This changeset adds byte run reporters for node and value metadata in the
hivexml program. This location reporting required several new ABI
functions, which required new ABI return types. One benefit to the byte
run functions is additional sanity checks, which have revealed new data
or parsing errors when run on M57 patents images. An example error:
Image: Charlie, 2009-12-11, available at
<
http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>.
hive: C:/WINDOWS/system32/config/SECURITY
Address 12624 is processed as a value, but it has a node signature.
Alex Nelson (7):
generator: Add new return type to ABI: RSize
hivex: Split value_key function into value_key and value_key_len
generator: Add new return types to ABI: RLenNode and RLenValue
hivex: Add metadata length functions for nodes and values
hivex: Add offset-&-length function for long value data
hivexml: Report attributes in values instead of text.
hivexml: Add byte run reporting functions
generator/generator.ml | 169 +++++++++++++++++++++++++++++++++++++++++++++++-
lib/hivex.c | 115 +++++++++++++++++++++++++++++---
xml/hivexml.c | 127 ++++++++++++++++++++++++++++++++----
3 files changed, 385 insertions(+), 26 deletions(-)
--
1.7.6