#include <unistd.h>
#include <errno.h>
#include <time.h>
+#include <locale.h>
+
+#ifdef HAVE_LIBINTL_H
+#include <libintl.h>
+#endif
+
+#include <getopt.h>
#include <libxml/xmlwriter.h>
main (int argc, char *argv[])
{
setlocale (LC_ALL, "");
+#ifdef HAVE_BINDTEXTDOMAIN
bindtextdomain (PACKAGE, LOCALEBASEDIR);
textdomain (PACKAGE);
+#endif
int c;
int open_flags = 0;
* fiwalk.cpp.
*
* The caller should free the returned buffer.
+ *
+ * This function returns NULL on a 0 input. In the context of
+ * hives, which only have mtimes, 0 will always be a complete
+ * absence of data.
*/
#define WINDOWS_TICK 10000000LL
time_t t;
struct tm *tm;
+ if (windows_ticks == 0LL)
+ return NULL;
+
t = windows_ticks / WINDOWS_TICK - SEC_TO_UNIX_EPOCH;
tm = gmtime (&t);
if (tm == NULL)
XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node"));
XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "name", BAD_CAST name));
+ if (node == hivex_root (h)) {
+ XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "root", BAD_CAST "1"));
+ }
+
last_modified = hivex_node_timestamp (h, node);
if (last_modified >= 0) {
timebuf = filetime_to_8601 (last_modified);
}
start_value (writer, key, type, NULL);
+ XML_CHECK (xmlTextWriterStartAttribute, (writer, BAD_CAST "value"));
XML_CHECK (xmlTextWriterWriteString, (writer, BAD_CAST str));
+ XML_CHECK (xmlTextWriterEndAttribute, (writer));
end_value (writer);
return 0;
}
}
start_value (writer, key, type, "base64");
+ XML_CHECK (xmlTextWriterStartAttribute, (writer, BAD_CAST "value"));
XML_CHECK (xmlTextWriterWriteBase64, (writer, str, 0, len));
+ XML_CHECK (xmlTextWriterEndAttribute, (writer));
end_value (writer);
return 0;
{
xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v;
start_value (writer, key, "int32", NULL);
- XML_CHECK (xmlTextWriterWriteFormatString, (writer, "%" PRIi32, v));
+ XML_CHECK (xmlTextWriterWriteFormatAttribute, (writer, BAD_CAST "value", "%" PRIi32, v));
end_value (writer);
return 0;
}
{
xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v;
start_value (writer, key, "int64", NULL);
- XML_CHECK (xmlTextWriterWriteFormatString, (writer, "%" PRIi64, v));
+ XML_CHECK (xmlTextWriterWriteFormatAttribute, (writer, BAD_CAST "value", "%" PRIi64, v));
end_value (writer);
return 0;
}
{
xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v;
start_value (writer, key, "binary", "base64");
+ XML_CHECK (xmlTextWriterStartAttribute, (writer, BAD_CAST "value"));
XML_CHECK (xmlTextWriterWriteBase64, (writer, v, 0, len));
+ XML_CHECK (xmlTextWriterEndAttribute, (writer));
end_value (writer);
return 0;
}
{
xmlTextWriterPtr writer = (xmlTextWriterPtr) writer_v;
start_value (writer, key, "none", "base64");
- if (len > 0) XML_CHECK (xmlTextWriterWriteBase64, (writer, v, 0, len));
+ if (len > 0) {
+ XML_CHECK (xmlTextWriterStartAttribute, (writer, BAD_CAST "value"));
+ XML_CHECK (xmlTextWriterWriteBase64, (writer, v, 0, len));
+ XML_CHECK (xmlTextWriterEndAttribute, (writer));
+ }
end_value (writer);
return 0;
}
}
start_value (writer, key, type, "base64");
- if (len > 0) XML_CHECK (xmlTextWriterWriteBase64, (writer, v, 0, len));
+ if (len > 0) {
+ XML_CHECK (xmlTextWriterStartAttribute, (writer, BAD_CAST "value"));
+ XML_CHECK (xmlTextWriterWriteBase64, (writer, v, 0, len));
+ XML_CHECK (xmlTextWriterEndAttribute, (writer));
+ }
end_value (writer);
return 0;