hivex: More debugging around nk 'unknown2' field.

[hivex.git] / hivex / hivex.c

diff --git a/hivex/hivex.c b/hivex/hivex.c
index c8257a3..2a094b8 100644 (file)
--- a/hivex/hivex.c
+++ b/hivex/hivex.c
@@ -195,7 +195,7 @@ struct ntreg_nk_record {
 
 struct ntreg_lf_record {
   int32_t seg_len;
-  char id[2];                   /* "lf" */
+  char id[2];                   /* "lf"|"lh" */
   uint16_t nr_keys;             /* number of keys in this record */
   struct {
     uint32_t offset;            /* offset of nk-record for this subkey */
@@ -735,7 +735,7 @@ get_children (hive_h *h, hive_node_h node,
   subkey_lf += 0x1000;
   if (!IS_VALID_BLOCK (h, subkey_lf)) {
     if (h->msglvl >= 2)
-      fprintf (stderr, "hivex_node_children: returning EFAULT because subkey_lf is not a valid block (%zu)\n",
+      fprintf (stderr, "hivex_node_children: returning EFAULT because subkey_lf is not a valid block (0x%zx)\n",
                subkey_lf);
     errno = EFAULT;
     goto error;
@@ -803,7 +803,7 @@ get_children (hive_h *h, hive_node_h node,
     /* Count total number of children. */
     size_t i, count = 0;
     for (i = 0; i < nr_offsets; ++i) {
-      hive_node_h offset = ri->offset[i];
+      hive_node_h offset = le32toh (ri->offset[i]);
       offset += 0x1000;
       if (!IS_VALID_BLOCK (h, offset)) {
         if (h->msglvl >= 2)
@@ -813,6 +813,9 @@ get_children (hive_h *h, hive_node_h node,
         goto error;
       }
       if (!BLOCK_ID_EQ (h, offset, "lf") && !BLOCK_ID_EQ (h, offset, "lh")) {
+        if (h->msglvl >= 2)
+          fprintf (stderr, "get_children: returning ENOTSUP because ri-record offset does not point to lf/lh (0x%zx)\n",
+                   offset);
         errno = ENOTSUP;
         goto error;
       }
@@ -839,7 +842,7 @@ get_children (hive_h *h, hive_node_h node,
      * something reasonable above.
      */
     for (i = 0; i < nr_offsets; ++i) {
-      hive_node_h offset = ri->offset[i];
+      hive_node_h offset = le32toh (ri->offset[i]);
       offset += 0x1000;
       if (!IS_VALID_BLOCK (h, offset)) {
         if (h->msglvl >= 2)
@@ -849,6 +852,9 @@ get_children (hive_h *h, hive_node_h node,
         goto error;
       }
       if (!BLOCK_ID_EQ (h, offset, "lf") && !BLOCK_ID_EQ (h, offset, "lh")) {
+        if (h->msglvl >= 2)
+          fprintf (stderr, "get_children: returning ENOTSUP because ri-record offset does not point to lf/lh (0x%zx)\n",
+                   offset);
         errno = ENOTSUP;
         goto error;
       }
@@ -876,6 +882,9 @@ get_children (hive_h *h, hive_node_h node,
     goto ok;
   }
   /* else not supported, set errno and fall through */
+  if (h->msglvl >= 2)
+    fprintf (stderr, "get_children: returning ENOTSUP because subkey block is not lf/lh/ri (0x%zx, %d, %d)\n",
+             subkey_lf, block->id[0], block->id[1]);
   errno = ENOTSUP;
  error:
   free_offset_list (&children);
@@ -1838,6 +1847,8 @@ allocate_block (hive_h *h, size_t seg_len, const char id[2])
     blockhdr->id[1] = id[1];
   }
 
+  BITMAP_SET (h->bitmap, offset);
+
   h->endblocks += seg_len;
 
   /* If there is space after the last block in the last page, then we