/* Retrieves the size of the UTF-16 encoded computer name * The returned size includes the end of string character * Returns 1 if successful, 0 if not available or -1 on error */ int libevt_record_get_utf16_computer_name_size( libevt_record_t *record, size_t *utf16_string_size, libcerror_error_t **error ) { libevt_internal_record_t *internal_record = NULL; static char *function = "libevt_record_get_utf16_computer_name_size"; if( record == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid record.", function ); return( -1 ); } internal_record = (libevt_internal_record_t *) record; if( internal_record->record_values == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid internal record - missing record values.", function ); return( -1 ); } if( libfvalue_value_get_utf16_string_size( internal_record->record_values->computer_name, 0, utf16_string_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve UTF-16 string size.", function ); return( -1 ); } return( 1 ); }
/* Retrieves the size of a specific UTF-16 formatted string * Returns 1 if successful or -1 on error */ int libwrc_string_get_utf16_string_size( libwrc_resource_t *resource, uint32_t language_identifier, int string_index, size_t *utf16_string_size, libcerror_error_t **error ) { libfvalue_value_t *string_values = NULL; static char *function = "libwrc_string_get_utf16_string_size"; if( libwrc_resource_get_value_by_language_identifier( resource, LIBWRC_RESOURCE_TYPE_STRING, language_identifier, string_index, (intptr_t **) &string_values, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve string values.", function ); return( -1 ); } if( libfvalue_value_get_utf16_string_size( string_values, 0, utf16_string_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve UTF-16 string size of string value: %d.", function, string_index ); return( -1 ); } return( 1 ); }
/* Retrieves the size of a specific UTF-16 encoded string * The returned size includes the end of string character * Returns 1 if successful or -1 on error */ int libevt_record_get_utf16_string_size( libevt_record_t *record, int string_index, size_t *utf16_string_size, libcerror_error_t **error ) { libevt_internal_record_t *internal_record = NULL; static char *function = "libevt_record_get_utf16_string_size"; if( record == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid record.", function ); return( -1 ); } internal_record = (libevt_internal_record_t *) record; if( internal_record->record_values == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid internal record - missing record values.", function ); return( -1 ); } if( internal_record->record_values->strings == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid string index value out of bounds.", function ); return( -1 ); } if( libfvalue_value_get_utf16_string_size( internal_record->record_values->strings, string_index, utf16_string_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve UTF-16 string size of strings value entry: %d.", function, string_index ); return( -1 ); } return( 1 ); }
/* Retrieves the size of the UTF-16 encoded location * The returned size includes the end of string character * Returns 1 if successful, 0 if no location or -1 on error */ int libmsiecf_redirected_get_utf16_location_size( libmsiecf_item_t *redirected, size_t *utf16_string_size, libcerror_error_t **error ) { libmsiecf_internal_item_t *internal_item = NULL; static char *function = "libmsiecf_redirected_get_utf16_location_size"; if( redirected == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid redirected.", function ); return( -1 ); } internal_item = (libmsiecf_internal_item_t *) redirected; if( internal_item->item_descriptor == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid item - missing item descriptor.", function ); return( -1 ); } if( internal_item->item_descriptor->type != LIBMSIECF_ITEM_TYPE_REDIRECTED ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE, "%s: unsupported item type: %" PRIu8 ".", function, internal_item->item_descriptor->type ); return( -1 ); } if( internal_item->value == NULL ) { if( libmsiecf_item_read_values( internal_item, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_IO, LIBCERROR_IO_ERROR_READ_FAILED, "%s: unable to read item values.", function ); return( -1 ); } if( internal_item->value == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid item values.", function ); return( -1 ); } } if( ( (libmsiecf_redirected_values_t *) internal_item->value )->location == NULL ) { return( 0 ); } if( libfvalue_value_get_utf16_string_size( ( (libmsiecf_redirected_values_t *) internal_item->value )->location, 0, utf16_string_size, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve location UTF-16 string size.", function ); return( -1 ); } return( 1 ); }
/* Retrieves the size of an UTF-16 string * The returned size includes the end of string character * Returns 1 if successful, 0 if value is NULL or -1 on error */ int libesedb_record_value_get_utf16_string_size( libfvalue_value_t *record_value, size_t *utf16_string_size, libcerror_error_t **error ) { uint8_t *entry_data = NULL; static char *function = "libesedb_record_value_get_utf16_string_size"; size_t entry_data_size = 0; uint32_t data_flags = 0; int encoding = 0; int result = 0; if( record_value == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid record value.", function ); return( -1 ); } result = libfvalue_value_has_data( record_value, error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to determine if record value has data.", function ); return( -1 ); } else if( result != 0 ) { if( libfvalue_value_get_data_flags( record_value, &data_flags, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve data flags.", function ); return( -1 ); } if( ( data_flags & LIBESEDB_VALUE_FLAG_MULTI_VALUE ) != 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, "%s: unsupported data flags: 0x%02" PRIx32 ".", function, data_flags ); return( -1 ); } if( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 ) { if( libfvalue_value_get_entry_data( record_value, 0, &entry_data, &entry_data_size, &encoding, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve record value entry data.", function ); return( -1 ); } result = libesedb_compression_get_utf16_string_size( entry_data, entry_data_size, utf16_string_size, error ); } else { result = libfvalue_value_get_utf16_string_size( record_value, 0, utf16_string_size, error ); } if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable retrieve UTF-16 string size.", function ); return( -1 ); } } return( result ); }
/* Retrieves the size of the UTF-16 encoded string of a specific value of the multi value * The returned size includes the end of string character * Returns 1 if successful or -1 on error */ int libesedb_multi_value_get_value_utf16_string_size( libesedb_multi_value_t *multi_value, int multi_value_index, size_t *utf16_string_size, libcerror_error_t **error ) { libesedb_internal_multi_value_t *internal_multi_value = NULL; uint8_t *entry_data = NULL; static char *function = "libesedb_multi_value_get_value_utf16_string_size"; size_t entry_data_size = 0; uint32_t column_type = 0; uint32_t data_flags = 0; int encoding = 0; int result = 0; if( multi_value == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid multi value.", function ); return( -1 ); } internal_multi_value = (libesedb_internal_multi_value_t *) multi_value; if( libesedb_catalog_definition_get_column_type( internal_multi_value->column_catalog_definition, &column_type, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve catalog definition column type.", function ); return( -1 ); } if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT ) && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE, "%s: unsupported column type: %" PRIu32 ".", function, column_type ); return( -1 ); } if( libfvalue_value_get_data_flags( internal_multi_value->record_value, &data_flags, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value data flags.", function ); return( -1 ); } if( ( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 ) && ( multi_value_index == 0 ) ) { if( libfvalue_value_get_entry_data( internal_multi_value->record_value, multi_value_index, &entry_data, &entry_data_size, &encoding, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve record value entry: %d data.", function, multi_value_index ); return( -1 ); } result = libesedb_compression_get_utf16_string_size( entry_data, entry_data_size, utf16_string_size, error ); } else { result = libfvalue_value_get_utf16_string_size( internal_multi_value->record_value, multi_value_index, utf16_string_size, error ); } if( result != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable retrieve UTF-16 string size: %d.", function, multi_value_index ); return( -1 ); } return( 1 ); }