( -1 ); } if( path_prefix_size == 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: missing path prefix.", function ); goto on_error; } if( path_prefix_size > (size_t) ( SSIZE_MAX / sizeof( system_character_t ) ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid path prefix size value exceeds maximum.", function ); goto on_error; } file_system->path_prefix = system_string_allocate( path_prefix_size ); if( file_system->path_prefix == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create path prefix string.", function ); goto on_error; } if( system_string_copy( file_system->path_prefix, path_prefix, path_prefix_size ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy path prefix.", function ); goto on_error; } file_system->path_prefix[ path_prefix_size - 1 ] = 0; file_system->path_prefix_size = path_prefix_size; return( 1 ); on_error: if( file_system->path_prefix != NULL ) { memory_free( file_system->path_prefix ); file_system->path_prefix = NULL; } file_system->path_prefix_size = 0; return( -1 ); }
/* Creates a file entry * Make sure the value file_entry is referencing, is set to NULL * Returns 1 if successful or -1 on error */ int mount_file_entry_initialize( mount_file_entry_t **file_entry, mount_file_system_t *file_system, const system_character_t *name, size_t name_length, libvshadow_store_t *vshadow_store, libcerror_error_t **error ) { static char *function = "mount_file_entry_initialize"; if( file_entry == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid file entry.", function ); return( -1 ); } if( *file_entry != NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, "%s: invalid file entry value already set.", function ); return( -1 ); } if( file_system == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid file system.", function ); return( -1 ); } if( name_length > (size_t) ( SSIZE_MAX - 1 ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid name length value exceeds maximum.", function ); return( -1 ); } *file_entry = memory_allocate_structure( mount_file_entry_t ); if( *file_entry == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create file entry.", function ); goto on_error; } if( memory_set( *file_entry, 0, sizeof( mount_file_entry_t ) ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_SET_FAILED, "%s: unable to clear file entry.", function ); memory_free( *file_entry ); *file_entry = NULL; return( -1 ); } ( *file_entry )->file_system = file_system; if( name != NULL ) { ( *file_entry )->name = system_string_allocate( name_length + 1 ); if( ( *file_entry )->name == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create name string.", function ); goto on_error; } if( name_length > 0 ) { if( system_string_copy( ( *file_entry )->name, name, name_length ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy name.", function ); goto on_error; } } ( *file_entry )->name[ name_length ] = 0; ( *file_entry )->name_size = name_length + 1; } ( *file_entry )->vshadow_store = vshadow_store; return( 1 ); on_error: if( *file_entry != NULL ) { if( ( *file_entry )->name != NULL ) { memory_free( ( *file_entry )->name ); } memory_free( *file_entry ); *file_entry = NULL; } return( -1 ); }
/* Clones the extent table * Returns 1 if successful or -1 on error */ int libvmdk_extent_table_clone( libvmdk_extent_table_t **destination_extent_table, libvmdk_extent_table_t *source_extent_table, libcerror_error_t **error ) { static char *function = "libvmdk_extent_table_clone"; if( destination_extent_table == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid destination extent table.", function ); return( -1 ); } if( *destination_extent_table != NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, "%s: invalid destination extent table value already set.", function ); return( -1 ); } if( source_extent_table == NULL ) { *destination_extent_table = NULL; return( 1 ); } *destination_extent_table = memory_allocate_structure( libvmdk_extent_table_t ); if( *destination_extent_table == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create destination extent table.", function ); goto on_error; } if( memory_set( *destination_extent_table, 0, sizeof( libvmdk_extent_table_t ) ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_SET_FAILED, "%s: unable to clear source to destination extent table.", function ); memory_free( *destination_extent_table ); *destination_extent_table = NULL; return( -1 ); } if( source_extent_table->data_files_path != NULL ) { ( *destination_extent_table )->data_files_path = system_string_allocate( source_extent_table->data_files_path_size ); if( *destination_extent_table == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create destination extent table.", function ); goto on_error; } if( memory_copy( ( *destination_extent_table )->data_files_path, source_extent_table->data_files_path, sizeof( system_character_t ) * source_extent_table->data_files_path_size ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_COPY_FAILED, "%s: unable to copy source to destination data files path.", function ); goto on_error; } ( *destination_extent_table )->data_files_path_size = source_extent_table->data_files_path_size; } if( libfdata_list_clone( &( ( *destination_extent_table )->extent_files_list ), source_extent_table->extent_files_list, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create destination extent files list.", function ); goto on_error; } if( libfcache_cache_clone( &( ( *destination_extent_table )->extent_files_cache ), source_extent_table->extent_files_cache, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create destination extent files cache.", function ); goto on_error; } if( libfdata_stream_clone( &( ( *destination_extent_table )->extent_files_stream ), source_extent_table->extent_files_stream, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create destination extent files stream.", function ); goto on_error; } return( 1 ); on_error: if( *destination_extent_table != NULL ) { if( ( *destination_extent_table )->extent_files_cache != NULL ) { libfcache_cache_free( &( ( *destination_extent_table )->extent_files_cache ), NULL ); } if( ( *destination_extent_table )->extent_files_list != NULL ) { libfdata_list_free( &( ( *destination_extent_table )->extent_files_list ), NULL ); } if( ( *destination_extent_table )->data_files_path != NULL ) { memory_free( ( *destination_extent_table )->data_files_path ); } memory_free( *destination_extent_table ); *destination_extent_table = NULL; } return( -1 ); }
/* Sets the data files path * Returns 1 if successful or -1 on error */ int libvmdk_extent_table_set_data_files_path_wide( libvmdk_extent_table_t *extent_table, const wchar_t *path, size_t path_length, libcerror_error_t **error ) { static char *function = "libvmdk_extent_table_set_data_files_path_wide"; if( extent_table == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid extent table.", function ); return( -1 ); } if( path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid path.", function ); return( -1 ); } if( path_length > (size_t) ( SSIZE_MAX - 1 ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid path length value exceeds maximum.", function ); return( -1 ); } if( extent_table->data_files_path != NULL ) { memory_free( extent_table->data_files_path ); extent_table->data_files_path = NULL; extent_table->data_files_path_size = 0; } if( libvmdk_system_string_size_from_wide_string( path, path_length + 1, &( extent_table->data_files_path_size ), error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_CONVERSION, LIBCERROR_CONVERSION_ERROR_GENERIC, "%s: unable to determine data files path size.", function ); goto on_error; } extent_table->data_files_path = system_string_allocate( extent_table->data_files_path_size ); if( extent_table->data_files_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create data files path.", function ); goto on_error; } if( libvmdk_system_string_copy_from_wide_string( extent_table->data_files_path, extent_table->data_files_path_size, path, path_length + 1, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_CONVERSION, LIBCERROR_CONVERSION_ERROR_GENERIC, "%s: unable to set data files path.", function ); goto on_error; } return( 1 ); on_error: if( extent_table->data_files_path != NULL ) { memory_free( extent_table->data_files_path ); extent_table->data_files_path = NULL; } extent_table->data_files_path_size = 0; return( -1 ); }
