libevtx-python - npm Package Compare versions

Comparing version 20220724 to 20221101

libwrc/libwrc_resource_node_entry.c

+/*
+ * Resource node entry functions
+ *
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <common.h>
+#include <byte_stream.h>
+#include <memory.h>
+#include <types.h>
+
+#include "libwrc_data_descriptor.h"
+#include "libwrc_debug.h"
+#include "libwrc_definitions.h"
+#include "libwrc_libcdata.h"
+#include "libwrc_libcerror.h"
+#include "libwrc_libcnotify.h"
+#include "libwrc_libuna.h"
+#include "libwrc_resource_node_entry.h"
+
+#include "wrc_resource_node.h"
+
+/* Creates a table entry
+ * Make sure the value resource_node_entry is referencing, is set to NULL
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_initialize(
+     libwrc_resource_node_entry_t **resource_node_entry,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_initialize";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid table entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( *resource_node_entry != NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
+		 "%s: invalid table entry value already set.",
+		 function );
+
+		return( -1 );
+	}
+	*resource_node_entry = memory_allocate_structure(
+	                        libwrc_resource_node_entry_t );
+
+	if( *resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+		 "%s: unable to create table entry.",
+		 function );
+
+		goto on_error;
+	}
+	if( memory_set(
+	     *resource_node_entry,
+	     0,
+	     sizeof( libwrc_resource_node_entry_t ) ) == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
+		 "%s: unable to clear table entry.",
+		 function );
+
+		goto on_error;
+	}
+	return( 1 );
+
+on_error:
+	if( *resource_node_entry != NULL )
+	{
+		memory_free(
+		 *resource_node_entry );
+
+		*resource_node_entry = NULL;
+	}
+	return( -1 );
+}
+
+/* Frees a table entry
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_free(
+     libwrc_resource_node_entry_t **resource_node_entry,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_free";
+	int result            = 1;
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid table entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( *resource_node_entry != NULL )
+	{
+		if( libwrc_data_descriptor_free(
+		     &( ( *resource_node_entry )->data_descriptor ),
+		     error ) != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
+			 "%s: unable to free data descriptor.",
+			 function );
+
+			result = -1;
+		}
+		if( ( *resource_node_entry )->name_string != NULL )
+		{
+			memory_free(
+			 ( *resource_node_entry )->name_string );
+		}
+		memory_free(
+		 *resource_node_entry );
+
+		*resource_node_entry = NULL;
+	}
+	return( result );
+}
+
+/* Reads the resource node entry data
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_read_data(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     const uint8_t *data,
+     size_t data_size,
+     int node_level,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_read_data";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( data == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( data_size < 8 )
+	 || ( data_size > (size_t) SSIZE_MAX ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid data size value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: resource node entry data:\n",
+		 function );
+		libcnotify_print_data(
+		 data,
+		 8,
+		 0 );
+	}
+#endif
+	byte_stream_copy_to_uint32_little_endian(
+	 ( (wrc_resource_node_entry_t *) data )->identifier,
+	 resource_node_entry->identifier );
+
+	byte_stream_copy_to_uint32_little_endian(
+	 ( (wrc_resource_node_entry_t *) data )->offset,
+	 resource_node_entry->offset );
+
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: identifier\t\t\t: 0x%08" PRIx32 "",
+		 function,
+		 resource_node_entry->identifier );
+
+		if( ( node_level == 1 )
+		 && ( ( resource_node_entry->identifier & LIBWRC_RESOURCE_IDENTIFIER_FLAG_HAS_NAME ) == 0 ) )
+		{
+			libcnotify_printf(
+			 " (%s)",
+			 libwrc_debug_get_resource_identifier(
+			  resource_node_entry->identifier ) );
+		}
+		libcnotify_printf(
+		 "\n" );
+
+		libcnotify_printf(
+		 "%s: offset\t\t\t\t: 0x%08" PRIx32 "\n",
+		 function,
+		 resource_node_entry->offset );
+	}
+#endif /* defined( HAVE_DEBUG_OUTPUT ) */
+
+	return( 1 );
+}
+
+/* Reads the resource node entry
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_read_file_io_handle(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     libbfio_handle_t *file_io_handle,
+     off64_t file_offset,
+     int node_level,
+     libcerror_error_t **error )
+{
+	uint8_t resource_node_entry_data[ sizeof( wrc_resource_node_entry_t ) ];
+
+	static char *function = "libwrc_resource_node_entry_read_file_io_handle";
+	ssize_t read_count    = 0;
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: reading resource node entry at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",
+		 function,
+		 file_offset,
+		 file_offset );
+	}
+#endif
+	read_count = libbfio_handle_read_buffer_at_offset(
+	              file_io_handle,
+	              resource_node_entry_data,
+	              sizeof( wrc_resource_node_entry_t ),
+	              file_offset,
+	              error );
+
+	if( read_count != (ssize_t) sizeof( wrc_resource_node_entry_t ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read resource node entry data at offset: %" PRIi64 " (0x%08" PRIx64 ").",
+		 function,
+		 file_offset,
+		 file_offset );
+
+		return( -1 );
+	}
+	if( libwrc_resource_node_entry_read_data(
+	     resource_node_entry,
+	     resource_node_entry_data,
+	     sizeof( wrc_resource_node_entry_t ),
+	     node_level,
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+
+/* Reads the resource node entry name
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libwrc_resource_node_entry_read_name_file_io_handle(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     libbfio_handle_t *file_io_handle,
+     libcerror_error_t **error )
+{
+	uint8_t name_size_data[ 2 ];
+
+	static char *function   = "libwrc_resource_node_entry_read_name_file_io_handle";
+	size_t name_string_size = 0;
+	ssize_t read_count      = 0;
+	off64_t file_offset     = 0;
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( resource_node_entry->identifier & LIBWRC_RESOURCE_IDENTIFIER_FLAG_HAS_NAME ) == 0 )
+	{
+		return( 0 );
+	}
+	file_offset = (off64_t) ( resource_node_entry->identifier & 0x7fffffffUL );
+
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: reading name at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",
+		 function,
+		 file_offset,
+		 file_offset );
+	}
+#endif
+	read_count = libbfio_handle_read_buffer_at_offset(
+		      file_io_handle,
+		      name_size_data,
+		      2,
+		      file_offset,
+		      error );
+
+	if( read_count != (ssize_t) 2 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read resource node entry name string size at offset: %" PRIi64 " (0x%08" PRIx64 ").",
+		 function,
+		 file_offset,
+		 file_offset );
+
+		goto on_error;
+	}
+	byte_stream_copy_to_uint16_little_endian(
+	 name_size_data,
+	 name_string_size );
+
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: name string size\t: %" PRIzd "\n",
+		 function,
+		 name_string_size );
+	}
+#endif
+	name_string_size *= 2;
+
+	if( ( name_string_size == 0 )
+	 || ( name_string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid name string size value out of bounds.",
+		 function );
+
+		goto on_error;
+	}
+	resource_node_entry->name_string = (uint8_t *) memory_allocate(
+	                                                sizeof( uint8_t ) * name_string_size );
+
+	if( resource_node_entry->name_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+		 "%s: unable to create name string.",
+		 function );
+
+		goto on_error;
+	}
+	resource_node_entry->name_string_size = name_string_size;
+
+	read_count = libbfio_handle_read_buffer(
+		      file_io_handle,
+		      resource_node_entry->name_string,
+		      name_string_size,
+		      error );
+
+	if( read_count != (ssize_t) name_string_size )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read name string.",
+		 function );
+
+		goto on_error;
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		if( libwrc_debug_print_utf16_string_value(
+		     function,
+		     "name string\t",
+		     resource_node_entry->name_string,
+		     resource_node_entry->name_string_size,
+		     LIBUNA_ENDIAN_LITTLE,
+		     error ) != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+			 LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
+			 "%s: unable to print UTF-16 string value.",
+			 function );
+
+			return( -1 );
+		}
+	}
+#endif /* defined( HAVE_DEBUG_OUTPUT ) */
+
+	return( 1 );
+
+on_error:
+	if( resource_node_entry->name_string != NULL )
+	{
+		memory_free(
+		 resource_node_entry->name_string );
+
+		resource_node_entry->name_string = NULL;
+	}
+	resource_node_entry->name_string_size = 0;
+
+	return( -1 );
+}
+
+/* Compares two resource node entries
+ * Returns LIBCDATA_COMPARE_LESS, LIBCDATA_COMPARE_EQUAL, LIBCDATA_COMPARE_GREATER if successful or -1 on error
+ */
+int libwrc_resource_node_entry_compare(
+     libwrc_resource_node_entry_t *first_resource_node_entry,
+     libwrc_resource_node_entry_t *second_resource_node_entry,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_compare";
+
+	if( first_resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid first resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( second_resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid second resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( first_resource_node_entry->identifier < second_resource_node_entry->identifier )
+	{
+		return( LIBCDATA_COMPARE_LESS );
+	}
+	else if( first_resource_node_entry->identifier > second_resource_node_entry->identifier )
+	{
+		return( LIBCDATA_COMPARE_GREATER );
+	}
+	return( LIBCDATA_COMPARE_EQUAL );
+}
+
+/* Sets the name string
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_set_name_string(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     const uint8_t *name_string,
+     size_t name_string_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_set_name_string";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( resource_node_entry->name_string != NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
+		 "%s: invalid resource node entry - name string value already set.",
+		 function );
+
+		return( -1 );
+	}
+	if( name_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid name string.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( name_string_size == 0 )
+	 || ( name_string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid name string size value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
+	resource_node_entry->name_string = (uint8_t *) memory_allocate(
+	                                                sizeof( uint8_t ) * name_string_size );
+
+	if( resource_node_entry->name_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+		 "%s: unable to create resource node name string.",
+		 function );
+
+		goto on_error;
+	}
+	resource_node_entry->name_string_size = name_string_size;
+
+	if( memory_copy(
+	     resource_node_entry->name_string,
+	     name_string,
+	     name_string_size ) == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_COPY_FAILED,
+		 "%s: unable to copy name string.",
+		 function );
+
+		goto on_error;
+	}
+	return( 1 );
+
+on_error:
+	if( resource_node_entry->name_string != NULL )
+	{
+		memory_free(
+		 resource_node_entry->name_string );
+
+		resource_node_entry->name_string = NULL;
+	}
+	resource_node_entry->name_string_size = 0;
+
+	return( -1 );
+}
+
+/* Retrieves the identifier
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_get_identifier(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     uint32_t *identifier,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_get_identifier";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( identifier == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid identifier.",
+		 function );
+
+		return( -1 );
+	}
+	*identifier = resource_node_entry->identifier;
+
+	return( 1 );
+}
+
+/* Retrieves the size of the UTF-8 encoded name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libwrc_resource_node_entry_get_utf8_name_size(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     size_t *utf8_string_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_get_utf8_name_size";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string size.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( resource_node_entry->name_string == NULL )
+	 || ( resource_node_entry->name_string_size == 0 ) )
+	{
+		return( 0 );
+	}
+	if( libuna_utf8_string_size_from_utf16_stream(
+	     resource_node_entry->name_string,
+	     resource_node_entry->name_string_size,
+	     LIBUNA_ENDIAN_LITTLE,
+	     utf8_string_size,
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+		 "%s: unable to retrieve UTF-8 string size.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+
+/* Retrieves the UTF-8 encoded name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libwrc_resource_node_entry_get_utf8_name(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_get_utf8_name";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf8_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-8 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( resource_node_entry->name_string == NULL )
+	 || ( resource_node_entry->name_string_size == 0 ) )
+	{
+		return( 0 );
+	}
+	if( libuna_utf8_string_copy_from_utf16_stream(
+	     utf8_string,
+	     utf8_string_size,
+	     resource_node_entry->name_string,
+	     resource_node_entry->name_string_size,
+	     LIBUNA_ENDIAN_LITTLE,
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+		 "%s: unable to retrieve UTF-8 string.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+
+/* Retrieves the size of the UTF-16 encoded name
+ * The returned size includes the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libwrc_resource_node_entry_get_utf16_name_size(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     size_t *utf16_string_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_get_utf16_name_size";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string size.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( resource_node_entry->name_string == NULL )
+	 || ( resource_node_entry->name_string_size == 0 ) )
+	{
+		return( 0 );
+	}
+	if( libuna_utf16_string_size_from_utf16_stream(
+	     resource_node_entry->name_string,
+	     resource_node_entry->name_string_size,
+	     LIBUNA_ENDIAN_LITTLE,
+	     utf16_string_size,
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+		 "%s: unable to retrieve UTF-16 string size.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+
+/* Retrieves the UTF-16 encoded name
+ * The size should include the end of string character
+ * Returns 1 if successful, 0 if not available or -1 on error
+ */
+int libwrc_resource_node_entry_get_utf16_name(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_get_utf16_name";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	if( utf16_string_size > (size_t) SSIZE_MAX )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid UTF-16 string size value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( resource_node_entry->name_string == NULL )
+	 || ( resource_node_entry->name_string_size == 0 ) )
+	{
+		return( 0 );
+	}
+	if( libuna_utf16_string_copy_from_utf16_stream(
+	     utf16_string,
+	     utf16_string_size,
+	     resource_node_entry->name_string,
+	     resource_node_entry->name_string_size,
+	     LIBUNA_ENDIAN_LITTLE,
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+		 "%s: unable to retrieve UTF-16 string.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+
+/* Retrieves the type
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_entry_get_type(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     int *type,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_entry_get_type";
+
+	if( resource_node_entry == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( type == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid type.",
+		 function );
+
+		return( -1 );
+	}
+	*type = resource_node_entry->type;
+
+	return( 1 );
+}
+

libwrc/libwrc_resource_node_entry.h

+/*
+ * Resource node entry functions
+ *
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBWRC_RESOURCE_NODE_ENTRY_H )
+#define _LIBWRC_RESOURCE_NODE_ENTRY_H
+
+#include <common.h>
+#include <types.h>
+
+#include "libwrc_data_descriptor.h"
+#include "libwrc_libbfio.h"
+#include "libwrc_libcerror.h"
+
+#if defined( __cplusplus )
+extern "C" {
+#endif
+
+typedef struct libwrc_resource_node_entry libwrc_resource_node_entry_t;
+
+struct libwrc_resource_node_entry
+{
+	/* The identifier
+	 */
+	uint32_t identifier;
+
+	/* The offset
+	 */
+	uint32_t offset;
+
+	/* The name string
+	 */
+	uint8_t *name_string;
+
+	/* The name string size
+	 */
+	size_t name_string_size;
+
+	/* The data descriptor
+	 */
+	libwrc_data_descriptor_t *data_descriptor;
+
+	/* The type
+	 */
+	int type;
+};
+
+int libwrc_resource_node_entry_initialize(
+     libwrc_resource_node_entry_t **resource_node_entry,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_free(
+     libwrc_resource_node_entry_t **resource_node_entry,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_read_data(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     const uint8_t *data,
+     size_t data_size,
+     int node_level,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_read_file_io_handle(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     libbfio_handle_t *file_io_handle,
+     off64_t file_offset,
+     int node_level,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_read_name_file_io_handle(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     libbfio_handle_t *file_io_handle,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_compare(
+     libwrc_resource_node_entry_t *first_resource_node_entry,
+     libwrc_resource_node_entry_t *second_resource_node_entry,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_set_name_string(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     const uint8_t *name_string,
+     size_t name_string_size,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_get_identifier(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     uint32_t *identifier,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_get_utf8_name_size(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     size_t *utf8_string_size,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_get_utf8_name(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     uint8_t *utf8_string,
+     size_t utf8_string_size,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_get_utf16_name_size(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     size_t *utf16_string_size,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_get_utf16_name(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     uint16_t *utf16_string,
+     size_t utf16_string_size,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_entry_get_type(
+     libwrc_resource_node_entry_t *resource_node_entry,
+     int *type,
+     libcerror_error_t **error );
+
+#if defined( __cplusplus )
+}
+#endif
+
+#endif /* !defined( _LIBWRC_RESOURCE_NODE_ENTRY_H ) */
+

libwrc/libwrc_resource_node_header.c

+/*
+ * Resource node header functions
+ *
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <common.h>
+#include <byte_stream.h>
+#include <memory.h>
+#include <types.h>
+
+#include "libwrc_libbfio.h"
+#include "libwrc_libcerror.h"
+#include "libwrc_libcnotify.h"
+#include "libwrc_resource_node_header.h"
+
+#include "wrc_resource_node.h"
+
+/* Creates a table entry
+ * Make sure the value resource_node_header is referencing, is set to NULL
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_header_initialize(
+     libwrc_resource_node_header_t **resource_node_header,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_header_initialize";
+
+	if( resource_node_header == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid table entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( *resource_node_header != NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
+		 "%s: invalid table entry value already set.",
+		 function );
+
+		return( -1 );
+	}
+	*resource_node_header = memory_allocate_structure(
+	                         libwrc_resource_node_header_t );
+
+	if( *resource_node_header == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+		 "%s: unable to create table entry.",
+		 function );
+
+		goto on_error;
+	}
+	if( memory_set(
+	     *resource_node_header,
+	     0,
+	     sizeof( libwrc_resource_node_header_t ) ) == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
+		 "%s: unable to clear table entry.",
+		 function );
+
+		goto on_error;
+	}
+	return( 1 );
+
+on_error:
+	if( *resource_node_header != NULL )
+	{
+		memory_free(
+		 *resource_node_header );
+
+		*resource_node_header = NULL;
+	}
+	return( -1 );
+}
+
+/* Frees a table entry
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_header_free(
+     libwrc_resource_node_header_t **resource_node_header,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_header_free";
+
+	if( resource_node_header == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid table entry.",
+		 function );
+
+		return( -1 );
+	}
+	if( *resource_node_header != NULL )
+	{
+		memory_free(
+		 *resource_node_header );
+
+		*resource_node_header = NULL;
+	}
+	return( 1 );
+}
+
+/* Reads the resource node header data
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_header_read_data(
+     libwrc_resource_node_header_t *resource_node_header,
+     const uint8_t *data,
+     size_t data_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_resource_node_header_read_data";
+
+#if defined( HAVE_DEBUG_OUTPUT )
+	uint32_t value_32bit  = 0;
+	uint16_t value_16bit  = 0;
+#endif
+
+	if( resource_node_header == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node header.",
+		 function );
+
+		return( -1 );
+	}
+	if( data == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( data_size < sizeof( wrc_resource_node_header_t ) )
+	 || ( data_size > (size_t) SSIZE_MAX ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid data size value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: resource node header data:\n",
+		 function );
+		libcnotify_print_data(
+		 data,
+		 sizeof( wrc_resource_node_header_t ),
+		 0 );
+	}
+#endif
+	byte_stream_copy_to_uint32_little_endian(
+	 ( (wrc_resource_node_header_t *) data )->flags,
+	 resource_node_header->flags );
+
+	byte_stream_copy_to_uint16_little_endian(
+	 ( (wrc_resource_node_header_t *) data )->number_of_named_entries,
+	 resource_node_header->number_of_named_entries );
+
+	byte_stream_copy_to_uint16_little_endian(
+	 ( (wrc_resource_node_header_t *) data )->number_of_unnamed_entries,
+	 resource_node_header->number_of_unnamed_entries );
+
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: flags\t\t\t\t: 0x%08" PRIx32 "\n",
+		 function,
+		 resource_node_header->flags );
+
+/* TODO print meaning of flags */
+
+		byte_stream_copy_to_uint32_little_endian(
+		 ( (wrc_resource_node_header_t *) data )->flags,
+		 value_32bit );
+		libcnotify_printf(
+		 "%s: creation time\t\t\t: 0x%08" PRIx32 "\n",
+		 function,
+		 value_32bit );
+
+		byte_stream_copy_to_uint16_little_endian(
+		 ( (wrc_resource_node_header_t *) data )->major_version,
+		 value_16bit );
+		libcnotify_printf(
+		 "%s: major version\t\t\t: %" PRIu16 "\n",
+		 function,
+		 value_16bit );
+
+		byte_stream_copy_to_uint16_little_endian(
+		 ( (wrc_resource_node_header_t *) data )->minor_version,
+		 value_16bit );
+		libcnotify_printf(
+		 "%s: minor version\t\t\t: %" PRIu16 "\n",
+		 function,
+		 value_16bit );
+
+		libcnotify_printf(
+		 "%s: number of named entries\t\t: %" PRIu16 "\n",
+		 function,
+		 resource_node_header->number_of_named_entries );
+
+		libcnotify_printf(
+		 "%s: number of unnamed entries\t: %" PRIu16 "\n",
+		 function,
+		 resource_node_header->number_of_unnamed_entries );
+
+		libcnotify_printf(
+		 "\n" );
+	}
+#endif /* defined( HAVE_DEBUG_OUTPUT ) */
+
+	if( resource_node_header->flags != 0 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
+		 "%s: unsupported flags: 0x%08" PRIx32 ".",
+		 function,
+		 resource_node_header->flags );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+
+/* Reads the resource node header
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_resource_node_header_read_file_io_handle(
+     libwrc_resource_node_header_t *resource_node_header,
+     libbfio_handle_t *file_io_handle,
+     off64_t file_offset,
+     libcerror_error_t **error )
+{
+	uint8_t resource_node_header_data[ sizeof( wrc_resource_node_header_t ) ];
+
+	static char *function = "libwrc_resource_node_header_read_file_io_handle";
+	ssize_t read_count    = 0;
+
+	if( resource_node_header == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid resource node header.",
+		 function );
+
+		return( -1 );
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: reading resource node header at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",
+		 function,
+		 file_offset,
+		 file_offset );
+	}
+#endif
+	read_count = libbfio_handle_read_buffer_at_offset(
+	              file_io_handle,
+	              resource_node_header_data,
+	              sizeof( wrc_resource_node_header_t ),
+	              file_offset,
+	              error );
+
+	if( read_count != (ssize_t) sizeof( wrc_resource_node_header_t ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read resource node header data at offset: %" PRIi64 " (0x%08" PRIx64 ").",
+		 function,
+		 file_offset,
+		 file_offset );
+
+		return( -1 );
+	}
+	if( libwrc_resource_node_header_read_data(
+	     resource_node_header,
+	     resource_node_header_data,
+	     sizeof( wrc_resource_node_header_t ),
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read resource node header.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+

libwrc/libwrc_resource_node_header.h

+/*
+ * Resource node header functions
+ *
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
+ *
+ * Refer to AUTHORS for acknowledgements.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#if !defined( _LIBWRC_RESOURCE_NODE_HEADER_H )
+#define _LIBWRC_RESOURCE_NODE_HEADER_H
+
+#include <common.h>
+#include <types.h>
+
+#include "libwrc_libbfio.h"
+#include "libwrc_libcerror.h"
+
+#if defined( __cplusplus )
+extern "C" {
+#endif
+
+typedef struct libwrc_resource_node_header libwrc_resource_node_header_t;
+
+struct libwrc_resource_node_header
+{
+	/* The flags
+	 */
+	uint32_t flags;
+
+	/* The number of named entries
+	 */
+	uint16_t number_of_named_entries;
+
+	/* The number of unnamed entries
+	 */
+	uint16_t number_of_unnamed_entries;
+};
+
+int libwrc_resource_node_header_initialize(
+     libwrc_resource_node_header_t **resource_node_header,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_header_free(
+     libwrc_resource_node_header_t **resource_node_header,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_header_read_data(
+     libwrc_resource_node_header_t *resource_node_header,
+     const uint8_t *data,
+     size_t data_size,
+     libcerror_error_t **error );
+
+int libwrc_resource_node_header_read_file_io_handle(
+     libwrc_resource_node_header_t *resource_node_header,
+     libbfio_handle_t *file_io_handle,
+     off64_t file_offset,
+     libcerror_error_t **error );
+
+#if defined( __cplusplus )
+}
+#endif
+
+#endif /* !defined( _LIBWRC_RESOURCE_NODE_HEADER_H ) */
+

common/config.h

@@ -608,3 +608,3 @@ /* common/config.h.  Generated from config.h.in by configure.  */
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libevtx 20220724"
+#define PACKAGE_STRING "libevtx 20221101"
 
