search for: hbin

On Wed, Feb 15, 2017 at 02:28:41PM -0500, Dawid Zamirski wrote: > Correct, however there's also no guarantee that seeking by 4k in > "garbage" data would not land you in registry data that happens to > evaluate to "hbin" as well. That's why I put "hbin" offset validation > check couple of lines below to make sure that the "hbin" we found by > searching is a proper one. The offset check I'm referring to is: > > /* get "stated" hbin offset from header */ > s...

On Wed, Feb 15, 2017 at 01:48:29PM -0500, Dawid Zamirski wrote: > On Wed, 2017-02-15 at 16:54 +0000, Richard W.M. Jones wrote: > > On Tue, Feb 14, 2017 at 12:05:20PM -0500, Dawid Zamirski wrote: > > > * hivex_open: when looping over hbin sections (aka pages), handle a > > >   case where following hbin section may not begin at exactly at the > > > end > > >   of previous one. If this happens, scan the page section until > > > next > > >   one is found and validate it by checking declared...

...0, Richard W.M. Jones wrote: > On Wed, Feb 15, 2017 at 01:48:29PM -0500, Dawid Zamirski wrote: > > On Wed, 2017-02-15 at 16:54 +0000, Richard W.M. Jones wrote: > > > On Tue, Feb 14, 2017 at 12:05:20PM -0500, Dawid Zamirski wrote: > > > > * hivex_open: when looping over hbin sections (aka pages), > > > > handle a > > > >   case where following hbin section may not begin at exactly at > > > > the > > > > end > > > >   of previous one. If this happens, scan the page section until > > > > next > &g...

...: > > On Wed, Feb 15, 2017 at 02:28:41PM -0500, Dawid Zamirski wrote: > > > Correct, however there's also no guarantee that seeking by 4k in > > > "garbage" data would not land you in registry data that happens > > > to > > > evaluate to "hbin" as well. That's why I put "hbin" offset > > > validation > > > check couple of lines below to make sure that the "hbin" we found > > > by > > > searching is a proper one. The offset check I'm referring to is: > > > >...

On Tue, Feb 14, 2017 at 12:05:20PM -0500, Dawid Zamirski wrote: > * hivex_open: when looping over hbin sections (aka pages), handle a > case where following hbin section may not begin at exactly at the end > of previous one. If this happens, scan the page section until next > one is found and validate it by checking declared offset with actual > one - if they match, all is good a...

...:14 +0000, Richard W.M. Jones wrote: > On Wed, Feb 15, 2017 at 02:28:41PM -0500, Dawid Zamirski wrote: > > Correct, however there's also no guarantee that seeking by 4k in > > "garbage" data would not land you in registry data that happens to > > evaluate to "hbin" as well. That's why I put "hbin" offset > > validation > > check couple of lines below to make sure that the "hbin" we found > > by > > searching is a proper one. The offset check I'm referring to is: > > > > /* get "stated...

...Feb 15, 2017 at 02:28:41PM -0500, Dawid Zamirski wrote: > > > > Correct, however there's also no guarantee that seeking by 4k in > > > > "garbage" data would not land you in registry data that happens > > > > to > > > > evaluate to "hbin" as well. That's why I put "hbin" offset > > > > validation > > > > check couple of lines below to make sure that the "hbin" we found > > > > by > > > > searching is a proper one. The offset check I'm referring to is:...

* hivex_open: when looping over hbin sections (aka pages), handle a case where following hbin section may not begin at exactly at the end of previous one. If this happens, scan the page section until next one is found and validate it by checking declared offset with actual one - if they match, all is good and we can safely mov...

* hivex_open: when looping over hbin sections (aka pages), handle a case where following hbin section may not begin at exactly at the end of previous one. If this happens, scan the page section until next one is found and validate it by checking declared offset with actual one - if they match, all is good and we can safely mov...

* hivex_open: when looping over hbin sections (aka pages), handle a case where following hbin section may not begin at exactly at the end of previous one. If this happens, scan the page section until next one is found and validate it by checking declared offset with actual one - if they match, all is good and we can safely mov...

