similar to: [PATCH 0/3] hivex: Improve OS X support

Hello all, I've been testing hivexml in OS X, and came across an inconsistency in building. Some while back, I hit a snag with iconv in OS X, where basically this would happen when a hive of any sophistication (greater than hivex/images/small) was processed: >$ xml/hivexml images/large >test.xml >dyld: lazy symbol binding failed: Symbol not found: _iconv_open > Referenced from:

This patch addresses a build failure in OS X. Running git-bisect on a straightforward build (bootstrap, autogen.sh, configure, make, make install) showed this as the "Bad commit:" 3e7c039799cddc45517350cc917eb10715f33fec The issue is that hivex-internal.h uses le32toh in a static inline function. In case `configure` doesn't find le32toh, byte_conversions.h defines it. But

Hi, libhivex seems to do a great job at parsing hives most of the time, but there are some issues with a few registry keys. These can be worked around in the application that uses libhivex, but I think it'd be better if libhivex handled these itself. 1. UTF16 string in REG_SZ that has garbage after the \0\0 There is code in hivex.c to handle this already but I think it has a typo: /*

Put the "=back" to close the list only after the last element. --- regedit/hivexregedit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/regedit/hivexregedit b/regedit/hivexregedit index 02c382b..cd49063 100755 --- a/regedit/hivexregedit +++ b/regedit/hivexregedit @@ -248,8 +248,6 @@ You should only use this option for quick hacking and debugging of the hive

Whilst building hivex I'm seeing warnings/errors for the documentation: pod2html complaints: /usr/bin/pod2html: sh/hivexsh.pod: unknown pod directive 'encoding' in paragraph 1. ignoring. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<hivex(3)> in paragraph 8. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<virt-cat(1)> in paragraph 8. /usr/bin/pod2html:

--- ruby/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ruby/Makefile.am b/ruby/Makefile.am index b6654d3..e78ab59 100644 --- a/ruby/Makefile.am +++ b/ruby/Makefile.am @@ -51,7 +51,7 @@ RUBY_SITEARCH := $(shell $(RUBY) -rrbconfig -e "puts RbConfig::CONFIG['sitearchd install: $(MKDIR_P) $(DESTDIR)$(RUBY_SITELIB) $(MKDIR_P)

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

From: Jim Meyering <meyering at redhat.com> * lib/hivex.c (hivex_node_set_value): Remove unnecessary test-before-free. --- lib/hivex.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index d042f4f..a72fa77 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -2748,8 +2748,7 @@ hivex_node_set_value (hive_h *h, hive_node_h node, leave_partial:

hivexml on OS X was failing with a symbol-not-found error while dynamically linking. Adding iconv to libhivex fixes the issue and lets OS X process 'images/large' with hivexml. It took careful iconv autotool additions to get compilation working in Fedora as well, but these two lines build and run on OS X 10.6 and 10.8, and Fedora 17 and 18. Unfortunately, a separate issue is revealed

OS X lacks open_memstream, causing hivexsh to fail to build. This patch defines HAVE_HIVEXSH, setting the only condition to open_memstream existence. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- Makefile.am | 6 +++++- configure.ac | 4 ++++ 2 files changed, 9 insertions(+), 1 deletions(-) diff --git a/Makefile.am b/Makefile.am index 8d69c55..dbab38a 100644 ---

I'm trying to build hivex 1.2.7 on Ubuntu 10.04, and get the following failure: Making all in xml make[2]: Entering directory `/opt/sandbox/src/hivex/hivex-1.2.7/xml' CC hivexml-hivexml.o CCLD hivexml hivexml-hivexml.o: In function `main': /opt/sandbox/src/hivex/hivex-1.2.7/xml/hivexml.c:86: undefined reference to `rpl_getopt'

Hi As my cross platform registry editor (FRED available from https://www.pinguin.lu (sorry for advertising but I couldn't resist ;-))) is evolving, I recently added write support to it. While under Linux everything worked nice, the Windblows build didn't. It seems that Windows opens files by default in text mode (O_TEXT) which is a problem. The attached patch adds the O_BINARY flag to

This changeset adds byte run reporters for node and value metadata in the hivexml program. This location reporting required several new ABI functions, which required new ABI return types. One benefit to the byte run functions is additional sanity checks, which have revealed new data or parsing errors when run on M57 patents images. An example error: Image: Charlie, 2009-12-11, available at

On Fri, Nov 26, 2010 at 10:03:05AM -0800, Yandell, Henri wrote: > We?re looking into using Hivex and came across something odd. While > the license of hivex.c is LGPL 2.1, it appears to require the GPL > 3.0 licensed gnulib package for a few minor functions ( full_read, > full_write and c_toupper ). There are also a few GPL 3.0 build > files. It has always been our intention to

(Resending since my message from 2 days ago didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints

Is there a reason why a previous version of hivex ignored this condition while more recent ones throw an error? I do have some hive files that are failing (I'm yet to validate if they are good or were corrupted some other way). I will do so and share my findings Thanks ~ Hari On 9/24/13 5:20 PM, "Richard W.M. Jones" <rjones@redhat.com> wrote: >On Tue, Sep 24, 2013 at

Whilst cleaning up the lintian reports in preparation for the Debian/Ubuntu hivex package one of the issues is: E: libhivex-perl: binary-or-shlib-defines-rpath ./usr/lib/perl/5.10.1/auto/Win/Hivex/Hivex.so /tmp/buildd/hivex-1.2.1/perl/../lib/.libs I've temporarily dealt with this by using chrpath in the build and a rule to delete the RPATH from "auto/Win/Hivex/Hivex.so". I wonder

Building against multiple versions of Python is a lot of fun as it is. Add autoconf/automake/libtool (and possible distribution-specific stuff) to the mix and things get really interesting: On Debian and Ubuntu, building against python 3.3 requires an extra include path as documented in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692387>. As discussed in

Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- generator/generator.ml | 6 ++++++ lib/hivex.c | 6 ++++++ xml/hivexml.c | 9 +++++++++ 3 files changed, 21 insertions(+), 0 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index fc7b483..9e53f4e 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -159,6 +159,12

--- configure.ac | 2 +- images/Makefile.am | 5 +++-- lib/Makefile.am | 14 +++++++------- ocaml/Makefile.am | 3 ++- ocaml/t/hivex_300_fold.ml | 3 +-- python/run-python-tests | 25 ------------------------- python/run-python-tests.in | 25 +++++++++++++++++++++++++ 7 files changed, 39 insertions(+), 38 deletions(-) delete mode