/* Retrieves the UTF-16 encoded computer name
* The size should include the end of string character
* Returns 1 if successful, 0 if not available or -1 on error
*/
int libevt_record_get_utf16_computer_name(
libevt_record_t *record,
uint16_t *utf16_string,
size_t utf16_string_size,
libcerror_error_t **error )
{
libevt_internal_record_t *internal_record = NULL;
static char *function = "libevt_record_get_utf16_computer_name";
if( record == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record.",
function );
return( -1 );
}
internal_record = (libevt_internal_record_t *) record;
if( internal_record->record_values == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid internal record - missing record values.",
function );
return( -1 );
}
if( libfvalue_value_copy_to_utf16_string(
internal_record->record_values->computer_name,
0,
utf16_string,
utf16_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy computer name to UTF-16 string.",
function );
return( -1 );
}
return( 1 );
}
/* Retrieves a specific UTF-16 formatted string
* Returns 1 if successful or -1 on error
*/
int libwrc_string_get_utf16_string(
libwrc_resource_t *resource,
uint32_t language_identifier,
int string_index,
uint16_t *utf16_string,
size_t utf16_string_size,
libcerror_error_t **error )
{
libfvalue_value_t *string_values = NULL;
static char *function = "libwrc_string_get_utf16_string";
if( libwrc_resource_get_value_by_language_identifier(
resource,
LIBWRC_RESOURCE_TYPE_STRING,
language_identifier,
string_index,
(intptr_t **) &string_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve string values.",
function );
return( -1 );
}
if( libfvalue_value_copy_to_utf16_string(
string_values,
0,
utf16_string,
utf16_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy string value: %d to UTF-16 string.",
function,
string_index );
return( -1 );
}
return( 1 );
}
/* Retrieves a specific UTF-16 encoded string
* The size should include the end of string character
* Returns 1 if successful or -1 on error
*/
int libevt_record_get_utf16_string(
libevt_record_t *record,
int string_index,
uint16_t *utf16_string,
size_t utf16_string_size,
libcerror_error_t **error )
{
libevt_internal_record_t *internal_record = NULL;
static char *function = "libevt_record_get_utf16_string";
if( record == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record.",
function );
return( -1 );
}
internal_record = (libevt_internal_record_t *) record;
if( internal_record->record_values == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid internal record - missing record values.",
function );
return( -1 );
}
if( internal_record->record_values->strings == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid string index value out of bounds.",
function );
return( -1 );
}
if( libfvalue_value_copy_to_utf16_string(
internal_record->record_values->strings,
string_index,
utf16_string,
utf16_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy strings value entry: %d to UTF-16 string.",
function,
string_index );
return( -1 );
}
return( 1 );
}
/* Retrieves the UTF-16 encoded location
* The size should include the end of string character
* Returns 1 if successful, 0 if no location or -1 on error
*/
int libmsiecf_redirected_get_utf16_location(
libmsiecf_item_t *redirected,
uint16_t *utf16_string,
size_t utf16_string_size,
libcerror_error_t **error )
{
libmsiecf_internal_item_t *internal_item = NULL;
static char *function = "libmsiecf_redirected_get_utf16_location";
if( redirected == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid redirected.",
function );
return( -1 );
}
internal_item = (libmsiecf_internal_item_t *) redirected;
if( internal_item->item_descriptor == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid item - missing item descriptor.",
function );
return( -1 );
}
if( internal_item->item_descriptor->type != LIBMSIECF_ITEM_TYPE_REDIRECTED )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
"%s: unsupported item type: %" PRIu8 ".",
function,
internal_item->item_descriptor->type );
return( -1 );
}
if( internal_item->value == NULL )
{
if( libmsiecf_item_read_values(
internal_item,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_IO,
LIBCERROR_IO_ERROR_READ_FAILED,
"%s: unable to read item values.",
function );
return( -1 );
}
if( internal_item->value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
"%s: invalid item values.",
function );
return( -1 );
}
}
