Since iconv() does not treat null characters as special, this makes it possible to read node names and value keys with embedded null characters. which are not displayed at all by Windows Regedit. --- generator/generator.ml | 19 ++++++++++++++----- lib/node.c | 24 ++++++++++++++++++++++++ lib/value.c | 9 +++++---- 3 files changed, 43 insertions(+), 9 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index 54e5f0f..1c62129 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -179,7 +179,14 @@ C<$$$PROTO.HIV> (other names are possible: it seems to depend on the tool or program that created the hive in the first place). You can only know the \"real\" name of the root node by knowing which registry file this hive originally comes from, which is knowledge that is -outside the scope of this library."; +outside the scope of this library. + +The name is recoded to UTF-8 and may contain embedded NUL characters."; + + "node_name_len", (RSize, [AHive; ANode "node"]), + "return the length of a node's name", + "\ +Return the length of the node name as produced by C<hivex_node_name>."; "node_timestamp", (RInt64, [AHive; ANode "node"]), "return the modification time of the node", @@ -233,13 +240,15 @@ default key."; "value_key_len", (RSize, [AHive; AValue "val"]), "return the length of a value's key", "\ -Return the length of the key (name) of a (key, value) pair. The -length can legitimately be 0, so errno is the necesary mechanism -to check for errors. +Return the length of the key (name) of a (key, value) pair as produced +by C<hivex_value_key>. The length can legitimately be 0, so errno is +the necesary mechanism to check for errors. In the context of Windows Registries, a zero-length name means that this value is the default key for this node in the tree. -This is usually written as C&lt;\&quot;(a)\&quot;&gt;.&quot;; +This is usually written as C<\"@\">. + +The key is recoded to UTF-8 and may contain embedded NUL characters."; "value_key", (RString, [AHive; AValue "val"]), "return the key of a (key, value) pair", diff --git a/lib/node.c b/lib/node.c index fcd7442..22d1861 100644 --- a/lib/node.c +++ b/lib/node.c @@ -96,6 +96,30 @@ hivex_node_name (hive_h *h, hive_node_h node) } } +size_t +hivex_node_name_len (hive_h *h, hive_node_h node) +{ + if (!IS_VALID_BLOCK (h, node) || !BLOCK_ID_EQ (h, node, "nk")) { + SET_ERRNO (EINVAL, "invalid block or not an 'nk' block"); + return 0; + } + struct ntreg_nk_record *nk = + (struct ntreg_nk_record *) ((char *) h->addr + node); + + /* nk->name_len is unsigned, 16 bit, so this is safe ... However + * we have to make sure the length doesn't exceed the block length. + */ + size_t len = le16toh (nk->name_len); + size_t seg_len = block_len (h, node, NULL); + if (sizeof (struct ntreg_nk_record) + len - 1 > seg_len) { + SET_ERRNO (EFAULT, "node name is too long (%zu, %zu)", len, seg_len); + return 0; + } + + return _hivex_utf8_strlen (nk->name, len, ! (le16toh (nk->flags) & 0x20)); +} + + static int64_t timestamp_check (hive_h *h, hive_node_h node, int64_t timestamp) { diff --git a/lib/value.c b/lib/value.c index 3460a8c..65404d7 100644 --- a/lib/value.c +++ b/lib/value.c @@ -186,13 +186,14 @@ hivex_value_key_len (hive_h *h, hive_value_h value) /* vk->name_len is unsigned, 16 bit, so this is safe ... However * we have to make sure the length doesn't exceed the block length. */ - size_t ret = le16toh (vk->name_len); + size_t len = le16toh (vk->name_len); + size_t seg_len = block_len (h, value, NULL); - if (sizeof (struct ntreg_vk_record) + ret - 1 > seg_len) { - SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", ret, seg_len); + if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { + SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); return 0; } - return ret; + return _hivex_utf8_strlen (vk->name, len, ! (le16toh (vk->flags) & 0x01)); } char * -- 1.8.5.2

