/src/libevtx/libevtx/libevtx_template_definition.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Template definition functions |
3 | | * |
4 | | * Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com> |
5 | | * |
6 | | * Refer to AUTHORS for acknowledgements. |
7 | | * |
8 | | * This program is free software: you can redistribute it and/or modify |
9 | | * it under the terms of the GNU Lesser General Public License as published by |
10 | | * the Free Software Foundation, either version 3 of the License, or |
11 | | * (at your option) any later version. |
12 | | * |
13 | | * This program is distributed in the hope that it will be useful, |
14 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | | * GNU General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
20 | | */ |
21 | | |
22 | | #include <common.h> |
23 | | #include <memory.h> |
24 | | #include <types.h> |
25 | | |
26 | | #include "libevtx_io_handle.h" |
27 | | #include "libevtx_libcdata.h" |
28 | | #include "libevtx_libcerror.h" |
29 | | #include "libevtx_libcnotify.h" |
30 | | #include "libevtx_libfwevt.h" |
31 | | #include "libevtx_template_definition.h" |
32 | | |
33 | | /* Creates a template definition |
34 | | * Make sure the value template_definition is referencing, is set to NULL |
35 | | * Returns 1 if successful or -1 on error |
36 | | */ |
37 | | int libevtx_template_definition_initialize( |
38 | | libevtx_template_definition_t **template_definition, |
39 | | libcerror_error_t **error ) |
40 | 0 | { |
41 | 0 | libevtx_internal_template_definition_t *internal_template_definition = NULL; |
42 | 0 | static char *function = "libevtx_template_definition_initialize"; |
43 | |
|
44 | 0 | if( template_definition == NULL ) |
45 | 0 | { |
46 | 0 | libcerror_error_set( |
47 | 0 | error, |
48 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
49 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
50 | 0 | "%s: invalid template definition.", |
51 | 0 | function ); |
52 | |
|
53 | 0 | return( -1 ); |
54 | 0 | } |
55 | 0 | if( *template_definition != NULL ) |
56 | 0 | { |
57 | 0 | libcerror_error_set( |
58 | 0 | error, |
59 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
60 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
61 | 0 | "%s: invalid template definition value already set.", |
62 | 0 | function ); |
63 | |
|
64 | 0 | return( -1 ); |
65 | 0 | } |
66 | 0 | internal_template_definition = memory_allocate_structure( |
67 | 0 | libevtx_internal_template_definition_t ); |
68 | |
|
69 | 0 | if( internal_template_definition == NULL ) |
70 | 0 | { |
71 | 0 | libcerror_error_set( |
72 | 0 | error, |
73 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
74 | 0 | LIBCERROR_MEMORY_ERROR_INSUFFICIENT, |
75 | 0 | "%s: unable to create template definition.", |
76 | 0 | function ); |
77 | |
|
78 | 0 | goto on_error; |
79 | 0 | } |
80 | 0 | if( memory_set( |
81 | 0 | internal_template_definition, |
82 | 0 | 0, |
83 | 0 | sizeof( libevtx_internal_template_definition_t ) ) == NULL ) |
84 | 0 | { |
85 | 0 | libcerror_error_set( |
86 | 0 | error, |
87 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
88 | 0 | LIBCERROR_MEMORY_ERROR_SET_FAILED, |
89 | 0 | "%s: unable to clear template definition.", |
90 | 0 | function ); |
91 | |
|
92 | 0 | goto on_error; |
93 | 0 | } |
94 | 0 | if( libfwevt_template_initialize( |
95 | 0 | &( internal_template_definition->wevt_template ), |
96 | 0 | error ) != 1 ) |
97 | 0 | { |
98 | 0 | libcerror_error_set( |
99 | 0 | error, |
100 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
101 | 0 | LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, |
102 | 0 | "%s: unable to create WEVT template.", |
103 | 0 | function ); |
104 | |
|
105 | 0 | goto on_error; |
106 | 0 | } |
107 | 0 | *template_definition = (libevtx_template_definition_t *) internal_template_definition; |
108 | |
|
109 | 0 | return( 1 ); |
110 | | |
111 | 0 | on_error: |
112 | 0 | if( internal_template_definition != NULL ) |
113 | 0 | { |
114 | 0 | memory_free( |
115 | 0 | internal_template_definition ); |
