search for: hivex_open_unsafe

...ot;Enable writes to the hive"; + 8, "UNSAFE", "Enable heuristics to allow read/write of corrupted hives"; ] (* The API calls. *) @@ -145,6 +146,13 @@ Open the hive for writing. If omitted, the hive is read-only. See L<hivex(3)/WRITING TO HIVE FILES>. +=item HIVEX_OPEN_UNSAFE + +Open the hive in unsafe mode that enables heuristics to handle corrupted hives. + +This may allow to read or write registry keys/values that appear intact in an +otherwise corrupted hive. Use at your own risk. + =back"; "close", (RErrDispose, [AHive]), diff --git a/lib/handl...

...opt (argc, argv, "dku")) != EOF) { switch (c) { case 'd': open_flags |= HIVEX_OPEN_DEBUG; @@ -103,6 +103,9 @@ main (int argc, char *argv[]) case 'k': visit_flags |= HIVEX_VISIT_SKIP_BAD; break; + case 'u': + open_flags |= HIVEX_OPEN_UNSAFE; + break; default: fprintf (stderr, "hivexml [-dk] regfile > output.xml\n"); exit (EXIT_FAILURE); diff --git a/xml/hivexml.pod b/xml/hivexml.pod index 257257c..afab80b 100644 --- a/xml/hivexml.pod +++ b/xml/hivexml.pod @@ -29,6 +29,13 @@ bug report. Keep going...

Map the HIVEX_OPEN_UNSAFE flag into the libguestfs API and use it in various places. Rich.

...the caller might be looking at keys that are perfectly readable/writable (e.g. to identify Windows version from HKLM/Software/Microsoft/Windows NT/CurrentVersion) and other "corrupted" and irrelevant keys might prevent one from doing so. Changes in v4: * rebase on current master * add HIVEX_OPEN_UNSAFE flag to be used as a guard to enable changes made in these series. This is because heuristic approach is not guaranteed to be always accurate/safe nor is tolerating corrupted blocks when traversing nodes. It's better to have this behavior optional. * make the "hbin" while...

On Friday, 17 February 2017 10:24:58 CET Richard W.M. Jones wrote: > Map the HIVEX_OPEN_UNSAFE flag into the libguestfs API and use it > in various places. The series LGTM. Should virt-win-reg in display/export mode use the unsafe mode as well? Thanks, -- Pino Toscano