@@ -618,3 +618,3 @@ /* Define to the one symbol short name of this package. */
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "20220724"
+#define PACKAGE_VERSION "20221101"
 
@@ -652,3 +652,3 @@ /* The size of `int', as computed by sizeof. */
 /* Version number of package */
-#define VERSION "20220724"
+#define VERSION "20221101"
 
@@ -655,0 +655,0 @@ /* Number of bits in a file offset, on hosts where this is settable. */

evtxtools/resource_file.c

@@ -29,11 +29,2 @@ /*
 
-#if defined( TIME_WITH_SYS_TIME )
-#include <sys/time.h>
-#include <time.h>
-#elif defined( HAVE_SYS_TIME_H )
-#include <sys/time.h>
-#else
-#include <time.h>
-#endif
-
 #include "evtxtools_libbfio.h"
@@ -1162,3 +1153,3 @@ #include "evtxtools_libcerror.h"
 	static char *function                 = "resource_file_get_message_string";
-	time_t timestamp                      = 0;
+	int64_t timestamp                     = 0;
 	int result                            = 0;
@@ -1165,0 +1156,0 @@

include/libevtx/definitions.h

@@ -27,7 +27,7 @@ /*
 
-#define LIBEVTX_VERSION			20220724
+#define LIBEVTX_VERSION			20221101
 
 /* The version string
  */
-#define LIBEVTX_VERSION_STRING		"20220724"
+#define LIBEVTX_VERSION_STRING		"20221101"
 
@@ -34,0 +34,0 @@ /* The access flags definitions

libbfio/libbfio_definitions.h

@@ -36,7 +36,7 @@ /*
 #else
-#define LIBBFIO_VERSION					20220120
+#define LIBBFIO_VERSION					20221025
 
 /* The libbfio version string
  */
-#define LIBBFIO_VERSION_STRING				"20220120"
+#define LIBBFIO_VERSION_STRING				"20221025"
 
@@ -43,0 +43,0 @@ /* The library flags definitions

libevtx/libevtx_definitions.h

@@ -40,7 +40,7 @@ /*
 #else
-#define LIBEVTX_VERSION						20220724
+#define LIBEVTX_VERSION						20221101
 
 /* The version string
  */
-#define LIBEVTX_VERSION_STRING					"20220724"
+#define LIBEVTX_VERSION_STRING					"20221101"
 
@@ -47,0 +47,0 @@ /* The access flags definitions

libevtx/libevtx_libfwevt.h

@@ -58,5 +58,5 @@ /*
 
-#endif
+#endif /* defined( HAVE_LOCAL_LIBFWEVT ) */
 
-#endif
+#endif /* !defined( _LIBEVTX_LIBFWEVT_H ) */
 

libexe/exe_file_header.h

 /*
  * The file header definition of an executable (EXE) file
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/exe_le_header.h

 /*
  * LE header of an executable (EXE) file
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/exe_mz_header.h

 /*
  * MZ header of an executable (EXE) file
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/exe_ne_header.h

 /*
  * NE header of an executable (EXE) file
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/exe_pe_header.h

 /*
  * PE header of an executable (EXE) file
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/exe_section_table.h

 /*
  * The section table definition of an executable (EXE) file
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_codepage.h

 /*
  * Codepage functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_coff_header.c

 /*
  * COFF header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_coff_header.h

 /*
  * COFF header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_coff_optional_header.c

 /*
  * COFF optional header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_coff_optional_header.h

 /*
  * COFF optional header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_data_directory_descriptor.h

 /*
  * Data directory descriptor functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_debug_data.c

 /*
  * Debug data functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_debug_data.h

 /*
  * Debug data functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_debug.c

 /*
  * Debug functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -42,3 +42,3 @@ * Refer to AUTHORS for acknowledgements.
 		libcnotify_printf(
-		 "\t0x0001 (IMAGE_FILE_RELOCS_STRIPPEDD)\n" );
+		 "\t0x0001 (IMAGE_FILE_RELOCS_STRIPPED)\n" );
 	}
@@ -48,3 +48,3 @@ if( ( characteristic_flags & 0x0002 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0002 (IMAGE_FILE_EXECUTABLE_IMAGED)\n" );
+		 "\t0x0002 (IMAGE_FILE_EXECUTABLE_IMAGE)\n" );
 	}
@@ -54,3 +54,3 @@ if( ( characteristic_flags & 0x0004 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0004 (IMAGE_FILE_LINE_NUMS_STRIPPEDD)\n" );
+		 "\t0x0004 (IMAGE_FILE_LINE_NUMS_STRIPPED)\n" );
 	}
@@ -60,3 +60,3 @@ if( ( characteristic_flags & 0x0008 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0008 (IMAGE_FILE_LOCAL_SYMS_STRIPPEDD)\n" );
+		 "\t0x0008 (IMAGE_FILE_LOCAL_SYMS_STRIPPED)\n" );
 	}
@@ -66,3 +66,3 @@ if( ( characteristic_flags & 0x0010 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0010 (IMAGE_FILE_AGGRESSIVE_WS_TRIMD)\n" );
+		 "\t0x0010 (IMAGE_FILE_AGGRESSIVE_WS_TRIM)\n" );
 	}
@@ -72,3 +72,3 @@ if( ( characteristic_flags & 0x0020 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0020 (IMAGE_FILE_LARGE_ADDRESS_AWARED)\n" );
+		 "\t0x0020 (IMAGE_FILE_LARGE_ADDRESS_AWARE)\n" );
 	}
@@ -78,3 +78,3 @@ if( ( characteristic_flags & 0x0040 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0040 (IMAGE_FILE_16BIT_MACHINED)\n" );
+		 "\t0x0040 (IMAGE_FILE_16BIT_MACHINE)\n" );
 	}
@@ -84,3 +84,3 @@ if( ( characteristic_flags & 0x0080 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0080 (IMAGE_FILE_BYTES_REVERSED_LOD)\n" );
+		 "\t0x0080 (IMAGE_FILE_BYTES_REVERSED_LO)\n" );
 	}
@@ -90,3 +90,3 @@ if( ( characteristic_flags & 0x0100 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0100 (IMAGE_FILE_32BIT_MACHINED)\n" );
+		 "\t0x0100 (IMAGE_FILE_32BIT_MACHINE)\n" );
 	}
@@ -96,3 +96,3 @@ if( ( characteristic_flags & 0x0200 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0200 (IMAGE_FILE_DEBUG_STRIPPEDD)\n" );
+		 "\t0x0200 (IMAGE_FILE_DEBUG_STRIPPED)\n" );
 	}
@@ -102,3 +102,3 @@ if( ( characteristic_flags & 0x0400 ) != 0 )
 		libcnotify_printf(
-		 "\t0x0400 (IMAGE_FILE_REMOVABLE_RUN_FROM_SWAPD)\n" );
+		 "\t0x0400 (IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP)\n" );
 	}
@@ -109,3 +109,3 @@
 		libcnotify_printf(
-		 "\t0x1000 (IMAGE_FILE_SYSTEMD)\n" );
+		 "\t0x1000 (IMAGE_FILE_SYSTEM)\n" );
 	}
@@ -115,3 +115,3 @@ if( ( characteristic_flags & 0x2000 ) != 0 )
 		libcnotify_printf(
-		 "\t0x2000 (IMAGE_FILE_DLLD)\n" );
+		 "\t0x2000 (IMAGE_FILE_DLL)\n" );
 	}
@@ -121,3 +121,3 @@ if( ( characteristic_flags & 0x4000 ) != 0 )
 		libcnotify_printf(
-		 "\t0x4000 (IMAGE_FILE_UP_SYSTEM_ONLYD)\n" );
+		 "\t0x4000 (IMAGE_FILE_UP_SYSTEM_ONLY)\n" );
 	}
@@ -127,3 +127,3 @@ if( ( characteristic_flags & 0x8000 ) != 0 )
 		libcnotify_printf(
-		 "\t0x8000 (IMAGE_FILE_BYTES_REVERSED_HID)\n" );
+		 "\t0x8000 (IMAGE_FILE_BYTES_REVERSED_HI)\n" );
 	}
@@ -130,0 +130,0 @@ }

libexe/libexe_debug.h

 /*
  * Debug functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_definitions.h

 /*
  * The internal definitions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -40,7 +40,7 @@ * Refer to AUTHORS for acknowledgements.
 #else
-#define LIBEXE_VERSION						20210424
+#define LIBEXE_VERSION						20221023
 
 /* The version string
  */
-#define LIBEXE_VERSION_STRING					"20210424"
+#define LIBEXE_VERSION_STRING					"20221023"
 
@@ -47,0 +47,0 @@ /* The access flags definitions

libexe/libexe_error.c

 /*
  * Error functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_error.h

 /*
  * Error functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_export_table.c

 /*
  * Export table functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_export_table.h

 /*
  * Export table functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_extern.h

 /*
  * The internal extern definition
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_file.c

 /*
  * File functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_file.h

 /*
  * File functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_import_table.c

 /*
  * Import table functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_import_table.h

 /*
  * Import table functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_io_handle.c

 /*
  * Input/Output (IO) handle functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_io_handle.h

 /*
  * Input/Output (IO) handle functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_le_header.c

 /*
  * LE header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_le_header.h

 /*
  * LE header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libbfio.h

 /*
  * The libbfio header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libcdata.h

 /*
  * The libcdata header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libcerror.h

 /*
  * The libcerror header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libclocale.h

 /*
  * The libclocale header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libcnotify.h

 /*
  * The libcnotify header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libfcache.h

 /*
  * The libfcache header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libfdata.h

 /*
  * The libfdata header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libfdatetime.h

 /*
  * The libfdatetime header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_libuna.h

 /*
  * The libuna header wrapper
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_mz_header.c

 /*
  * MZ header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_mz_header.h

 /*
  * MZ header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_ne_header.c

 /*
  * NE header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_ne_header.h

 /*
  * NE header functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_notify.c

 /*
  * Notification functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_notify.h

 /*
  * Notification functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_section_descriptor.c

 /*
  * Section decriptor functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_section_descriptor.h

 /*
  * Section descriptor functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_section_io_handle.c

 /*
  * Section IO handle functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_section_io_handle.h

 /*
  * Section IO handle functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_section.c

 /*
  * Section functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_section.h

 /*
  * Section functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_support.c

 /*
  * Support functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_support.h

 /*
  * Support functions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_types.h

 /*
  * The internal type definitions
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libexe/libexe_unused.h

 /*
  * Definitions to silence compiler warnings about unused function attributes/parameters.
  *
- * Copyright (C) 2011-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_access_control_entry.c

 /*
  * Windows NT Access Control Entry (ACE) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_access_control_entry.h

 /*
  * Windows NT Access Contol Entry (ACE) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_access_control_list.c

 /*
  * Windows NT Access Control List (ACL) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_access_control_list.h

 /*
  * Windows NT Access Contol List (ACL) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_bit_stream.c

 /*
  * Bit-stream functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_bit_stream.h

 /*
  * Bit-stream functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_debug.c

 /*
  * Debug functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_debug.h

 /*
  * Debug functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_definitions.h

 /*
  * The internal definitions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -39,7 +39,7 @@ * Refer to AUTHORS for acknowledgements.
 
-#define LIBFWNT_VERSION					20210906
+#define LIBFWNT_VERSION					20220922
 
 /* The version string
  */
-#define LIBFWNT_VERSION_STRING				"20210906"
+#define LIBFWNT_VERSION_STRING				"20220922"
 
@@ -46,0 +46,0 @@

libfwnt/libfwnt_error.c

 /*
  * Error functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_error.h

 /*
  * Error functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_extern.h

 /*
  * The internal extern definition
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_huffman_tree.c

 /*
  * Huffman tree functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_huffman_tree.h

 /*
  * Huffman tree functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_libcdata.h

 /*
  * The libcdata header wrapper
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_libcerror.h

 /*
  * The libcerror header wrapper
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_libcnotify.h

 /*
  * The libcnotify header wrapper
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_locale_identifier.c

 /*
  * Locale identifier (LCID) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_locale_identifier.h

 /*
  * Locale identifier (LCID) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_lznt1.c

 /*
  * LZNT1 (de)compression functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -31,62 +31,2 @@ * Refer to AUTHORS for acknowledgements.
 
-/* Compresses data using LZNT1 compression
- * Returns 1 on success or -1 on error
- */
-int libfwnt_lznt1_compress(
-     const uint8_t *uncompressed_data,
-     size_t uncompressed_data_size,
-     uint8_t *compressed_data,
-     size_t *compressed_data_size,
-     libcerror_error_t **error )
-{
-	static char *function = "libfwnt_lznt1_compress";
-
-	if( uncompressed_data == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid uncompressed data.",
-		 function );
-
-		return( -1 );
-	}
-	if( uncompressed_data_size > (size_t) SSIZE_MAX )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
-		 "%s: invalid uncompressed data size value exceeds maximum.",
-		 function );
-
-		return( -1 );
-	}
-	if( compressed_data == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid compressed data.",
-		 function );
-
-		return( -1 );
-	}
-	if( compressed_data_size == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid compressed data size.",
-		 function );
-
-		return( -1 );
-	}
-/* TODO implement */
-	return( -1 );
-}
-
 /* Decompresses a LZNT1 compressed chunk
@@ -93,0 +33,0 @@ * Returns 1 on success or -1 on error

libfwnt/libfwnt_lznt1.h

 /*
  * LZNT1 (de)compression functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -35,10 +35,2 @@ * Refer to AUTHORS for acknowledgements.
 
-LIBFWNT_EXTERN \
-int libfwnt_lznt1_compress(
-     const uint8_t *uncompressed_data,
-     size_t uncompressed_data_size,
-     uint8_t *compressed_data,
-     size_t *compressed_data_size,
-     libcerror_error_t **error );
-
 int libfwnt_lznt1_decompress_chunk(
@@ -45,0 +37,0 @@ const uint8_t *compressed_data,

libfwnt/libfwnt_lzx.c

 /*
  * LZX (un)compression functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_lzx.h

 /*
  * LZX (un)compression functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_lzxpress.c

 /*
  * LZXPRESS (de)compression functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -327,3 +327,2 @@ * Refer to AUTHORS for acknowledgements.
 					compressed_data_offset += 2;
-
 				}
@@ -363,3 +362,4 @@ /* The size value is stored as
 				}
-#endif
+#endif /* defined( HAVE_DEBUG_OUTPUT ) */
+
 				if( compression_tuple_size > 32771 )
@@ -366,0 +366,0 @@ {

libfwnt/libfwnt_lzxpress.h

 /*
  * LZXPRESS (de)compression functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_notify.c

 /*
  * Notification functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_notify.h

 /*
  * Notification functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_security_descriptor.c

 /*
  * Windows NT Security Descriptor functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_security_descriptor.h

 /*
  * Windows NT Security Descriptor functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_security_identifier.c

 /*
  * Windows NT Security Identifier (SID) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_security_identifier.h

 /*
  * Windows NT Security Identifier (SID) functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_support.c

 /*
  * Support functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_support.h

 /*
  * Support functions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_types.h

 /*
  * The internal type definitions
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libfwnt/libfwnt_unused.h

 /*
  * Definitions to silence compiler warnings about unused function attributes/parameters.
  *
- * Copyright (C) 2009-2021, Joachim Metz <[e-mail]>
+ * Copyright (C) 2009-2022, Joachim Metz <[e-mail]>
  *
@@ -6,0 +6,0 @@ * Refer to AUTHORS for acknowledgements.

libregf/libregf_definitions.h

@@ -40,7 +40,7 @@ /*
 #else
-#define LIBREGF_VERSION					20220131
+#define LIBREGF_VERSION					20221026
 
 /* The libregf version string
  */
-#define LIBREGF_VERSION_STRING				"20220131"
+#define LIBREGF_VERSION_STRING				"20221026"
 
@@ -47,0 +47,0 @@ /* The libregf file access

libwrc/libwrc_data_descriptor.c

@@ -23,2 +23,3 @@ /*
 #include <common.h>
+#include <byte_stream.h>
 #include <memory.h>
@@ -28,4 +29,8 @@ #include <types.h>
 #include "libwrc_data_descriptor.h"
+#include "libwrc_libbfio.h"
 #include "libwrc_libcerror.h"
+#include "libwrc_libcnotify.h"
 
+#include "wrc_data_descriptor.h"
+
 /* Creates a data descriptor
@@ -134,1 +139,160 @@ * Make sure the value data_descriptor is referencing, is set to NULL
 
+/* Reads the data descriptor data
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_data_descriptor_read_data(
+     libwrc_data_descriptor_t *data_descriptor,
+     const uint8_t *data,
+     size_t data_size,
+     libcerror_error_t **error )
+{
+	static char *function = "libwrc_data_descriptor_read_data";
+
+	if( data_descriptor == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data descriptor.",
+		 function );
+
+		return( -1 );
+	}
+	if( data == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data.",
+		 function );
+
+		return( -1 );
+	}
+	if( ( data_size < 8 )
+	 || ( data_size > (size_t) SSIZE_MAX ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid data size value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: data descriptor data:\n",
+		 function );
+		libcnotify_print_data(
+		 data,
+		 sizeof( wrc_data_descriptor_t ),
+		 0 );
+	}
+#endif
+	byte_stream_copy_to_uint32_little_endian(
+	 ( (wrc_data_descriptor_t *) data )->virtual_address,
+	 data_descriptor->virtual_address );
+
+	byte_stream_copy_to_uint32_little_endian(
+	 ( (wrc_data_descriptor_t *) data )->size,
+	 data_descriptor->size );
+
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: virtual address\t\t\t: 0x%08" PRIx32 "\n",
+		 function,
+		 data_descriptor->virtual_address );
+
+		libcnotify_printf(
+		 "%s: size\t\t\t\t: %" PRIu32 "\n",
+		 function,
+		 data_descriptor->size );
+
+		libcnotify_printf(
+		 "\n" );
+	}
+#endif /* defined( HAVE_DEBUG_OUTPUT ) */
+
+	return( 1 );
+}
+
+/* Reads the data descriptor
+ * Returns 1 if successful or -1 on error
+ */
+int libwrc_data_descriptor_read_file_io_handle(
+     libwrc_data_descriptor_t *data_descriptor,
+     libbfio_handle_t *file_io_handle,
+     off64_t file_offset,
+     libcerror_error_t **error )
+{
+	uint8_t data_descriptor_data[ sizeof( wrc_data_descriptor_t ) ];
+
+	static char *function = "libwrc_data_descriptor_read_file_io_handle";
+	ssize_t read_count    = 0;
+
+	if( data_descriptor == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid data descriptor.",
+		 function );
+
+		return( -1 );
+	}
+#if defined( HAVE_DEBUG_OUTPUT )
+	if( libcnotify_verbose != 0 )
+	{
+		libcnotify_printf(
+		 "%s: reading data descriptor at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",
+		 function,
+		 file_offset,
+		 file_offset );
+	}
+#endif
+	read_count = libbfio_handle_read_buffer_at_offset(
+	              file_io_handle,
+	              data_descriptor_data,
+	              sizeof( wrc_data_descriptor_t ),
+	              file_offset,
+	              error );
+
+	if( read_count != (ssize_t) sizeof( wrc_data_descriptor_t ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read data descriptor data at offset: %" PRIi64 " (0x%08" PRIx64 ").",
+		 function,
+		 file_offset,
+		 file_offset );
+
+		return( -1 );
+	}
+	if( libwrc_data_descriptor_read_data(
+	     data_descriptor,
+	     data_descriptor_data,
+	     sizeof( wrc_data_descriptor_t ),
+	     error ) != 1 )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_IO,
+		 LIBCERROR_IO_ERROR_READ_FAILED,
+		 "%s: unable to read data descriptor.",
+		 function );
+
+		return( -1 );
+	}
+	return( 1 );
+}
+

libwrc/libwrc_data_descriptor.h

@@ -28,2 +28,3 @@ /*
 
+#include "libwrc_libbfio.h"
 #include "libwrc_libcerror.h"
@@ -56,2 +57,14 @@
 
+int libwrc_data_descriptor_read_data(
+     libwrc_data_descriptor_t *data_descriptor,
+     const uint8_t *data,
+     size_t data_size,
+     libcerror_error_t **error );
+
+int libwrc_data_descriptor_read_file_io_handle(
+     libwrc_data_descriptor_t *data_descriptor,
+     libbfio_handle_t *file_io_handle,
+     off64_t file_offset,
+     libcerror_error_t **error );
+
 #if defined( __cplusplus )
@@ -58,0 +71,0 @@ }

libwrc/libwrc_debug.c

@@ -60,4 +60,4 @@ /*
 
-		case LIBWRC_RESOURCE_IDENTIFIER_STRING:
-			return( "String" );
+		case LIBWRC_RESOURCE_IDENTIFIER_STRING_TABLE:
+			return( "String table" );
 
@@ -85,4 +85,4 @@ case LIBWRC_RESOURCE_IDENTIFIER_FONT_DIRECTORY:
 
-		case LIBWRC_RESOURCE_IDENTIFIER_VERSION:
-			return( "Version" );
+		case LIBWRC_RESOURCE_IDENTIFIER_VERSION_INFORMATION:
+			return( "Version information" );
 
@@ -89,0 +89,0 @@ case LIBWRC_RESOURCE_IDENTIFIER_DIALOG_INCLUDE:

libwrc/libwrc_definitions.h

@@ -40,7 +40,7 @@ /*
 #else
-#define LIBWRC_VERSION					20220104
+#define LIBWRC_VERSION					20220720
 
 /* The version string
  */
-#define LIBWRC_VERSION_STRING				"20220104"
+#define LIBWRC_VERSION_STRING				"20220720"
 
@@ -76,3 +76,3 @@ /* The access flags definitions
 	LIBWRC_RESOURCE_IDENTIFIER_DIALOG		= 0x05,
-	LIBWRC_RESOURCE_IDENTIFIER_STRING		= 0x06,
+	LIBWRC_RESOURCE_IDENTIFIER_STRING_TABLE		= 0x06,
 	LIBWRC_RESOURCE_IDENTIFIER_FONT_DIRECTORY	= 0x07,
@@ -87,3 +87,3 @@ LIBWRC_RESOURCE_IDENTIFIER_FONT			= 0x08,
 
-	LIBWRC_RESOURCE_IDENTIFIER_VERSION		= 0x10,
+	LIBWRC_RESOURCE_IDENTIFIER_VERSION_INFORMATION	= 0x10,
 	LIBWRC_RESOURCE_IDENTIFIER_DIALOG_INCLUDE	= 0x11,
@@ -99,2 +99,5 @@
 