/* Sets the name * Returns 1 if successful or -1 error */ int resource_file_set_name( resource_file_t *resource_file, const system_character_t *name, size_t name_length, libcerror_error_t **error ) { static char *function = "resource_file_set_name"; if( resource_file == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid resource file.", function ); return( -1 ); } if( resource_file->is_open != 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, "%s: invalid resource file already open.", function ); return( -1 ); } if( name == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid name.", function ); return( -1 ); } if( name_length > (size_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid name length value exceeds maximum.", function ); return( -1 ); } if( resource_file->name != NULL ) { memory_free( resource_file->name ); resource_file->name = NULL; } resource_file->name_size = name_length + 1; resource_file->name = system_string_allocate( resource_file->name_size ); if( resource_file->name == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create name.", function ); goto on_error; } if( system_string_copy( resource_file->name, name, name_length ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy name.", function ); goto on_error; } ( resource_file->name )[ name_length ] = 0; return( 1 ); on_error: if( resource_file->name != NULL ) { memory_free( resource_file->name ); resource_file->name = NULL; } resource_file->name_size = 0; return( -1 ); }
/* Exports a key * Returns the 1 if succesful or -1 on error */ int export_handle_export_key( export_handle_t *export_handle, libregf_key_t *key, log_handle_t *log_handle, libcerror_error_t **error ) { system_character_t *value_string = NULL; libregf_key_t *sub_key = NULL; libregf_value_t *value = NULL; uint8_t *data = NULL; static char *function = "export_handle_export_key"; size_t data_size = 0; size_t expected_data_size = 0; size_t value_string_size = 0; ssize_t print_count = 0; uint64_t value_64bit = 0; uint32_t value_32bit = 0; uint32_t value_type = 0; int number_of_sub_keys = 0; int number_of_values = 0; int result = 0; int sub_key_index = 0; int value_index = 0; if( export_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export handle.", function ); return( -1 ); } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_key_get_utf16_name_size( key, &value_string_size, error ); #else result = libregf_key_get_utf8_name_size( key, &value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve key name size.", function ); goto on_error; } if( value_string_size > 0 ) { if( ( value_string_size > (size_t) SSIZE_MAX ) || ( ( sizeof( system_character_t ) * value_string_size ) > (size_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid name size value exceeds maximum.", function ); goto on_error; } value_string = system_string_allocate( value_string_size ); if( value_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create name string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_key_get_utf16_name( key, (uint16_t *) value_string, value_string_size, error ); #else result = libregf_key_get_utf8_name( key, (uint8_t *) value_string, value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve key name.", function ); goto on_error; } /* TODO print full key path */ fprintf( export_handle->notify_stream, "Key: %" PRIs_SYSTEM "\n", value_string ); memory_free( value_string ); value_string = NULL; } #ifdef TODO /* TODO fix this */ #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_key_get_utf16_class_name_size( key, &value_string_size, error ); #else result = libregf_key_get_utf8_class_name_size( key, &value_string_size, error ); #endif if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve the class name size.", function ); goto on_error; } if( ( result != 0 ) && ( value_string_size > 0 ) ) { if( ( value_string_size > (size_t) SSIZE_MAX ) || ( ( sizeof( system_character_t ) * value_string_size ) > (size_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid name size value exceeds maximum.", function ); goto on_error; } value_string = system_string_allocate( value_string_size ); if( value_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create name string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_key_get_utf16_class_name( key, (uint16_t *) value_string, value_string_size, error ); #else result = libregf_key_get_utf8_class_name( key, (uint8_t *) value_string, value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve class name.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Class name: %" PRIs_SYSTEM "\n", value_string ); memory_free( value_string ); value_string = NULL; } #endif if( libregf_key_get_number_of_values( key, &number_of_values, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of values.", function ); goto on_error; } for( value_index = 0; value_index < number_of_values; value_index++ ) { if( libregf_key_get_value( key, value_index, &value, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value: %d.", function, value_index ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_value_get_utf16_name_size( value, &value_string_size, error ); #else result = libregf_value_get_utf8_name_size( value, &value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value name size.", function ); goto on_error; } if( value_string_size > 0 ) { if( ( value_string_size > (size_t) SSIZE_MAX ) || ( ( sizeof( system_character_t ) * value_string_size ) > (size_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid name size value exceeds maximum.", function ); goto on_error; } value_string = system_string_allocate( value_string_size ); if( value_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create name string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_value_get_utf16_name( value, (uint16_t *) value_string, value_string_size, error ); #else result = libregf_value_get_utf8_name( value, (uint8_t *) value_string, value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value name.