Skip to content

Commit

Permalink
fix(amcache): install date is optional and should be treated as such
Browse files Browse the repository at this point in the history
  • Loading branch information
alexkornitzer committed Jul 11, 2024
1 parent 99661e0 commit 21ab8c6
Showing 1 changed file with 3 additions and 8 deletions.
11 changes: 3 additions & 8 deletions src/file/hve/amcache.rs
Original file line number Diff line number Diff line change
Expand Up @@ -79,17 +79,12 @@ impl super::Parser {
let program_id = key.key_name.clone();
let program_name = string_value_from_key(&key, "Name")?
.ok_or(anyhow!("Could not get Name for program {}", key.key_name))?;
let install_date = string_value_from_key(&key, "InstallDate")?.ok_or(anyhow!(
"Could not get InstallDate for program {}",
program_id
))?;
let version = string_value_from_key(&key, "Version")?
.ok_or(anyhow!("Could not get Version for program {}", program_id))?;

let install_date = if !install_date.is_empty() {
Some(win_reg_str_ts_to_date_time(install_date.as_str())?)
} else {
None
let install_date = match string_value_from_key(&key, "InstallDate")?.as_deref() {
Some("") | None => None,
Some(v) => Some(win_reg_str_ts_to_date_time(v)?),
};

let root_directory_path = string_value_from_key(&key, "RootDirPath")?;
Expand Down

0 comments on commit 21ab8c6

Please sign in to comment.