+#define LIBWRC_RESOURCE_IDENTIFIER_STRING		LIBWRC_RESOURCE_IDENTIFIER_STRING_TABLE
+#define LIBWRC_RESOURCE_IDENTIFIER_VERSION		LIBWRC_RESOURCE_IDENTIFIER_VERSION_INFORMATION
+
 #define LIBWRC_RESOURCE_IDENTIFIER_FLAG_HAS_NAME	0x80000000UL
@@ -122,3 +125,3 @@
 
-	LIBWRC_RESOURCE_TYPE_VERSION,
+	LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION,
 	LIBWRC_RESOURCE_TYPE_DIALOG_INCLUDE,
@@ -139,2 +142,3 @@
 #define LIBWRC_RESOURCE_TYPE_STRING			LIBWRC_RESOURCE_TYPE_STRING_TABLE
+#define LIBWRC_RESOURCE_TYPE_VERSION			LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION
 
@@ -141,0 +145,0 @@ #endif /* !defined( HAVE_LOCAL_LIBWRC ) */

libwrc/libwrc_io_handle.c

@@ -25,6 +25,3 @@ /*
 #include <memory.h>
-#include <narrow_string.h>
-#include <system_string.h>
 #include <types.h>
-#include <wide_string.h>
 
@@ -41,6 +38,6 @@ #include "libwrc_codepage.h"
 #include "libwrc_libuna.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
+#include "libwrc_resource_node_header.h"
 #include "libwrc_unused.h"
 
-#include "wrc_data_descriptor.h"
 #include "wrc_resource_node.h"
@@ -293,3 +290,3 @@
 		 root_node,
-		 (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_resource_values_free,
+		 (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_resource_node_entry_free,
 		 NULL );
@@ -311,29 +308,14 @@ }
 {
-	uint8_t resource_name_size_data[ 2 ];
-	wrc_resource_node_header_t resource_node_header;
+	libcdata_tree_node_t *sub_node                        = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry     = NULL;
+	libwrc_resource_node_entry_t *sub_resource_node_entry = NULL;
+	libwrc_resource_node_header_t *resource_node_header   = NULL;
+	static char *function                                 = "libwrc_io_handle_read_resource_node";
+	uint32_t entry_index                                  = 0;
+	uint32_t number_of_entries                            = 0;
+	int number_of_sub_nodes                               = 0;
+	int resource_node_entry_index                         = 0;
+	int result                                            = 0;
+	int sub_node_index                                    = 0;
 
-	libcdata_tree_node_t *sub_node                = NULL;
-	libwrc_resource_values_t *resource_values     = NULL;
-	libwrc_resource_values_t *sub_resource_values = NULL;
-	uint8_t *resource_node_data                   = NULL;
-	static char *function                         = "libwrc_io_handle_read_resource_node";
-	size_t name_string_size                       = 0;
-	size_t resource_node_data_offset              = 0;
-	size_t resource_node_data_size                = 0;
-	ssize_t read_count                            = 0;
-	uint32_t flags                                = 0;
-	uint16_t number_of_named_entries              = 0;
-	uint16_t number_of_unnamed_entries            = 0;
-	int number_of_sub_nodes                       = 0;
-	int resource_node_entry                       = 0;
-	int sub_node_index                            = 0;
-
-#if defined( HAVE_DEBUG_OUTPUT )
-	system_character_t *value_string              = NULL;
-	size_t value_string_size                      = 0;
-	uint32_t value_32bit                          = 0;
-	uint16_t value_16bit                          = 0;
-	int result                                    = 0;
-#endif
-
 	if( io_handle == NULL )
@@ -373,20 +355,20 @@ {
 	}
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
+	if( libwrc_resource_node_header_initialize(
+	     &resource_node_header,
+	     error ) == -1 )
 	{
-		libcnotify_printf(
-		 "%s: reading resource node header at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",
-		 function,
-		 file_offset,
-		 file_offset );
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+		 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
+		 "%s: unable to create resource node header.",
+		 function );
+
+		goto on_error;
 	}
-#endif
-	read_count = libbfio_handle_read_buffer_at_offset(
-	              file_io_handle,
-	              (uint8_t *) &resource_node_header,
-	              sizeof( wrc_resource_node_header_t ),
-	              file_offset,
-	              error );
-
-	if( read_count != (ssize_t) sizeof( wrc_resource_node_header_t ) )
+	if( libwrc_resource_node_header_read_file_io_handle(
+	     resource_node_header,
+	     file_io_handle,
+	     file_offset,
+	     error ) != 1 )
 	{
@@ -404,95 +386,15 @@ libcerror_error_set(
 	}
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
-	{
-		libcnotify_printf(
-		 "%s: resource node header data:\n",
-		 function );
-		libcnotify_print_data(
-		 (uint8_t *) &resource_node_header,
-		 sizeof( wrc_resource_node_header_t ),
-		 0 );
-	}
-#endif
-	byte_stream_copy_to_uint32_little_endian(
-	 resource_node_header.flags,
-	 flags );
+	file_offset += sizeof( wrc_resource_node_header_t );
 
-	byte_stream_copy_to_uint16_little_endian(
-	 resource_node_header.number_of_named_entries,
-	 number_of_named_entries );
+	number_of_entries = (uint32_t) resource_node_header->number_of_named_entries + (uint32_t) resource_node_header->number_of_unnamed_entries;
 
-	byte_stream_copy_to_uint16_little_endian(
-	 resource_node_header.number_of_unnamed_entries,
-	 number_of_unnamed_entries );
-
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
+	if( libwrc_resource_node_header_free(
+	     &resource_node_header,
+	     error ) == -1 )
 	{
-		libcnotify_printf(
-		 "%s: flags\t\t\t\t\t: 0x%08" PRIx32 "\n",
-		 function,
-		 value_32bit );
-
-		byte_stream_copy_to_uint32_little_endian(
-		 resource_node_header.flags,
-		 value_32bit );
-		libcnotify_printf(
-		 "%s: creation time\t\t\t\t: 0x%08" PRIx32 "\n",
-		 function,
-		 value_32bit );
-
-		byte_stream_copy_to_uint16_little_endian(
-		 resource_node_header.major_version,
-		 value_16bit );
-		libcnotify_printf(
-		 "%s: major version\t\t\t\t: %" PRIu16 "\n",
-		 function,
-		 value_16bit );
-
-		byte_stream_copy_to_uint16_little_endian(
-		 resource_node_header.minor_version,
-		 value_16bit );
-		libcnotify_printf(
-		 "%s: minor version\t\t\t\t: %" PRIu16 "\n",
-		 function,
-		 value_16bit );
-
-		libcnotify_printf(
-		 "%s: number of named entries\t\t\t: %" PRIu16 "\n",
-		 function,
-		 number_of_named_entries );
-
-		libcnotify_printf(
-		 "%s: number of unnamed entries\t\t\t: %" PRIu16 "\n",
-		 function,
-		 number_of_unnamed_entries );
-
-		libcnotify_printf(
-		 "\n" );
-	}
-#endif /* defined( HAVE_DEBUG_OUTPUT ) */
-
-	if( flags != 0 )
-	{
 		libcerror_error_set(
 		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
-		 "%s: unsupported flags: 0x%08" PRIx32 ".",
-		 function,
-		 flags );
-
-		return( -1 );
-	}
-	resource_node_data_size = ( (size_t) number_of_named_entries + (size_t) number_of_unnamed_entries ) * 8;
-
-	if( ( resource_node_data_size == 0 )
-	 || ( resource_node_data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
-	{
-		libcerror_error_set(
-		 error,
 		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
-		 "%s: invalid resource node data size value out of bounds.",
+		 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
+		 "%s: unable to free resource node header.",
 		 function );
@@ -502,49 +404,8 @@
 	}
-	resource_node_data = (uint8_t *) memory_allocate(
-	                                  sizeof( uint8_t ) * resource_node_data_size );
-
-	if( resource_node_data == NULL )
+	for( entry_index = 0;
+	     entry_index < number_of_entries;
+	     entry_index++ )
 	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create resource node data.",
-		 function );
-
-		goto on_error;
-	}
-	read_count = libbfio_handle_read_buffer(
-	              file_io_handle,
-	              resource_node_data,
-	              resource_node_data_size,
-	              error );
-
-	if( read_count != (ssize_t) resource_node_data_size )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_IO,
-		 LIBCERROR_IO_ERROR_READ_FAILED,
-		 "%s: unable to read resource node data.",
-		 function );
-
-		goto on_error;
-	}
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
-	{
-		libcnotify_printf(
-		 "%s: resource node data:\n",
-		 function );
-		libcnotify_print_data(
-		 resource_node_data,
-		 resource_node_data_size,
-		 0 );
-	}
-#endif
-	while( ( resource_node_data_offset + 8 ) <= resource_node_data_size )
-	{
-		if( libwrc_resource_values_initialize(
-		     &resource_values,
+		if( libwrc_resource_node_entry_initialize(
+		     &resource_node_entry,
 		     error ) == -1 )
@@ -556,148 +417,131 @@ {
 			 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-			 "%s: unable to create resource values: %d.",
-			 function,
-			 resource_node_entry );
+			 "%s: unable to create resource node entry.",
+			 function );
 
 			goto on_error;
 		}
-		if( resource_values == NULL )
+		if( libwrc_resource_node_entry_read_file_io_handle(
+		     resource_node_entry,
+		     file_io_handle,
+		     file_offset,
+		     node_level,
+		     error ) != 1 )
 		{
 			libcerror_error_set(
 			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: invalid resource values: %d.",
+			 LIBCERROR_ERROR_DOMAIN_IO,
+			 LIBCERROR_IO_ERROR_READ_FAILED,
+			 "%s: unable to read resource node entry at offset: %" PRIi64 " (0x%08" PRIx64 ").",
 			 function,
-			 resource_node_entry );
+			 file_offset,
+			 file_offset );
 
 			goto on_error;
 		}
-		byte_stream_copy_to_uint32_little_endian(
-		 &( resource_node_data[ resource_node_data_offset ] ),
-		 resource_values->identifier );
+		file_offset += sizeof( wrc_resource_node_entry_t );
 
-		resource_node_data_offset += 4;
+		result = libwrc_resource_node_entry_read_name_file_io_handle(
+		          resource_node_entry,
+		          file_io_handle,
+		          error );
 
-		byte_stream_copy_to_uint32_little_endian(
-		 &( resource_node_data[ resource_node_data_offset ] ),
-		 resource_values->offset );
-
-		resource_node_data_offset += 4;
-
-#if defined( HAVE_DEBUG_OUTPUT )
-		if( libcnotify_verbose != 0 )
+		if( result == -1 )
 		{
-			libcnotify_printf(
-			 "%s: resource node entry: %03d identifier\t: 0x%08" PRIx32 "",
-			 function,
-			 resource_node_entry,
-			 resource_values->identifier );
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_IO,
+			 LIBCERROR_IO_ERROR_READ_FAILED,
+			 "%s: unable to read resource node name.",
+			 function );
 
-			if( ( node_level == 1 )
-			 && ( ( resource_values->identifier & LIBWRC_RESOURCE_IDENTIFIER_FLAG_HAS_NAME ) == 0 ) )
-			{
-				libcnotify_printf(
-				 " (%s)",
-				 libwrc_debug_get_resource_identifier(
-				  resource_values->identifier ) );
-			}
-			libcnotify_printf(
-			 "\n" );
-
-			libcnotify_printf(
-			 "%s: resource node entry: %03d offset\t\t: 0x%08" PRIx32 "\n",
-			 function,
-			 resource_node_entry,
-			 resource_values->offset );
+			goto on_error;
 		}
-#endif /* defined( HAVE_DEBUG_OUTPUT ) */
-
 		if( node_level == 1 )
 		{
-			if( ( resource_values->identifier & LIBWRC_RESOURCE_IDENTIFIER_FLAG_HAS_NAME ) == 0 )
+			if( ( resource_node_entry->identifier & LIBWRC_RESOURCE_IDENTIFIER_FLAG_HAS_NAME ) == 0 )
 			{
-				switch( resource_values->identifier )
+				switch( resource_node_entry->identifier )
 				{
 					case LIBWRC_RESOURCE_IDENTIFIER_CURSOR:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_CURSOR;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_CURSOR;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_BITMAP:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_BITMAP;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_BITMAP;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_ICON:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_ICON;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_ICON;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_MENU:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_MENU;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_MENU;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_DIALOG:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_DIALOG;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_DIALOG;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_STRING:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_STRING;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_STRING;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_FONT_DIRECTORY:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_FONT_DIRECTORY;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_FONT_DIRECTORY;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_FONT:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_FONT;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_FONT;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_ACCELERATOR:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_ACCELERATOR;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_ACCELERATOR;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_RAW_DATA:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_RAW_DATA;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_RAW_DATA;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_MESSAGE_TABLE:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_MESSAGE_TABLE;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_MESSAGE_TABLE;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_GROUP_CURSOR:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_GROUP_CURSOR;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_GROUP_CURSOR;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_GROUP_ICON:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_GROUP_ICON;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_GROUP_ICON;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_VERSION:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_VERSION;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_VERSION;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_DIALOG_INCLUDE:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_DIALOG_INCLUDE;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_DIALOG_INCLUDE;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_PLUG_AND_PLAY:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_PLUG_AND_PLAY;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_PLUG_AND_PLAY;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_VXD:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_VXD;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_VXD;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_ANIMATED_CURSOR:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_ANIMATED_CURSOR;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_ANIMATED_CURSOR;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_ANIMATED_ICON:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_ANIMATED_ICON;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_ANIMATED_ICON;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_HTML:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_HTML;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_HTML;
 						break;
 
 					case LIBWRC_RESOURCE_IDENTIFIER_MANIFEST:
-						resource_values->type = LIBWRC_RESOURCE_TYPE_MANIFEST;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_MANIFEST;
 						break;
@@ -708,204 +552,28 @@ }
 			{
-				read_count = libbfio_handle_read_buffer_at_offset(
-					      file_io_handle,
-					      resource_name_size_data,
-					      2,
-					      (off64_t) ( resource_values->identifier & 0x7fffffffUL ),
-					      error );
-
-				if( read_count != (ssize_t) 2 )
+				if( resource_node_entry->name_string_size == 6 )
 				{
-					libcerror_error_set(
-					 error,
-					 LIBCERROR_ERROR_DOMAIN_IO,
-					 LIBCERROR_IO_ERROR_READ_FAILED,
-					 "%s: unable to read resource name string size at offset: %" PRIi64 " (0x%08" PRIx64 ").",
-					 function,
-					 (off64_t) ( resource_values->identifier & 0x7fffffffUL ),
-					 (off64_t) ( resource_values->identifier & 0x7fffffffUL ) );
-
-					goto on_error;
+					if( memory_compare(
+					     resource_node_entry->name_string,
+					     libwrc_resource_name_mui,
+					     6 ) == 0 )
+					{
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_MUI;
+					}
 				}
-				byte_stream_copy_to_uint16_little_endian(
-				 resource_name_size_data,
-				 name_string_size );
-
-#if defined( HAVE_DEBUG_OUTPUT )
-				if( libcnotify_verbose != 0 )
+				else if( resource_node_entry->name_string_size == 26 )
 				{
-					libcnotify_printf(
-					 "%s: resource node entry: %03d name string size\t: %" PRIzd "\n",
-					 function,
-					 resource_node_entry,
-					 name_string_size );
-
-				}
-#endif
-				name_string_size *= 2;
-
-				if( ( name_string_size == 0 )
-				 || ( name_string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
-				{
-					libcerror_error_set(
-					 error,
-					 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-					 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
-					 "%s: invalid name string size value out of bounds.",
-					 function );
-
-					goto on_error;
-				}
-				resource_values->name_string = (uint8_t *) memory_allocate(
-				                                            sizeof( uint8_t ) * name_string_size );
-
-				if( resource_values->name_string == NULL )
-				{
-					libcerror_error_set(
-					 error,
-					 LIBCERROR_ERROR_DOMAIN_MEMORY,
-					 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-					 "%s: unable to create resource node name string.",
-					 function );
-
-					goto on_error;
-				}
-				resource_values->name_string_size = name_string_size;
-
-				read_count = libbfio_handle_read_buffer(
-					      file_io_handle,
-					      resource_values->name_string,
-					      name_string_size,
-					      error );
-
-				if( read_count != (ssize_t) name_string_size )
-				{
-					libcerror_error_set(
-					 error,
-					 LIBCERROR_ERROR_DOMAIN_IO,
-					 LIBCERROR_IO_ERROR_READ_FAILED,
-					 "%s: unable to read resource node name string.",
-					 function );
-
-					goto on_error;
-				}
-#if defined( HAVE_DEBUG_OUTPUT )
-				if( libcnotify_verbose != 0 )
-				{
-#if defined( HAVE_WIDE_SYSTEM_CHARACTER )
-					result = libuna_utf16_string_size_from_utf16_stream(
-						  resource_values->name_string,
-						  resource_values->name_string_size,
-						  LIBUNA_ENDIAN_LITTLE,
-						  &value_string_size,
-						  error );
-#else
-					result = libuna_utf8_string_size_from_utf16_stream(
-						  resource_values->name_string,
-						  resource_values->name_string_size,
-						  LIBUNA_ENDIAN_LITTLE,
-						  &value_string_size,
-						  error );
-#endif
-					if( result != 1 )
+					if( memory_compare(
+					     resource_node_entry->name_string,
+					     libwrc_resource_name_wevt_template,
+					     26 ) == 0 )
 					{
-						libcerror_error_set(
-						 error,
-						 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-						 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-						 "%s: unable to determine size of data string.",
-						 function );
-
-						goto on_error;
+						resource_node_entry->type = LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE;
 					}
-					if( value_string_size > ( (size_t) SSIZE_MAX / sizeof( system_character_t ) ) )
-					{
-						libcerror_error_set(
-						 error,
-						 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-						 LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,
-						 "%s: invalid data string size value exceeds maximum.",
-						 function );
-
-						goto on_error;
-					}
-					value_string = system_string_allocate(
-							value_string_size );
-
-					if( value_string == NULL )
-					{
-						libcerror_error_set(
-						 error,
-						 LIBCERROR_ERROR_DOMAIN_MEMORY,
-						 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-						 "%s: unable to create data string.",
-						 function );
-
-						goto on_error;
-					}
-#if defined( HAVE_WIDE_SYSTEM_CHARACTER )
-					result = libuna_utf16_string_copy_from_utf16_stream(
-						  (libuna_utf16_character_t *) value_string,
-						  value_string_size,
-						  resource_values->name_string,
-						  resource_values->name_string_size,
-						  LIBUNA_ENDIAN_LITTLE,
-						  error );
-#else
-					result = libuna_utf8_string_copy_from_utf16_stream(
-						  (libuna_utf8_character_t *) value_string,
-						  value_string_size,
-						  resource_values->name_string,
-						  resource_values->name_string_size,
-						  LIBUNA_ENDIAN_LITTLE,
-						  error );
-#endif
-					if( result != 1 )
-					{
-						libcerror_error_set(
-						 error,
-						 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-						 LIBCERROR_RUNTIME_ERROR_SET_FAILED,
-						 "%s: unable to set data string.",
-						 function );
-
-						goto on_error;
-					}
-					libcnotify_printf(
-					 "%s: resource node entry: %03d name string\t: %" PRIs_SYSTEM "\n",
-					 function,
-					 resource_node_entry,
-					 value_string );
-
-					memory_free(
-					 value_string );
-
-					value_string = NULL;
 				}
-#endif /* defined( HAVE_DEBUG_OUTPUT ) */
 			}
-			if( resource_values->name_string_size == 6 )
-			{
-				if( memory_compare(
-				     resource_values->name_string,
-				     libwrc_resource_name_mui,
-				     6 ) == 0 )
-				{
-					resource_values->type = LIBWRC_RESOURCE_TYPE_MUI;
-				}
-			}
-			else if( resource_values->name_string_size == 26 )
-			{
-				if( memory_compare(
-				     resource_values->name_string,
-				     libwrc_resource_name_wevt_template,
-				     26 ) == 0 )
-				{
-					resource_values->type = LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE;
-				}
-			}
 		}
 		if( libcdata_tree_node_insert_value(
 		     node,
-		     (intptr_t *) resource_values,
-		     (int (*)(intptr_t *, intptr_t *, libcerror_error_t **)) &libwrc_resource_values_compare,
+		     (intptr_t *) resource_node_entry,
+		     (int (*)(intptr_t *, intptr_t *, libcerror_error_t **)) &libwrc_resource_node_entry_compare,
 		     LIBCDATA_INSERT_FLAG_NON_UNIQUE_ENTRIES,
@@ -920,9 +588,9 @@ error ) == -1 )
 			 function,
-			 resource_node_entry );
+			 resource_node_entry_index );
 
 			goto on_error;
 		}
-		resource_values = NULL;
+		resource_node_entry = NULL;
 
-		resource_node_entry++;
+		resource_node_entry_index++;
 
@@ -937,7 +605,2 @@ #if defined( HAVE_DEBUG_OUTPUT )
 	}
-	memory_free(
-	 resource_node_data );
-
-	resource_node_data = NULL;
-
 	if( libcdata_tree_node_get_number_of_sub_nodes(
@@ -978,3 +641,3 @@ node,
 		     sub_node,
-		     (intptr_t **) &sub_resource_values,
+		     (intptr_t **) &sub_resource_node_entry,
 		     error ) != 1 )
@@ -986,3 +649,3 @@ {
 			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve value of sub node: %d.",
+			 "%s: unable to retrieve resource sub node: %d entry.",
 			 function,
@@ -993,3 +656,3 @@ sub_node_index );
 		}
-		if( sub_resource_values == NULL )
+		if( sub_resource_node_entry == NULL )
 		{
@@ -1000,3 +663,3 @@ libcerror_error_set(
 			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: invalid sub resource values: %d.",
+			 "%s: invalid resource sub node: %d entry.",
 			 function,
@@ -1007,3 +670,3 @@ sub_node_index );
 		}
-		if( ( sub_resource_values->offset & 0x80000000UL ) != 0 )
+		if( ( sub_resource_node_entry->offset & 0x80000000UL ) != 0 )
 		{
@@ -1013,3 +676,3 @@ if( libwrc_io_handle_read_resource_node(
 			     file_io_handle,
-			     (off64_t) ( sub_resource_values->offset & 0x7fffffffUL ),
+			     (off64_t) ( sub_resource_node_entry->offset & 0x7fffffffUL ),
 			     node_level + 1,
@@ -1023,6 +686,7 @@ sub_node,
 				 LIBCERROR_IO_ERROR_READ_FAILED,
-				 "%s: unable to read sub resource node: %d at offset: 0x%08" PRIx32 ".",
+				 "%s: unable to read sub resource node: %d at offset: %" PRIu32 " (0x%08" PRIx32 ").",
 				 function,
 				 sub_node_index,
-				 sub_resource_values->offset );
+				 sub_resource_node_entry->offset,
+				 sub_resource_node_entry->offset );
 
