search for: d33c1d0

...s some garbage data between hbin section but the hive is still perfectly usable as long as the offsets stated in hbin headers are correct. --- lib/handle.c | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/lib/handle.c b/lib/handle.c index d33c1d0..42fd672 100644 --- a/lib/handle.c +++ b/lib/handle.c @@ -226,11 +226,30 @@ hivex_open (const char *filename, int flags) page->magic[1] != 'b' || page->magic[2] != 'i' || page->magic[3] != 'n') { - SET_ERRNO (ENOTSUP, -...

...fe mode that enables heuristics to handle corrupted hives. + +This may allow to read or write registry keys/values that appear intact in an +otherwise corrupted hive. Use at your own risk. + =back"; "close", (RErrDispose, [AHive]), diff --git a/lib/handle.c b/lib/handle.c index d33c1d0..a4982dd 100644 --- a/lib/handle.c +++ b/lib/handle.c @@ -83,6 +83,7 @@ hivex_open (const char *filename, int flags) DEBUG (2, "created handle %p", h); h->writable = !!(flags & HIVEX_OPEN_WRITE); + h->unsafe = !!(flags & HIVEX_OPEN_UNSAFE); h->filename = strdu...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at