if( ( (libmsiecf_redirected_values_t *) internal_item->value )->location == NULL )
{
return( 0 );
}
if( libfvalue_value_copy_to_utf16_string(
( (libmsiecf_redirected_values_t *) internal_item->value )->location,
0,
utf16_string,
utf16_string_size,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy location to UTF-16 string.",
function );
return( -1 );
}
return( 1 );
}
/* Retrieves the UTF-16 encoded string
* The size should include the end of string character
* Returns 1 if successful, 0 if value is NULL or -1 on error
*/
int libesedb_record_value_get_utf16_string(
libfvalue_value_t *record_value,
uint16_t *utf16_string,
size_t utf16_string_size,
libcerror_error_t **error )
{
uint8_t *entry_data = NULL;
static char *function = "libesedb_record_value_get_utf16_string";
size_t entry_data_size = 0;
uint32_t data_flags = 0;
int encoding = 0;
int result = 0;
if( record_value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record value.",
function );
return( -1 );
}
result = libfvalue_value_has_data(
record_value,
error );
if( result == -1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to determine if record value has data.",
function );
return( -1 );
}
else if( result != 0 )
{
if( libfvalue_value_get_data_flags(
record_value,
&data_flags,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve data flags.",
function );
return( -1 );
}
if( ( data_flags & LIBESEDB_VALUE_FLAG_MULTI_VALUE ) != 0 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
"%s: unsupported data flags: 0x%02" PRIx32 ".",
function,
data_flags );
return( -1 );
}
if( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 )
{
if( libfvalue_value_get_entry_data(
record_value,
0,
&entry_data,
&entry_data_size,
&encoding,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve record value entry data.",
function );
return( -1 );
}
result = libesedb_compression_copy_to_utf16_string(
entry_data,
entry_data_size,
utf16_string,
utf16_string_size,
error );
}
else
{
result = libfvalue_value_copy_to_utf16_string(
record_value,
0,
utf16_string,
utf16_string_size,
error );
}
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy value to UTF-16 string.",
function );
return( -1 );
}
}
return( result );
}
/* Retrieves the UTF-16 encoded string value of a specific value of the multi value
* The size should include the end of string character
* Returns 1 if successful or -1 on error
*/
int libesedb_multi_value_get_value_utf16_string(
libesedb_multi_value_t *multi_value,
int multi_value_index,
uint16_t *utf16_string,
size_t utf16_string_size,
libcerror_error_t **error )
{
libesedb_internal_multi_value_t *internal_multi_value = NULL;
uint8_t *entry_data = NULL;
static char *function = "libesedb_multi_value_get_value_utf16_string";
size_t entry_data_size = 0;
uint32_t column_type = 0;
uint32_t data_flags = 0;
int encoding = 0;
int result = 0;
if( multi_value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid multi value.",
function );
return( -1 );
}
internal_multi_value = (libesedb_internal_multi_value_t *) multi_value;
if( libesedb_catalog_definition_get_column_type(
internal_multi_value->column_catalog_definition,
&column_type,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve catalog definition column type.",
function );
return( -1 );
}
if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT )
&& ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
"%s: unsupported column type: %" PRIu32 ".",
function,
column_type );
return( -1 );
}
if( libfvalue_value_get_data_flags(
internal_multi_value->record_value,
&data_flags,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve value data flags.",
function );
return( -1 );
}
if( ( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 )
&& ( multi_value_index == 0 ) )
{
if( libfvalue_value_get_entry_data(
internal_multi_value->record_value,
multi_value_index,
&entry_data,
&entry_data_size,
&encoding,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve record value entry: %d data.",
function,
multi_value_index );
return( -1 );
}
result = libesedb_compression_copy_to_utf16_string(
entry_data,
entry_data_size,
utf16_string,
utf16_string_size,
error );
}
else
{
result = libfvalue_value_copy_to_utf16_string(
internal_multi_value->record_value,
multi_value_index,
utf16_string,
utf16_string_size,
error );
}
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
"%s: unable to copy value entry: %d to UTF-16 string.",
function,
multi_value_index );
return( -1 );
}
return( 1 );
}