@@ -1035,3 +699,3 @@ goto on_error;
 			if( libwrc_data_descriptor_initialize(
-			     &( sub_resource_values->data_descriptor ),
+			     &( sub_resource_node_entry->data_descriptor ),
 			     error ) == -1 )
@@ -1049,7 +713,6 @@ {
 			}
-			if( libwrc_io_handle_read_data_descriptor(
-			     io_handle,
+			if( libwrc_data_descriptor_read_file_io_handle(
+			     sub_resource_node_entry->data_descriptor,
 			     file_io_handle,
-			     (off64_t) sub_resource_values->offset,
-			     sub_resource_values->data_descriptor,
+			     (off64_t) sub_resource_node_entry->offset,
 			     error ) != 1 )
@@ -1061,9 +724,35 @@ {
 				 LIBCERROR_IO_ERROR_READ_FAILED,
-				 "%s: unable to read data descriptor: %d at offset: 0x%08" PRIx32 ".",
+				 "%s: unable to read data descriptor: %d at offset: %" PRIu32 " (0x%08" PRIx32 ").",
 				 function,
 				 sub_node_index,
-				 sub_resource_values->offset );
+				 sub_resource_node_entry->offset,
+				 sub_resource_node_entry->offset );
 
 				goto on_error;
 			}
+			if( ( sub_resource_node_entry->data_descriptor->virtual_address < io_handle->virtual_address )
+			 || ( (size64_t) sub_resource_node_entry->data_descriptor->virtual_address >= ( io_handle->virtual_address + io_handle->stream_size ) ) )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+				 "%s: invalid data descriptor: %d - virtual address out of bounds.",
+				 function,
+				 sub_node_index );
+
+				goto on_error;
+			}
+			if( (size64_t) ( sub_resource_node_entry->data_descriptor->virtual_address + sub_resource_node_entry->data_descriptor->size ) > ( io_handle->virtual_address + io_handle->stream_size ) )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+				 "%s: invalid data descriptor: %d - size out of bounds.",
+				 function,
+				 sub_node_index );
+
+				goto on_error;
+			}
 		}
@@ -1089,152 +778,16 @@ if( libcdata_tree_node_get_next_node(
 on_error:
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( value_string != NULL )
+	if( resource_node_entry != NULL )
 	{
-		memory_free(
-		 value_string );
+		libwrc_resource_node_entry_free(
+		 &resource_node_entry,
+		 NULL );
 	}
-#endif
-	if( resource_values != NULL )
+	if( resource_node_header != NULL )
 	{
-		libwrc_resource_values_free(
-		 &resource_values,
+		libwrc_resource_node_header_free(
+		 &resource_node_header,
 		 NULL );
 	}
-	if( resource_node_data != NULL )
-	{
-		memory_free(
-		 resource_node_data );
-	}
 	return( -1 );
 }
 
-/* Reads a data descriptor
- * Returns 1 if successful or -1 on error
- */
-int libwrc_io_handle_read_data_descriptor(
-     libwrc_io_handle_t *io_handle,
-     libbfio_handle_t *file_io_handle,
-     off64_t file_offset,
-     libwrc_data_descriptor_t *data_descriptor,
-     libcerror_error_t **error )
-{
-	wrc_data_descriptor_t data_descriptor_data;
-
-	static char *function = "libwrc_io_handle_read_data_descriptor";
-	ssize_t read_count    = 0;
-
-	if( io_handle == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid IO handle.",
-		 function );
-
-		return( -1 );
-	}
-	if( data_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid data descriptor.",
-		 function );
-
-		return( -1 );
-	}
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
-	{
-		libcnotify_printf(
-		 "%s: reading data descriptor at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",
-		 function,
-		 file_offset,
-		 file_offset );
-	}
-#endif
-	read_count = libbfio_handle_read_buffer_at_offset(
-	              file_io_handle,
-	              (uint8_t *) &data_descriptor_data,
-	              sizeof( wrc_data_descriptor_t ),
-	              file_offset,
-	              error );
-
-	if( read_count != (ssize_t) sizeof( wrc_data_descriptor_t ) )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_IO,
-		 LIBCERROR_IO_ERROR_READ_FAILED,
-		 "%s: unable to read data descriptor at offset: %" PRIi64 " (0x%08" PRIx64 ").",
-		 function,
-		 file_offset,
-		 file_offset );
-
-		return( -1 );
-	}
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
-	{
-		libcnotify_printf(
-		 "%s: data descriptor data:\n",
-		 function );
-		libcnotify_print_data(
-		 (uint8_t *) &data_descriptor_data,
-		 sizeof( wrc_data_descriptor_t ),
-		 0 );
-	}
-#endif
-	byte_stream_copy_to_uint32_little_endian(
-	 data_descriptor_data.virtual_address,
-	 data_descriptor->virtual_address );
-
-	byte_stream_copy_to_uint32_little_endian(
-	 data_descriptor_data.size,
-	 data_descriptor->size );
-
-#if defined( HAVE_DEBUG_OUTPUT )
-	if( libcnotify_verbose != 0 )
-	{
-		libcnotify_printf(
-		 "%s: virtual address\t\t\t: 0x%08" PRIx32 "\n",
-		 function,
-		 data_descriptor->virtual_address );
-
-		libcnotify_printf(
-		 "%s: size\t\t\t\t: %" PRIu32 "\n",
-		 function,
-		 data_descriptor->size );
-
-		libcnotify_printf(
-		 "\n" );
-	}
-#endif
-	if( ( data_descriptor->virtual_address < io_handle->virtual_address )
-	 || ( (size64_t) data_descriptor->virtual_address >= ( io_handle->virtual_address + io_handle->stream_size ) ) )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
-		 "%s: virtual address out of bounds.",
-		 function );
-
-		return( -1 );
-	}
-	if( (size64_t) ( data_descriptor->virtual_address + data_descriptor->size ) > ( io_handle->virtual_address + io_handle->stream_size ) )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
-		 "%s: size out of bounds.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-

libwrc/libwrc_io_handle.h

@@ -28,3 +28,2 @@ /*
 
-#include "libwrc_data_descriptor.h"
 #include "libwrc_libbfio.h"
@@ -87,9 +86,2 @@ #include "libwrc_libcdata.h"
 
-int libwrc_io_handle_read_data_descriptor(
-     libwrc_io_handle_t *io_handle,
-     libbfio_handle_t *file_io_handle,
-     off64_t file_offset,
-     libwrc_data_descriptor_t *data_descriptor,
-     libcerror_error_t **error );
-
 #if defined( __cplusplus )
@@ -96,0 +88,0 @@ }

libwrc/libwrc_manifest.c

@@ -34,3 +34,2 @@ /*
 #include "libwrc_resource.h"
-#include "libwrc_resource_values.h"
 
@@ -37,0 +36,0 @@ /* Retrieves the size of a specific UTF-8 formatted string

libwrc/libwrc_message_table_resource.c

@@ -225,3 +225,3 @@ /*
 	if( ( data_size < 4 )
-	 || ( data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
+	 || ( data_size > (size_t) SSIZE_MAX ) )
 	{
@@ -228,0 +228,0 @@ libcerror_error_set(

libwrc/libwrc_message_table.c

@@ -32,3 +32,3 @@ /*
 #include "libwrc_resource.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 
@@ -60,3 +60,3 @@ /* Retrieves the number of messages
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -67,3 +67,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -73,3 +73,3 @@
 	}
-	if( internal_resource->resource_values->identifier != LIBWRC_RESOURCE_IDENTIFIER_MESSAGE_TABLE )
+	if( internal_resource->resource_node_entry->identifier != LIBWRC_RESOURCE_IDENTIFIER_MESSAGE_TABLE )
 	{
@@ -80,5 +80,5 @@ libcerror_error_set(
 		 LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
-		 "%s: unsupported resource type: 0x%08" PRIx32 ".",
+		 "%s: invalid resource - invalid resource node entry - unsupported resource type: 0x%08" PRIx32 ".",
 		 function,
-		 internal_resource->resource_values->identifier );
+		 internal_resource->resource_node_entry->identifier );
 
@@ -243,3 +243,3 @@ return( -1 );
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -250,3 +250,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -256,3 +256,3 @@
 	}
-	if( internal_resource->resource_values->identifier != LIBWRC_RESOURCE_IDENTIFIER_MESSAGE_TABLE )
+	if( internal_resource->resource_node_entry->identifier != LIBWRC_RESOURCE_IDENTIFIER_MESSAGE_TABLE )
 	{
@@ -263,5 +263,5 @@ libcerror_error_set(
 		 LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
-		 "%s: unsupported resource type: 0x%08" PRIx32 ".",
+		 "%s: invalid resource - missing resource node entry - unsupported resource type: 0x%08" PRIx32 ".",
 		 function,
-		 internal_resource->resource_values->identifier );
+		 internal_resource->resource_node_entry->identifier );
 
@@ -268,0 +268,0 @@ return( -1 );

libwrc/libwrc_resource_item.c

@@ -31,3 +31,3 @@ /*
 #include "libwrc_resource_item.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 
@@ -46,3 +46,3 @@ /* Creates a resource item
 	libwrc_internal_resource_item_t *internal_resource_item = NULL;
-	libwrc_resource_values_t *resource_values               = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry       = NULL;
 	static char *function                                   = "libwrc_resource_item_initialize";
@@ -74,3 +74,3 @@
 	     resource_node,
-	     (intptr_t **) &resource_values,
+	     (intptr_t **) &resource_node_entry,
 	     error ) != 1 )
@@ -82,3 +82,3 @@ {
 		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve value of resource node.",
+		 "%s: unable to retrieve resource node entry.",
 		 function );
@@ -88,3 +88,3 @@
 	}
-	if( resource_values == NULL )
+	if( resource_node_entry == NULL )
 	{
@@ -95,3 +95,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource values.",
+		 "%s: invalid resource node entry.",
 		 function );
@@ -132,6 +132,6 @@
 	}
-	internal_resource_item->io_handle       = io_handle;
-	internal_resource_item->file_io_handle  = file_io_handle;
-	internal_resource_item->resource_node   = resource_node;
-	internal_resource_item->resource_values = resource_values;
+	internal_resource_item->io_handle           = io_handle;
+	internal_resource_item->file_io_handle      = file_io_handle;
+	internal_resource_item->resource_node       = resource_node;
+	internal_resource_item->resource_node_entry = resource_node_entry;
 
@@ -207,4 +207,4 @@ *resource_item = (libwrc_resource_item_t *) internal_resource_item;
 
-	if( libwrc_resource_values_get_identifier(
-	     internal_resource_item->resource_values,
+	if( libwrc_resource_node_entry_get_identifier(
+	     internal_resource_item->resource_node_entry,
 	     identifier,
@@ -251,4 +251,4 @@ error ) != 1 )
 
-	result = libwrc_resource_values_get_utf8_name_size(
-	          internal_resource_item->resource_values,
+	result = libwrc_resource_node_entry_get_utf8_name_size(
+	          internal_resource_item->resource_node_entry,
 	          utf8_string_size,
@@ -298,4 +298,4 @@ error );
 
-	result = libwrc_resource_values_get_utf8_name(
-	          internal_resource_item->resource_values,
+	result = libwrc_resource_node_entry_get_utf8_name(
+	          internal_resource_item->resource_node_entry,
 	          utf8_string,
@@ -345,4 +345,4 @@ utf8_string_size,
 
-	result = libwrc_resource_values_get_utf16_name_size(
-	          internal_resource_item->resource_values,
+	result = libwrc_resource_node_entry_get_utf16_name_size(
+	          internal_resource_item->resource_node_entry,
 	          utf16_string_size,
@@ -392,4 +392,4 @@ error );
 
-	result = libwrc_resource_values_get_utf16_name(
-	          internal_resource_item->resource_values,
+	result = libwrc_resource_node_entry_get_utf16_name(
+	          internal_resource_item->resource_node_entry,
 	          utf16_string,
@@ -451,3 +451,3 @@ utf16_string_size,
 	}
-	if( internal_resource_item->resource_values == NULL )
+	if( internal_resource_item->resource_node_entry == NULL )
 	{
@@ -458,3 +458,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - missing resource values.",
+		 "%s: invalid resource item - missing resource node entry.",
 		 function );
@@ -464,3 +464,3 @@
 	}
-	if( internal_resource_item->resource_values->data_descriptor == NULL )
+	if( internal_resource_item->resource_node_entry->data_descriptor == NULL )
 	{
@@ -471,3 +471,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - invalid resource values - missing data descriptor.",
+		 "%s: invalid resource item - invalid resource node entry - missing data descriptor.",
 		 function );
@@ -510,12 +510,12 @@
 	}
-	if( internal_resource_item->current_offset >= (off64_t) internal_resource_item->resource_values->data_descriptor->size )
+	if( internal_resource_item->current_offset >= (off64_t) internal_resource_item->resource_node_entry->data_descriptor->size )
 	{
 		return( 0 );
 	}
-	if( ( size > (size64_t) internal_resource_item->resource_values->data_descriptor->size )
-	 || ( (size64_t) internal_resource_item->current_offset > ( (size64_t) internal_resource_item->resource_values->data_descriptor->size - size ) ) )
+	if( ( size > (size64_t) internal_resource_item->resource_node_entry->data_descriptor->size )
+	 || ( (size64_t) internal_resource_item->current_offset > ( (size64_t) internal_resource_item->resource_node_entry->data_descriptor->size - size ) ) )
 	{
-		size = (size_t)( (off64_t) internal_resource_item->resource_values->data_descriptor->size - internal_resource_item->current_offset );
+		size = (size_t)( (off64_t) internal_resource_item->resource_node_entry->data_descriptor->size - internal_resource_item->current_offset );
 	}
-	data_offset  = internal_resource_item->resource_values->data_descriptor->virtual_address;
+	data_offset  = internal_resource_item->resource_node_entry->data_descriptor->virtual_address;
 	data_offset -= internal_resource_item->io_handle->virtual_address;
@@ -620,3 +620,3 @@ data_offset += internal_resource_item->current_offset;
 
-	if( internal_resource_item->resource_values == NULL )
+	if( internal_resource_item->resource_node_entry == NULL )
 	{
@@ -627,3 +627,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - missing resource values.",
+		 "%s: invalid resource item - missing resource node entry.",
 		 function );
@@ -633,3 +633,3 @@
 	}
-	if( internal_resource_item->resource_values->data_descriptor == NULL )
+	if( internal_resource_item->resource_node_entry->data_descriptor == NULL )
 	{
@@ -640,3 +640,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - invalid resource values - missing data descriptor.",
+		 "%s: invalid resource item - invalid resource node entry - missing data descriptor.",
 		 function );
@@ -676,3 +676,3 @@
 	{
-		offset += internal_resource_item->resource_values->data_descriptor->size;
+		offset += internal_resource_item->resource_node_entry->data_descriptor->size;
 	}
@@ -719,3 +719,3 @@ if( offset < 0 )
 
-	if( internal_resource_item->resource_values == NULL )
+	if( internal_resource_item->resource_node_entry == NULL )
 	{
@@ -726,3 +726,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - missing resource values.",
+		 "%s: invalid resource item - missing resource node entry.",
 		 function );
@@ -732,3 +732,3 @@
 	}
-	if( internal_resource_item->resource_values->data_descriptor == NULL )
+	if( internal_resource_item->resource_node_entry->data_descriptor == NULL )
 	{
@@ -739,3 +739,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - invalid resource values - missing data descriptor.",
+		 "%s: invalid resource item - invalid resource node entry - missing data descriptor.",
 		 function );
@@ -786,3 +786,3 @@
 
-	if( internal_resource_item->resource_values == NULL )
+	if( internal_resource_item->resource_node_entry == NULL )
 	{
@@ -793,3 +793,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource item - missing resource values.",
+		 "%s: invalid resource item - missing resource node entry.",
 		 function );
@@ -810,5 +810,5 @@
 	}
-	if( internal_resource_item->resource_values->data_descriptor != NULL )
+	if( internal_resource_item->resource_node_entry->data_descriptor != NULL )
 	{
-		safe_size = (uint32_t) internal_resource_item->resource_values->data_descriptor->size;
+		safe_size = (uint32_t) internal_resource_item->resource_node_entry->data_descriptor->size;
 	}
@@ -815,0 +815,0 @@ *size = safe_size;

libwrc/libwrc_resource_item.h

@@ -33,3 +33,3 @@ /*
 #include "libwrc_libcerror.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 #include "libwrc_types.h"
@@ -57,5 +57,5 @@
 
-	/* The resource values
+	/* The resource node entry
 	 */
-	libwrc_resource_values_t *resource_values;
+	libwrc_resource_node_entry_t *resource_node_entry;
 
@@ -62,0 +62,0 @@ /* The current data offset

libwrc/libwrc_resource.c

@@ -35,3 +35,2 @@ /*
 #include "libwrc_libfvalue.h"
-#include "libwrc_libfwevt.h"
 #include "libwrc_libfwnt.h"
@@ -43,6 +42,5 @@ #include "libwrc_manifest_values.h"
 #include "libwrc_resource_item.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 #include "libwrc_string_values.h"
 #include "libwrc_version_values.h"
-#include "libwrc_wevt_template_values.h"
 
@@ -60,5 +58,5 @@ /* Creates a resource
 {
-	libwrc_internal_resource_t *internal_resource = NULL;
-	libwrc_resource_values_t *resource_values     = NULL;
-	static char *function                         = "libwrc_resource_initialize";
+	libwrc_internal_resource_t *internal_resource     = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry = NULL;
+	static char *function                             = "libwrc_resource_initialize";
 
@@ -89,3 +87,3 @@ if( resource == NULL )
 	     resource_node,
-	     (intptr_t **) &resource_values,
+	     (intptr_t **) &resource_node_entry,
 	     error ) != 1 )
@@ -97,3 +95,3 @@ {
 		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve value of resource node.",
+		 "%s: unable to retrieve resource node entry.",
 		 function );
@@ -103,3 +101,3 @@
 	}
-	if( resource_values == NULL )
+	if( resource_node_entry == NULL )
 	{
@@ -110,3 +108,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource values.",
+		 "%s: invalid resource node entry.",
 		 function );
@@ -147,6 +145,6 @@
 	}
-	internal_resource->io_handle       = io_handle;
-	internal_resource->file_io_handle  = file_io_handle;
-	internal_resource->resource_node   = resource_node;
-	internal_resource->resource_values = resource_values;
+	internal_resource->io_handle           = io_handle;
+	internal_resource->file_io_handle      = file_io_handle;
+	internal_resource->resource_node       = resource_node;
+	internal_resource->resource_node_entry = resource_node_entry;
 
@@ -193,3 +191,3 @@ *resource = (libwrc_resource_t *) internal_resource;
 
-		/* The io_handle, file_io_handle, resource_node and resource_values references are freed elsewhere
+		/* The io_handle, file_io_handle, resource_node and resource_node_entry references are freed elsewhere
 		 */
@@ -228,17 +226,17 @@ if( internal_resource->value != NULL )
 {
-	libcdata_tree_node_t *leaf_node                  = NULL;
-	libcdata_tree_node_t *sub_node                   = NULL;
-	libwrc_data_descriptor_t *data_descriptor        = NULL;
-	libwrc_language_entry_t *existing_language_entry = NULL;
-	libwrc_language_entry_t *language_entry          = NULL;
-	libwrc_resource_values_t *leaf_resource_values   = NULL;
-	libwrc_resource_values_t *sub_resource_values    = NULL;
-	const char *resource_type_string                 = NULL;
-	static char *function                            = "libwrc_resource_read_value";
-	int entry_index                                  = 0;
-	int leaf_node_index                              = 0;
-	int number_of_leaf_nodes                         = 0;
-	int number_of_sub_nodes                          = 0;
-	int result                                       = 0;
-	int sub_node_index                               = 0;
+	libcdata_tree_node_t *leaf_node                        = NULL;
+	libcdata_tree_node_t *sub_node                         = NULL;
+	libwrc_data_descriptor_t *data_descriptor              = NULL;
+	libwrc_language_entry_t *existing_language_entry       = NULL;
+	libwrc_language_entry_t *language_entry                = NULL;
+	libwrc_resource_node_entry_t *leaf_resource_node_entry = NULL;
+	libwrc_resource_node_entry_t *sub_resource_node_entry  = NULL;
+	static char *function                                  = "libwrc_resource_read_value";
+	const char *resource_type_string                       = NULL;
+	int entry_index                                        = 0;
+	int leaf_node_index                                    = 0;
+	int number_of_leaf_nodes                               = 0;
+	int number_of_sub_nodes                                = 0;
+	int result                                             = 0;
+	int sub_node_index                                     = 0;
 
@@ -267,3 +265,3 @@ if( internal_resource == NULL )
 	}
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -274,3 +272,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -280,5 +278,5 @@
 	}
-	switch( internal_resource->resource_values->type )
+	switch( internal_resource->resource_node_entry->type )
 	{
-		case LIBWRC_RESOURCE_TYPE_STRING:
+		case LIBWRC_RESOURCE_TYPE_STRING_TABLE:
 			resource_type_string = "string";
@@ -327,3 +325,3 @@
 
-		case LIBWRC_RESOURCE_TYPE_VERSION:
+		case LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION:
 			resource_type_string = "version";
@@ -339,14 +337,2 @@
 
-/* TODO deprecate */
-		case LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE:
-			resource_type_string = "event template";
-
-			result = libwrc_language_table_initialize(
-			          (libwrc_language_table_t **) &( internal_resource->value ),
-			          error );
-
-			internal_resource->free_value = (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_language_table_free;
-
-			break;
-
 		default:
@@ -366,3 +352,3 @@ #if defined( HAVE_DEBUG_OUTPUT )
 			 function,
-			 internal_resource->resource_values->type );
+			 internal_resource->resource_node_entry->type );
 
@@ -398,7 +384,6 @@ goto on_error;
 	}
-	if( ( internal_resource->resource_values->type == LIBWRC_RESOURCE_TYPE_MESSAGE_TABLE )
-	 || ( internal_resource->resource_values->type == LIBWRC_RESOURCE_TYPE_VERSION )
-	 || ( internal_resource->resource_values->type == LIBWRC_RESOURCE_TYPE_MANIFEST )
-	 || ( internal_resource->resource_values->type == LIBWRC_RESOURCE_TYPE_MUI )
-	 || ( internal_resource->resource_values->type == LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE ) )
+	if( ( internal_resource->resource_node_entry->type == LIBWRC_RESOURCE_TYPE_MESSAGE_TABLE )
+	 || ( internal_resource->resource_node_entry->type == LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION )
+	 || ( internal_resource->resource_node_entry->type == LIBWRC_RESOURCE_TYPE_MANIFEST )
+	 || ( internal_resource->resource_node_entry->type == LIBWRC_RESOURCE_TYPE_MUI ) )
 	{
@@ -440,3 +425,3 @@ if( number_of_sub_nodes != 1 )
 		     sub_node,
-		     (intptr_t **) &sub_resource_values,
+		     (intptr_t **) &sub_resource_node_entry,
 		     error ) != 1 )
@@ -448,3 +433,3 @@ {
 			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve value of sub node: %d.",
+			 "%s: unable to retrieve resource sub node: %d entry.",
 			 function,
@@ -455,3 +440,3 @@ sub_node_index );
 		}
-		if( sub_resource_values == NULL )
+		if( sub_resource_node_entry == NULL )
 		{
@@ -462,3 +447,3 @@ libcerror_error_set(
 			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: invalid sub resource values: %d.",
+			 "%s: invalid resource sub node: %d entry.",
 			 function,
@@ -505,3 +490,3 @@ sub_node_index );
 			     leaf_node,
-			     (intptr_t **) &leaf_resource_values,
+			     (intptr_t **) &leaf_resource_node_entry,
 			     error ) != 1 )
@@ -513,3 +498,3 @@ {
 				 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-				 "%s: unable to retrieve value of leaf node: %d.",
+				 "%s: unable to retrieve resource leaf node: %d entry.",
 				 function,
@@ -520,3 +505,3 @@ leaf_node_index );
 			}
-			if( leaf_resource_values == NULL )
+			if( leaf_resource_node_entry == NULL )
 			{
@@ -527,3 +512,3 @@ libcerror_error_set(
 				 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-				 "%s: invalid leaf resource values: %d.",
+				 "%s: invalid resource leaf node: %d entry.",
 				 function,
@@ -534,3 +519,3 @@ leaf_node_index );
 			}
-			if( leaf_resource_values->data_descriptor == NULL )
+			if( leaf_resource_node_entry->data_descriptor == NULL )
 			{
@@ -541,16 +526,16 @@ libcerror_error_set(
 				 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-				 "%s: invalid leaf resource values: 0x%08" PRIx32 " - missing data descriptor.",
+				 "%s: invalid resource leaf node: %d entry - missing data descriptor.",
 				 function,
-				 leaf_resource_values->identifier );
+				 leaf_node_index );
 
 				goto on_error;
 			}
-			data_descriptor = leaf_resource_values->data_descriptor;
+			data_descriptor = leaf_resource_node_entry->data_descriptor;
 
