Coverage Report

Created: 2025-09-05 06:58

/src/libevtx/libevtx/libevtx_template_definition.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Template definition functions
3
 *
4
 * Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>
5
 *
6
 * Refer to AUTHORS for acknowledgements.
7
 *
8
 * This program is free software: you can redistribute it and/or modify
9
 * it under the terms of the GNU Lesser General Public License as published by
10
 * the Free Software Foundation, either version 3 of the License, or
11
 * (at your option) any later version.
12
 *
13
 * This program is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16
 * GNU General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU Lesser General Public License
19
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
20
 */
21
22
#include <common.h>
23
#include <memory.h>
24
#include <types.h>
25
26
#include "libevtx_io_handle.h"
27
#include "libevtx_libcdata.h"
28
#include "libevtx_libcerror.h"
29
#include "libevtx_libcnotify.h"
30
#include "libevtx_libfwevt.h"
31
#include "libevtx_template_definition.h"
32
33
/* Creates a template definition
34
 * Make sure the value template_definition is referencing, is set to NULL
35
 * Returns 1 if successful or -1 on error
36
 */
37
int libevtx_template_definition_initialize(
38
     libevtx_template_definition_t **template_definition,
39
     libcerror_error_t **error )
40
0
{
41
0
  libevtx_internal_template_definition_t *internal_template_definition = NULL;
42
0
  static char *function                                                = "libevtx_template_definition_initialize";
43
44
0
  if( template_definition == NULL )
45
0
  {
46
0
    libcerror_error_set(
47
0
     error,
48
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
49
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
50
0
     "%s: invalid template definition.",
51
0
     function );
52
53
0
    return( -1 );
54
0
  }
55
0
  if( *template_definition != NULL )
56
0
  {
57
0
    libcerror_error_set(
58
0
     error,
59
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
60
0
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
61
0
     "%s: invalid template definition value already set.",
62
0
     function );
63
64
0
    return( -1 );
65
0
  }
66
0
  internal_template_definition = memory_allocate_structure(
67
0
                                  libevtx_internal_template_definition_t );
68
69
0
  if( internal_template_definition == NULL )
70
0
  {
71
0
    libcerror_error_set(
72
0
     error,
73
0
     LIBCERROR_ERROR_DOMAIN_MEMORY,
74
0
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
75
0
     "%s: unable to create template definition.",
76
0
     function );
77
78
0
    goto on_error;
79
0
  }
80
0
  if( memory_set(
81
0
       internal_template_definition,
82
0
       0,
83
0
       sizeof( libevtx_internal_template_definition_t ) ) == NULL )
84
0
  {
85
0
    libcerror_error_set(
86
0
     error,
87
0
     LIBCERROR_ERROR_DOMAIN_MEMORY,
88
0
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
89
0
     "%s: unable to clear template definition.",
90
0
     function );
91
92
0
    goto on_error;
93
0
  }
94
0
  if( libfwevt_template_initialize(
95
0
       &( internal_template_definition->wevt_template ),
96
0
       error ) != 1 )
97
0
  {
98
0
    libcerror_error_set(
99
0
     error,
100
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
101
0
     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
102
0
     "%s: unable to create WEVT template.",
103
0
     function );
104
105
0
    goto on_error;
106
0
  }
107
0
  *template_definition = (libevtx_template_definition_t *) internal_template_definition;
108
109
0
  return( 1 );
110
111
0
on_error:
112
0
  if( internal_template_definition != NULL )
113
0
  {
114
0
    memory_free(
115
0
     internal_template_definition );
116
0
  }
117
0
  return( -1 );
118
0
}
119
120
/* Frees a template definition
121
 * Returns 1 if successful or -1 on error
122
 */
123
int libevtx_template_definition_free(
124
     libevtx_template_definition_t **template_definition,
125
     libcerror_error_t **error )
126
0
{
127
0
  libevtx_internal_template_definition_t *internal_template_definition = NULL;
128
0
  static char *function                                                = "libevtx_template_definition_free";
129
0
  int result                                                           = 1;
130
131
0
  if( template_definition == NULL )
132
0
  {
133
0
    libcerror_error_set(
134
0
     error,
135
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
136
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
137
0
     "%s: invalid template.",
138
0
     function );
139
140
0
    return( -1 );
141
0
  }
142
0
  if( *template_definition != NULL )
143
0
  {
144
0
    internal_template_definition = (libevtx_internal_template_definition_t *) *template_definition;
145
0
    *template_definition         = NULL;
146
147
0
    if( libfwevt_template_free(
148
0
         &( internal_template_definition->wevt_template ),
149
0
         error ) != 1 )
150
0
    {
151
0
      libcerror_error_set(
152
0
       error,
153
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
154
0
       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
155
0
       "%s: unable to free WEVT template.",
156
0
       function );
157
158
0
      result = -1;
159
0
    }
160
0
    if( internal_template_definition->xml_document != NULL )
161
0
    {
162
0
      if( libfwevt_xml_document_free(
163
0
           &( internal_template_definition->xml_document ),
164
0
           error ) != 1 )
165
0
      {
166
0
        libcerror_error_set(
167
0
         error,
168
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
169
0
         LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