--- images/README | 14 ++++++++++++ images/mkzero/Makefile | 9 ++++++++ images/mkzero/mkzero.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ images/special | Bin 0 -> 8192 bytes 4 files changed, 82 insertions(+) create mode 100644 images/mkzero/Makefile create mode 100644 images/mkzero/mkzero.c create mode 100644 images/special diff --git a/images/README b/images/README index 2131885..b01e5a2 100644 --- a/images/README +++ b/images/README @@ -11,3 +11,17 @@ hand-crafted binary blob. tests. - Richard W.M. Jones 2010-02-24. + +'special' was created by importing 'minimal' into a VM running Windows +XP, loading it into HKEY_LOCAL_MACHINE\minimal using regedit.exe +(File/Load Hive...), and running 'mkzero.exe'. + +'mkzero.exe' creates the following keys and values: + +- A key 'zero\0key' containing a REG_DWORD value 'zero\0val' (\0 = zero + character) +- A key 'asdf_äöüß' containing a REG_DWORD value 'asdf_äöüß' +- A key 'weird™' containing a REG_DWORD value 'symbols $£₤₧€' (SMALL + DOLLAR SIGN, FULLWIDTH POUND SIGN, PESETA SIGN, EURO SIGN) + +- Hilko Bengen 2014-01-10. diff --git a/images/mkzero/Makefile b/images/mkzero/Makefile new file mode 100644 index 0000000..affe52b --- /dev/null +++ b/images/mkzero/Makefile @@ -0,0 +1,9 @@ +CROSS=i686-w64-mingw32- +CFLAGS=--std=c99 +all: mkzero.exe +clean: + rm -f *.exe *.o +mkzero.exe: mkzero.o + $(CROSS)gcc -o $@ $< -lntdll +%.o: %.c + $(CROSS)gcc $(CFLAGS) -Wpedantic -Wall -o $@ -c $< diff --git a/images/mkzero/mkzero.c b/images/mkzero/mkzero.c new file mode 100644 index 0000000..a95794a --- /dev/null +++ b/images/mkzero/mkzero.c @@ -0,0 +1,59 @@ +/* use the NT native API to create registry key and value that contain + a zero character */ + +#include <ntdef.h> +#include <stdio.h> +#include <ddk/wdm.h> +#include <windef.h> + +void create_key_value (PHANDLE handle, WCHAR* key, int key_len, WCHAR* val, int val_len) +{ + UNICODE_STRING key_name = { key_len, key_len, key }; + UNICODE_STRING value_name = { val_len, val_len, val }; + OBJECT_ATTRIBUTES key_obj; + InitializeObjectAttributes (&key_obj, &key_name, + OBJ_OPENIF | OBJ_CASE_INSENSITIVE, + *handle, NULL); + HANDLE key_handle; + NTSTATUS rc; + rc = ZwCreateKey (&key_handle, KEY_ALL_ACCESS, &key_obj, + 0, NULL, REG_OPTION_NON_VOLATILE, NULL); + if (!NT_SUCCESS (rc)) { + wprintf(L"error: CreateKey %s: 0x%08x\n", key, rc); + exit(1); + } + DWORD value = 0; + rc = ZwSetValueKey (key_handle, &value_name, 0, + REG_DWORD, &value, sizeof(value)); + if (!NT_SUCCESS (rc)) { + wprintf(L"error: SetValueKey %s: 0x%08x\n", val, rc); + exit(1); + } +} + +int main (int argc, char **argv) +{ + UNICODE_STRING root_key_name; + RtlInitUnicodeString(&root_key_name, L"\\Registry\\Machine\\minimal"); + OBJECT_ATTRIBUTES root_key_obj; + InitializeObjectAttributes (&root_key_obj, &root_key_name, + OBJ_OPENIF | OBJ_CASE_INSENSITIVE, + NULL, NULL); + HANDLE minimal_key_handle; + NTSTATUS rc = ZwCreateKey (&minimal_key_handle, KEY_ALL_ACCESS, &root_key_obj, + 0, NULL, REG_OPTION_NON_VOLATILE, NULL); + if (!NT_SUCCESS (rc)) { + wprintf(L"error: CreateKey <HKLM\\minimal>: 0x%08x\n", rc); + exit(1); + } + WCHAR k1[] = L"zero\0key"; + WCHAR v1[] = L"zero\0val"; + create_key_value (&minimal_key_handle, k1, sizeof (k1)-2, v1, sizeof (v1)-2); + WCHAR k2[] = L"abcd_äöüß"; + WCHAR v2[] = L"abcd_äöüß"; + create_key_value (&minimal_key_handle, k2, sizeof (k2)-2, v2, sizeof (v2)-2); + WCHAR k3[] = L"weird™"; + WCHAR v3[] = L"symbols $£₤₧€"; + create_key_value (&minimal_key_handle, k3, sizeof (k3)-2, v3, sizeof (v3)-2); + return 0; +} diff --git a/images/special b/images/special new file mode 100644 index 0000000000000000000000000000000000000000..8a5ff5f34f32f0e56c1e1e9abf49bd3a8857c5e7 GIT binary patch literal 8192 zcmeHLziU%b6h28CZ9~<EDAeHa+P=XdxC$;R6s%K4L=cN5X`%@)O-drwio+ZH@elY1 z1T2`rMJE?Ghc2Q^L|k-m(@8`sh|ll4H&6SLm(oQjat_>k?mh3^bH4X|uYulX`TDgz zDG`p7(@(o+_rFeIDH#kJ*De>1UAJUG&PYj?r7CrdmfVo06fig77i3n-i1}u}f_;>? zjGP+lsO=gC@|UkX+cjVmh%%rIC<DrXGN2471ImChpbRJj%D_Kmpi->XO#}RYA6aw{ zz<oOm!@8fB{JkG9c{jk=>AfN&T);Y`B1j3jrVo1lAOn3ifxYK>=P%4(oIgHy?h+qw z{0hUCkL!iB9c*wEQ%Xi3^76qk9Yqcyo|Z3?<sq4rBiN;I29|L#O>v!_#3aE$JRyH( zNWO_9|CAhv)p!5qJ6r3UIMA7Vi#223Jxj!Zzcn_rZY<YO+utKz2fTypy6?txaoMqF z)PlzLZB!(`+(*wTH>5K*hWU26*$}_H*6!&MAjUy3vnT>R?oPlTv+vW>W7F#44ACPu zM301g!+S!$i6cKz51T)zhm)X3F2=Fd$nk7ld)bvajCbvvcw4^n+1od>xa5E1yT;F1 zZMMlz4SCknQ#PT23*zbDz<-2a^~b11fNu2s?5!TFg&Ok$bZx`$RPU7pz4=YDHf<cE zP+Tf4e)|6NgNg7jN~BgvO9yAKb|1WY4iGQCdhg#EeB%T7`p;W@vZL?uRsy~p`bYTq zJ8={Dh*jJumSlR05Q(E!8To^64$0m1`;7=Eb7&g|Z!U(H@s_ONF0zPQ${N<Lc=AZr k-N)_|mrtRG{b8{ios|J)Kp9X5lmTTx8Bhk4f&Y|&-#+)~(*OVf literal 0 HcmV?d00001 -- 1.8.5.2