-			switch( internal_resource->resource_values->type )
+			switch( internal_resource->resource_node_entry->type )
 			{
-				case LIBWRC_RESOURCE_TYPE_STRING:
+				case LIBWRC_RESOURCE_TYPE_STRING_TABLE:
 					result = libwrc_language_table_get_entry_by_identifier(
 						  (libwrc_language_table_t *) internal_resource->value,
-						  leaf_resource_values->identifier,
+						  leaf_resource_node_entry->identifier,
 						  &existing_language_entry,
@@ -578,3 +563,3 @@ error );
 						     &language_entry,
-						     leaf_resource_values->identifier,
+						     leaf_resource_node_entry->identifier,
 						     (int (*)(intptr_t **, libcerror_error_t **)) &libfvalue_value_free,
@@ -599,3 +584,3 @@ error ) != 1 )
 					     &language_entry,
-					     leaf_resource_values->identifier,
+					     leaf_resource_node_entry->identifier,
 					     (int (*)(intptr_t **, libcerror_error_t **)) &libfvalue_value_free,
@@ -618,3 +603,3 @@ error ) != 1 )
 					     &language_entry,
-					     leaf_resource_values->identifier,
+					     leaf_resource_node_entry->identifier,
 					     (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_mui_values_free,
@@ -634,6 +619,6 @@ error ) != 1 )
 
-				case LIBWRC_RESOURCE_TYPE_VERSION:
+				case LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION:
 					if( libwrc_language_entry_initialize(
 					     &language_entry,
-					     leaf_resource_values->identifier,
+					     leaf_resource_node_entry->identifier,
 					     (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_version_values_free,
@@ -652,26 +637,7 @@ error ) != 1 )
 					break;
-
-/* TODO deprecate */
-				case LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE:
-					if( libwrc_language_entry_initialize(
-					     &language_entry,
-					     leaf_resource_values->identifier,
-					     (int (*)(intptr_t **, libcerror_error_t **)) &libfwevt_manifest_free,
-					     error ) != 1 )
-					{
-						libcerror_error_set(
-						 error,
-						 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-						 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-						 "%s: unable to create event template values.",
-						 function );
-
-						goto on_error;
-					}
-					break;
 			}
 #if defined( HAVE_DEBUG_OUTPUT )
-			switch( internal_resource->resource_values->type )
+			switch( internal_resource->resource_node_entry->type )
 			{
-				case LIBWRC_RESOURCE_TYPE_STRING:
+				case LIBWRC_RESOURCE_TYPE_STRING_TABLE:
 					if( libcnotify_verbose != 0 )
@@ -682,6 +648,6 @@ {
 						 function,
-						 sub_resource_values->identifier - 1,
-						 leaf_resource_values->identifier,
+						 sub_resource_node_entry->identifier - 1,
+						 leaf_resource_node_entry->identifier,
 						 libfwnt_locale_identifier_language_tag_get_identifier(
-						  leaf_resource_values->identifier & 0x0000ffffUL ) );
+						  leaf_resource_node_entry->identifier & 0x0000ffffUL ) );
 					}
@@ -693,4 +659,3 @@ break;
 				case LIBWRC_RESOURCE_TYPE_MUI:
-				case LIBWRC_RESOURCE_TYPE_VERSION:
-				case LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE:
+				case LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION:
 					if( libcnotify_verbose != 0 )
@@ -702,5 +667,5 @@ {
 						 resource_type_string,
-						 leaf_resource_values->identifier,
+						 leaf_resource_node_entry->identifier,
 						 libfwnt_locale_identifier_language_tag_get_identifier(
-						  leaf_resource_values->identifier & 0x0000ffffUL ) );
+						  leaf_resource_node_entry->identifier & 0x0000ffffUL ) );
 					}
@@ -711,5 +676,5 @@ break;
 
-			switch( internal_resource->resource_values->type )
+			switch( internal_resource->resource_node_entry->type )
 			{
-				case LIBWRC_RESOURCE_TYPE_STRING:
+				case LIBWRC_RESOURCE_TYPE_STRING_TABLE:
 					result = libwrc_string_values_read(
@@ -719,3 +684,3 @@ language_entry,
 					          internal_resource->file_io_handle,
-					          sub_resource_values->identifier - 1,
+					          sub_resource_node_entry->identifier - 1,
 					          data_descriptor,
@@ -752,3 +717,3 @@ error );
 
-				case LIBWRC_RESOURCE_TYPE_VERSION:
+				case LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION:
 					result = libwrc_version_values_read(
@@ -762,12 +727,2 @@ language_entry,
 
-/* TODO deprecate */
-				case LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE:
-					result = libwrc_wevt_template_values_read(
-					          language_entry,
-					          internal_resource->io_handle,
-					          internal_resource->file_io_handle,
-					          data_descriptor,
-					          error );
-					break;
-
 #if defined( HAVE_DEBUG_OUTPUT )
@@ -794,5 +749,5 @@ default:
 			}
-			switch( internal_resource->resource_values->type )
+			switch( internal_resource->resource_node_entry->type )
 			{
-				case LIBWRC_RESOURCE_TYPE_STRING:
+				case LIBWRC_RESOURCE_TYPE_STRING_TABLE:
 					if( result != 1 )
@@ -807,4 +762,4 @@ {
 						 resource_type_string,
-						 sub_resource_values->identifier,
-						 leaf_resource_values->identifier );
+						 sub_resource_node_entry->identifier,
+						 leaf_resource_node_entry->identifier );
 
@@ -827,3 +782,3 @@ goto on_error;
 							 function,
-							 leaf_resource_values->identifier );
+							 leaf_resource_node_entry->identifier );
 
@@ -840,4 +795,3 @@ goto on_error;
 				case LIBWRC_RESOURCE_TYPE_MUI:
-				case LIBWRC_RESOURCE_TYPE_VERSION:
-				case LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE:
+				case LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION:
 					if( result != 1 )
@@ -852,3 +806,3 @@ {
 						 resource_type_string,
-						 leaf_resource_values->identifier );
+						 leaf_resource_node_entry->identifier );
 
@@ -870,3 +824,3 @@ goto on_error;
 						 resource_type_string,
-						 leaf_resource_values->identifier );
+						 leaf_resource_node_entry->identifier );
 
@@ -1053,4 +1007,4 @@ goto on_error;
 
-	if( libwrc_resource_values_get_identifier(
-	     internal_resource->resource_values,
+	if( libwrc_resource_node_entry_get_identifier(
+	     internal_resource->resource_node_entry,
 	     identifier,
@@ -1097,4 +1051,4 @@ error ) != 1 )
 
-	result = libwrc_resource_values_get_utf8_name_size(
-	          internal_resource->resource_values,
+	result = libwrc_resource_node_entry_get_utf8_name_size(
+	          internal_resource->resource_node_entry,
 	          utf8_string_size,
@@ -1144,4 +1098,4 @@ error );
 
-	result = libwrc_resource_values_get_utf8_name(
-	          internal_resource->resource_values,
+	result = libwrc_resource_node_entry_get_utf8_name(
+	          internal_resource->resource_node_entry,
 	          utf8_string,
@@ -1191,4 +1145,4 @@ utf8_string_size,
 
-	result = libwrc_resource_values_get_utf16_name_size(
-	          internal_resource->resource_values,
+	result = libwrc_resource_node_entry_get_utf16_name_size(
+	          internal_resource->resource_node_entry,
 	          utf16_string_size,
@@ -1238,4 +1192,4 @@ error );
 
-	result = libwrc_resource_values_get_utf16_name(
-	          internal_resource->resource_values,
+	result = libwrc_resource_node_entry_get_utf16_name(
+	          internal_resource->resource_node_entry,
 	          utf16_string,
@@ -1283,4 +1237,4 @@ utf16_string_size,
 
-	if( libwrc_resource_values_get_type(
-	     internal_resource->resource_values,
+	if( libwrc_resource_node_entry_get_type(
+	     internal_resource->resource_node_entry,
 	     type,
@@ -1325,3 +1279,3 @@ error ) != 1 )
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -1332,3 +1286,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -1396,3 +1350,3 @@
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -1403,3 +1357,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -1472,3 +1426,3 @@
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -1479,3 +1433,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -1485,3 +1439,3 @@
 	}
-	if( internal_resource->resource_values->type != resource_type )
+	if( internal_resource->resource_node_entry->type != resource_type )
 	{
@@ -1492,5 +1446,5 @@ libcerror_error_set(
 		 LIBCERROR_ARGUMENT_ERROR_UNSUPPORTED_VALUE,
-		 "%s: unsupported resource type: 0x%08" PRIx32 ".",
+		 "%s: invalid resource - invalid resource node entry - unsupported resource type: 0x%08" PRIx32 ".",
 		 function,
-		 internal_resource->resource_values->type );
+		 internal_resource->resource_node_entry->type );
 
@@ -1497,0 +1451,0 @@ return( -1 );

libwrc/libwrc_resource.h

@@ -33,3 +33,3 @@ /*
 #include "libwrc_libcerror.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 #include "libwrc_types.h"
@@ -57,5 +57,5 @@
 
-	/* The resource values
+	/* The resource node entry
 	 */
-	libwrc_resource_values_t *resource_values;
+	libwrc_resource_node_entry_t *resource_node_entry;
 
@@ -62,0 +62,0 @@ /* The resource value

libwrc/libwrc_stream.c

@@ -38,3 +38,3 @@ /*
 #include "libwrc_resource.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 #include "libwrc_stream.h"
@@ -763,3 +763,3 @@
 	     &( internal_stream->resources_root_node ),
-	     (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_resource_values_free,
+	     (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_resource_node_entry_free,
 	     error ) != 1 )
@@ -1243,8 +1243,8 @@ {
 {
-	libcdata_tree_node_t *resource_node       = NULL;
-	libwrc_internal_stream_t *internal_stream = NULL;
-	libwrc_resource_values_t *resource_values = NULL;
-	static char *function                     = "libwrc_stream_get_resource_by_identifier";
-	int number_of_resources                   = 0;
-	int resource_index                        = 0;
+	libcdata_tree_node_t *resource_node               = NULL;
+	libwrc_internal_stream_t *internal_stream         = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry = NULL;
+	static char *function                             = "libwrc_stream_get_resource_by_identifier";
+	int number_of_resources                           = 0;
+	int resource_index                                = 0;
 
@@ -1286,38 +1286,7 @@ if( stream == NULL )
 	}
-	if( libcdata_tree_node_get_number_of_sub_nodes(
-	     internal_stream->resources_root_node,
-	     &number_of_resources,
-	     error ) != 1 )
+	if( internal_stream->resources_root_node != NULL )
 	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve number of resources.",
-		 function );
-
-		return( -1 );
-	}
-	if( libcdata_tree_node_get_sub_node_by_index(
-	     internal_stream->resources_root_node,
-	     0,
-	     &resource_node,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve first resource node.",
-		 function );
-
-		return( -1 );
-	}
-	for( resource_index = 0;
-	     resource_index < number_of_resources;
-	     resource_index++ )
-	{
-		if( libcdata_tree_node_get_value(
-		     resource_node,
-		     (intptr_t **) &resource_values,
+		if( libcdata_tree_node_get_number_of_sub_nodes(
+		     internal_stream->resources_root_node,
+		     &number_of_resources,
 		     error ) != 1 )
@@ -1329,9 +1298,12 @@ {
 			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve value of resource node: %d.",
-			 function,
-			 resource_index );
+			 "%s: unable to retrieve number of resources.",
+			 function );
 
 			return( -1 );
 		}
-		if( resource_values == NULL )
+		if( libcdata_tree_node_get_sub_node_by_index(
+		     internal_stream->resources_root_node,
+		     0,
+		     &resource_node,
+		     error ) != 1 )
 		{
@@ -1341,16 +1313,15 @@ libcerror_error_set(
 			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: missing resource values: %d.",
-			 function,
-			 resource_index );
+			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+			 "%s: unable to retrieve first resource node.",
+			 function );
 
 			return( -1 );
 		}
-		if( identifier == resource_values->identifier )
+		for( resource_index = 0;
+		     resource_index < number_of_resources;
+		     resource_index++ )
 		{
-			if( libwrc_resource_initialize(
-			     resource,
-			     internal_stream->io_handle,
-			     internal_stream->file_io_handle,
+			if( libcdata_tree_node_get_value(
 			     resource_node,
+			     (intptr_t **) &resource_node_entry,
 			     error ) != 1 )
@@ -1361,24 +1332,56 @@ {
 				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-				 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-				 "%s: unable to create resource.",
-				 function );
+				 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+				 "%s: unable to retrieve resource node: %d entry.",
+				 function,
+				 resource_index );
 
 				return( -1 );
 			}
-			return( 1 );
-		}
-		if( libcdata_tree_node_get_next_node(
-		     resource_node,
-		     &resource_node,
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve next node of resource node: %d.",
-			 function,
-			 resource_index );
+			if( resource_node_entry == NULL )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
+				 "%s: missing resource node: %d entry.",
+				 function,
+				 resource_index );
 
-			return( -1 );
+				return( -1 );
+			}
+			if( identifier == resource_node_entry->identifier )
+			{
+				if( libwrc_resource_initialize(
+				     resource,
+				     internal_stream->io_handle,
+				     internal_stream->file_io_handle,
+				     resource_node,
+				     error ) != 1 )
+				{
+					libcerror_error_set(
+					 error,
+					 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+					 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
+					 "%s: unable to create resource.",
+					 function );
+
+					return( -1 );
+				}
+				return( 1 );
+			}
+			if( libcdata_tree_node_get_next_node(
+			     resource_node,
+			     &resource_node,
+			     error ) != 1 )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
+				 "%s: unable to retrieve next node of resource node: %d.",
+				 function,
+				 resource_index );
+
+				return( -1 );
+			}
 		}
@@ -1398,8 +1401,8 @@ }
 {
-	libcdata_tree_node_t *resource_node       = NULL;
-	libwrc_internal_stream_t *internal_stream = NULL;
-	libwrc_resource_values_t *resource_values = NULL;
-	static char *function                     = "libwrc_stream_get_resource_by_type";
-	int number_of_resources                   = 0;
-	int resource_index                        = 0;
+	libcdata_tree_node_t *resource_node               = NULL;
+	libwrc_internal_stream_t *internal_stream         = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry = NULL;
+	static char *function                             = "libwrc_stream_get_resource_by_type";
+	int number_of_resources                           = 0;
+	int resource_index                                = 0;
 
@@ -1476,3 +1479,3 @@ if( stream == NULL )
 		     resource_node,
-		     (intptr_t **) &resource_values,
+		     (intptr_t **) &resource_node_entry,
 		     error ) != 1 )
@@ -1484,3 +1487,3 @@ {
 			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve value of resource node: %d.",
+			 "%s: unable to retrieve resource node: %d entry.",
 			 function,
@@ -1491,3 +1494,3 @@ resource_index );
 		}
-		if( resource_values == NULL )
+		if( resource_node_entry == NULL )
 		{
@@ -1498,3 +1501,3 @@ libcerror_error_set(
 			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: missing resource values: %d.",
+			 "%s: missing resource node: %d entry.",
 			 function,
@@ -1505,3 +1508,3 @@ resource_index );
 		}
-		if( type == resource_values->type )
+		if( type == resource_node_entry->type )
 		{
@@ -1555,9 +1558,9 @@ if( libwrc_resource_initialize(
 {
-	libcdata_tree_node_t *resource_node       = NULL;
-	libwrc_internal_stream_t *internal_stream = NULL;
-	libwrc_resource_values_t *resource_values = NULL;
-	static char *function                     = "libwrc_stream_get_resource_by_type";
-	int number_of_resources                   = 0;
-	int resource_index                        = 0;
-	int result                                = 0;
+	libcdata_tree_node_t *resource_node               = NULL;
+	libwrc_internal_stream_t *internal_stream         = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry = NULL;
+	static char *function                             = "libwrc_stream_get_resource_by_type";
+	int number_of_resources                           = 0;
+	int resource_index                                = 0;
+	int result                                        = 0;
 
@@ -1634,3 +1637,3 @@ if( stream == NULL )
 		     resource_node,
-		     (intptr_t **) &resource_values,
+		     (intptr_t **) &resource_node_entry,
 		     error ) != 1 )
@@ -1642,3 +1645,3 @@ {
 			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve value of resource node: %d.",
+			 "%s: unable to retrieve resource node: %d entry.",
 			 function,
@@ -1649,3 +1652,3 @@ resource_index );
 		}
-		if( resource_values == NULL )
+		if( resource_node_entry == NULL )
 		{
@@ -1656,3 +1659,3 @@ libcerror_error_set(
 			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: missing resource values: %d.",
+			 "%s: missing resource node: %d entry.",
 			 function,
@@ -1663,3 +1666,3 @@ resource_index );
 		}
-		if( resource_values->name_string_size > 0 )
+		if( resource_node_entry->name_string_size > 0 )
 		{
@@ -1669,4 +1672,4 @@ result = libuna_utf8_string_compare_with_utf16_stream(
 			          utf8_string_length + 1,
-			          resource_values->name_string,
-			          resource_values->name_string_size,
+			          resource_node_entry->name_string,
+			          resource_node_entry->name_string_size,
 			          LIBUNA_ENDIAN_LITTLE,
@@ -1737,9 +1740,9 @@ error );
 {
-	libcdata_tree_node_t *resource_node       = NULL;
-	libwrc_internal_stream_t *internal_stream = NULL;
-	libwrc_resource_values_t *resource_values = NULL;
-	static char *function                     = "libwrc_stream_get_resource_by_type";
-	int number_of_resources                   = 0;
-	int resource_index                        = 0;
-	int result                                = 0;
+	libcdata_tree_node_t *resource_node               = NULL;
+	libwrc_internal_stream_t *internal_stream         = NULL;
+	libwrc_resource_node_entry_t *resource_node_entry = NULL;
+	static char *function                             = "libwrc_stream_get_resource_by_type";
+	int number_of_resources                           = 0;
+	int resource_index                                = 0;
+	int result                                        = 0;
 
@@ -1816,3 +1819,3 @@ if( stream == NULL )
 		     resource_node,
-		     (intptr_t **) &resource_values,
+		     (intptr_t **) &resource_node_entry,
 		     error ) != 1 )
@@ -1824,3 +1827,3 @@ {
 			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve value of resource node: %d.",
+			 "%s: unable to retrieve resource node: %d entry.",
 			 function,
@@ -1831,3 +1834,3 @@ resource_index );
 		}
-		if( resource_values == NULL )
+		if( resource_node_entry == NULL )
 		{
@@ -1838,3 +1841,3 @@ libcerror_error_set(
 			 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-			 "%s: missing resource values: %d.",
+			 "%s: missing resource node: %d entry.",
 			 function,
@@ -1845,3 +1848,3 @@ resource_index );
 		}
-		if( resource_values->name_string_size > 0 )
+		if( resource_node_entry->name_string_size > 0 )
 		{
@@ -1851,4 +1854,4 @@ result = libuna_utf16_string_compare_with_utf16_stream(
 			          utf16_string_length + 1,
-			          resource_values->name_string,
-			          resource_values->name_string_size,
+			          resource_node_entry->name_string,
+			          resource_node_entry->name_string_size,
 			          LIBUNA_ENDIAN_LITTLE,
@@ -1855,0 +1858,0 @@ error );

libwrc/libwrc_string_table_resource.c

@@ -186,5 +186,5 @@ /*
 	size_t data_offset                                                      = 0;
-	uint32_t string_index                                                   = 0;
 	uint32_t string_size                                                    = 0;
 	int entry_index                                                         = 0;
+	int string_index                                                        = 0;
 
@@ -216,3 +216,3 @@ if( string_table_resource == NULL )
 	if( ( data_size < 2 )
-	 || ( data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
+	 || ( data_size > (size_t) SSIZE_MAX ) )
 	{
@@ -252,3 +252,3 @@ libcerror_error_set(
 			libcnotify_printf(
-			 "%s: string: %02" PRIu32 " length\t\t\t: %" PRIu32 "\n",
+			 "%s: string: %02d length\t\t\t: %" PRIu32 "\n",
 			 function,
@@ -278,3 +278,3 @@ string_index,
 				libcnotify_printf(
-				 "%s: string: %02" PRIu32 " data:\n",
+				 "%s: string: %02 data:\n",
 				 function,
@@ -317,3 +317,3 @@ string_index );
 			}
-			table_entry->identifier = ( ( base_identifier - 1 ) << 4 ) | string_index;
+			table_entry->identifier = ( ( base_identifier - 1 ) << 4 ) | (uint32_t) string_index;
 
@@ -348,4 +348,2 @@ if( libcdata_array_append_entry(
 	}
-/* TODO validate if number of strings is 16 ? */
-
 	return( 1 );
@@ -360,2 +358,7 @@
 	}
+	libcdata_array_empty(
+	 internal_string_table_resource->entries_array,
+	 (int (*)(intptr_t **, libcerror_error_t **)) &libwrc_table_entry_free,
+	 error );
+
 	return( -1 );
@@ -362,0 +365,0 @@ }

libwrc/libwrc_string.c

@@ -33,3 +33,3 @@ /*
 #include "libwrc_resource.h"
-#include "libwrc_resource_values.h"
+#include "libwrc_resource_node_entry.h"
 #include "libwrc_string.h"
@@ -62,3 +62,3 @@
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -69,3 +69,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -75,3 +75,3 @@
 	}
-	if( internal_resource->resource_values->identifier != LIBWRC_RESOURCE_IDENTIFIER_STRING )
+	if( internal_resource->resource_node_entry->identifier != LIBWRC_RESOURCE_IDENTIFIER_STRING )
 	{
@@ -84,3 +84,3 @@ libcerror_error_set(
 		 function,
-		 internal_resource->resource_values->identifier );
+		 internal_resource->resource_node_entry->identifier );
 
@@ -141,3 +141,3 @@ return( -1 );
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_STRING,
+	     LIBWRC_RESOURCE_TYPE_STRING_TABLE,
 	     language_identifier,
@@ -246,3 +246,3 @@ string_index,
 