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Value: %d %" PRIs_SYSTEM "\n", value_index, value_string ); memory_free( value_string ); value_string = NULL; } else { fprintf( export_handle->notify_stream, "Value: %d (default)\n", value_index ); } if( libregf_value_get_value_type( value, &value_type, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value type.", function ); goto on_error; } switch( value_type ) { case LIBREGF_VALUE_TYPE_UNDEFINED: fprintf( export_handle->notify_stream, "Type: undefined (none)\n" ); break; case LIBREGF_VALUE_TYPE_STRING: fprintf( export_handle->notify_stream, "Type: string\n" ); break; case LIBREGF_VALUE_TYPE_EXPANDABLE_STRING: fprintf( export_handle->notify_stream, "Type: expandable string\n" ); break; case LIBREGF_VALUE_TYPE_BINARY_DATA: fprintf( export_handle->notify_stream, "Type: binary data\n" ); break; case LIBREGF_VALUE_TYPE_INTEGER_32BIT_LITTLE_ENDIAN: fprintf( export_handle->notify_stream, "Type: 32-bit integer little-endian\n" ); break; case LIBREGF_VALUE_TYPE_INTEGER_32BIT_BIG_ENDIAN: fprintf( export_handle->notify_stream, "Type: 32-bit integer big-endian\n" ); break; case LIBREGF_VALUE_TYPE_SYMBOLIC_LINK: fprintf( export_handle->notify_stream, "Type: symbolic link\n" ); break; case LIBREGF_VALUE_TYPE_MULTI_VALUE_STRING: fprintf( export_handle->notify_stream, "Type: multi-value string\n" ); break; case LIBREGF_VALUE_TYPE_RESOURCE_LIST: fprintf( export_handle->notify_stream, "Type: resource list\n" ); break; case LIBREGF_VALUE_TYPE_FULL_RESOURCE_DESCRIPTOR: fprintf( export_handle->notify_stream, "Type: full resource descriptor\n" ); break; case LIBREGF_VALUE_TYPE_RESOURCE_REQUIREMENTS_LIST: fprintf( export_handle->notify_stream, "Type: resource requirements list\n" ); break; case LIBREGF_VALUE_TYPE_INTEGER_64BIT_LITTLE_ENDIAN: fprintf( export_handle->notify_stream, "Type: 64-bit integer little-endian\n" ); break; default: fprintf( export_handle->notify_stream, "Type: unknown: 0x%08" PRIx32 "\n", value_type ); break; } if( libregf_value_get_value_data_size( value, &data_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value data size.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Data size: %" PRIzd "\n", data_size ); switch( value_type ) { case LIBREGF_VALUE_TYPE_STRING: case LIBREGF_VALUE_TYPE_EXPANDABLE_STRING: #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_value_get_value_utf16_string_size( value, &value_string_size, error ); #else result = libregf_value_get_value_utf8_string_size( value, &value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value string size.", function ); goto on_error; } if( value_string_size > 0 ) { if( ( value_string_size > (size_t) SSIZE_MAX ) || ( ( sizeof( system_character_t ) * value_string_size ) > (size_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid value string size value exceeds maximum.", function ); goto on_error; } value_string = system_string_allocate( value_string_size ); if( value_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create value string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_value_get_value_utf16_string( value, (uint16_t *) value_string, value_string_size, error ); #else result = libregf_value_get_value_utf8_string( value, (uint8_t *) value_string, value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value string.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Data: %" PRIs_SYSTEM "\n", value_string ); memory_free( value_string ); value_string = NULL; } else { fprintf( export_handle->notify_stream, "Data:\n" ); } result = libregf_value_get_value_utf16_string_size( value, &expected_data_size, error ); if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value UTF-16 string size.", function ); goto on_error; } expected_data_size *= 2; if( expected_data_size == ( data_size + 2 ) ) { expected_data_size -= 2; } break; case LIBREGF_VALUE_TYPE_INTEGER_32BIT_LITTLE_ENDIAN: case LIBREGF_VALUE_TYPE_INTEGER_32BIT_BIG_ENDIAN: if( data_size == 4 ) { if( libregf_value_get_value_32bit( value, &value_32bit, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve 32-bit value.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Data: %" PRIu32 "\n", value_32bit ); } expected_data_size = 4; break; case LIBREGF_VALUE_TYPE_INTEGER_64BIT_LITTLE_ENDIAN: if( data_size == 8 ) { if( libregf_value_get_value_64bit( value, &value_64bit, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve 64-bit value.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Data: %" PRIu64 "\n", value_64bit ); } expected_data_size = 8; break; default: expected_data_size = 0; break; } if( data_size != expected_data_size ) { if( expected_data_size != 0 ) { fprintf( export_handle->notify_stream, "Mismatch in data size and that required for data type.\n" ); } if( data_size > 0 ) { data = (uint8_t *) memory_allocate( sizeof( uint8_t ) * data_size ); if( data == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create value data.", function ); goto on_error; } if( libregf_value_get_value_data( value, data, data_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value data.", function ); goto on_error; } fprintf( export_handle->notify_stream, "Data:\n" ); print_count = export_handle_print_data( export_handle, export_handle->notify_stream, data, data_size, error ); if( print_count == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, "%s: unable to print value data.", function ); goto on_error; } memory_free( data ); data = NULL; } else { fprintf( export_handle->notify_stream, "\n" ); } } else { fprintf( export_handle->notify_stream, "\n" ); } if( libregf_value_free( &value, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, "%s: unable to free value: %d.", function, value_index ); goto on_error; } } if( number_of_values == 0 ) { fprintf( export_handle->notify_stream, "\n" ); } if( libregf_key_get_number_of_sub_keys( key, &number_of_sub_keys, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of sub keys.", function ); goto on_error; } for( sub_key_index = 0; sub_key_index < number_of_sub_keys; sub_key_index++ ) { if( export_handle->abort != 0 ) { goto on_error; } if( libregf_key_get_sub_key( key, sub_key_index, &sub_key, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve sub key: %d.", function, sub_key_index ); goto on_error; } if( export_handle_export_key( export_handle, sub_key, log_handle, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GENERIC, "%s: unable to export sub key: %d.", function, sub_key_index ); goto on_error; } if( libregf_key_free( &sub_key, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, "%s: unable to free sub key: %d.", function, sub_key_index ); goto on_error; } } return( 1 ); on_error: if( sub_key != NULL ) { libregf_key_free( &sub_key, NULL ); } if( data != NULL ) { memory_free( data ); } if( value != NULL ) { libregf_value_free( &value, NULL ); } if( value_string != NULL ) { memory_free( value_string ); } return( -1 ); }
/* Sets the target path * Returns 1 if successful or -1 on error */ int export_handle_set_target_path( export_handle_t *export_handle, const system_character_t *target_path, libcerror_error_t **error ) { static char *function = "export_handle_set_target_path"; size_t target_path_length = 0; #if defined( WINAPI ) system_character_t *extended_length_target_path = NULL; size_t extended_length_target_path_size = 0; int result = 0; #endif if( export_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export handle.", function ); return( -1 ); } if( target_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid target path.", function ); return( -1 ); } if( export_handle->target_path != NULL ) { memory_free( export_handle->target_path ); export_handle->target_path = NULL; export_handle->target_path_size = 0; } target_path_length = system_string_length( target_path ); #if defined( WINAPI ) result = libcpath_path_get_full_path_wide( target_path, target_path_length, (wchar_t **) &extended_length_target_path, &extended_length_target_path_size, error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create extended-length target path.", function ); return( -1 ); } else if( result != 0 ) { target_path = extended_length_target_path; target_path_length = extended_length_target_path_size - 1; } #endif if( target_path_length > 0 ) { export_handle->target_path = system_string_allocate( target_path_length + 1 ); if( export_handle->target_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create target path.", function ); #if defined( WINAPI ) memory_free( extended_length_target_path ); #endif return( -1 ); } if( system_string_copy( export_handle->target_path, target_path, target_path_length ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy target path.", function ); #if defined( WINAPI ) memory_free( extended_length_target_path ); #endif memory_free( export_handle->target_path ); export_handle->target_path = NULL; return( -1 ); } ( export_handle->target_path )[ target_path_length ] = 0; export_handle->target_path_size = target_path_length + 1; } #if defined( WINAPI ) memory_free( extended_length_target_path ); #endif return( 1 ); }
