search for: authroot

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid

...om Windows7 systems and finding that hivex_value_value would only give me identical first 12 bytes for certain records though the data size had changed. If one runs hivexsh with debug messages enabled, it gives a warning when listing these values, for example: SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate> lsval [...] hivex_value_value: warning: declared data length is longer than the block it is in (data 0x28b9b60, data len 115347, block len 16) "EncodedCtl"=hex(3):64,62,08,00,70,8b,8b,02,00,b2,00,00 --- lib/hivex.c | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++--...

--- lib/hivex.c | 81 +++++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 66 insertions(+), 15 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index efc27f8..e3c1e05 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -208,6 +208,19 @@ struct ntreg_sk_record { char sec_desc[1]; /* security info follows */ } __attribute__((__packed__)); +struct