-	if( internal_resource->resource_values == NULL )
+	if( internal_resource->resource_node_entry == NULL )
 	{
@@ -253,3 +253,3 @@ libcerror_error_set(
 		 LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
-		 "%s: invalid resource - missing resource values.",
+		 "%s: invalid resource - missing resource node entry.",
 		 function );
@@ -259,3 +259,3 @@
 	}
-	if( internal_resource->resource_values->identifier != LIBWRC_RESOURCE_IDENTIFIER_STRING )
+	if( internal_resource->resource_node_entry->identifier != LIBWRC_RESOURCE_IDENTIFIER_STRING )
 	{
@@ -268,3 +268,3 @@ libcerror_error_set(
 		 function,
-		 internal_resource->resource_values->identifier );
+		 internal_resource->resource_node_entry->identifier );
 
@@ -404,3 +404,3 @@ return( -1 );
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_STRING,
+	     LIBWRC_RESOURCE_TYPE_STRING_TABLE,
 	     language_identifier,
@@ -455,3 +455,3 @@ string_index,
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_STRING,
+	     LIBWRC_RESOURCE_TYPE_STRING_TABLE,
 	     language_identifier,
@@ -506,3 +506,3 @@ string_index,
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_STRING,
+	     LIBWRC_RESOURCE_TYPE_STRING_TABLE,
 	     language_identifier,
@@ -557,3 +557,3 @@ string_index,
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_STRING,
+	     LIBWRC_RESOURCE_TYPE_STRING_TABLE,
 	     language_identifier,
@@ -560,0 +560,0 @@ string_index,

libwrc/libwrc_table_entry.h

@@ -28,3 +28,2 @@ /*
 
-#include "libwrc_libcdata.h"
 #include "libwrc_libcerror.h"
@@ -31,0 +30,0 @@

libwrc/libwrc_types.h

@@ -45,11 +45,2 @@ /*
 typedef struct libwrc_version_information_resource {}	libwrc_version_information_resource_t;
-typedef struct libwrc_wevt_channel {}			libwrc_wevt_channel_t;
-typedef struct libwrc_wevt_event {}			libwrc_wevt_event_t;
-typedef struct libwrc_wevt_keyword {}			libwrc_wevt_keyword_t;
-typedef struct libwrc_wevt_level {}			libwrc_wevt_level_t;
-typedef struct libwrc_wevt_map {}			libwrc_wevt_map_t;
-typedef struct libwrc_wevt_opcode {}			libwrc_wevt_opcode_t;
-typedef struct libwrc_wevt_provider {}			libwrc_wevt_provider_t;
-typedef struct libwrc_wevt_task {}			libwrc_wevt_task_t;
-typedef struct libwrc_wevt_template_definition {}	libwrc_wevt_template_definition_t;
 
@@ -65,11 +56,2 @@ #else
 typedef intptr_t libwrc_version_information_resource_t;
-typedef intptr_t libwrc_wevt_channel_t;
-typedef intptr_t libwrc_wevt_event_t;
-typedef intptr_t libwrc_wevt_keyword_t;
-typedef intptr_t libwrc_wevt_level_t;
-typedef intptr_t libwrc_wevt_map_t;
-typedef intptr_t libwrc_wevt_opcode_t;
-typedef intptr_t libwrc_wevt_provider_t;
-typedef intptr_t libwrc_wevt_task_t;
-typedef intptr_t libwrc_wevt_template_definition_t;
 
@@ -76,0 +58,0 @@ #endif /* defined( HAVE_DEBUG_OUTPUT ) && !defined( WINAPI ) */

libwrc/libwrc_version_information_resource.c

@@ -1455,3 +1455,3 @@ /*
 	if( ( data_size < sizeof( wrc_version_value_header_t ) )
-	 || ( data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
+	 || ( data_size > (size_t) SSIZE_MAX ) )
 	{
@@ -1458,0 +1458,0 @@ libcerror_error_set(

libwrc/libwrc_version.c

@@ -33,3 +33,2 @@ /*
 #include "libwrc_resource.h"
-#include "libwrc_resource_values.h"
 #include "libwrc_version.h"
@@ -52,3 +51,3 @@ #include "libwrc_version_values.h"
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_VERSION,
+	     LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION,
 	     language_identifier,
@@ -99,3 +98,3 @@ 0,
 	     resource,
-	     LIBWRC_RESOURCE_TYPE_VERSION,
+	     LIBWRC_RESOURCE_TYPE_VERSION_INFORMATION,
 	     language_identifier,
@@ -102,0 +101,0 @@ 0,

libwrc/Makefile.in

@@ -133,8 +133,7 @@ # Makefile.in generated by automake 1.16.5 from Makefile.am.
 	libwrc_libfcache.h libwrc_libfdata.h libwrc_libfguid.h \
-	libwrc_libfvalue.h libwrc_libfwevt.h libwrc_libfwnt.h \
-	libwrc_libuna.h libwrc_manifest.c libwrc_manifest.h \
-	libwrc_manifest_resource.c libwrc_manifest_resource.h \
-	libwrc_manifest_values.c libwrc_manifest_values.h \
-	libwrc_message_table.c libwrc_message_table.h \
-	libwrc_message_table_resource.c \
+	libwrc_libfvalue.h libwrc_libfwnt.h libwrc_libuna.h \
+	libwrc_manifest.c libwrc_manifest.h libwrc_manifest_resource.c \
+	libwrc_manifest_resource.h libwrc_manifest_values.c \
+	libwrc_manifest_values.h libwrc_message_table.c \
+	libwrc_message_table.h libwrc_message_table_resource.c \
 	libwrc_message_table_resource.h libwrc_message_table_values.c \
@@ -146,3 +145,4 @@ libwrc_message_table_values.h libwrc_mui.c libwrc_mui.h \
 	libwrc_resource_item.c libwrc_resource_item.h \
-	libwrc_resource_values.c libwrc_resource_values.h \
+	libwrc_resource_node_entry.c libwrc_resource_node_entry.h \
+	libwrc_resource_node_header.c libwrc_resource_node_header.h \
 	libwrc_stream.c libwrc_stream.h libwrc_support.c \
@@ -156,15 +156,5 @@ libwrc_support.h libwrc_string.c libwrc_string.h \
 	libwrc_version_information_resource.h libwrc_version_values.c \
-	libwrc_version_values.h libwrc_wevt_channel.c \
-	libwrc_wevt_channel.h libwrc_wevt_event.c libwrc_wevt_event.h \
-	libwrc_wevt_keyword.c libwrc_wevt_keyword.h \
-	libwrc_wevt_level.c libwrc_wevt_level.h libwrc_wevt_map.c \
-	libwrc_wevt_map.h libwrc_wevt_opcode.c libwrc_wevt_opcode.h \
-	libwrc_wevt_provider.c libwrc_wevt_provider.h \
-	libwrc_wevt_task.c libwrc_wevt_task.h libwrc_wevt_template.c \
-	libwrc_wevt_template.h libwrc_wevt_template_definition.c \
-	libwrc_wevt_template_definition.h \
-	libwrc_wevt_template_values.c libwrc_wevt_template_values.h \
-	wrc_data_descriptor.h wrc_message_table_resource.h \
-	wrc_mui_resource.h wrc_resource_node.h \
-	wrc_version_information_resource.h
+	libwrc_version_values.h wrc_data_descriptor.h \
+	wrc_message_table_resource.h wrc_mui_resource.h \
+	wrc_resource_node.h wrc_version_information_resource.h
 @HAVE_LOCAL_LIBWRC_TRUE@am_libwrc_la_OBJECTS =  \
@@ -186,3 +176,4 @@ @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_data_descriptor.lo \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_item.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_values.lo \
+@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_node_entry.lo \
+@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_node_header.lo \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_stream.lo libwrc_support.lo \
@@ -195,14 +186,3 @@ @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_string.lo \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_version_information_resource.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_version_values.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_channel.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_event.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_keyword.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_level.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_map.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_opcode.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_provider.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_task.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_template.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_template_definition.lo \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_template_values.lo
+@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_version_values.lo
 libwrc_la_OBJECTS = $(am_libwrc_la_OBJECTS)
@@ -244,3 +224,4 @@ AM_V_lt = $(am__v_lt_@AM_V@)
 	./$(DEPDIR)/libwrc_resource_item.Plo \
-	./$(DEPDIR)/libwrc_resource_values.Plo \
+	./$(DEPDIR)/libwrc_resource_node_entry.Plo \
+	./$(DEPDIR)/libwrc_resource_node_header.Plo \
 	./$(DEPDIR)/libwrc_stream.Plo ./$(DEPDIR)/libwrc_string.Plo \
@@ -253,14 +234,3 @@ ./$(DEPDIR)/libwrc_string_table_resource.Plo \
 	./$(DEPDIR)/libwrc_version_information_resource.Plo \
-	./$(DEPDIR)/libwrc_version_values.Plo \
-	./$(DEPDIR)/libwrc_wevt_channel.Plo \
-	./$(DEPDIR)/libwrc_wevt_event.Plo \
-	./$(DEPDIR)/libwrc_wevt_keyword.Plo \
-	./$(DEPDIR)/libwrc_wevt_level.Plo \
-	./$(DEPDIR)/libwrc_wevt_map.Plo \
-	./$(DEPDIR)/libwrc_wevt_opcode.Plo \
-	./$(DEPDIR)/libwrc_wevt_provider.Plo \
-	./$(DEPDIR)/libwrc_wevt_task.Plo \
-	./$(DEPDIR)/libwrc_wevt_template.Plo \
-	./$(DEPDIR)/libwrc_wevt_template_definition.Plo \
-	./$(DEPDIR)/libwrc_wevt_template_values.Plo
+	./$(DEPDIR)/libwrc_version_values.Plo
 am__mv = mv -f
@@ -725,3 +695,2 @@ COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 @HAVE_LOCAL_LIBWRC_TRUE@	@LIBFVALUE_CPPFLAGS@ \
-@HAVE_LOCAL_LIBWRC_TRUE@	@LIBFWEVT_CPPFLAGS@ \
 @HAVE_LOCAL_LIBWRC_TRUE@	@LIBFWNT_CPPFLAGS@ \
@@ -750,3 +719,2 @@ @HAVE_LOCAL_LIBWRC_TRUE@	@PTHREAD_CPPFLAGS@
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_libfvalue.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_libfwevt.h \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_libfwnt.h \
@@ -766,3 +734,4 @@ @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_libuna.h \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_item.c libwrc_resource_item.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_values.c libwrc_resource_values.h \
+@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_node_entry.c libwrc_resource_node_entry.h \
+@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_resource_node_header.c libwrc_resource_node_header.h \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_stream.c libwrc_stream.h \
@@ -779,13 +748,2 @@ @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_support.c libwrc_support.h \
 @HAVE_LOCAL_LIBWRC_TRUE@	libwrc_version_values.c libwrc_version_values.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_channel.c libwrc_wevt_channel.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_event.c libwrc_wevt_event.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_keyword.c libwrc_wevt_keyword.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_level.c libwrc_wevt_level.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_map.c libwrc_wevt_map.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_opcode.c libwrc_wevt_opcode.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_provider.c libwrc_wevt_provider.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_task.c libwrc_wevt_task.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_template.c libwrc_wevt_template.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_template_definition.c libwrc_wevt_template_definition.h \
-@HAVE_LOCAL_LIBWRC_TRUE@	libwrc_wevt_template_values.c libwrc_wevt_template_values.h \
 @HAVE_LOCAL_LIBWRC_TRUE@	wrc_data_descriptor.h \
@@ -872,3 +830,4 @@ @HAVE_LOCAL_LIBWRC_TRUE@	wrc_message_table_resource.h \
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_resource_item.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_resource_values.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_resource_node_entry.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_resource_node_header.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_stream.Plo@am__quote@ # am--include-marker
@@ -883,13 +842,2 @@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_string.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_version_values.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_channel.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_event.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_keyword.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_level.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_map.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_opcode.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_provider.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_task.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_template.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_template_definition.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libwrc_wevt_template_values.Plo@am__quote@ # am--include-marker
 
@@ -1115,3 +1063,4 @@ $(am__depfiles_remade):
 	-rm -f ./$(DEPDIR)/libwrc_resource_item.Plo
-	-rm -f ./$(DEPDIR)/libwrc_resource_values.Plo
+	-rm -f ./$(DEPDIR)/libwrc_resource_node_entry.Plo
+	-rm -f ./$(DEPDIR)/libwrc_resource_node_header.Plo
 	-rm -f ./$(DEPDIR)/libwrc_stream.Plo
@@ -1126,13 +1075,2 @@ -rm -f ./$(DEPDIR)/libwrc_string.Plo
 	-rm -f ./$(DEPDIR)/libwrc_version_values.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_channel.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_event.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_keyword.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_level.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_map.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_opcode.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_provider.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_task.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_template.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_template_definition.Plo
-	-rm -f ./$(DEPDIR)/libwrc_wevt_template_values.Plo
 	-rm -f Makefile
@@ -1139,0 +1077,0 @@ maintainer-clean-am: distclean-am maintainer-clean-generic

libwrc/wrc_resource_node.h

@@ -22,4 +22,4 @@ /*
 
-#if !defined( _WRC_RECORD_NODE_H )
-#define _WRC_RECORD_NODE_H
+#if !defined( _WRC_RESOURCE_NODE_H )
+#define _WRC_RESOURCE_NODE_H
 
@@ -69,2 +69,17 @@ #include <common.h>
 
+typedef struct wrc_resource_node_entry wrc_resource_node_entry_t;
+
+struct wrc_resource_node_entry
+{
+	/* The identifier
+	 * Consists of 4 bytes
+	 */
+	uint8_t identifier[ 4 ];
+
+	/* The offset
+	 * Consists of 4 bytes
+	 */
+	uint8_t offset[ 4 ];
+};
+
 #if defined( __cplusplus )
@@ -74,3 +89,3 @@ }
 
-#endif /* !defined( _WRC_RECORD_NODE_H ) */
+#endif /* !defined( _WRC_RESOURCE_NODE_H ) */
 

msvscpp/libevtx.sln

@@ -294,3 +294,2 @@
 		{35A5D4B4-775C-40E3-B364-19562437CD80} = {35A5D4B4-775C-40E3-B364-19562437CD80}
-		{C6DCD3D9-4397-466E-AC94-49A590DA0EC6} = {C6DCD3D9-4397-466E-AC94-49A590DA0EC6}
 		{1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7} = {1D7A10ED-2939-4C11-BAA0-D37C2A8CD6F7}
@@ -297,0 +296,0 @@ EndProjectSection

PKG-INFO

 Metadata-Version: 2.1
 Name: libevtx-python
-Version: 20220724
+Version: 20221101
 Summary: Python bindings module for libevtx
@@ -10,2 +10,3 @@ Home-page: https://github.com/libyal/libevtx/
 Platform: UNKNOWN
+Description-Content-Type: text/plain
 License-File: COPYING
@@ -12,0 +13,0 @@ License-File: COPYING.LESSER

setup.py

 #!/usr/bin/env python
 #
 # Script to build and install Python-bindings.
-# Version: 20211115
+# Version: 20220806
 
@@ -326,2 +326,3 @@ from __future__ import print_function
     long_description=project_information.package_description,
+    long_description_content_type="text/plain",
     author="Joachim Metz",
@@ -328,0 +329,0 @@ author_email="[e-mail]",

tests/test_runner.sh

 #!/bin/bash
 # Bash functions to run an executable for testing.
 #
-# Version: 20201215
+# Version: 20220924
 #
@@ -17,2 +17,4 @@ # When CHECK_WITH_ASAN is set to a non-empty value the test executable
 # is run with valgrind, otherwise it is run without.
+#
+# PYTHON and PYTHON_VERSION are used to determine the Python interpreter.
 
@@ -192,4 +194,16 @@ EXIT_SUCCESS=0;
 	local TEST_EXECUTABLE=$1;
-	local LIBRARY_NAME="${TEST_EXECUTABLE}";
+	local LIBRARY_NAME=`dirname ${TEST_EXECUTABLE}`;
 
+	local NAME=`basename ${LIBRARY_NAME}`;
+
+	if test ${NAME} = ".libs";
+	then
+		LIBRARY_NAME=`dirname ${LIBRARY_NAME}`;
+		NAME=`basename ${LIBRARY_NAME}`;
+	fi
+	if test ${NAME} = "tests";
+	then
+		LIBRARY_NAME=`dirname ${LIBRARY_NAME}`;
+		NAME=`basename ${LIBRARY_NAME}`;
+	fi
 	echo ${LIBRARY_NAME} | grep 'tools' > /dev/null 2>&1;
@@ -199,4 +213,2 @@
 	then
-		LIBRARY_NAME=`dirname ${LIBRARY_NAME}`;
-		LIBRARY_NAME=`dirname ${LIBRARY_NAME}`;
 		LIBRARY_NAME=`basename ${LIBRARY_NAME} | sed 's/\(.*\)tools$/lib\1/'`;
@@ -448,3 +460,3 @@ else
 
-	if test ${IS_PYTHON_SCRIPT} -eq 0;
+	if test ${IS_PYTHON_SCRIPT} -eq 0 && test -z ${PYTHON};
 	then
@@ -660,2 +672,3 @@ local PYTHON=`which python${PYTHON_VERSION} 2> /dev/null`;
 		fi
+		local TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );
 		local LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );
@@ -770,3 +783,3 @@ local PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );
 
-	if test ${IS_PYTHON_SCRIPT} -eq 0;
+	if test ${IS_PYTHON_SCRIPT} -eq 0 && test -z ${PYTHON};
 	then
@@ -983,2 +996,3 @@ local PYTHON=`which python${PYTHON_VERSION} 2> /dev/null`;
 		fi
+		local TEST_EXECUTABLE=$( find_binary_executable ${TEST_EXECUTABLE} );
 		local LIBRARY_PATH=$( find_binary_library_path ${TEST_EXECUTABLE} );
@@ -985,0 +999,0 @@ local PYTHON_MODULE_PATH=$( find_binary_python_module_path ${TEST_EXECUTABLE} );

libwrc/libwrc_libfwevt.h

-/*
- * The libfwevt header wrapper
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_LIBFWEVT_H )
-#define _LIBWRC_LIBFWEVT_H
-
-#include <common.h>
-
-/* Define HAVE_LOCAL_LIBFWEVT for local use of libfwevt
- */
-#if defined( HAVE_LOCAL_LIBFWEVT )
-
-#include <libfwevt_channel.h>
-#include <libfwevt_definitions.h>
-#include <libfwevt_event.h>
-#include <libfwevt_keyword.h>
-#include <libfwevt_level.h>
-#include <libfwevt_manifest.h>
-#include <libfwevt_map.h>
-#include <libfwevt_opcode.h>
-#include <libfwevt_provider.h>
-#include <libfwevt_task.h>
-#include <libfwevt_template.h>
-#include <libfwevt_types.h>
-#include <libfwevt_xml_document.h>
-#include <libfwevt_xml_tag.h>
-#include <libfwevt_xml_template_value.h>
-
-#else
-
-/* If libtool DLL support is enabled set LIBFWEVT_DLL_IMPORT
- * before including libfwevt.h
- */
-#if defined( _WIN32 ) && defined( DLL_IMPORT )
-#define LIBFWEVT_DLL_IMPORT
-#endif
-
-#include <libfwevt.h>
-
-#endif
-
-#endif
-

