search for: guestfs_hivex_value_value

This fixes v1 by checking the correct length field. I have tested this against Windows 10 and it works. Rich.

I wasn't able to test this patch yet, so I'm just going off the description in the bug and in an MSDN posting. Rich.

..._value_utf8"; added = (1, 19, 35); - style = RString (RPlainString, "databuf"), [Int64 "valueh"], []; - optional = Some "hivex"; - shortdesc = "return the data field from the (key, datatype, data) tuple"; - longdesc = "\ -This calls C<guestfs_hivex_value_value> (which returns the -data field from a hivex value tuple). It then assumes that -the field is a UTF-16LE string and converts the result to -UTF-8 (or if this is not possible, it returns an error). - -This is useful for reading strings out of the Windows registry. -However it is not foolproof be...

...ar gpt_prefix[] = "DMIO:ID:"; snprintf (system, len, "%s/system32/config/system", fs->windows_systemroot); @@ -493,9 +497,14 @@ check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs) type = guestfs_hivex_value_type (g, v); blob = guestfs_hivex_value_value (g, v, &len); - if (blob != NULL && type == 3 && len == 12) { + bool is_gpt = memcmp(blob, gpt_prefix, 8) == 0; + if (blob != NULL && type == 3 && (len == 12 || is_gpt)) { /* Try to map the blob to a known disk and partition. */ - d...

...;, fs->windows_systemroot); @@ -490,12 +494,18 @@ check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs) CLEANUP_FREE char *blob = NULL; char *device; int64_t type; + bool is_gpt; type = guestfs_hivex_value_type (g, v); blob = guestfs_hivex_value_value (g, v, &len); - if (blob != NULL && type == 3 && len == 12) { + is_gpt = memcmp (blob, gpt_prefix, 8) == 0; + if (blob != NULL && type == 3 && (len == 12 || is_gpt)) { /* Try to map the blob to a known disk and partition. */ - devic...

The existing mechanism was clunky, slow and used ~ 10 MB of local disk. Rich.

...ot;; > snprintf (system, len, "%s/system32/config/system", > fs->windows_systemroot); > > @@ -493,9 +497,14 @@ check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs) > > type = guestfs_hivex_value_type (g, v); > blob = guestfs_hivex_value_value (g, v, &len); > - if (blob != NULL && type == 3 && len == 12) { > + bool is_gpt = memcmp(blob, gpt_prefix, 8) == 0; > + if (blob != NULL && type == 3 && (len == 12 || is_gpt)) { > /* Try to map the blob to a known disk and part...

...;, fs->windows_systemroot); @@ -490,12 +494,18 @@ check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs) CLEANUP_FREE char *blob = NULL; char *device; int64_t type; + bool is_gpt; type = guestfs_hivex_value_type (g, v); blob = guestfs_hivex_value_value (g, v, &len); - if (blob != NULL && type == 3 && len == 12) { + is_gpt = memcmp (blob, gpt_prefix, 8) == 0; + if (blob != NULL && type == 3 && (len == 12 || is_gpt)) { /* Try to map the blob to a known disk and partition. */ - devic...

...t;%s/system32/config/system", > >              fs->windows_systemroot); > >   > > @@ -493,9 +497,14 @@ check_windows_system_registry (guestfs_h *g, > > struct inspect_fs *fs) > >   > >        type = guestfs_hivex_value_type (g, v); > >        blob = guestfs_hivex_value_value (g, v, &len); > > -      if (blob != NULL && type == 3 && len == 12) { > > +      bool is_gpt = memcmp(blob, gpt_prefix, 8) == 0; > > +      if (blob != NULL && type == 3 && (len == 12 || is_gpt)) { > >          /* Try to map the blob to a...

This adds most of the hivex APIs directly to the libguestfs API, so that you can read and write Windows Registry hive files from libguestfs without needing to download and upload hive files from the guest. This is analogous to how Augeas APIs are exposed already (guestfs_aug_*) Also, inspection is now done using the new APIs, which fixes the following bug:

This patch series changes a small part of the library to use __attribute__((cleanup(...))) to automatically free memory when pointers go out of the current scope. In general terms this seems to be a small win although you do have to use it carefully. For functions where you can completely get rid of the "exit code paths", it can simplify things. For a good example, see the

This fixes almost everything. Note that it adds an extra commit which fixes the whole utf8/iconv business. It's probably better to list what isn't fixed: (1) I didn't leave the osinfo code around because I'm still haven't looked too closely at virt-builder-repository. Can't we just fetch this code from the git history when we need it? (2) I didn't change the way

Various changes/fixes to use smaller stack frames. Rich.

...ath = guestfs_case_sensitive_path (g, system); if (!system_path) @@ -495,6 +492,7 @@ check_windows_system_registry (guestfs_h *g, struct inspect_fs *fs) char *device; int64_t type; bool is_gpt; + size_t len; type = guestfs_hivex_value_type (g, v); blob = guestfs_hivex_value_value (g, v, &len); diff --git a/src/osinfo.c b/src/osinfo.c index b1cfa09..4a4cbfc 100644 --- a/src/osinfo.c +++ b/src/osinfo.c @@ -229,9 +229,7 @@ static int read_os_node (guestfs_h *g, xmlXPathContextPtr xpathCtx, xmlNodePtr o static int read_osinfo_db_xml (guestfs_h *g, const char *filename) {...

v9 was here: https://www.redhat.com/archives/libguestfs/2017-July/msg00139.html This depends on these three series (the first two being single minor patches): https://www.redhat.com/archives/libguestfs/2017-July/msg00207.html https://www.redhat.com/archives/libguestfs/2017-July/msg00209.html https://www.redhat.com/archives/libguestfs/2017-July/msg00215.html There is no substantive change. I

This depends on the patch series "[PATCH 00/27] Reimplement many daemon APIs in OCaml." (https://www.redhat.com/archives/libguestfs/2017-July/msg00098.html) v8 was posted here: https://www.redhat.com/archives/libguestfs/2017-June/msg00274.html v9: - I split up the mega-patch into a more reviewable series of smaller, incremental patches. There are some other changes vs v8, but

v10: https://www.redhat.com/archives/libguestfs/2017-July/msg00245.html No actual change here, but I rebased and retested. Also this series now does not depend on any other patch series since everything else needed is upstream. Rich.

v6 was posted here: https://www.redhat.com/archives/libguestfs/2017-June/msg00103.html and this requires the utilities refactoring posted here: https://www.redhat.com/archives/libguestfs/2017-June/msg00169.html Inspection is now complete[*], although not very well tested. I'm intending to compare the output of many guests using old & new virt-inspector to see if I can find any

v5: https://www.redhat.com/archives/libguestfs/2017-June/msg00065.html Since v5, this now implements inspection almost completely for Linux and Windows guests. Rich.

v7 was: https://www.redhat.com/archives/libguestfs/2017-June/msg00169.html https://www.redhat.com/archives/libguestfs/2017-June/msg00184.html I believe this addresses all comments received so far. Also it now passes a test where I compared about 100 disk images processed with old and new virt-inspector binaries. The output is identical in all cases except one which is caused by a bug in blkid