On Sat, Jan 11, 2014 at 12:12:47AM +0100, Hilko Bengen wrote: I think this effectively removes a check. hivex_value_key_len contains this code: size_t seg_len = block_len (h, value, NULL); if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); return 0; } but after this change, this would no longer be run, so it would be possible to overrun the registry, or at least overrun the end of a block. Is there a reason for this patch? It seems like just an optimization. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/

--- lib/value.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/value.c b/lib/value.c index 65404d7..7b2e9d3 100644 --- a/lib/value.c +++ b/lib/value.c @@ -207,14 +207,14 @@ hivex_value_key (hive_h *h, hive_value_h value) struct ntreg_vk_record *vk = (struct ntreg_vk_record *) ((char *) h->addr + value); - /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is - * necessary. However we do need to nul-terminate the string. - */ - errno = 0; - size_t len = hivex_value_key_len (h, value); - if (len == 0 && errno != 0) - return NULL; size_t flags = le16toh (vk->flags); + size_t len = le16toh (vk->name_len); + + size_t seg_len = block_len (h, value, NULL); + if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { + SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); + return 0; + } if (flags & 0x01) { return _hivex_windows_latin1_to_utf8 (vk->name, len); } else { -- 1.8.5.2

On Sat, Jan 11, 2014 at 12:12:48AM +0100, Hilko Bengen wrote: ACK. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to F#)

On Sat, Jan 11, 2014 at 12:12:49AM +0100, Hilko Bengen wrote: ACK. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to F#)

On Sat, Jan 11, 2014 at 12:12:50AM +0100, Hilko Bengen wrote: ACK. I wonder what happens if the registry contains a garbage string (one which is not valid utf-8)? It looks from the source as if newSVpvn_utf8 just sets a flag in the SV, so that would be OK in the sense that Perl programs wouldn't start crashing. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://people.redhat.com/~rjones/virt-top