libwrc/libwrc_resource_values.c

-/*
- * Resource values functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_data_descriptor.h"
-#include "libwrc_libcdata.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libuna.h"
-#include "libwrc_resource_values.h"
-
-/* Creates resource values
- * Make sure the value resource_values is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_resource_values_initialize(
-     libwrc_resource_values_t **resource_values,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_initialize";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( *resource_values != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid resource values value already set.",
-		 function );
-
-		return( -1 );
-	}
-	*resource_values = memory_allocate_structure(
-	                    libwrc_resource_values_t );
-
-	if( *resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create resource values.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     *resource_values,
-	     0,
-	     sizeof( libwrc_resource_values_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear resource values.",
-		 function );
-
-		goto on_error;
-	}
-	return( 1 );
-
-on_error:
-	if( *resource_values != NULL )
-	{
-		memory_free(
-		 *resource_values );
-
-		*resource_values = NULL;
-	}
-	return( -1 );
-}
-
-/* Frees resource values
- * Returns 1 if successful or -1 on error
- */
-int libwrc_resource_values_free(
-     libwrc_resource_values_t **resource_values,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_free";
-	int result            = 1;
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( *resource_values != NULL )
-	{
-		if( libwrc_data_descriptor_free(
-		     &( ( *resource_values )->data_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free data descriptor.",
-			 function );
-
-			result = -1;
-		}
-		if( ( *resource_values )->name_string != NULL )
-		{
-			memory_free(
-			 ( *resource_values )->name_string );
-		}
-		memory_free(
-		 *resource_values );
-
-		*resource_values = NULL;
-	}
-	return( result );
-}
-
-/* Compares two resource values
- * Returns LIBCDATA_COMPARE_LESS, LIBCDATA_COMPARE_EQUAL, LIBCDATA_COMPARE_GREATER if successful or -1 on error
- */
-int libwrc_resource_values_compare(
-     libwrc_resource_values_t *first_resource_values,
-     libwrc_resource_values_t *second_resource_values,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_compare";
-
-	if( first_resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid first resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( second_resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid second resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( first_resource_values->identifier < second_resource_values->identifier )
-	{
-		return( LIBCDATA_COMPARE_LESS );
-	}
-	else if( first_resource_values->identifier > second_resource_values->identifier )
-	{
-		return( LIBCDATA_COMPARE_GREATER );
-	}
-	return( LIBCDATA_COMPARE_EQUAL );
-}
-
-/* Sets the name string
- * Returns 1 if successful or -1 on error
- */
-int libwrc_resource_values_set_name_string(
-     libwrc_resource_values_t *resource_values,
-     const uint8_t *name_string,
-     size_t name_string_size,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_identifier";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( resource_values->name_string != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid resource values - name string value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( name_string == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid name string.",
-		 function );
-
-		return( -1 );
-	}
-	if( ( name_string_size == 0 )
-	 || ( name_string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
-		 "%s: invalid name string size value out of bounds.",
-		 function );
-
-		return( -1 );
-	}
-	resource_values->name_string = (uint8_t *) memory_allocate(
-	                                            sizeof( uint8_t ) * name_string_size );
-
-	if( resource_values->name_string == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create resource node name string.",
-		 function );
-
-		goto on_error;
-	}
-	resource_values->name_string_size = name_string_size;
-
-	if( memory_copy(
-	     resource_values->name_string,
-	     name_string,
-	     name_string_size ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_COPY_FAILED,
-		 "%s: unable to copy name string.",
-		 function );
-
-		goto on_error;
-	}
-	return( 1 );
-
-on_error:
-	if( resource_values->name_string != NULL )
-	{
-		memory_free(
-		 resource_values->name_string );
-
-		resource_values->name_string = NULL;
-	}
-	resource_values->name_string_size = 0;
-
-	return( -1 );
-}
-
-/* Retrieves the identifier
- * Returns 1 if successful or -1 on error
- */
-int libwrc_resource_values_get_identifier(
-     libwrc_resource_values_t *resource_values,
-     uint32_t *identifier,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_identifier";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( identifier == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid identifier.",
-		 function );
-
-		return( -1 );
-	}
-	*identifier = resource_values->identifier;
-
-	return( 1 );
-}
-
-/* Retrieves the size of the UTF-8 encoded name
- * The returned size includes the end of string character
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_resource_values_get_utf8_name_size(
-     libwrc_resource_values_t *resource_values,
-     size_t *utf8_string_size,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_utf8_name_size";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( utf8_string_size == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid UTF-8 string size.",
-		 function );
-
-		return( -1 );
-	}
-	if( ( resource_values->name_string == NULL )
-	 || ( resource_values->name_string_size == 0 ) )
-	{
-		return( 0 );
-	}
-	if( libuna_utf8_string_size_from_utf16_stream(
-	     resource_values->name_string,
-	     resource_values->name_string_size,
-	     LIBUNA_ENDIAN_LITTLE,
-	     utf8_string_size,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve UTF-8 string size.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the UTF-8 encoded name
- * The size should include the end of string character
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_resource_values_get_utf8_name(
-     libwrc_resource_values_t *resource_values,
-     uint8_t *utf8_string,
-     size_t utf8_string_size,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_utf8_name";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( utf8_string == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid UTF-8 string.",
-		 function );
-
-		return( -1 );
-	}
-	if( utf8_string_size > (size_t) SSIZE_MAX )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,
-		 "%s: invalid UTF-8 string size value exceeds maximum.",
-		 function );
-
-		return( -1 );
-	}
-	if( ( resource_values->name_string == NULL )
-	 || ( resource_values->name_string_size == 0 ) )
-	{
-		return( 0 );
-	}
-	if( libuna_utf8_string_copy_from_utf16_stream(
-	     utf8_string,
-	     utf8_string_size,
-	     resource_values->name_string,
-	     resource_values->name_string_size,
-	     LIBUNA_ENDIAN_LITTLE,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve UTF-8 string.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the size of the UTF-16 encoded name
- * The returned size includes the end of string character
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_resource_values_get_utf16_name_size(
-     libwrc_resource_values_t *resource_values,
-     size_t *utf16_string_size,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_utf16_name_size";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( utf16_string_size == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid UTF-16 string size.",
-		 function );
-
-		return( -1 );
-	}
-	if( ( resource_values->name_string == NULL )
-	 || ( resource_values->name_string_size == 0 ) )
-	{
-		return( 0 );
-	}
-	if( libuna_utf16_string_size_from_utf16_stream(
-	     resource_values->name_string,
-	     resource_values->name_string_size,
-	     LIBUNA_ENDIAN_LITTLE,
-	     utf16_string_size,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve UTF-16 string size.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the UTF-16 encoded name
- * The size should include the end of string character
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_resource_values_get_utf16_name(
-     libwrc_resource_values_t *resource_values,
-     uint16_t *utf16_string,
-     size_t utf16_string_size,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_utf16_name";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( utf16_string == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid UTF-16 string.",
-		 function );
-
-		return( -1 );
-	}
-	if( utf16_string_size > (size_t) SSIZE_MAX )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_EXCEEDS_MAXIMUM,
-		 "%s: invalid UTF-16 string size value exceeds maximum.",
-		 function );
-
-		return( -1 );
-	}
-	if( ( resource_values->name_string == NULL )
-	 || ( resource_values->name_string_size == 0 ) )
-	{
-		return( 0 );
-	}
-	if( libuna_utf16_string_copy_from_utf16_stream(
-	     utf16_string,
-	     utf16_string_size,
-	     resource_values->name_string,
-	     resource_values->name_string_size,
-	     LIBUNA_ENDIAN_LITTLE,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve UTF-16 string.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the type
- * Returns 1 if successful or -1 on error
- */
-int libwrc_resource_values_get_type(
-     libwrc_resource_values_t *resource_values,
-     int *type,
-     libcerror_error_t **error )
-{
-	static char *function = "libwrc_resource_values_get_type";
-
-	if( resource_values == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid resource values.",
-		 function );
-
-		return( -1 );
-	}
-	if( type == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid type.",
-		 function );
-
-		return( -1 );
-	}
-	*type = resource_values->type;
-
-	return( 1 );
-}
-

libwrc/libwrc_resource_values.h

-/*
- * Resource values functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_RESOURCE_VALUES_H )
-#define _LIBWRC_RESOURCE_VALUES_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_data_descriptor.h"
-#include "libwrc_libcerror.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_resource_values libwrc_resource_values_t;
-
-struct libwrc_resource_values
-{
-	/* The identifier
-	 */
-	uint32_t identifier;
-
-	/* The offset
-	 */
-	uint32_t offset;
-
-	/* The name string
-	 */
-	uint8_t *name_string;
-
-	/* The name string size
-	 */
-	size_t name_string_size;
-
-	/* The type
-	 */
-	int type;
-
-	/* The data descriptor
-	 */
-	libwrc_data_descriptor_t *data_descriptor;
-};
-
-int libwrc_resource_values_initialize(
-     libwrc_resource_values_t **resource_values,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_free(
-     libwrc_resource_values_t **resource_values,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_compare(
-     libwrc_resource_values_t *first_resource_values,
-     libwrc_resource_values_t *second_resource_values,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_set_name_string(
-     libwrc_resource_values_t *resource_values,
-     const uint8_t *name_string,
-     size_t name_string_size,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_get_identifier(
-     libwrc_resource_values_t *resource_values,
-     uint32_t *identifier,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_get_utf8_name_size(
-     libwrc_resource_values_t *resource_values,
-     size_t *utf8_string_size,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_get_utf8_name(
-     libwrc_resource_values_t *resource_values,
-     uint8_t *utf8_string,
-     size_t utf8_string_size,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_get_utf16_name_size(
-     libwrc_resource_values_t *resource_values,
-     size_t *utf16_string_size,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_get_utf16_name(
-     libwrc_resource_values_t *resource_values,
-     uint16_t *utf16_string,
-     size_t utf16_string_size,
-     libcerror_error_t **error );
-
-int libwrc_resource_values_get_type(
-     libwrc_resource_values_t *resource_values,
-     int *type,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_RESOURCE_VALUES_H ) */
-

libwrc/libwrc_wevt_channel.c

-/*
- * WEVT channel functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_channel.h"
-
-/* Creates a channel
- * Make sure the value channel is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_channel_initialize(
-     libwrc_wevt_channel_t **channel,
-     libfwevt_channel_t *channel_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_channel_t *internal_channel = NULL;
-	static char *function                            = "libwrc_wevt_channel_initialize";
-
-	if( channel == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid channel.",
-		 function );
-
-		return( -1 );
-	}
-	if( *channel != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid channel value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( channel_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid channel descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_channel = memory_allocate_structure(
-	                    libwrc_internal_wevt_channel_t );
-
-	if( internal_channel == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create channel.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_channel,
-	     0,
-	     sizeof( libwrc_internal_wevt_channel_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear channel.",
-		 function );
-
-		goto on_error;
-	}
-	internal_channel->channel_descriptor = channel_descriptor;
-
-	*channel = (libwrc_wevt_channel_t *) internal_channel;
-
-	return( 1 );
-
-on_error:
-	if( internal_channel != NULL )
-	{
-		memory_free(
-		 internal_channel );
-	}
-	return( -1 );
-}
-
-/* Frees a channel
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_channel_free(
-     libwrc_wevt_channel_t **channel,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_channel_t *internal_channel = NULL;
-	static char *function                            = "libwrc_wevt_channel_free";
-	int result                                       = 1;
-
-	if( channel == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid channel.",
-		 function );
-
-		return( -1 );
-	}
-	if( *channel != NULL )
-	{
-		internal_channel = (libwrc_internal_wevt_channel_t *) *channel;
-		*channel         = NULL;
-
-		if( libfwevt_channel_free(
-		     &( internal_channel->channel_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free channel descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_channel );
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_channel.h

-/*
- * WEVT channel functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_CHANNEL_H )
-#define _LIBWRC_INTERNAL_WEVT_CHANNEL_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_channel libwrc_internal_wevt_channel_t;
-
-struct libwrc_internal_wevt_channel
-{
-	/* The channel descriptor
-	 */
-	libfwevt_channel_t *channel_descriptor;
-};
-
-int libwrc_wevt_channel_initialize(
-     libwrc_wevt_channel_t **channel,
-     libfwevt_channel_t *channel_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_channel_free(
-     libwrc_wevt_channel_t **channel,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_CHANNEL_H ) */
-

libwrc/libwrc_wevt_event.c

-/*
- * WEVT event functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_event.h"
-#include "libwrc_wevt_template_definition.h"
-
-/* Creates an event
- * Make sure the value event is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_event_initialize(
-     libwrc_wevt_event_t **event,
-     libfwevt_provider_t *provider_descriptor,
-     libfwevt_event_t *event_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_event_t *internal_event = NULL;
-	static char *function                        = "libwrc_wevt_event_initialize";
-
-	if( event == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid event.",
-		 function );
-
-		return( -1 );
-	}
-	if( *event != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid event value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( event_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid event descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_event = memory_allocate_structure(
-	                  libwrc_internal_wevt_event_t );
-
-	if( internal_event == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create event.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_event,
-	     0,
-	     sizeof( libwrc_internal_wevt_event_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear event.",
-		 function );
-
-		goto on_error;
-	}
-	internal_event->provider_descriptor = provider_descriptor;
-	internal_event->event_descriptor    = event_descriptor;
-
-	*event = (libwrc_wevt_event_t *) internal_event;
-
-	return( 1 );
-
-on_error:
-	if( internal_event != NULL )
-	{
-		memory_free(
-		 internal_event );
-	}
-	return( -1 );
-}
-
-/* Frees an event
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_event_free(
-     libwrc_wevt_event_t **event,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_event_t *internal_event = NULL;
-	static char *function                        = "libwrc_wevt_event_free";
-	int result                                   = 1;
-
-	if( event == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid event.",
-		 function );
-
-		return( -1 );
-	}
-	if( *event != NULL )
-	{
-		internal_event = (libwrc_internal_wevt_event_t *) *event;
-		*event         = NULL;
-
-		if( libfwevt_event_free(
-		     &( internal_event->event_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free event descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_event );
-	}
-	return( result );
-}
-
-/* Retrieves the identifier
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_event_get_identifier(
-     libwrc_wevt_event_t *event,
-     uint32_t *identifier,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_event_t *internal_event = NULL;
-	static char *function                        = "libwrc_wevt_event_get_identifier";
-
-	if( event == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid event.",
-		 function );
-
-		return( -1 );
-	}
-	internal_event = (libwrc_internal_wevt_event_t *) event;
-
-	if( libfwevt_event_get_identifier(
-	     internal_event->event_descriptor,
-	     identifier,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve identifier.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the message identifier
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_event_get_message_identifier(
-     libwrc_wevt_event_t *event,
-     uint32_t *message_identifier,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_event_t *internal_event = NULL;
-	static char *function                        = "libwrc_wevt_event_get_message_identifier";
-
-	if( event == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid event.",
-		 function );
-
-		return( -1 );
-	}
-	internal_event = (libwrc_internal_wevt_event_t *) event;
-
-	if( libfwevt_event_get_message_identifier(
-	     internal_event->event_descriptor,
-	     message_identifier,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve message identifier.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the template definition
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_wevt_event_get_template_definition(
-     libwrc_wevt_event_t *event,
-     libwrc_wevt_template_definition_t **template_definition,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_event_t *internal_event = NULL;
-	libfwevt_template_t *template_descriptor     = NULL;
-	static char *function                        = "libwrc_wevt_event_get_template_definition";
-	uint32_t template_offset                     = 0;
-	int result                                   = 0;
-
-	if( event == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid event.",
-		 function );
-
-		return( -1 );
-	}
-	internal_event = (libwrc_internal_wevt_event_t *) event;
-
-	if( libfwevt_event_get_template_offset(
-	     internal_event->event_descriptor,
-	     &template_offset,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve template offset.",
-		 function );
-
-		return( -1 );
-	}
-	if( template_offset != 0 )
-	{
-		result = libfwevt_provider_get_template_by_offset(
-			  internal_event->provider_descriptor,
-			  template_offset,
-			  &template_descriptor,
-			  error );
-
-		if( result == -1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-			 "%s: unable to retrieve template by offset.",
-			 function );
-
-			return( -1 );
-		}
-		else if( result != 0 )
-		{
-			if( libwrc_wevt_template_definition_initialize(
-			     template_definition,
-			     template_descriptor,
-			     error ) != 1 )
-			{
-				libcerror_error_set(
-				 error,
-				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-				 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-				 "%s: unable to create template definition.",
-				 function );
-
-				return( -1 );
-			}
-		}
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_event.h

-/*
- * WEVT event functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_EVENT_H )
-#define _LIBWRC_INTERNAL_WEVT_EVENT_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_event libwrc_internal_wevt_event_t;
-
-struct libwrc_internal_wevt_event
-{
-	/* The provider descriptor
-	 */
-	libfwevt_provider_t *provider_descriptor;
-
-	/* The event descriptor
-	 */
-	libfwevt_event_t *event_descriptor;
-};
-
-int libwrc_wevt_event_initialize(
-     libwrc_wevt_event_t **event,
-     libfwevt_provider_t *provider_descriptor,
-     libfwevt_event_t *event_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_event_free(
-     libwrc_wevt_event_t **event,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_event_get_identifier(
-     libwrc_wevt_event_t *event,
-     uint32_t *identifier,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_event_get_message_identifier(
-     libwrc_wevt_event_t *event,
-     uint32_t *message_identifier,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_event_get_template_definition(
-     libwrc_wevt_event_t *event,
-     libwrc_wevt_template_definition_t **template_definition,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_EVENT_H ) */
-

libwrc/libwrc_wevt_keyword.c

-/*
- * WEVT keyword functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_keyword.h"
-
-/* Creates a keyword
- * Make sure the value keyword is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_keyword_initialize(
-     libwrc_wevt_keyword_t **keyword,
-     libfwevt_keyword_t *keyword_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_keyword_t *internal_keyword = NULL;
-	static char *function                            = "libwrc_wevt_keyword_initialize";
-
-	if( keyword == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid keyword.",
-		 function );
-
-		return( -1 );
-	}
-	if( *keyword != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid keyword value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( keyword_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid keyword descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_keyword = memory_allocate_structure(
-	                    libwrc_internal_wevt_keyword_t );
-
-	if( internal_keyword == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create keyword.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_keyword,
-	     0,
-	     sizeof( libwrc_internal_wevt_keyword_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear keyword.",
-		 function );
-
-		goto on_error;
-	}
-	internal_keyword->keyword_descriptor = keyword_descriptor;
-
-	*keyword = (libwrc_wevt_keyword_t *) internal_keyword;
-
-	return( 1 );
-
-on_error:
-	if( internal_keyword != NULL )
-	{
-		memory_free(
-		 internal_keyword );
-	}
-	return( -1 );
-}
-
-/* Frees a keyword
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_keyword_free(
-     libwrc_wevt_keyword_t **keyword,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_keyword_t *internal_keyword = NULL;
-	static char *function                            = "libwrc_wevt_keyword_free";
-	int result                                       = 1;
-
-	if( keyword == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid keyword.",
-		 function );
-
-		return( -1 );
-	}
-	if( *keyword != NULL )
-	{
-		internal_keyword = (libwrc_internal_wevt_keyword_t *) *keyword;
-		*keyword         = NULL;
-
-		if( libfwevt_keyword_free(
-		     &( internal_keyword->keyword_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free keyword descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_keyword );
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_keyword.h

-/*
- * WEVT keyword functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_KEYWORD_H )
-#define _LIBWRC_INTERNAL_WEVT_KEYWORD_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_keyword libwrc_internal_wevt_keyword_t;
-
-struct libwrc_internal_wevt_keyword
-{
-	/* The keyword descriptor
-	 */
-	libfwevt_keyword_t *keyword_descriptor;
-};
-
-int libwrc_wevt_keyword_initialize(
-     libwrc_wevt_keyword_t **keyword,
-     libfwevt_keyword_t *keyword_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_keyword_free(
-     libwrc_wevt_keyword_t **keyword,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_KEYWORD_H ) */
-

libwrc/libwrc_wevt_level.c

-/*
- * WEVT level functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_level.h"
-
-/* Creates a level
- * Make sure the value level is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_level_initialize(
-     libwrc_wevt_level_t **level,
-     libfwevt_level_t *level_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_level_t *internal_level = NULL;
-	static char *function                        = "libwrc_wevt_level_initialize";
-
-	if( level == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid level.",
-		 function );
-
-		return( -1 );
-	}
-	if( *level != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid level value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( level_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid level descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_level = memory_allocate_structure(
-	                  libwrc_internal_wevt_level_t );
-
-	if( internal_level == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create level.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_level,
-	     0,
-	     sizeof( libwrc_internal_wevt_level_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear level.",
-		 function );
-
-		goto on_error;
-	}
-	internal_level->level_descriptor = level_descriptor;
-
-	*level = (libwrc_wevt_level_t *) internal_level;
-
-	return( 1 );
-
-on_error:
-	if( internal_level != NULL )
-	{
-		memory_free(
-		 internal_level );
-	}
-	return( -1 );
-}
-
-/* Frees a level
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_level_free(
-     libwrc_wevt_level_t **level,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_level_t *internal_level = NULL;
-	static char *function                        = "libwrc_wevt_level_free";
-	int result                                   = 1;
-
-	if( level == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid level.",
-		 function );
-
-		return( -1 );
-	}
-	if( *level != NULL )
-	{
-		internal_level = (libwrc_internal_wevt_level_t *) *level;
-		*level         = NULL;
-
-		if( libfwevt_level_free(
-		     &( internal_level->level_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free level descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_level );
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_level.h

-/*
- * WEVT level functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_LEVEL_H )
-#define _LIBWRC_INTERNAL_WEVT_LEVEL_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_level libwrc_internal_wevt_level_t;
-
-struct libwrc_internal_wevt_level
-{
-	/* The level descriptor
-	 */
-	libfwevt_level_t *level_descriptor;
-};
-
-int libwrc_wevt_level_initialize(
-     libwrc_wevt_level_t **level,
-     libfwevt_level_t *level_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_level_free(
-     libwrc_wevt_level_t **level,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_LEVEL_H ) */
-

libwrc/libwrc_wevt_map.c

-/*
- * WEVT map functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_map.h"
-
-/* Creates a map
- * Make sure the value map is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_map_initialize(
-     libwrc_wevt_map_t **map,
-     libfwevt_map_t *map_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_map_t *internal_map = NULL;
-	static char *function                    = "libwrc_wevt_map_initialize";
-
-	if( map == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid map.",
-		 function );
-
-		return( -1 );
-	}
-	if( *map != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid map value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( map_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid map descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_map = memory_allocate_structure(
-	                    libwrc_internal_wevt_map_t );
-
-	if( internal_map == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create map.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_map,
-	     0,
-	     sizeof( libwrc_internal_wevt_map_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear map.",
-		 function );
-
-		goto on_error;
-	}
-	internal_map->map_descriptor = map_descriptor;
-
-	*map = (libwrc_wevt_map_t *) internal_map;
-
-	return( 1 );
-
-on_error:
-	if( internal_map != NULL )
-	{
-		memory_free(
-		 internal_map );
-	}
-	return( -1 );
-}
-
-/* Frees a map
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_map_free(
-     libwrc_wevt_map_t **map,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_map_t *internal_map = NULL;
-	static char *function                    = "libwrc_wevt_map_free";
-	int result                               = 1;
-
-	if( map == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid map.",
-		 function );
-
-		return( -1 );
-	}
-	if( *map != NULL )
-	{
-		internal_map = (libwrc_internal_wevt_map_t *) *map;
-		*map         = NULL;
-
-		if( libfwevt_map_free(
-		     &( internal_map->map_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free map descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_map );
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_map.h

-/*
- * WEVT map functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_MAP_H )
-#define _LIBWRC_INTERNAL_WEVT_MAP_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_map libwrc_internal_wevt_map_t;
-
-struct libwrc_internal_wevt_map
-{
-	/* The map descriptor
-	 */
-	libfwevt_map_t *map_descriptor;
-};
-
-int libwrc_wevt_map_initialize(
-     libwrc_wevt_map_t **map,
-     libfwevt_map_t *map_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_map_free(
-     libwrc_wevt_map_t **map,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_MAP_H ) */
-

libwrc/libwrc_wevt_opcode.c

-/*
- * WEVT opcode functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_opcode.h"
-
-/* Creates an opcode
- * Make sure the value opcode is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_opcode_initialize(
-     libwrc_wevt_opcode_t **opcode,
-     libfwevt_opcode_t *opcode_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_opcode_t *internal_opcode = NULL;
-	static char *function                          = "libwrc_wevt_opcode_initialize";
-
-	if( opcode == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid opcode.",
-		 function );
-
-		return( -1 );
-	}
-	if( *opcode != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid opcode value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( opcode_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid opcode descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_opcode = memory_allocate_structure(
-	                   libwrc_internal_wevt_opcode_t );
-
-	if( internal_opcode == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create opcode.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_opcode,
-	     0,
-	     sizeof( libwrc_internal_wevt_opcode_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear opcode.",
-		 function );
-
-		goto on_error;
-	}
-	internal_opcode->opcode_descriptor = opcode_descriptor;
-
-	*opcode = (libwrc_wevt_opcode_t *) internal_opcode;
-
-	return( 1 );
-
-on_error:
-	if( internal_opcode != NULL )
-	{
-		memory_free(
-		 internal_opcode );
-	}
-	return( -1 );
-}
-
-/* Frees an opcode
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_opcode_free(
-     libwrc_wevt_opcode_t **opcode,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_opcode_t *internal_opcode = NULL;
-	static char *function                          = "libwrc_wevt_opcode_free";
-	int result                                     = 1;
-
-	if( opcode == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid opcode.",
-		 function );
-
-		return( -1 );
-	}
-	if( *opcode != NULL )
-	{
-		internal_opcode = (libwrc_internal_wevt_opcode_t *) *opcode;
-		*opcode         = NULL;
-
-		if( libfwevt_opcode_free(
-		     &( internal_opcode->opcode_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free opcode descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_opcode );
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_opcode.h