On Wed, 2017-02-15 at 16:54 +0000, Richard W.M. Jones wrote: > On Tue, Feb 14, 2017 at 12:05:20PM -0500, Dawid Zamirski wrote: > > * hivex_open: when looping over hbin sections (aka pages), handle a > >   case where following hbin section may not begin at exactly at the > > end > >   of previous one. If this happens, scan the page section until > > next > >   one is found and validate it by checking declared offset with > > act...

...caller might be looking at keys that are perfectly readable/writable (e.g. to identify Windows version from HKLM/Software/Microsoft/Windows NT/CurrentVersion) and other "corrupted" and irrelevant keys might prevent one from doing so. Regards, Dawid Dawid Zamirski (2): lib: change how hbin sections are read. lib: allow to walk registry with corrupted blocks lib/handle.c | 52 +++++++++++++++++++++++++++++++++++++++++++--------- lib/node.c | 11 +++++------ 2 files changed, 48 insertions(+), 15 deletions(-) -- 2.9.3

...bug statements * do not depend on bad_root_block variable, instead report error and exit if root block is corrupted * handle the missed case where check_child_is_nk_block was still returning instead of skipping faulty block with debug message Regards, Dawid Zamirski (2): lib: change how hbin sections are read. lib: allow to walk registry with corrupted blocks lib/handle.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++--------- lib/node.c | 21 ++++++++++++--------- 2 files changed, 58 insertions(+), 18 deletions(-) -- 2.9.3

...rupted" and irrelevant keys might prevent one from doing so. Changes in v3: * rebase on current master * fix GCC7 -Wunsafe-loop-optimizations warning by incrementing the "off" variable by 1 rather than 0x1000, the latter was assuming "garbage" data in between "hbins" would be aligned on 4096 bytes which does not have to be true and GCC7 is correct. Regards, Dawid Zamirski (2): lib: change how hbin sections are read. lib: allow to walk registry with corrupted blocks lib/handle.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++--------- lib/...

On Wed, Feb 15, 2017 at 10:29:41PM +0000, Richard W.M. Jones wrote: > Yes, or even how about this (not tried it): > > while (off <= h->endpages - 0x1000) { > ... > } In fact this doesn't work either :-( I'll have another look at this tomorrow morning. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and

On Wed, 2017-02-15 at 22:35 +0000, Richard W.M. Jones wrote: > On Wed, Feb 15, 2017 at 10:29:41PM +0000, Richard W.M. Jones wrote: > > Yes, or even how about this (not tried it): > > > > while (off <= h->endpages - 0x1000) { > >   ... > > } > > In fact this doesn't work either :-( > > I'll have another look at this tomorrow morning.

On Wed, Feb 15, 2017 at 10:59:33PM +0000, Richard W.M. Jones wrote: > > OK, I ended up turning the warning off. It appears from the > info file that the warning is about GCC not being able to make > an optimization, not a bug in the code. > > However I do have a more substantial problem with the patch. > By checking the offset against h->endpages, we're using an

On Thu, 2017-02-16 at 08:43 +0000, Richard W.M. Jones wrote: > On Wed, Feb 15, 2017 at 10:59:33PM +0000, Richard W.M. Jones wrote: > > > > OK, I ended up turning the warning off.  It appears from the > > info file that the warning is about GCC not being able to make > > an optimization, not a bug in the code. > > > > However I do have a more substantial

OK, I ended up turning the warning off. It appears from the info file that the warning is about GCC not being able to make an optimization, not a bug in the code. However I do have a more substantial problem with the patch. By checking the offset against h->endpages, we're using an untrusted field supplied to us by the hive, which means that a crafted hive could cause us to walk through

...from last year, so I hope my problem is not too stupid. I would like to plot some data using hexagonal binning. Currently, I am doing the following: library(hexbin) data<-scan("input.dat", what = list('numeric', 'numeric')) x<-unlist(data[1]) y<-unlist(data[2]) hbin<-hexbin(x, y) plot(hbin) That does get me a hexgonal bin plot, so far, so good. My problem now is twofold: 1) Some of my data points have really high values in x and y, and I would like to exclude them. First idea was to set xbnds and ybnds parameters for hexbin like this. hbin<-hexbin(x...