int af_get_segq(AFFILE *af,const char *name,int64_t *aff_quad)
{
unsigned char buf[8];
size_t bufsize = sizeof(buf);
if(af_get_seg(af,name,0,(unsigned char *)&buf,&bufsize)){
return -1; // couldn't get it...
}
if(bufsize!=sizeof(struct aff_quad)){ // make sure size is good.
return -1;
}
*aff_quad = af_decode_q(buf);
return 0;
}
int AffNode::addSegmentAttribute(Attributes* vmap, AFFILE* af, const char* segname)
{
#ifdef NEW_AFF_LIB
uint32_t arg;
#else
unsigned long arg;
#endif
unsigned char *data = 0;
if (segname[0] == 0)
return (0);
size_t data_len = 0;
if(af_get_seg(af, segname, &arg, 0, &data_len))
{
return (0);
}
data = (unsigned char *)malloc(data_len);
if(af_get_seg(af, segname, 0, data, &data_len))
{
free(data);
return (0);
}
if(strcmp(segname, AF_ACQUISITION_SECONDS) == 0)
{
int hours = arg / 3600;
int minutes = (arg / 60) % 60;
int seconds = arg % 60;
vtime* time = new vtime;
time->hour = hours;
time->minute = minutes;
time->second = seconds;
(*vmap)[std::string(segname)] = new Variant(time);
free(data);
return (1);
}
if(((arg == AF_SEG_QUADWORD) && (data_len==8)) || af_display_as_quad(segname))
{
switch(data_len)
{
case 8:
(*vmap)[segname] = new Variant(af_decode_q(data));
break;
case 0:
(*vmap)[segname] = new Variant(0);
break;
default:
(*vmap)[segname] = new Variant(std::string("Cannot decode segment"));
}
free(data);
return (1);
}
if (data_len == 0 && arg != 0)
{
(*vmap)[std::string(segname)] = new Variant((uint64_t)arg);
free(data);
return (1);
}
if(af_display_as_hex(segname) || (data_len == 16 && strstr(segname, "md5")) || (data_len == 20 && strstr(segname, "sha1")))
{
char buf[80];
af_hexbuf(buf, sizeof(buf), data, data_len, AF_HEXBUF_NO_SPACES);
(*vmap)[std::string(segname)] = new Variant(std::string(buf));
free(data);
return (1);
}
else
{
(*vmap)[segname] = new Variant(std::string((char *)data));
free(data);
return (1);
}
}
