diff --git a/trunk/threadsearch.cpp b/trunk/threadsearch.cpp index 72e499e..23a06d7 100644 --- a/trunk/threadsearch.cpp +++ b/trunk/threadsearch.cpp @@ -1,27 +1,79 @@ /******************************************************************************* * fred Copyright (c) 2011 by Gillen Daniel * * * * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor * * with special feautures useful during forensic analysis. * * * * This program is free software: you can redistribute it and/or modify it * * under the terms of the GNU General Public License as published by the Free * * Software Foundation, either version 3 of the License, or (at your option) * * any later version. * * * * This program is distributed in the hope that it will be useful, but WITHOUT * * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for * * more details. * * * * You should have received a copy of the GNU General Public License along with * * this program. If not, see . * *******************************************************************************/ #include "threadsearch.h" +#include + ThreadSearch::ThreadSearch(QObject *p_parent) : QThread(p_parent) { + this->hive_file=""; + this->h_hive=NULL; + this->keywords=QList(); + this->search_nodes=false; + this->search_keys=false; + this->search_values=false; + this->root_node=0; +} + +bool ThreadSearch::Search(QString registry_hive, + QList search_keywords, + bool search_node_names, + bool search_key_names, + bool search_key_values, + QString search_path) +{ + this->hive_file=registry_hive; + this->keywords=search_keywords; + this->search_nodes=search_node_names; + this->search_keys=search_key_names; + this->search_values=search_key_values; + + // Try to open hive + this->h_hive=hivex_open(this->hive_file.toAscii().constData(),0); + if(this->h_hive==NULL) return false; + + // Get root node + this->root_node=hivex_root(this->h_hive); + if(this->root_node==0) { + hivex_close(this->h_hive); + return false; + } + + // If a root path was specified, itearte to it + if(search_path!="\\") { + QStringList path_nodes=search_path.split("\\",QString::SkipEmptyParts); + int i; + for(i=0;iroot_node=hivex_node_get_child(this->h_hive, + this->root_node, + path_nodes.at(i).toAscii().constData()); + if(this->root_node==0) { + hivex_close(this->h_hive); + return false; + } + } + } + + this->start(); + return true; } void ThreadSearch::run() { } diff --git a/trunk/threadsearch.h b/trunk/threadsearch.h index 0e314ef..e64a35c 100644 --- a/trunk/threadsearch.h +++ b/trunk/threadsearch.h @@ -1,37 +1,59 @@ /******************************************************************************* * fred Copyright (c) 2011 by Gillen Daniel * * * * Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor * * with special feautures useful during forensic analysis. * * * * This program is free software: you can redistribute it and/or modify it * * under the terms of the GNU General Public License as published by the Free * * Software Foundation, either version 3 of the License, or (at your option) * * any later version. * * * * This program is distributed in the hope that it will be useful, but WITHOUT * * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for * * more details. * * * * You should have received a copy of the GNU General Public License along with * * this program. If not, see . * *******************************************************************************/ #ifndef THREADSEARCH_H #define THREADSEARCH_H #include #include +#include +#include + +#include class ThreadSearch : public QThread { Q_OBJECT public: ThreadSearch(QObject *p_parent=0); + bool Search(QString registry_hive, + QList search_keywords, + bool search_node_names, + bool search_key_names, + bool search_key_values, + QString search_path="\\"); + protected: void run(); + + private: + QString hive_file; + hive_h *h_hive; + QList keywords; + bool search_nodes; + bool search_keys; + bool search_values; + hive_node_h root_node; + + }; #endif // THREADSEARCH_H