/* Reads the reparse point values * Returns 1 if successful or -1 on error */ int libfsntfs_reparse_point_values_read_data( libfsntfs_reparse_point_values_t *reparse_point_values, const uint8_t *data, size_t data_size, libcerror_error_t **error ) { static char *function = "libfsntfs_reparse_point_values_read_data"; uint32_t flags = 0; #if defined( HAVE_DEBUG_OUTPUT ) system_character_t *value_string = NULL; size_t value_string_size = 0; int result = 0; #endif if( reparse_point_values == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid reparse point values.", function ); return( -1 ); } if( data == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid data.", function ); return( -1 ); } if( data_size > (size_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid data size value out of bounds.", function ); return( -1 ); } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: reparse point data:\n", function ); libcnotify_print_data( data, data_size, 0 ); } #endif byte_stream_copy_to_uint32_little_endian( ( (fsntfs_reparse_point_t *) data )->tag, reparse_point_values->tag ); byte_stream_copy_to_uint16_little_endian( ( (fsntfs_reparse_point_t *) data )->reparse_data_size, reparse_point_values->reparse_data_size ); #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: tag\t\t\t\t: 0x%08" PRIx32 "\n", function, reparse_point_values->tag ); libfsntfs_debug_print_reparse_point_tag( reparse_point_values->tag ); libcnotify_printf( "\n" ); libcnotify_printf( "%s: reparse data size\t\t: %" PRIu16 "\n", function, reparse_point_values->reparse_data_size ); libcnotify_printf( "\n" ); } #endif if( reparse_point_values->reparse_data_size > 0 ) { if( ( sizeof( fsntfs_reparse_point_t ) > data_size ) || ( (size_t) reparse_point_values->reparse_data_size > ( data_size - sizeof( fsntfs_reparse_point_t ) ) ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid reparse data size value out of bounds.", function ); goto on_error; } reparse_point_values->reparse_data = (uint8_t *) memory_allocate( sizeof( uint8_t ) * reparse_point_values->reparse_data_size ); if( reparse_point_values->reparse_data == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create reparse data.", function ); goto on_error; } if( memory_copy( reparse_point_values->reparse_data, &( data[ sizeof( fsntfs_reparse_point_t ) ] ), (size_t) reparse_point_values->reparse_data_size ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_COPY_FAILED, "%s: unable to copy reparse data.", function ); goto on_error; } } if( ( reparse_point_values->tag == 0xa0000003 ) || ( reparse_point_values->tag == 0xa000000c ) ) { byte_stream_copy_to_uint16_little_endian( ( (fsntfs_mount_point_reparse_data_t *) reparse_point_values->reparse_data )->substitute_name_offset, reparse_point_values->substitute_name_offset ); byte_stream_copy_to_uint16_little_endian( ( (fsntfs_mount_point_reparse_data_t *) reparse_point_values->reparse_data )->substitute_name_size, reparse_point_values->substitute_name_size ); byte_stream_copy_to_uint16_little_endian( ( (fsntfs_mount_point_reparse_data_t *) reparse_point_values->reparse_data )->print_name_offset, reparse_point_values->print_name_offset ); byte_stream_copy_to_uint16_little_endian( ( (fsntfs_mount_point_reparse_data_t *) reparse_point_values->reparse_data )->print_name_size, reparse_point_values->print_name_size ); #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: substitute name offset\t: 0x%04" PRIx16 "\n", function, reparse_point_values->substitute_name_offset ); libcnotify_printf( "%s: substitute name size\t\t: %" PRIu16 "\n", function, reparse_point_values->substitute_name_size ); libcnotify_printf( "%s: print name offset\t\t: 0x%04" PRIx16 "\n", function, reparse_point_values->print_name_offset ); libcnotify_printf( "%s: print name size\t\t: %" PRIu16 "\n", function, reparse_point_values->print_name_size ); } #endif } if( reparse_point_values->tag == 0xa0000003 ) { reparse_point_values->substitute_name_offset += sizeof( fsntfs_mount_point_reparse_data_t ); reparse_point_values->print_name_offset += sizeof( fsntfs_mount_point_reparse_data_t ); } else if( reparse_point_values->tag == 0xa000000c ) { byte_stream_copy_to_uint32_little_endian( ( (fsntfs_symbolic_link_reparse_data_t *) reparse_point_values->reparse_data )->flags, flags ); #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: flags\t\t\t: 0x%08" PRIx32 "\n", function, flags ); } #endif reparse_point_values->substitute_name_offset += sizeof( fsntfs_symbolic_link_reparse_data_t ); reparse_point_values->print_name_offset += sizeof( fsntfs_symbolic_link_reparse_data_t ); } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { if( ( reparse_point_values->tag == 0xa0000003 ) || ( reparse_point_values->tag == 0xa000000c ) ) { libcnotify_printf( "\n" ); } else { libcnotify_printf( "%s: unusupported reparse point tag: 0x%08" PRIx32 "\n", function, reparse_point_values->tag ); } } #endif if( reparse_point_values->substitute_name_size > 0 ) { if( reparse_point_values->substitute_name_offset >= reparse_point_values->reparse_data_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid substitute name offset value out of bounds.", function ); goto on_error; } if( reparse_point_values->substitute_name_size > ( reparse_point_values->reparse_data_size - reparse_point_values->substitute_name_offset ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid substitute name size value out of bounds.", function ); goto on_error; } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libuna_utf16_string_size_from_utf16_stream( &( reparse_point_values->reparse_data[ reparse_point_values->substitute_name_offset ] ), (size_t) reparse_point_values->substitute_name_size, LIBUNA_ENDIAN_LITTLE, &value_string_size, error ); #else result = libuna_utf8_string_size_from_utf16_stream( &( reparse_point_values->reparse_data[ reparse_point_values->substitute_name_offset ] ), (size_t) reparse_point_values->substitute_name_size, LIBUNA_ENDIAN_LITTLE, &value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to determine size of substitute name string.", function ); goto on_error; } value_string = system_string_allocate( value_string_size ); if( value_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create substitute name string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libuna_utf16_string_copy_from_utf16_stream( (libuna_utf16_character_t *) value_string, value_string_size, &( reparse_point_values->reparse_data[ reparse_point_values->substitute_name_offset ] ), (size_t) reparse_point_values->substitute_name_size, LIBUNA_ENDIAN_LITTLE, error ); #else result = libuna_utf8_string_copy_from_utf16_stream( (libuna_utf8_character_t *) value_string, value_string_size, &( reparse_point_values->reparse_data[ reparse_point_values->substitute_name_offset ] ), (size_t) reparse_point_values->substitute_name_size, LIBUNA_ENDIAN_LITTLE, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to set substitute name string.", function ); goto on_error; } libcnotify_printf( "%s: substitute name\t\t: %" PRIs_SYSTEM "\n", function, value_string ); memory_free( value_string ); value_string = NULL; } #endif } if( reparse_point_values->print_name_size > 0 ) { if( reparse_point_values->print_name_offset >= reparse_point_values->reparse_data_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid print name offset value out of bounds.", function ); goto on_error; } if( reparse_point_values->print_name_size > ( reparse_point_values->reparse_data_size - reparse_point_values->print_name_offset ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid print name size value out of bounds.", function ); goto on_error; } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libuna_utf16_string_size_from_utf16_stream( &( reparse_point_values->reparse_data[ reparse_point_values->print_name_offset ] ), (size_t) reparse_point_values->print_name_size, LIBUNA_ENDIAN_LITTLE, &value_string_size, error ); #else result = libuna_utf8_string_size_from_utf16_stream( &( reparse_point_values->reparse_data[ reparse_point_values->print_name_offset ] ), (size_t) reparse_point_values->print_name_size, LIBUNA_ENDIAN_LITTLE, &value_string_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to determine size of print name string.", function ); goto on_error; } value_string = system_string_allocate( value_string_size ); if( value_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create print name string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libuna_utf16_string_copy_from_utf16_stream( (libuna_utf16_character_t *) value_string, value_string_size, &( reparse_point_values->reparse_data[ reparse_point_values->print_name_offset ] ), (size_t) reparse_point_values->print_name_size, LIBUNA_ENDIAN_LITTLE, error ); #else result = libuna_utf8_string_copy_from_utf16_stream( (libuna_utf8_character_t *) value_string, value_string_size, &( reparse_point_values->reparse_data[ reparse_point_values->print_name_offset ] ), (size_t) reparse_point_values->print_name_size, LIBUNA_ENDIAN_LITTLE, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to set print name string.", function ); goto on_error; } libcnotify_printf( "%s: print name\t\t\t: %" PRIs_SYSTEM "\n", function, value_string ); memory_free( value_string ); value_string = NULL; } #endif } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "\n" ); } #endif return( 1 ); on_error: #if defined( HAVE_DEBUG_OUTPUT ) if( value_string != NULL ) { memory_free( value_string ); } #endif if( reparse_point_values->reparse_data != NULL ) { memory_free( reparse_point_values->reparse_data ); reparse_point_values->reparse_data = NULL; } reparse_point_values->reparse_data_size = 0; return( -1 ); }
/* Sets an export path consisting of a base path and a suffix * Returns 1 if successful or -1 on error */ int export_handle_set_export_path( export_handle_t *export_handle, const system_character_t *base_path, size_t base_path_length, const system_character_t *suffix, size_t suffix_length, system_character_t **export_path, size_t *export_path_size, libcerror_error_t **error ) { static char *function = "export_handle_set_export_path"; if( export_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export handle.", function ); return( -1 ); } if( base_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid base path.", function ); return( -1 ); } if( base_path_length > (size_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid base path length value exceeds maximum.", function ); return( -1 ); } if( suffix == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid suffix.", function ); return( -1 ); } if( suffix_length > (size_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid suffix length value exceeds maximum.", function ); return( -1 ); } if( export_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export path.", function ); return( -1 ); } if( export_path_size == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export path size.", function ); return( -1 ); } if( *export_path != NULL ) { memory_free( *export_path ); *export_path = NULL; *export_path_size = 0; } *export_path_size = base_path_length + suffix_length + 1; *export_path = system_string_allocate( *export_path_size ); if( *export_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create export path.", function ); goto on_error; } if( system_string_copy( *export_path, base_path, base_path_length ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy base path to item export path.", function ); goto on_error; } if( system_string_copy( &( ( *export_path )[ base_path_length ] ), suffix, suffix_length ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy suffix to item export path.", function ); goto on_error; } ( *export_path )[ *export_path_size - 1 ] = 0; return( 1 ); on_error: if( *export_path != NULL ) { memory_free( *export_path ); *export_path = NULL; *export_path_size = 0; } return( -1 ); }
/* Exports the item * Returns 1 if successful or -1 on error */ int export_handle_export_item( export_handle_t *export_handle, libolecf_item_t *item, int item_index, int number_of_items, const system_character_t *export_path, size_t export_path_length, log_handle_t *log_handle, libcerror_error_t **error ) { libcfile_file_t *stream_data_file = NULL; system_character_t *item_name = NULL; system_character_t *item_path = NULL; system_character_t *sanitized_name = NULL; system_character_t *target_path = NULL; uint8_t *buffer = NULL; static char *function = "export_handle_export_item"; size_t buffer_size = EXPORT_HANDLE_BUFFER_SIZE; size_t item_name_size = 0; size_t item_path_size = 0; size_t minimum_item_name_size = 0; size_t read_size = 0; size_t sanitized_name_size = 0; size_t target_path_size = 0; ssize_t read_count = 0; ssize_t write_count = 0; uint32_t stream_data_size = 0; int print_count = 0; int result = 0; if( export_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export handle.", function ); return( -1 ); } if( item == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid item.", function ); return( -1 ); } if( export_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid export path.", function ); return( -1 ); } log_handle_printf( log_handle, "Processing item: %05d in path: %" PRIs_SYSTEM "%c\n", item_index, export_path, LIBCPATH_SEPARATOR ); /* Create the storage or stream directory */ #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libolecf_item_get_utf16_name_size( item, &item_name_size, error ); #else result = libolecf_item_get_utf8_name_size( item, &item_name_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve item name size.", function ); goto on_error; } minimum_item_name_size = item_name_size; if( minimum_item_name_size < 10 ) { minimum_item_name_size = 10; } item_name = system_string_allocate( minimum_item_name_size ); if( item_name == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create the item name.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libolecf_item_get_utf16_name( item, (uint16_t *) item_name, item_name_size, error ); #else result = libolecf_item_get_utf8_name( item, (uint8_t *) item_name, item_name_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve item name.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) if( libcpath_path_get_sanitized_filename_wide( item_name, item_name_size - 1, &sanitized_name, &sanitized_name_size, error ) != 1 ) #else if( libcpath_path_get_sanitized_filename( item_name, item_name_size - 1, &sanitized_name, &sanitized_name_size, error ) != 1 ) #endif { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to sanitize item name.", function ); goto on_error; } memory_free( item_name ); item_name = sanitized_name; item_name_size = sanitized_name_size; sanitized_name = NULL; sanitized_name_size = 0; #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcpath_path_join_wide( &item_path, &item_path_size, export_path, export_path_length, item_name, item_name_size - 1, error ); #else result = libcpath_path_join( &item_path, &item_path_size, export_path, export_path_length, item_name, item_name_size - 1, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create item path.", function ); goto on_error; } if( item_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid item path.