Re: [Libguestfs] [PATCH 9/12] hivex: Begin implementation of writing to hives.
On Fri, Feb 05, 2010 at 01:20:44PM +0000, Matthew Booth wrote:
On 05/02/10 12:46, Richard W.M. Jones wrote:
> On Thu, Feb 04, 2010 at 04:54:53PM +0000, Matthew Booth wrote:
>>> + size_t len;
>>> + len = le32toh (vk->data_len);
>>> + if (len == 0x80000000) /* special case */
>>> + len = 4;
>>> + len &= 0x7fffffff;
>>
>> Comment, please. What's going on with this record length?
>
> This is a mysterious and undocumented part of the format. I don't
> claim to understand why, but it is necessary.
Hehe, ok. Can you at least put in a comment to that effect, preferrably
with a pointer to your source.
Alright I've looked into this further:
The MSB (vk->data_len & 0x80000000) indicates whether the data is
inline.
In all existing registry hives, the data is always stored inline if
the data length <= 4 (ie. the data_len field would be stored in those
cases as 0x80000004 or whatever).
I am updating the code accordingly ...
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines. Supports shell scripting,
bindings from many languages. http://et.redhat.com/~rjones/libguestfs/
See what it can do: http://et.redhat.com/~rjones/libguestfs/recipes.html