--- python/t/120-rlenvalue.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/t/120-rlenvalue.py b/python/t/120-rlenvalue.py index ebc48f5..a9b2129 100644 --- a/python/t/120-rlenvalue.py +++ b/python/t/120-rlenvalue.py @@ -38,5 +38,5 @@ moderate_value_node = h.node_get_child (root, "ModerateValueParent") moderate_value_value = h.node_get_value (moderate_value_node, "33Bytes") r = h.value_data_cell_offset (moderate_value_value) -assert r[0] == 37L -assert r[1] == 8712L +assert r[0] == 37 +assert r[1] == 8712 -- 1.8.5.2

--- python/run-python-tests.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/run-python-tests.in b/python/run-python-tests.in index 90aee03..0df646b 100755 --- a/python/run-python-tests.in +++ b/python/run-python-tests.in @@ -19,7 +19,7 @@ set -e shopt -s nullglob -for f in @srcdir(a)t/*.py; do +for f in @srcdir(a)/t/*.py; do basename "$f" $PYTHON "$f" done -- 1.8.5.2

On Sat, Jan 11, 2014 at 12:12:46AM +0100, Hilko Bengen wrote: ACK. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/

--- configure.ac | 1 + ruby/run-ruby-tests | 27 --------------------------- ruby/run-ruby-tests.in | 27 +++++++++++++++++++++++++++ ruby/tests/tc_010_load.rb | 2 -- ruby/tests/tc_021_close.rb | 2 -- ruby/tests/tc_120_rlenvalue.rb | 4 +--- ruby/tests/tc_200_write.rb | 2 -- ruby/tests/tc_210_setvalue.rb | 2 -- run.in | 4 ++-- 9 files changed, 31 insertions(+), 40 deletions(-) delete mode 100755 ruby/run-ruby-tests create mode 100755 ruby/run-ruby-tests.in diff --git a/configure.ac b/configure.ac index 4066ca5..6785037 100644 --- a/configure.ac +++ b/configure.ac @@ -564,6 +564,7 @@ AC_CONFIG_FILES([Makefile sh/Makefile xml/Makefile]) AC_CONFIG_FILES([python/run-python-tests], [chmod +x python/run-python-tests]) +AC_CONFIG_FILES([ruby/run-ruby-tests], [chmod +x ruby/run-ruby-tests]) AC_CONFIG_FILES([run], [chmod +x,-w run]) AC_OUTPUT diff --git a/ruby/run-ruby-tests b/ruby/run-ruby-tests deleted file mode 100755 index 2efd890..0000000 --- a/ruby/run-ruby-tests +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/sh - -# hivex Ruby bindings -# Copyright (C) 2009-2011 Red Hat Inc. -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - -set -e - -# Run them one at a time, otherwise rake runs them in parallel (which -# is bound to fail because they all use a single test image file). - -for f in tests/tc_*.rb; do - echo $RAKE test "$@" TEST="$f" - $RAKE test "$@" TEST="$f" -done diff --git a/ruby/run-ruby-tests.in b/ruby/run-ruby-tests.in new file mode 100755 index 0000000..b61699e --- /dev/null +++ b/ruby/run-ruby-tests.in @@ -0,0 +1,27 @@ +#!/bin/sh - +# hivex Ruby bindings +# Copyright (C) 2009-2011 Red Hat Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +set -e + +# Run them one at a time, otherwise rake runs them in parallel (which +# is bound to fail because they all use a single test image file). +export abs_srcdir=@abs_srcdir@ +for f in @srcdir(a)/tests/tc_*.rb; do + echo $RAKE test "$@" TEST="$f" + $RAKE test "$@" TEST="$f" +done diff --git a/ruby/tests/tc_010_load.rb b/ruby/tests/tc_010_load.rb index 113ab69..8a8ae51 100644 --- a/ruby/tests/tc_010_load.rb +++ b/ruby/tests/tc_010_load.rb @@ -16,8 +16,6 @@ # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. require 'test/unit' -$:.unshift(File::join(File::dirname(__FILE__), "..", "lib")) -$:.unshift(File::join(File::dirname(__FILE__), "..", "ext", "hivex")) require 'hivex' class TestLoad < Test::Unit::TestCase diff --git a/ruby/tests/tc_021_close.rb b/ruby/tests/tc_021_close.rb index a089cf3..9c5ea65 100644 --- a/ruby/tests/tc_021_close.rb +++ b/ruby/tests/tc_021_close.rb @@ -16,8 +16,6 @@ # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. require 'test/unit' -$:.unshift(File::join(File::dirname(__FILE__), "..", "lib")) -$:.unshift(File::join(File::dirname(__FILE__), "..", "ext", "hivex")) require 'hivex' class TestClose < Test::Unit::TestCase diff --git a/ruby/tests/tc_120_rlenvalue.rb b/ruby/tests/tc_120_rlenvalue.rb index 368cb19..5cb0a80 100644 --- a/ruby/tests/tc_120_rlenvalue.rb +++ b/ruby/tests/tc_120_rlenvalue.rb @@ -22,13 +22,11 @@ # 8712. require 'test/unit' -$:.unshift(File::join(File::dirname(__FILE__), "..", "lib")) -$:.unshift(File::join(File::dirname(__FILE__), "..", "ext", "hivex")) require 'hivex' class TestRLenValue < Test::Unit::TestCase def test_RLenValue - h = Hivex::open("../images/rlenvalue_test_hive", {}) + h = Hivex::open(File::join(ENV['abs_srcdir'], '..', 'images', 'rlenvalue_test_hive'), {}) assert_not_nil(h) root = h.root() diff --git a/ruby/tests/tc_200_write.rb b/ruby/tests/tc_200_write.rb index b46dc7b..6ae239e 100644 --- a/ruby/tests/tc_200_write.rb +++ b/ruby/tests/tc_200_write.rb @@ -16,8 +16,6 @@ # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. require 'test/unit' -$:.unshift(File::join(File::dirname(__FILE__), "..", "lib")) -$:.unshift(File::join(File::dirname(__FILE__), "..", "ext", "hivex")) require 'hivex' class TestWrite < Test::Unit::TestCase diff --git a/ruby/tests/tc_210_setvalue.rb b/ruby/tests/tc_210_setvalue.rb index e55e5fe..4d1aa7e 100644 --- a/ruby/tests/tc_210_setvalue.rb +++ b/ruby/tests/tc_210_setvalue.rb @@ -16,8 +16,6 @@ # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. require 'test/unit' -$:.unshift(File::join(File::dirname(__FILE__), "..", "lib")) -$:.unshift(File::join(File::dirname(__FILE__), "..", "ext", "hivex")) require 'hivex' class TestSetValue < Test::Unit::TestCase diff --git a/run.in b/run.in index 9592e38..46b3df6 100755 --- a/run.in +++ b/run.in @@ -70,9 +70,9 @@ export PYTHONPATH export RUBY=@RUBY@ export RAKE=@RAKE@ if [ -z "$RUBYLIB" ]; then - RUBYLIB="$b/ruby/lib:$b/ruby/ext/hivex" + RUBYLIB="$s/ruby/lib:$b/ruby/ext/hivex" else - RUBYLIB="$b/ruby/lib:$b/ruby/ext/hivex:$RUBYLIB" + RUBYLIB="$s/ruby/lib:$b/ruby/ext/hivex:$RUBYLIB" fi export RUBYLIB export LD_LIBRARY_PATH="$b/ruby/ext/hivex:$LD_LIBRARY_PATH" -- 1.8.5.2

