I recenetly came across a Windows XP image, where one REG_QWORD value
(HKLM\Software\Microsoft\Windows\CurrentVersion\Group
Policy\State\Machine\Scripts\Shutdown\0\0\ExecTime)
would be displayed by hivexsh but hivex_value_qword() would return -1.
It turned out that the data length of this value was 16 bytes instead
of 8.
There is no problem in simply interpreting the first 4 (DWORD) or
8 (QWORD) bytes -- if there are enough bytes to be interpreted.
---
lib/hivex.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/hivex.c b/lib/hivex.c
index a2bd43b..efc27f8 100644
--- a/lib/hivex.c
+++ b/lib/hivex.c
@@ -1624,7 +1624,7 @@ hivex_value_dword (hive_h *h, hive_value_h value)
if (data == NULL)
return -1;
- if ((t != hive_t_dword && t != hive_t_dword_be) || len != 4) {
+ if ((t != hive_t_dword && t != hive_t_dword_be) || len < 4) {
free (data);
errno = EINVAL;
return -1;
@@ -1650,7 +1650,7 @@ hivex_value_qword (hive_h *h, hive_value_h value)
if (data == NULL)
return -1;
- if (t != hive_t_qword || len != 8) {
+ if (t != hive_t_qword || len < 8) {
free (data);
errno = EINVAL;
return -1;
--
1.8.3.1