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcfile_file_exists_wide( item_path, error ); #else result = libcfile_file_exists( item_path, error ); #endif if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_GENERIC, "%s: unable to determine if %" PRIs_SYSTEM " exists.", function, item_path ); goto on_error; } else if( result == 1 ) { memory_free( item_path ); item_path = NULL; print_count = system_string_sprintf( item_name, 10, _SYSTEM_STRING( "Item%05d" ), item_index + 1 ); if( ( print_count < 0 ) || ( print_count > 12 ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_SET_FAILED, "%s: unable to set item name.", function ); goto on_error; } item_name[ 9 ] = 0; item_name_size = 10; log_handle_printf( log_handle, "Item already exists defaulting to: %" PRIs_SYSTEM "\n", item_name ); #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcpath_path_join_wide( &item_path, &item_path_size, export_path, export_path_length, item_name, item_name_size - 1, error ); #else result = libcpath_path_join( &item_path, &item_path_size, export_path, export_path_length, item_name, item_name_size - 1, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create item path.", function ); goto on_error; } if( item_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid item path.", function ); goto on_error; } } memory_free( item_name ); item_name = NULL; #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcpath_path_make_directory_wide( item_path, error ); #else result = libcpath_path_make_directory( item_path, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_WRITE_FAILED, "%s: unable to make directory: %" PRIs_SYSTEM ".", function, item_path ); goto on_error; } log_handle_printf( log_handle, "Created directory: %" PRIs_SYSTEM ".\n", item_path ); /* Create the item file */ #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcpath_path_join_wide( &target_path, &target_path_size, item_path, item_path_size - 1, L"StreamData.bin", 14, error ); #else result = libcpath_path_join( &target_path, &target_path_size, item_path, item_path_size - 1, "StreamData.bin", 14, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create target path.", function ); goto on_error; } if( target_path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid target path.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcfile_file_exists_wide( target_path, error ); #else result = libcfile_file_exists( target_path, error ); #endif if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_GENERIC, "%s: unable to determine if %" PRIs_SYSTEM " exists.", function, target_path ); goto on_error; } else if( result != 0 ) { log_handle_printf( log_handle, "Skipping item: %" PRIs_SYSTEM " it already exists.\n", target_path ); memory_free( target_path ); memory_free( item_path ); return( 1 ); } if( libolecf_item_get_size( item, &stream_data_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve item stream data size.", function ); goto on_error; } if( libcfile_file_initialize( &stream_data_file, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create stream data file.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libcfile_file_open_wide( stream_data_file, target_path, LIBCFILE_OPEN_WRITE, error ); #else result = libcfile_file_open( stream_data_file, target_path, LIBCFILE_OPEN_WRITE, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_OPEN_FAILED, "%s: unable to open: %" PRIs_SYSTEM ".", function, target_path ); goto on_error; } memory_free( target_path ); target_path = NULL; if( stream_data_size > 0 ) { buffer = (uint8_t *) memory_allocate( sizeof( uint8_t ) * buffer_size ); if( buffer == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create the buffer.", function ); goto on_error; } while( stream_data_size > 0 ) { read_size = buffer_size; if( read_size > stream_data_size ) { read_size = stream_data_size; } read_count = libolecf_stream_read_buffer( item, buffer, read_size, error ); if( read_count != (ssize_t) read_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_READ_FAILED, "%s: unable to read stream data from item.", function ); goto on_error; } stream_data_size -= read_size; write_count = libcfile_file_write_buffer( stream_data_file, buffer, read_size, error ); if( write_count != (ssize_t) read_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_WRITE_FAILED, "%s: unable to write stream data to file.", function ); goto on_error; } } memory_free( buffer ); buffer = NULL; } if( libcfile_file_close( stream_data_file, error ) != 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_CLOSE_FAILED, "%s: unable to stream data file.", function ); goto on_error; } if( libcfile_file_free( &stream_data_file, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, "%s: unable to free stream data file.", function ); goto on_error; } /* Export the sub items */ if( export_handle_export_sub_items( export_handle, item, item_path, item_path_size - 1, log_handle, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_OUTPUT, LIBCERROR_OUTPUT_ERROR_GENERIC, "%s: unable to export sub items.", function ); goto on_error; } memory_free( item_path ); item_path = NULL; return( 1 ); on_error: if( buffer != NULL ) { memory_free( buffer ); } if( stream_data_file != NULL ) { libcfile_file_free( &stream_data_file, NULL ); } if( target_path != NULL ) { memory_free( target_path ); } if( item_path != NULL ) { memory_free( item_path ); } if( sanitized_name != NULL ) { memory_free( sanitized_name ); } if( item_name != NULL ) { memory_free( item_name ); } return( -1 ); }
/* Creates a (split) RAW filename * Returns 1 if successful or -1 on error */ int libsmraw_filename_create( system_character_t **filename, size_t *filename_size, system_character_t *basename, size_t basename_size, int number_of_segments, int segment_index, libcerror_error_t **error ) { static char *function = "libsmraw_filename_create"; size_t additional_length = 0; size_t filename_index = 0; if( filename == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid segment filename.", function ); return( -1 ); } if( *filename != NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, "%s: invalid segment filename already set.", function ); return( -1 ); } if( filename_size == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid segment filename size.", function ); return( -1 ); } if( basename == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid basename.", function ); return( -1 ); } if( basename_size > (size_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid basename size value exceeds maximum.", function ); return( -1 ); } if( ( number_of_segments < 0 ) || ( number_of_segments >= 1000 ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid number of segments value out of bounds.", function ); return( -1 ); } if( number_of_segments > 0 ) { if( ( segment_index < 0 ) || ( segment_index > number_of_segments ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid segment index value out of bounds.", function ); return( -1 ); } } if( number_of_segments == 1 ) { additional_length = 4; } else { additional_length = 8; } *filename_size = basename_size + additional_length; *filename = system_string_allocate( *filename_size ); if( *filename == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create segment filename.", function ); goto on_error; } if( system_string_copy( *filename, basename, basename_size - 1 ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy basename to segment filename.", function ); goto on_error; } filename_index = basename_size - 1; if( system_string_copy( &( ( *filename )[ filename_index ] ), _SYSTEM_STRING( ".raw" ), 4 ) == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy extension to segment filename.", function ); goto on_error; } filename_index += 4; if( number_of_segments != 1 ) { ( *filename )[ filename_index++ ] = (system_character_t) '.'; ( *filename )[ filename_index++ ] = (system_character_t) '0' + (system_character_t) ( segment_index / 100 ); segment_index %= 100; ( *filename )[ filename_index++ ] = (system_character_t) '0' + (system_character_t) ( segment_index / 10 ); segment_index %= 10; ( *filename )[ filename_index++ ] = (system_character_t) '0' + (system_character_t) segment_index; } ( *filename )[ filename_index ] = 0; return( 1 ); on_error: if( *filename != NULL ) { memory_free( *filename ); *filename = NULL; } *filename_size = 0; return( -1 ); }