-/*
- * WEVT opcode functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_OPCODE_H )
-#define _LIBWRC_INTERNAL_WEVT_OPCODE_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_opcode libwrc_internal_wevt_opcode_t;
-
-struct libwrc_internal_wevt_opcode
-{
-	/* The opcode descriptor
-	 */
-	libfwevt_opcode_t *opcode_descriptor;
-};
-
-int libwrc_wevt_opcode_initialize(
-     libwrc_wevt_opcode_t **opcode,
-     libfwevt_opcode_t *opcode_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_opcode_free(
-     libwrc_wevt_opcode_t **opcode,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_OPCODE_H ) */
-

libwrc/libwrc_wevt_provider.c

-/*
- * WEVT provider functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <byte_stream.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcdata.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_event.h"
-#include "libwrc_wevt_provider.h"
-
-/* Creates a provider
- * Make sure the value provider is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_provider_initialize(
-     libwrc_wevt_provider_t **provider,
-     libfwevt_provider_t *provider_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_provider_t *internal_provider = NULL;
-	static char *function                              = "libwrc_wevt_provider_initialize";
-
-	if( provider == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid provider.",
-		 function );
-
-		return( -1 );
-	}
-	if( *provider != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid provider value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( provider_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid provider descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_provider = memory_allocate_structure(
-	                     libwrc_internal_wevt_provider_t );
-
-	if( internal_provider == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create provider.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_provider,
-	     0,
-	     sizeof( libwrc_internal_wevt_provider_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear provider.",
-		 function );
-
-		goto on_error;
-	}
-	internal_provider->provider_descriptor = provider_descriptor;
-
-	*provider = (libwrc_wevt_provider_t *) internal_provider;
-
-	return( 1 );
-
-on_error:
-	if( internal_provider != NULL )
-	{
-		memory_free(
-		 internal_provider );
-	}
-	return( -1 );
-}
-
-/* Frees a provider
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_provider_free(
-     libwrc_wevt_provider_t **provider,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_provider_t *internal_provider = NULL;
-	static char *function                              = "libwrc_wevt_provider_free";
-	int result                                         = 1;
-
-	if( provider == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid provider.",
-		 function );
-
-		return( -1 );
-	}
-	if( *provider != NULL )
-	{
-		internal_provider = (libwrc_internal_wevt_provider_t *) *provider;
-		*provider         = NULL;
-
-		if( libfwevt_provider_free(
-		     &( internal_provider->provider_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free provider descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_provider );
-	}
-	return( result );
-}
-
-/* Retrieves the number of events
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_provider_get_number_of_events(
-     libwrc_wevt_provider_t *provider,
-     int *number_of_events,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_provider_t *internal_provider = NULL;
-	static char *function                              = "libwrc_wevt_provider_get_number_of_events";
-
-	if( provider == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid provider.",
-		 function );
-
-		return( -1 );
-	}
-	internal_provider = (libwrc_internal_wevt_provider_t *) provider;
-
-	if( libfwevt_provider_get_number_of_events(
-	     internal_provider->provider_descriptor,
-	     number_of_events,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve number of events.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves a specific event
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_provider_get_event(
-     libwrc_wevt_provider_t *provider,
-     int event_index,
-     libwrc_wevt_event_t **event,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_provider_t *internal_provider = NULL;
-	libfwevt_event_t *event_descriptor                 = NULL;
-	static char *function                              = "libwrc_wevt_provider_get_event";
-
-	if( provider == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid provider.",
-		 function );
-
-		return( -1 );
-	}
-	internal_provider = (libwrc_internal_wevt_provider_t *) provider;
-
-	if( libfwevt_provider_get_event(
-	     internal_provider->provider_descriptor,
-	     event_index,
-	     &event_descriptor,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve event: %d.",
-		 function,
-		 event_index );
-
-		return( -1 );
-	}
-	if( libwrc_wevt_event_initialize(
-	     event,
-	     internal_provider->provider_descriptor,
-	     event_descriptor,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-		 "%s: unable to create event.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves a specific event by identifier
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_wevt_provider_get_event_by_identifier(
-     libwrc_wevt_provider_t *provider,
-     uint32_t event_identifier,
-     libwrc_wevt_event_t **event,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_provider_t *internal_provider = NULL;
-	libfwevt_event_t *event_descriptor                 = NULL;
-	static char *function                              = "libwrc_wevt_provider_get_event_by_identifier";
-	int result                                         = 0;
-
-	if( provider == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid provider.",
-		 function );
-
-		return( -1 );
-	}
-	internal_provider = (libwrc_internal_wevt_provider_t *) provider;
-
-	result = libfwevt_provider_get_event_by_identifier(
-	          internal_provider->provider_descriptor,
-	          event_identifier,
-	          &event_descriptor,
-	          error );
-
-	if( result == -1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve event.",
-		 function );
-
-		return( -1 );
-	}
-	else if( result != 0 )
-	{
-		if( libwrc_wevt_event_initialize(
-		     event,
-		     internal_provider->provider_descriptor,
-		     event_descriptor,
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-			 "%s: unable to create event.",
-			 function );
-
-			return( -1 );
-		}
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_provider.h

-/*
- * WEVT provider functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_PROVIDER_H )
-#define _LIBWRC_INTERNAL_WEVT_PROVIDER_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_resource.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_provider libwrc_internal_wevt_provider_t;
-
-struct libwrc_internal_wevt_provider
-{
-	/* The provider descriptor
-	 */
-	libfwevt_provider_t *provider_descriptor;
-};
-
-int libwrc_wevt_provider_initialize(
-     libwrc_wevt_provider_t **provider,
-     libfwevt_provider_t *provider_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_provider_free(
-     libwrc_wevt_provider_t **provider,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_provider_get_number_of_events(
-     libwrc_wevt_provider_t *provider,
-     int *number_of_events,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_provider_get_event(
-     libwrc_wevt_provider_t *provider,
-     int event_index,
-     libwrc_wevt_event_t **event,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_provider_get_event_by_identifier(
-     libwrc_wevt_provider_t *provider,
-     uint32_t event_identifier,
-     libwrc_wevt_event_t **event,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_PROVIDER_H ) */
-

libwrc/libwrc_wevt_task.c

-/*
- * WEVT task functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_task.h"
-
-/* Creates a task
- * Make sure the value task is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_task_initialize(
-     libwrc_wevt_task_t **task,
-     libfwevt_task_t *task_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_task_t *internal_task = NULL;
-	static char *function                      = "libwrc_wevt_task_initialize";
-
-	if( task == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid task.",
-		 function );
-
-		return( -1 );
-	}
-	if( *task != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid task value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( task_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid task descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_task = memory_allocate_structure(
-	                 libwrc_internal_wevt_task_t );
-
-	if( internal_task == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create task.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_task,
-	     0,
-	     sizeof( libwrc_internal_wevt_task_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear task.",
-		 function );
-
-		goto on_error;
-	}
-	internal_task->task_descriptor = task_descriptor;
-
-	*task = (libwrc_wevt_task_t *) internal_task;
-
-	return( 1 );
-
-on_error:
-	if( internal_task != NULL )
-	{
-		memory_free(
-		 internal_task );
-	}
-	return( -1 );
-}
-
-/* Frees a task
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_task_free(
-     libwrc_wevt_task_t **task,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_task_t *internal_task = NULL;
-	static char *function                      = "libwrc_wevt_task_free";
-	int result                                 = 1;
-
-	if( task == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid task.",
-		 function );
-
-		return( -1 );
-	}
-	if( *task != NULL )
-	{
-		internal_task = (libwrc_internal_wevt_task_t *) *task;
-		*task         = NULL;
-
-		if( libfwevt_task_free(
-		     &( internal_task->task_descriptor ),
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
-			 "%s: unable to free task descriptor.",
-			 function );
-
-			result = -1;
-		}
-		memory_free(
-		 internal_task );
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_task.h

-/*
- * WEVT task functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_TASK_H )
-#define _LIBWRC_INTERNAL_WEVT_TASK_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_task libwrc_internal_wevt_task_t;
-
-struct libwrc_internal_wevt_task
-{
-	/* The task descriptor
-	 */
-	libfwevt_task_t *task_descriptor;
-};
-
-int libwrc_wevt_task_initialize(
-     libwrc_wevt_task_t **task,
-     libfwevt_task_t *task_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_task_free(
-     libwrc_wevt_task_t **task,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_TASK_H ) */
-

libwrc/libwrc_wevt_template_definition.c

-/*
- * WEVT template definition functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_template_definition.h"
-
-/* Creates a template definition
- * Make sure the value template_definition is referencing, is set to NULL
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_definition_initialize(
-     libwrc_wevt_template_definition_t **template_definition,
-     libfwevt_template_t *template_descriptor,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_template_definition_t *internal_template_definition = NULL;
-	static char *function                                                    = "libwrc_wevt_template_definition_initialize";
-
-	if( template_definition == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid template definition.",
-		 function );
-
-		return( -1 );
-	}
-	if( *template_definition != NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
-		 "%s: invalid template definition value already set.",
-		 function );
-
-		return( -1 );
-	}
-	if( template_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid template descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	internal_template_definition = memory_allocate_structure(
-	                                libwrc_internal_wevt_template_definition_t );
-
-	if( internal_template_definition == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create template definition.",
-		 function );
-
-		goto on_error;
-	}
-	if( memory_set(
-	     internal_template_definition,
-	     0,
-	     sizeof( libwrc_internal_wevt_template_definition_t ) ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_SET_FAILED,
-		 "%s: unable to clear template definition.",
-		 function );
-
-		goto on_error;
-	}
-	internal_template_definition->template_descriptor = template_descriptor;
-
-	*template_definition = (libwrc_wevt_template_definition_t *) internal_template_definition;
-
-	return( 1 );
-
-on_error:
-	if( internal_template_definition != NULL )
-	{
-		memory_free(
-		 internal_template_definition );
-	}
-	return( -1 );
-}
-
-/* Frees a template definition
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_definition_free(
-     libwrc_wevt_template_definition_t **template_definition,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_template_definition_t *internal_template_definition = NULL;
-	static char *function                                                    = "libwrc_wevt_template_definition_free";
-
-	if( template_definition == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid template definition.",
-		 function );
-
-		return( -1 );
-	}
-	if( *template_definition != NULL )
-	{
-		internal_template_definition = (libwrc_internal_wevt_template_definition_t *) *template_definition;
-		*template_definition         = NULL;
-
-		memory_free(
-		 internal_template_definition );
-	}
-	return( 1 );
-}
-
-/* Retrieves the data
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_definition_get_data(
-     libwrc_wevt_template_definition_t *template_definition,
-     uint8_t *data,
-     size_t data_size,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_template_definition_t *internal_template_definition = NULL;
-	const uint8_t *template_data                                             = NULL;
-	static char *function                                                    = "libwrc_wevt_template_definition_get_data";
-	size_t template_data_size                                                = 0;
-
-	if( template_definition == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid template definition.",
-		 function );
-
-		return( -1 );
-	}
-	internal_template_definition = (libwrc_internal_wevt_template_definition_t *) template_definition;
-
-	if( data == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid data.",
-		 function );
-
-		return( -1 );
-	}
-	if( data_size > (size_t) SSIZE_MAX )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
-		 "%s: invalid data size value exceeds maximum.",
-		 function );
-
-		return( -1 );
-	}
-	if( libfwevt_template_get_data(
-	     internal_template_definition->template_descriptor,
-	     &template_data,
-	     &template_data_size,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve data.",
-		 function );
-
-		return( -1 );
-	}
-	if( data_size < template_data_size )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
-		 "%s: invalid data value too small.",
-		 function );
-
-		return( -1 );
-	}
-	if( memory_copy(
-	     data,
-	     template_data,
-	     template_data_size ) == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_COPY_FAILED,
-		 "%s: unable to copy data.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the offset
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_definition_get_offset(
-     libwrc_wevt_template_definition_t *template_definition,
-     uint32_t *offset,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_template_definition_t *internal_template_definition = NULL;
-	static char *function                                                    = "libwrc_wevt_template_definition_get_offset";
-
-	if( template_definition == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid template definition.",
-		 function );
-
-		return( -1 );
-	}
-	internal_template_definition = (libwrc_internal_wevt_template_definition_t *) template_definition;
-
-	if( libfwevt_template_get_offset(
-	     internal_template_definition->template_descriptor,
-	     offset,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve offest.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves the size
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_definition_get_size(
-     libwrc_wevt_template_definition_t *template_definition,
-     size_t *size,
-     libcerror_error_t **error )
-{
-	libwrc_internal_wevt_template_definition_t *internal_template_definition = NULL;
-	static char *function                                                    = "libwrc_wevt_template_definition_get_size";
-
-	if( template_definition == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid template definition.",
-		 function );
-
-		return( -1 );
-	}
-	internal_template_definition = (libwrc_internal_wevt_template_definition_t *) template_definition;
-
-	if( libfwevt_template_get_size(
-	     internal_template_definition->template_descriptor,
-	     (uint32_t *) size,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve size.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-

libwrc/libwrc_wevt_template_definition.h

-/*
- * WEVT template definition functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_INTERNAL_WEVT_TEMPLATE_DEFINITION_H )
-#define _LIBWRC_INTERNAL_WEVT_TEMPLATE_DEFINITION_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-typedef struct libwrc_internal_wevt_template_definition libwrc_internal_wevt_template_definition_t;
-
-struct libwrc_internal_wevt_template_definition
-{
-	/* The template descriptor
-	 */
-	libfwevt_template_t *template_descriptor;
-};
-
-int libwrc_wevt_template_definition_initialize(
-     libwrc_wevt_template_definition_t **template_definition,
-     libfwevt_template_t *template_descriptor,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_definition_free(
-     libwrc_wevt_template_definition_t **template_definition,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_definition_get_data(
-     libwrc_wevt_template_definition_t *template_definition,
-     uint8_t *data,
-     size_t data_size,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_definition_get_offset(
-     libwrc_wevt_template_definition_t *template_definition,
-     uint32_t *offset,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_definition_get_size(
-     libwrc_wevt_template_definition_t *template_definition,
-     size_t *size,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_INTERNAL_WEVT_TEMPLATE_DEFINITION_H ) */
-

libwrc/libwrc_wevt_template_values.c

-/*
- * WEVT_TEMPLATE (resource) values functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_data_descriptor.h"
-#include "libwrc_debug.h"
-#include "libwrc_definitions.h"
-#include "libwrc_io_handle.h"
-#include "libwrc_language_entry.h"
-#include "libwrc_libbfio.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_wevt_template_values.h"
-
-/* Reads the event template (resource) values
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_values_read(
-     libwrc_language_entry_t *language_entry,
-     libwrc_io_handle_t *io_handle,
-     libbfio_handle_t *file_io_handle,
-     libwrc_data_descriptor_t *data_descriptor,
-     libcerror_error_t **error )
-{
-	libfwevt_manifest_t *manifest = NULL;
-	uint8_t *resource_data        = NULL;
-	static char *function         = "libwrc_wevt_template_values_read";
-	off64_t file_offset           = 0;
-	size_t resource_data_size     = 0;
-	ssize_t read_count            = 0;
-	int value_index               = 0;
-
-	if( language_entry == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid language entry.",
-		 function );
-
-		return( -1 );
-	}
-	if( io_handle == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid IO handle.",
-		 function );
-
-		return( -1 );
-	}
-	if( data_descriptor == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
-		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
-		 "%s: invalid data descriptor.",
-		 function );
-
-		return( -1 );
-	}
-	if( libfwevt_manifest_initialize(
-	     &manifest,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-		 "%s: unable to create manifest.",
-		 function );
-
-		goto on_error;
-	}
-	resource_data_size = (size_t) data_descriptor->size;
-
-	if( ( resource_data_size == 0 )
-	 || ( resource_data_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
-		 "%s: invalid resource data size value out of bounds.",
-		 function );
-
-		goto on_error;
-	}
-	resource_data = (uint8_t *) memory_allocate(
-	                             sizeof( uint8_t ) * resource_data_size );
-
-	if( resource_data == NULL )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_MEMORY,
-		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
-		 "%s: unable to create resource data.",
-		 function );
-
-		goto on_error;
-	}
-	file_offset = data_descriptor->virtual_address - io_handle->virtual_address;
-
-	read_count = libbfio_handle_read_buffer_at_offset(
-	              file_io_handle,
-	              resource_data,
-	              resource_data_size,
-	              file_offset,
-	              error );
-
-	if( read_count != (ssize_t) resource_data_size )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_IO,
-		 LIBCERROR_IO_ERROR_READ_FAILED,
-		 "%s: unable to read resource data at offset: %" PRIi64 " (0x%08" PRIx64 ").",
-		 function,
-		 file_offset,
-		 file_offset );
-
-		goto on_error;
-	}
-	if( libfwevt_manifest_read(
-	     manifest,
-	     resource_data,
-	     resource_data_size,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_IO,
-		 LIBCERROR_IO_ERROR_READ_FAILED,
-		 "%s: unable to read manifest.",
-		 function );
-
-		goto on_error;
-	}
-	if( libwrc_language_entry_append_value(
-	     language_entry,
-	     &value_index,
-	     (intptr_t *) manifest,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,
-		 "%s: unable to append manifest.",
-		 function );
-
-		goto on_error;
-	}
-	manifest = NULL;
-
-	memory_free(
-	 resource_data );
-
-	return( 1 );
-
-on_error:
-	if( resource_data != NULL )
-	{
-		memory_free(
-		 resource_data );
-	}
-	if( manifest != NULL )
-	{
-		libfwevt_manifest_free(
-		 &manifest,
-		 NULL );
-	}
-	return( -1 );
-}
-

libwrc/libwrc_wevt_template_values.h

-/*
- * WEVT_TEMPLATE (resource) values functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_WEVT_TEMPLATE_VALUES_H )
-#define _LIBWRC_WEVT_TEMPLATE_VALUES_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_data_descriptor.h"
-#include "libwrc_io_handle.h"
-#include "libwrc_language_entry.h"
-#include "libwrc_libbfio.h"
-#include "libwrc_libcerror.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-int libwrc_wevt_template_values_read(
-     libwrc_language_entry_t *language_entry,
-     libwrc_io_handle_t *io_handle,
-     libbfio_handle_t *file_io_handle,
-     libwrc_data_descriptor_t *data_descriptor,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_WEVT_TEMPLATE_VALUES_H ) */
-

libwrc/libwrc_wevt_template.c

-/*
- * WEVT_TEMPLATE (resource) functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#include <common.h>
-#include <byte_stream.h>
-#include <memory.h>
-#include <types.h>
-
-#include "libwrc_definitions.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_libfwevt.h"
-#include "libwrc_resource.h"
-#include "libwrc_types.h"
-#include "libwrc_wevt_provider.h"
-#include "libwrc_wevt_template.h"
-#include "libwrc_wevt_template_values.h"
-
-/* Retrieves the number of providers
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_get_number_of_providers(
-     libwrc_resource_t *resource,
-     uint32_t language_identifier,
-     int *number_of_providers,
-     libcerror_error_t **error )
-{
-	libfwevt_manifest_t *manifest = NULL;
-	static char *function         = "libwrc_wevt_template_get_number_of_providers";
-
-	if( libwrc_resource_get_value_by_language_identifier(
-	     resource,
-	     LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE,
-	     language_identifier,
-	     0,
-	     (intptr_t **) &manifest,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve WEVT_TEMPLATE manifest.",
-		 function );
-
-		return( -1 );
-	}
-	if( libfwevt_manifest_get_number_of_providers(
-	     manifest,
-	     number_of_providers,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve number of providers.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves a specific provider
- * Returns 1 if successful or -1 on error
- */
-int libwrc_wevt_template_get_provider(
-     libwrc_resource_t *resource,
-     uint32_t language_identifier,
-     int provider_index,
-     libwrc_wevt_provider_t **provider,
-     libcerror_error_t **error )
-{
-	libfwevt_manifest_t *manifest            = NULL;
-	libfwevt_provider_t *provider_descriptor = NULL;
-	static char *function                    = "libwrc_wevt_template_get_provider";
-
-	if( libwrc_resource_get_value_by_language_identifier(
-	     resource,
-	     LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE,
-	     language_identifier,
-	     0,
-	     (intptr_t **) &manifest,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve WEVT_TEMPLATE manifest.",
-		 function );
-
-		return( -1 );
-	}
-	if( libfwevt_manifest_get_provider_by_index(
-	     manifest,
-	     provider_index,
-	     &provider_descriptor,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve provider: %d.",
-		 function,
-		 provider_index );
-
-		return( -1 );
-	}
-	if( libwrc_wevt_provider_initialize(
-	     provider,
-	     provider_descriptor,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-		 "%s: unable to create provider.",
-		 function );
-
-		return( -1 );
-	}
-	return( 1 );
-}
-
-/* Retrieves a specific provider by identifier (GUID)
- * Returns 1 if successful, 0 if not available or -1 on error
- */
-int libwrc_wevt_template_get_provider_by_identifier(
-     libwrc_resource_t *resource,
-     uint32_t language_identifier,
-     const uint8_t *provider_identifier,
-     size_t provider_identifier_size,
-     libwrc_wevt_provider_t **provider,
-     libcerror_error_t **error )
-{
-	libfwevt_manifest_t *manifest            = NULL;
-	libfwevt_provider_t *provider_descriptor = NULL;
-	static char *function                    = "libwrc_wevt_template_get_provider_by_identifier";
-	int result                               = 0;
-
-	if( libwrc_resource_get_value_by_language_identifier(
-	     resource,
-	     LIBWRC_RESOURCE_TYPE_WEVT_TEMPLATE,
-	     language_identifier,
-	     0,
-	     (intptr_t **) &manifest,
-	     error ) != 1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve WEVT_TEMPLATE manifest.",
-		 function );
-
-		return( -1 );
-	}
-	result = libfwevt_manifest_get_provider_by_identifier(
-	          manifest,
-	          provider_identifier,
-	          provider_identifier_size,
-	          &provider_descriptor,
-	          error );
-
-	if( result == -1 )
-	{
-		libcerror_error_set(
-		 error,
-		 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-		 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
-		 "%s: unable to retrieve provider.",
-		 function );
-
-		return( -1 );
-	}
-	else if( result != 0 )
-	{
-		if( libwrc_wevt_provider_initialize(
-		     provider,
-		     provider_descriptor,
-		     error ) != 1 )
-		{
-			libcerror_error_set(
-			 error,
-			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
-			 LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
-			 "%s: unable to create provider.",
-			 function );
-
-			return( -1 );
-		}
-	}
-	return( result );
-}
-

libwrc/libwrc_wevt_template.h

-/*
- * WEVT_TEMPLATE (resource) functions
- *
- * Copyright (C) 2011-2022, Joachim Metz <[e-mail]>
- *
- * Refer to AUTHORS for acknowledgements.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-#if !defined( _LIBWRC_WEVT_TEMPLATE_H )
-#define _LIBWRC_WEVT_TEMPLATE_H
-
-#include <common.h>
-#include <types.h>
-
-#include "libwrc_extern.h"
-#include "libwrc_libcerror.h"
-#include "libwrc_resource.h"
-#include "libwrc_types.h"
-
-#if defined( __cplusplus )
-extern "C" {
-#endif
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_get_number_of_providers(
-     libwrc_resource_t *resource,
-     uint32_t language_identifier,
-     int *number_of_providers,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_get_provider(
-     libwrc_resource_t *resource,
-     uint32_t language_identifier,
-     int provider_index,
-     libwrc_wevt_provider_t **provider,
-     libcerror_error_t **error );
-
-LIBWRC_EXTERN \
-int libwrc_wevt_template_get_provider_by_identifier(
-     libwrc_resource_t *resource,
-     uint32_t language_identifier,
-     const uint8_t *provider_identifier,
-     size_t provider_identifier_size,
-     libwrc_wevt_provider_t **provider,
-     libcerror_error_t **error );
-
-#if defined( __cplusplus )
-}
-#endif
-
-#endif /* !defined( _LIBWRC_WEVT_TEMPLATE_H ) */
-

Alert delta unavailable

Currently unable to show alert delta for PyPI packages.

Improved metrics

Lines of code

503

0.2%

Worsened metrics

Total package byte prevSize

15842707

-0.47%

Number of package files

1156

-1.78%