--- ruby/tests/tc_130_special.rb | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 ruby/tests/tc_130_special.rb diff --git a/ruby/tests/tc_130_special.rb b/ruby/tests/tc_130_special.rb new file mode 100644 index 0000000..0623f4d --- /dev/null +++ b/ruby/tests/tc_130_special.rb @@ -0,0 +1,30 @@ +# -*- coding: utf-8 -*- +# -*- ruby -*- + +require 'test/unit' +require 'hivex' + +class TestRLenValue < Test::Unit::TestCase + def test_RLenValue + h = Hivex::open(File::join(ENV['abs_srcdir'], '..', 'images', 'special'), {}) + assert_not_nil(h) + + root = h.root() + assert_not_nil(root) + + nodes = h.node_children (root) + node = nodes.find { |n| h.node_name(n) == "abcd_äöüß" } + assert node != nil + value = h.node_values(node).find { |v| h.value_key(v) == "abcd_äöüß" } + assert value != nil + node = nodes.find { |n| h.node_name(n) == "zero\0key" } + assert node != nil + value = h.node_values(node).find { |v| h.value_key(v) == "zero\0val" } + assert value != nil + node = nodes.find { |n| h.node_name(n) == "weird™" } + assert node != nil + value = h.node_values(node).find { |v| h.value_key(v) == "symbols $£₤₧€" } + assert value != nil + + end +end -- 1.8.5.2