From: Richard Jones Date: Wed, 28 Apr 2010 13:28:27 +0000 (+0100) Subject: regedit: Add implicit nul-termination when importing strings. X-Git-Tag: 1.2.2~1 X-Git-Url: http://git.annexia.org/?a=commitdiff_plain;h=81cc08b749bde37f364400c2b983d1e73e8dde21;p=hivex.git regedit: Add implicit nul-termination when importing strings. When you import a string value like: "Foo"="Bar" using Windows regedit program, implicit nul-termination is added to the value (not the key), so what is stored in the value would be something like: hex(1):42,00,61,00,72,00,00,00 where two of the trailing zero bytes come from the implicit terminator. This corrects the reg_import function so it works the same way. --- diff --git a/perl/lib/Win/Hivex/Regedit.pm b/perl/lib/Win/Hivex/Regedit.pm index 871e5ba..c69fda8 100644 --- a/perl/lib/Win/Hivex/Regedit.pm +++ b/perl/lib/Win/Hivex/Regedit.pm @@ -285,16 +285,19 @@ sub _parse_value $type = 1; $data = _parse_quoted_string ($1); return undef unless defined $data; + $data .= "\0"; # Value strings are implicitly ASCIIZ. $data = encode ($encoding, $data); } elsif (m/^str\(([[:xdigit:]]+)\):(".*")$/) { $type = hex ($1); $data = _parse_quoted_string ($2); return undef unless defined $data; + $data .= "\0"; # Value strings are implicitly ASCIIZ. $data = encode ($encoding, $data); } elsif (m/^(".*")$/) { $type = 1; $data = _parse_quoted_string ($1); return undef unless defined $data; + $data .= "\0"; # Value strings are implicitly ASCIIZ. $data = encode ($encoding, $data); } else { return undef; diff --git a/perl/t/560-regedit-import.t b/perl/t/560-regedit-import.t index b0c5254..163a46e 100644 --- a/perl/t/560-regedit-import.t +++ b/perl/t/560-regedit-import.t @@ -55,7 +55,7 @@ $expected = '[\] [\C] "Key1"=hex(2):48,00,65,00,6c,00,6c,00,6f,00 -"Key2"=hex(2):48,00,65,00,6c,00,6c,00,6f,00 +"Key2"=hex(2):48,00,65,00,6c,00,6c,00,6f,00,00,00 "Key3"=hex(3):48,00,65,00,6c,00,6c,00,6f,00,48,00,65,00,6c,00,6c,00,6f,00 "Key4"=dword:ff123456 @@ -72,11 +72,11 @@ $data = ' $expected = '[\] [\A] -@=hex(1):48,00,65,00,6c,00,6c,00,6f,00 +@=hex(1):48,00,65,00,6c,00,6c,00,6f,00,00,00 [\C] "Key1"=hex(2):48,00,65,00,6c,00,6c,00,6f,00 -"Key2"=hex(2):48,00,65,00,6c,00,6c,00,6f,00 +"Key2"=hex(2):48,00,65,00,6c,00,6c,00,6f,00,00,00 "Key3"=hex(3):48,00,65,00,6c,00,6c,00,6f,00,48,00,65,00,6c,00,6c,00,6f,00 "Key4"=dword:ff123456