--- lib/node.c | 23 +++++++++++------------ lib/value.c | 18 +++++++++++------- 2 files changed, 22 insertions(+), 19 deletions(-) diff --git a/lib/node.c b/lib/node.c index 5090dbe..fda4592 100644 --- a/lib/node.c +++ b/lib/node.c @@ -79,11 +79,6 @@ hivex_node_name (hive_h *h, hive_node_h node) struct ntreg_nk_record *nk = (struct ntreg_nk_record *) ((char *) h->addr + node); - /* AFAIK the node name is always plain ASCII, so no conversion - * to UTF-8 is necessary. However we do need to nul-terminate - * the string. - */ - /* nk->name_len is unsigned, 16 bit, so this is safe ... However * we have to make sure the length doesn't exceed the block length. */ @@ -93,13 +88,17 @@ hivex_node_name (hive_h *h, hive_node_h node) SET_ERRNO (EFAULT, "node name is too long (%zu, %zu)", len, seg_len); return NULL; } - - char *ret = malloc (len + 1); - if (ret == NULL) - return NULL; - memcpy (ret, nk->name, len); - ret[len] = '\0'; - return ret; + size_t flags = le16toh (nk->flags); + if (flags & 0x20) { + char *ret = malloc (len + 1); + if (ret == NULL) + return NULL; + memcpy (ret, nk->name, len); + ret[len] = '\0'; + return ret; + } else { + return _hivex_windows_utf16_to_utf8 (nk->name, len); + } } static int64_t diff --git a/lib/value.c b/lib/value.c index 6d0f266..66cde48 100644 --- a/lib/value.c +++ b/lib/value.c @@ -213,13 +213,17 @@ hivex_value_key (hive_h *h, hive_value_h value) size_t len = hivex_value_key_len (h, value); if (len == 0 && errno != 0) return NULL; - - char *ret = malloc (len + 1); - if (ret == NULL) - return NULL; - memcpy (ret, vk->name, len); - ret[len] = '\0'; - return ret; + size_t flags = le16toh (vk->flags); + if (flags & 0x01) { + char *ret = malloc (len + 1); + if (ret == NULL) + return NULL; + memcpy (ret, vk->name, len); + ret[len] = '\0'; + return ret; + } else { + return _hivex_windows_utf16_to_utf8 (vk->name, len); + } } int -- 1.8.4.3