- hive_node_h node = hivex_root (h);
- /* XXX Don't hard-code ControlSet001. The current control set would
- * be another good thing to expose up through the inspection API.
- */
+ root = hivex_root (h);
+ if (root == 0) {
+ perrorf (g, "hivex_root");
+ goto out;
+ }
+
+ /* Get the CurrentControlSet. */
+ errno = 0;
+ node = hivex_node_get_child (h, root, "Select");
+ if (node == 0) {
+ if (errno != 0)
+ perrorf (g, "hivex_node_get_child");
+ else
+ error (g, "hivex: could not locate HKLM\\SYSTEM\\Select");
+ goto out;
+ }
+
+ errno = 0;
+ value = hivex_node_get_value (h, node, "Current");
+ if (value == 0) {
+ if (errno != 0)
+ perrorf (g, "hivex_node_get_value");
+ else
+ error (g, "hivex: HKLM\\System\\Select Default entry not found.");
+ goto out;
+ }
+
+ /* XXX Should check the type. */
+ dword = hivex_value_dword (h, value);
+ fs->windows_current_control_set = safe_asprintf (g, "ControlSet%03d", dword);
+
+ /* Get the hostname. */