From b17fed0255ebeda633d5da26117e81cb17a7355d Mon Sep 17 00:00:00 2001 From: Piotr Caban Date: Tue, 1 Aug 2023 14:00:46 +0200 Subject: [PATCH] winedump: Add support for decoding data stored in offset in regf files. --- tools/winedump/reg.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/tools/winedump/reg.c b/tools/winedump/reg.c index 338e37133e0..92ab3839de8 100644 --- a/tools/winedump/reg.c +++ b/tools/winedump/reg.c @@ -193,6 +193,7 @@ static BOOL dump_subkeys(unsigned int hive_off, unsigned int off) static BOOL dump_value(unsigned int hive_off, unsigned int off) { const void *data = NULL; + unsigned int data_size; const value_key *val; const char *name; @@ -219,9 +220,15 @@ static BOOL dump_value(unsigned int hive_off, unsigned int off) printf("@="); } - if (val->data_size) + data_size = val->data_size; + if (data_size & 0x80000000) { - data = PRD(hive_off + val->data_off + sizeof(unsigned int), val->data_size); + data = &val->data_off; + data_size &= ~0x80000000; + } + else if (data_size) + { + data = PRD(hive_off + val->data_off + sizeof(unsigned int), data_size); if (!data) return FALSE; } @@ -230,7 +237,7 @@ static BOOL dump_value(unsigned int hive_off, unsigned int off) { case REG_SZ: printf("%s", !data ? "" : - get_unicode_str((const WCHAR *)data, val->data_size / sizeof(WCHAR))); + get_unicode_str((const WCHAR *)data, data_size / sizeof(WCHAR))); break; default: printf("unhandled data type %d", val->data_type);