/* Opens the registry file * Returns 1 if successful or -1 on error */ int registry_file_open( registry_file_t *registry_file, const system_character_t *filename, libcerror_error_t **error ) { system_character_t *name = NULL; libregf_key_t *sub_key = NULL; libregf_value_t *value = NULL; static char *function = "registry_file_open"; const char *sub_key_path = NULL; const char *value_name = NULL; size_t name_size = 0; size_t sub_key_path_length = 0; size_t value_name_length = 0; int number_of_sub_keys = 0; int result = 0; if( registry_file == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid registry file.", function ); return( -1 ); } if( registry_file->is_open != 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, "%s: invalid registry file already open.", function ); return( -1 ); } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) if( libregf_file_open_wide( registry_file->regf_file, filename, LIBREGF_OPEN_READ, error ) != 1 ) #else if( libregf_file_open( registry_file->regf_file, filename, LIBREGF_OPEN_READ, error ) != 1 ) #endif { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_OPEN_FAILED, "%s: unable to open REGF file.", function ); goto on_error; } if( libregf_file_get_root_key( registry_file->regf_file, &( registry_file->root_key ), error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve root key.", function ); goto on_error; } if( libregf_key_get_number_of_sub_keys( registry_file->root_key, &number_of_sub_keys, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of sub keys.", function ); goto on_error; } if( number_of_sub_keys == 1 ) { #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_key_get_utf16_name_size( registry_file->root_key, &name_size, error ); #else result = libregf_key_get_utf8_name_size( registry_file->root_key, &name_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve root key name size.", function ); goto on_error; } if( ( result != 0 ) && ( name_size > 0 ) ) { if( ( name_size > (size_t) SSIZE_MAX ) || ( ( sizeof( system_character_t ) * name_size ) > (size_t) SSIZE_MAX ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid name size value exceeds maximum.", function ); goto on_error; } name = system_string_allocate( name_size ); if( name == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create name string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libregf_key_get_utf16_name( registry_file->root_key, (uint16_t *) name, name_size, error ); #else result = libregf_key_get_utf8_name( registry_file->root_key, (uint8_t *) name, name_size, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve root key name.", function ); goto on_error; } result = 0; /* TODO what about Windows NT4 */ if( name_size == 13 ) { /* Root key used by Windows 2000, XP, 2003 */ if( system_string_compare_no_case( name, _SYSTEM_STRING( "$$$PROTO.HIV" ), 12 ) == 0 ) { result = 1; } } else if( name_size == 53 ) { /* Root key used by Windows Vista, 2008, 7 */ if( system_string_compare_no_case( name, _SYSTEM_STRING( "CMI-CreateHive{" ), 15 ) == 0 ) { if( name[ 51 ] == (system_character_t) '}' ) { result = 1; } } } else if( name_size == 58 ) { /* Root key used by Windows 8 */ if( system_string_compare_no_case( name, _SYSTEM_STRING( "CsiTool-CreateHive-{" ), 20 ) == 0 ) { if( name[ 56 ] == (system_character_t) '}' ) { result = 1; } } } memory_free( name ); name = NULL; } if( result != 0 ) { if( libregf_key_get_sub_key( registry_file->root_key, 0, &( registry_file->base_key ), error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve base key.", function ); goto on_error; } } } else if( number_of_sub_keys > 1 ) { registry_file->base_key = registry_file->root_key; } if( libregf_key_get_number_of_sub_keys( registry_file->base_key, &number_of_sub_keys, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of sub keys.", function ); goto on_error; } /* Get the current control set from: * SYSTEM\Select\Current */ sub_key_path = "Select"; sub_key_path_length = narrow_string_length( sub_key_path ); result = libregf_key_get_sub_key_by_utf8_path( registry_file->base_key, (uint8_t *) sub_key_path, sub_key_path_length, &sub_key, error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve sub key: %s.", function, sub_key_path ); goto on_error; } else if( result != 0 ) { value_name = "Current"; value_name_length = narrow_string_length( value_name ); result = libregf_key_get_value_by_utf8_name( sub_key, (uint8_t *) value_name, value_name_length, &value, error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value: %s.", function, value_name ); goto on_error; } else if( result != 0 ) { if( libregf_value_get_value_32bit( value, &( registry_file->current_control_set ), error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve 32-bit value: %s.", function, value_name ); goto on_error; } if( libregf_value_free( &value, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, "%s: unable to free value.", function ); goto on_error; } } } if( libregf_key_free( &sub_key, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, "%s: unable to free sub key.", function ); goto on_error; } /* Retrieve the control set 1 key: SYSTEM\ControlSet001 */ sub_key_path = "ControlSet001"; sub_key_path_length = narrow_string_length( sub_key_path ); result = libregf_key_get_sub_key_by_utf8_path( registry_file->base_key, (uint8_t *) sub_key_path, sub_key_path_length, &( registry_file->control_set1_key ), error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve sub key: %s.", function, sub_key_path ); goto on_error; } /* Retrieve the control set 2 key: SYSTEM\ControlSet002 */ sub_key_path = "ControlSet002"; sub_key_path_length = narrow_string_length( sub_key_path ); result = libregf_key_get_sub_key_by_utf8_path( registry_file->base_key, (uint8_t *) sub_key_path, sub_key_path_length, &( registry_file->control_set2_key ), error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve sub key: %s.", function, sub_key_path ); goto on_error; } if( ( registry_file->current_control_set != 0 ) || ( registry_file->control_set1_key != NULL ) || ( registry_file->control_set2_key != NULL ) ) { if( ( registry_file->current_control_set != 1 ) && ( registry_file->current_control_set != 2 ) ) { /* TODO print debug notification */ registry_file->current_control_set = 1; } if( ( registry_file->current_control_set == 1 ) && ( registry_file->control_set1_key != NULL ) ) { registry_file->current_control_set_key = registry_file->control_set1_key; } else if( ( registry_file->current_control_set == 2 ) && ( registry_file->control_set2_key != NULL ) ) { registry_file->current_control_set_key = registry_file->control_set2_key; } } registry_file->is_open = 1; return( 1 ); on_error: if( value != NULL ) { libregf_value_free( &value, NULL ); } if( sub_key != NULL ) { libregf_key_free( &sub_key, NULL ); } if( registry_file->control_set2_key != NULL ) { libregf_key_free( &( registry_file->control_set2_key ), NULL ); } if( registry_file->control_set1_key != NULL ) { libregf_key_free( &( registry_file->control_set1_key ), NULL ); } if( ( registry_file->base_key != NULL ) && ( registry_file->base_key != registry_file->root_key ) ) { libregf_key_free( &( registry_file->base_key ), NULL ); } if( name != NULL ) { memory_free( name ); } if( registry_file->root_key != NULL ) { libregf_key_free( &( registry_file->root_key ), NULL ); } libregf_file_close( registry_file->regf_file, NULL ); return( -1 ); }
