test: hivehdr.c File Reference

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# hivehdr.c File Reference

`#include "regutil.h"`
`#include "edithive.h"`

Go to the source code of this file.

## Defines

#define | _ARCCODES_

## Functions

void | DoDump (PUCHAR Filename)
void __cdecl | main (int argc, char *argv[])

## Define Documentation

#define _ARCCODES_

| Definition at line 24 of file hivehdr.c.

## Function Documentation

void DoDump | ( | PUCHAR | Filename | ) |

Definition at line 55 of file hivehdr.c.

References _HBASE_BLOCK::CheckSum, _HBASE_BLOCK::Cluster, FALSE, _HBASE_BLOCK::FileName, _HBASE_BLOCK::Format, HBASE_BLOCK_SIGNATURE, HBASE_FORMAT_MEMORY, HBASE_NAME_ALLOC, HFILE_TYPE_ALTERNATE, HFILE_TYPE_LOG, HFILE_TYPE_MAX, HFILE_TYPE_PRIMARY, HSECTOR_SIZE, HSYS_MAJOR, HSYS_MINOR, HvpHeaderCheckSum(), INVALID_HANDLE_VALUE, _HBASE_BLOCK::Length, _HBASE_BLOCK::Major, _HBASE_BLOCK::Minor, NULL, OPEN_EXISTING, _HBASE_BLOCK::RootCell, _HBASE_BLOCK::Sequence1, _HBASE_BLOCK::Sequence2, _HBASE_BLOCK::Signature, _HBASE_BLOCK::TimeStamp, TRUE, and _HBASE_BLOCK::Type.

Referenced by main().

    00058 {
    00059     HANDLE  infile;
    00060     static char buffer[HSECTOR_SIZE];
    00061     PHBASE_BLOCK bbp;
    00062     char   *validstring[] = { "BAD", "OK" };
    00063     int     valid;
    00064     char   *typename[] = { "primary", "alternate", "log", "external", "unknown" };
    00065     int     typeselect;
    00066     int     readcount;
    00067     unsigned long checksum;
    00068     unsigned long i;
    00069
    00070     infile = (HANDLE)CreateFile(
    00071             Filename,                           // file name
    00072             GENERIC_READ,                       // desired access
    00073             FILE_SHARE_READ | FILE_SHARE_WRITE, // share mode
    00074             NULL,                               // security attributes
    00075             OPEN_EXISTING,                      // creation disposition
    00076             FILE_FLAG_SEQUENTIAL_SCAN,          // flags and attributes
    00077             NULL                                // template file
    00078     );
    00079     if (infile == INVALID_HANDLE_VALUE) {
    00080         fprintf(stderr, "hivehdr: Could not open '%s'\n", Filename);
    00081         return;
    00082     }
    00083
    00084     if (!ReadFile(infile, buffer, HSECTOR_SIZE, &readcount, NULL)) {
    00085         fprintf(
    00086             stderr, "hivehdr: '%s' - cannot read full base block\n", Filename);
    00087         return;
    00088     }
    00089     if (readcount != HSECTOR_SIZE) {
    00090         fprintf(
    00091             stderr, "hivehdr: '%s' - cannot read full base block\n", Filename);
    00092         return;
    00093     }
    00094
    00095     bbp = (PHBASE_BLOCK)&(buffer[0]);
    00096
    00097     if ((bbp->Major != 1) || (bbp->Minor != 1)) {
    00098         printf("WARNING: Hive file is newer than hivehdr, or is invalid\n");
    00099     }
    00100
    00101     printf("         File: '%s'\n", Filename);
    00102     printf("    BaseBlock:\n");
    00103
    00104     valid = (bbp->Signature == HBASE_BLOCK_SIGNATURE);
    00105     printf("    Signature: %08lx  '%4.4s'\t\t%s\n",
    00106             bbp->Signature, (PUCHAR)&(bbp->Signature), validstring[valid]);
    00107
    00108     valid = (bbp->Sequence1 == bbp->Sequence2);
    00109     printf(" Sequence1//2: %08lx//%08lx\t%s\n",
    00110             bbp->Sequence1, bbp->Sequence2, validstring[valid]);
    00111
    00112     printf("    TimeStamp: %08lx:%08lx\n",
    00113             bbp->TimeStamp.HighPart, bbp->TimeStamp.LowPart,
    00114             (PUCHAR)&(bbp->Signature), validstring[valid]);
    00115
    00116     valid = (bbp->Major == HSYS_MAJOR);
    00117     printf("Major Version: %08lx\t\t\t%s\n",
    00118             bbp->Major, validstring[valid]);
    00119
    00120     valid = (bbp->Minor == HSYS_MINOR);
    00121     printf("Minor Version: %08lx\t\t\t%s\n",
    00122             bbp->Minor, validstring[valid]);
    00123
    00124     valid = ( (bbp->Type == HFILE_TYPE_PRIMARY) ||
    00125               (bbp->Type == HFILE_TYPE_ALTERNATE) ||
    00126               (bbp->Type == HFILE_TYPE_LOG) );
    00127     if (valid) {
    00128         typeselect = bbp->Type;
    00129     } else {
    00130         typeselect = HFILE_TYPE_MAX;
    00131     }
    00132
    00133     printf("         Type: %08lx %s\t\t%s\n",
    00134             bbp->Type, typename[typeselect], validstring[valid]);
    00135
    00136     valid = (bbp->Format == HBASE_FORMAT_MEMORY);
    00137     printf("       Format: %08lx\t\t\t%s\n",
    00138             bbp->Format, validstring[valid]);
    00139
    00140     printf("     RootCell: %08lx\n", bbp->RootCell);
    00141
    00142     printf("       Length: %08lx\n", bbp->Length);
    00143
    00144     printf("      Cluster: %08lx\n", bbp->Cluster);
    00145
    00146     checksum = HvpHeaderCheckSum(bbp);
    00147     valid = (checksum == bbp->CheckSum);
    00148     if (checksum == bbp->CheckSum) {
    00149         printf("     CheckSum: %08lx\t\t\t%s\n",
    00150                 bbp->CheckSum, validstring[TRUE]);
    00151     } else {
    00152         printf("     CheckSum: %08lx\t\t\t%s\tCorrect: %08lx\n",
    00153                 bbp->CheckSum, validstring[FALSE], checksum);
    00154     }
    00155
    00156     //
    00157     // print last part of file name, aid to identification
    00158     //
    00159     printf("Hive/FileName: ");
    00160
    00161     for (i = 0; i < HBASE_NAME_ALLOC;i+=sizeof(WCHAR)) {
    00162         printf("%wc", bbp->FileName[i]);
    00163     }
    00164
    00165
    00166     return;
    00167 }

void __cdecl main | ( | int | argc,
|  | char * | argv[]
| ) |

Definition at line 35 of file hivehdr.c.

References DoDump(), and exit.

    00039 {
    00040     int i;
    00041
    00042     if (argc == 1) {
    00043         fprintf(stderr, "Usage: hivehdr filename filename...\n", argv[0]);
    00044         exit(1);
    00045     }
    00046
    00047     for (i = 1; i < argc; i++) {
    00048         DoDump(argv[i]);
    00049     }
    00050
    00051     exit(0);
    00052 }