116 | 0 | } |
117 | 0 | return( -1 ); |
118 | 0 | } |
119 | | |
120 | | /* Frees a template definition |
121 | | * Returns 1 if successful or -1 on error |
122 | | */ |
123 | | int libevtx_template_definition_free( |
124 | | libevtx_template_definition_t **template_definition, |
125 | | libcerror_error_t **error ) |
126 | 0 | { |
127 | 0 | libevtx_internal_template_definition_t *internal_template_definition = NULL; |
128 | 0 | static char *function = "libevtx_template_definition_free"; |
129 | 0 | int result = 1; |
130 | |
|
131 | 0 | if( template_definition == NULL ) |
132 | 0 | { |
133 | 0 | libcerror_error_set( |
134 | 0 | error, |
135 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
136 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
137 | 0 | "%s: invalid template.", |
138 | 0 | function ); |
139 | |
|
140 | 0 | return( -1 ); |
141 | 0 | } |
142 | 0 | if( *template_definition != NULL ) |
143 | 0 | { |
144 | 0 | internal_template_definition = (libevtx_internal_template_definition_t *) *template_definition; |
145 | 0 | *template_definition = NULL; |
146 | |
|
147 | 0 | if( libfwevt_template_free( |
148 | 0 | &( internal_template_definition->wevt_template ), |
149 | 0 | error ) != 1 ) |
150 | 0 | { |
151 | 0 | libcerror_error_set( |
152 | 0 | error, |
153 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
154 | 0 | LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, |
155 | 0 | "%s: unable to free WEVT template.", |
156 | 0 | function ); |
157 | |
|
158 | 0 | result = -1; |
159 | 0 | } |
160 | 0 | if( internal_template_definition->xml_document != NULL ) |
161 | 0 | { |
162 | 0 | if( libfwevt_xml_document_free( |
163 | 0 | &( internal_template_definition->xml_document ), |
164 | 0 | error ) != 1 ) |
165 | 0 | { |
166 | 0 | libcerror_error_set( |
167 | 0 | error, |
168 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
169 | 0 | LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, |
170 | 0 | "%s: unable to free XML document.", |
171 | 0 | function ); |
172 | |
|
173 | 0 | result = -1; |
174 | 0 | } |
175 | 0 | } |
176 | 0 | memory_free( |
177 | 0 | internal_template_definition ); |
178 | 0 | } |
179 | 0 | return( result ); |
180 | 0 | } |
181 | | |
182 | | /* Sets the data |
183 | | * Returns 1 if successful or -1 on error |
184 | | */ |
185 | | int libevtx_template_definition_set_data( |
186 | | libevtx_template_definition_t *template_definition, |
187 | | const uint8_t *data, |
188 | | size_t data_size, |
189 | | uint32_t data_offset, |
190 | | libcerror_error_t **error ) |
191 | 0 | { |
192 | 0 | libevtx_internal_template_definition_t *internal_template_definition = NULL; |
193 | 0 | static char *function = "libevtx_template_definition_set_data"; |
194 | |
|
195 | 0 | if( template_definition == NULL ) |
196 | 0 | { |
197 | 0 | libcerror_error_set( |
198 | 0 | error, |
199 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
200 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
201 | 0 | "%s: invalid template definition.", |
202 | 0 | function ); |
203 | |
|
204 | 0 | return( -1 ); |
205 | 0 | } |
206 | 0 | internal_template_definition = (libevtx_internal_template_definition_t *) template_definition; |
207 | |
|
208 | 0 | if( libfwevt_template_set_offset( |
209 | 0 | internal_template_definition->wevt_template, |
210 | 0 | data_offset, |
211 | 0 | error ) != 1 ) |
212 | 0 | { |
213 | 0 | libcerror_error_set( |
214 | 0 | error, |
215 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
216 | 0 | LIBCERROR_RUNTIME_ERROR_SET_FAILED, |
217 | 0 | "%s: unable to set template offset.", |
218 | 0 | function ); |
219 | |
|
220 | 0 | return( -1 ); |
221 | 0 | } |
222 | 0 | if( libfwevt_template_set_data( |
223 | 0 | internal_template_definition->wevt_template, |
224 | 0 | data, |
225 | 0 | data_size, |
226 | 0 | error ) != 1 ) |
227 | 0 | { |
228 | 0 | libcerror_error_set( |
229 | 0 | error, |
230 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
231 | 0 | LIBCERROR_RUNTIME_ERROR_SET_FAILED, |
232 | 0 | "%s: unable to set template data.", |