/* Converts an access control entry stored in a byte stream into a runtime version * Returns 1 if successful or -1 on error */ int libfwnt_access_control_entry_copy_from_byte_stream( libfwnt_access_control_entry_t *access_control_entry, const uint8_t *byte_stream, size_t byte_stream_size, int byte_order, libcerror_error_t **error ) { libfwnt_internal_access_control_entry_t *internal_access_control_entry = NULL; static char *function = "libfwnt_access_control_entry_copy_from_byte_stream"; size_t access_mask_offset = 0; size_t sid_offset = 0; #if defined( HAVE_DEBUG_OUTPUT ) system_character_t *sid_string = NULL; size_t sid_string_size = 0; int result = 0; #endif if( access_control_entry == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid access control entry.", function ); return( -1 ); } internal_access_control_entry = (libfwnt_internal_access_control_entry_t *) access_control_entry; if( byte_stream == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid byte stream.", function ); return( -1 ); } if( byte_stream_size < 4 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL, "%s: byte stream too small.", function ); return( -1 ); } if( byte_stream_size > (size_t) SSIZE_MAX ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: byte stream size exceeds maximum.", function ); return( -1 ); } if( byte_order != LIBFWNT_ENDIAN_LITTLE ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE, "%s: unsupported byte order.", function ); return( -1 ); } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: header data:\n", function ); libcnotify_print_data( byte_stream, 4, 0 ); } #endif internal_access_control_entry->type = byte_stream[ 0 ]; internal_access_control_entry->flags = byte_stream[ 1 ]; byte_stream_copy_to_uint16_little_endian( &( byte_stream[ 2 ] ), internal_access_control_entry->size ); #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: type\t\t: %" PRIu8 " (%s)\n", function, internal_access_control_entry->type, libfwnt_debug_print_access_control_entry_type( internal_access_control_entry->type ) ); libcnotify_printf( "%s: flags\t\t: 0x%02" PRIx8 "\n", function, internal_access_control_entry->flags ); libfwnt_debug_print_access_control_entry_flags( internal_access_control_entry->flags ); libcnotify_printf( "\n" ); libcnotify_printf( "%s: size\t\t: %" PRIu16 "\n", function, internal_access_control_entry->size ); libcnotify_printf( "\n" ); } #endif if( ( internal_access_control_entry->size < 4 ) || ( (size_t) internal_access_control_entry->size > byte_stream_size ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: access control entry size value out of bounds.", function ); goto on_error; } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: access control entry data:\n", function ); libcnotify_print_data( &( byte_stream[ 4 ] ), internal_access_control_entry->size - 4, 0 ); } #endif switch( internal_access_control_entry->type ) { /* Basic types */ case LIBFWNT_ACCESS_ALLOWED: case LIBFWNT_ACCESS_DENIED: case LIBFWNT_SYSTEM_AUDIT: case LIBFWNT_SYSTEM_ALARM: case LIBFWNT_ACCESS_ALLOWED_CALLBACK: case LIBFWNT_ACCESS_DENIED_CALLBACK: case LIBFWNT_SYSTEM_AUDIT_CALLBACK: case LIBFWNT_SYSTEM_ALARM_CALLBACK: case LIBFWNT_SYSTEM_MANDATORY_LABEL: access_mask_offset = 4; sid_offset = 8; break; /* Object types */ case LIBFWNT_ACCESS_ALLOWED_OBJECT: case LIBFWNT_ACCESS_DENIED_OBJECT: case LIBFWNT_SYSTEM_AUDIT_OBJECT: case LIBFWNT_SYSTEM_ALARM_OBJECT: case LIBFWNT_ACCESS_ALLOWED_CALLBACK_OBJECT: case LIBFWNT_ACCESS_DENIED_CALLBACK_OBJECT: case LIBFWNT_SYSTEM_AUDIT_CALLBACK_OBJECT: case LIBFWNT_SYSTEM_ALARM_CALLBACK_OBJECT: access_mask_offset = 4; sid_offset = 40; break; /* Unknown types */ case LIBFWNT_ACCESS_ALLOWED_COMPOUND: default: break; } if( access_mask_offset > 0 ) { byte_stream_copy_to_uint32_little_endian( &( byte_stream[ access_mask_offset ] ), internal_access_control_entry->access_mask ); #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "%s: access mask\t\t: 0x%08" PRIx32 "\n", function, internal_access_control_entry->access_mask ); libfwnt_debug_print_access_control_entry_access_mask( internal_access_control_entry->access_mask ); libcnotify_printf( "\n" ); } #endif } if( sid_offset > 0 ) { if( sid_offset > byte_stream_size ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: security identifier offset value out of bounds.", function ); goto on_error; } if( libfwnt_security_identifier_initialize( &( internal_access_control_entry->security_identifier ), error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to create security identifier.", function ); goto on_error; } if( internal_access_control_entry->security_identifier == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid access control entry - missing owner security identifier.", function ); goto on_error; } ( (libfwnt_internal_security_identifier_t *) internal_access_control_entry->security_identifier )->is_managed = 1; if( libfwnt_security_identifier_copy_from_byte_stream( internal_access_control_entry->security_identifier, &( byte_stream[ sid_offset ] ), byte_stream_size - sid_offset, byte_order, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy security identifier from byte stream.", function ); goto on_error; } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { if( libfwnt_security_identifier_get_string_size( internal_access_control_entry->security_identifier, &sid_string_size, 0, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve security identifier string size.", function ); goto on_error; } libcnotify_printf( "%s: SID\t\t\t: ", function ); if( sid_string_size > 0 ) { sid_string = system_string_allocate( sid_string_size ); if( sid_string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_MEMORY, LIBCERROR_MEMORY_ERROR_INSUFFICIENT, "%s: unable to create security identifier string.", function ); goto on_error; } #if defined( HAVE_WIDE_SYSTEM_CHARACTER ) result = libfwnt_security_identifier_copy_to_utf16_string( internal_access_control_entry->security_identifier, (uint16_t *) sid_string, sid_string_size, 0, error ); #else result = libfwnt_security_identifier_copy_to_utf8_string( internal_access_control_entry->security_identifier, (uint8_t *) sid_string, sid_string_size, 0, error ); #endif if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_COPY_FAILED, "%s: unable to copy security identifier to string.", function ); goto on_error; } libcnotify_printf( "%" PRIs_SYSTEM "", sid_string ); memory_free( sid_string ); sid_string = NULL; } libcnotify_printf( "\n" ); } #endif } #if defined( HAVE_DEBUG_OUTPUT ) if( libcnotify_verbose != 0 ) { libcnotify_printf( "\n" ); } #endif return( 1 ); on_error: #if defined( HAVE_DEBUG_OUTPUT ) if( sid_string != NULL ) { memory_free( sid_string ); } #endif if( internal_access_control_entry->security_identifier != NULL ) { libfwnt_internal_security_identifier_free( (libfwnt_internal_security_identifier_t **) &( internal_access_control_entry->security_identifier ), NULL ); } return( -1 ); }