170
0
         "%s: unable to free XML document.",
171
0
         function );
172
173
0
        result = -1;
174
0
      }
175
0
    }
176
0
    memory_free(
177
0
     internal_template_definition );
178
0
  }
179
0
  return( result );
180
0
}
181
182
/* Sets the data
183
 * Returns 1 if successful or -1 on error
184
 */
185
int libevtx_template_definition_set_data(
186
     libevtx_template_definition_t *template_definition,
187
     const uint8_t *data,
188
     size_t data_size,
189
     uint32_t data_offset,
190
     libcerror_error_t **error )
191
0
{
192
0
  libevtx_internal_template_definition_t *internal_template_definition = NULL;
193
0
  static char *function                                                = "libevtx_template_definition_set_data";
194
195
0
  if( template_definition == NULL )
196
0
  {
197
0
    libcerror_error_set(
198
0
     error,
199
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
200
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
201
0
     "%s: invalid template definition.",
202
0
     function );
203
204
0
    return( -1 );
205
0
  }
206
0
  internal_template_definition = (libevtx_internal_template_definition_t *) template_definition;
207
208
0
  if( libfwevt_template_set_offset(
209
0
       internal_template_definition->wevt_template,
210
0
       data_offset,
211
0
       error ) != 1 )
212
0
  {
213
0
    libcerror_error_set(
214
0
     error,
215
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
216
0
     LIBCERROR_RUNTIME_ERROR_SET_FAILED,
217
0
     "%s: unable to set template offset.",
218
0
     function );
219
220
0
    return( -1 );
221
0
  }
222
0
  if( libfwevt_template_set_data(
223
0
       internal_template_definition->wevt_template,
224
0
       data,
225
0
       data_size,
226
0
       error ) != 1 )
227
0
  {
228
0
    libcerror_error_set(
229
0
     error,
230
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
231
0
     LIBCERROR_RUNTIME_ERROR_SET_FAILED,
232
0
     "%s: unable to set template data.",
233
0
     function );
234
235
0
    return( -1 );
236
0
  }
237
0
  return( 1 );
238
0
}
239
240
/* Reads the template
241
 * Returns 1 if successful or -1 on error
242
 */
243
int libevtx_template_definition_read(
244
     libevtx_internal_template_definition_t *internal_template_definition,
245
     libevtx_io_handle_t *io_handle,
246
     libcerror_error_t **error )
247
0
{
248
0
  static char *function = "libevtx_template_definition_read";
249
250
0
  if( internal_template_definition == NULL )
251
0
  {
252
0
    libcerror_error_set(
253
0
     error,
254
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
255
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
256
0
     "%s: invalid template definition.",
257
0
     function );
258
259
0
    return( -1 );
260
0
  }
261
0
  if( internal_template_definition->xml_document != NULL )
262
0
  {
263
0
    libcerror_error_set(
264
0
     error,
265
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
266
0
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
267
0
     "%s: invalid template definition - XML document already set.",
268
0
     function );
269
270
0
    return( -1 );
271
0
  }
272
0
  if( io_handle == NULL )
273
0
  {
274
0
    libcerror_error_set(
275
0
     error,
276
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
277
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
278
0
     "%s: invalid IO handle.",
279
0
     function );
280
281
0
    return( -1 );
282
0
  }
283
0
  if( libfwevt_template_set_ascii_codepage(
284
0
       internal_template_definition->wevt_template,
285
0
       io_handle->ascii_codepage,
286
0
       error ) != 1 )
287
0
  {
288
0
    libcerror_error_set(
289
0
     error,
290
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
291
0
     LIBCERROR_RUNTIME_ERROR_SET_FAILED,
292
0
     "%s: unable to set ASCII codepage in template.",
293
0
     function );
294
295
0
    goto on_error;
296
0
  }
297
0
  if( libfwevt_xml_document_initialize(
298
0
       &( internal_template_definition->xml_document ),
299
0
       error ) != 1 )
300
0
  {
301
0
    libcerror_error_set(
302
0
     error,
303
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
304
0
     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
305
0
     "%s: unable to create XML document.",
306
0
     function );
307
308
0
    goto on_error;
309
0
  }
310
0
  if( libfwevt_template_read_xml_document(
311
0
       internal_template_definition->wevt_template,
312
0
       internal_template_definition->xml_document,
313
0
       error ) != 1 )
314
0
  {
315
0
    libcerror_error_set(
316
0
     error,
317
0
     LIBCERROR_ERROR_DOMAIN_IO,
318
0
     LIBCERROR_IO_ERROR_READ_FAILED,
319
0
     "%s: unable to read XML document from template.",
320
0
     function );
321
322
0
    goto on_error;
323
0
  }
324
#if defined( HAVE_DEBUG_OUTPUT )
325
  if( libcnotify_verbose != 0 )
326
  {
327
    libcnotify_printf(
328
     "%s: XML document:\n",
329
     function );
330
331
    if( libfwevt_xml_document_debug_print(
332
         internal_template_definition->xml_document,
333
         error ) != 1 )
334
    {
335
      libcerror_error_set(
336
       error,
337
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
338
       LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
339
       "%s: unable to print XML document.",
340
       function );
341
342
      goto on_error;
343
    }
344
    libcnotify_printf(
345
     "\n" );
346
  }
347
#endif
348
0
  return( 1 );
349
350
0
on_error: 
351
0
  if( internal_template_definition->xml_document != NULL )
352
0
  {
353
0
    libfwevt_xml_document_free(
354
0
     &( internal_template_definition->xml_document ),
355
0
     NULL );
356
0
  }
357
0
  return( -1 );
358
0
}
359