233 | 0 | function ); |
234 | |
|
235 | 0 | return( -1 ); |
236 | 0 | } |
237 | 0 | return( 1 ); |
238 | 0 | } |
239 | | |
240 | | /* Reads the template |
241 | | * Returns 1 if successful or -1 on error |
242 | | */ |
243 | | int libevtx_template_definition_read( |
244 | | libevtx_internal_template_definition_t *internal_template_definition, |
245 | | libevtx_io_handle_t *io_handle, |
246 | | libcerror_error_t **error ) |
247 | 0 | { |
248 | 0 | static char *function = "libevtx_template_definition_read"; |
249 | |
|
250 | 0 | if( internal_template_definition == NULL ) |
251 | 0 | { |
252 | 0 | libcerror_error_set( |
253 | 0 | error, |
254 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
255 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
256 | 0 | "%s: invalid template definition.", |
257 | 0 | function ); |
258 | |
|
259 | 0 | return( -1 ); |
260 | 0 | } |
261 | 0 | if( internal_template_definition->xml_document != NULL ) |
262 | 0 | { |
263 | 0 | libcerror_error_set( |
264 | 0 | error, |
265 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
266 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
267 | 0 | "%s: invalid template definition - XML document already set.", |
268 | 0 | function ); |
269 | |
|
270 | 0 | return( -1 ); |
271 | 0 | } |
272 | 0 | if( io_handle == NULL ) |
273 | 0 | { |
274 | 0 | libcerror_error_set( |
275 | 0 | error, |
276 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
277 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
278 | 0 | "%s: invalid IO handle.", |
279 | 0 | function ); |
280 | |
|
281 | 0 | return( -1 ); |
282 | 0 | } |
283 | 0 | if( libfwevt_template_set_ascii_codepage( |
284 | 0 | internal_template_definition->wevt_template, |
285 | 0 | io_handle->ascii_codepage, |
286 | 0 | error ) != 1 ) |
287 | 0 | { |
288 | 0 | libcerror_error_set( |
289 | 0 | error, |
290 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
291 | 0 | LIBCERROR_RUNTIME_ERROR_SET_FAILED, |
292 | 0 | "%s: unable to set ASCII codepage in template.", |
293 | 0 | function ); |
294 | |
|
295 | 0 | goto on_error; |
296 | 0 | } |
297 | 0 | if( libfwevt_xml_document_initialize( |
298 | 0 | &( internal_template_definition->xml_document ), |
299 | 0 | error ) != 1 ) |
300 | 0 | { |
301 | 0 | libcerror_error_set( |
302 | 0 | error, |
303 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
304 | 0 | LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, |
305 | 0 | "%s: unable to create XML document.", |
306 | 0 | function ); |
307 | |
|
308 | 0 | goto on_error; |
309 | 0 | } |
310 | 0 | if( libfwevt_template_read_xml_document( |
311 | 0 | internal_template_definition->wevt_template, |
312 | 0 | internal_template_definition->xml_document, |
313 | 0 | error ) != 1 ) |
314 | 0 | { |
315 | 0 | libcerror_error_set( |
316 | 0 | error, |
317 | 0 | LIBCERROR_ERROR_DOMAIN_IO, |
318 | 0 | LIBCERROR_IO_ERROR_READ_FAILED, |
319 | 0 | "%s: unable to read XML document from template.", |
320 | 0 | function ); |
321 | |
|
322 | 0 | goto on_error; |
323 | 0 | } |
324 | | #if defined( HAVE_DEBUG_OUTPUT ) |
325 | | if( libcnotify_verbose != 0 ) |
326 | | { |
327 | | libcnotify_printf( |
328 | | "%s: XML document:\n", |
329 | | function ); |
330 | | |
331 | | if( libfwevt_xml_document_debug_print( |
332 | | internal_template_definition->xml_document, |
333 | | error ) != 1 ) |
334 | | { |
335 | | libcerror_error_set( |
336 | | error, |
337 | | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
338 | | LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, |
339 | | "%s: unable to print XML document.", |
340 | | function ); |
341 | | |
342 | | goto on_error; |
343 | | } |
344 | | libcnotify_printf( |
345 | | "\n" ); |
346 | | } |
347 | | #endif |
348 | 0 | return( 1 ); |
349 | | |
350 | 0 | on_error: |
351 | 0 | if( internal_template_definition->xml_document != NULL ) |
352 | 0 | { |
353 | 0 | libfwevt_xml_document_free( |
354 | 0 | &( internal_template_definition->xml_document ), |
355 | 0 | NULL ); |
356 | 0 | } |
357 | 0 | return( -1 ); |
358 | 0 | } |
359 | | |