search for: hivex_open_debug

[This email is either empty or too large to be displayed at this time]

...b/xml/hivexml.c @@ -95,7 +95,7 @@ main (int argc, char *argv[]) int open_flags = 0; int visit_flags = 0; - while ((c = getopt (argc, argv, "dk")) != EOF) { + while ((c = getopt (argc, argv, "dku")) != EOF) { switch (c) { case 'd': open_flags |= HIVEX_OPEN_DEBUG; @@ -103,6 +103,9 @@ main (int argc, char *argv[]) case 'k': visit_flags |= HIVEX_VISIT_SKIP_BAD; break; + case 'u': + open_flags |= HIVEX_OPEN_UNSAFE; + break; default: fprintf (stderr, "hivexml [-dk] regfile > output.xml\n")...

...children to not be freed properly? > > I know that if the return value of _hivex_get_children is -1, no free > is called; but from what I can see, -1 means there is nothing to be > freed/it’s been taken care of. > > I’ve attached the valgrind log together with the output of > HIVEX_OPEN_DEBUG, please let me know if there’s anything else I can > provide to make this easier. It seems like rather hivex_node_delete_child leaks the "blocks" array returned by _hivex_get_children every time. The patch should be easy, would you be able to give it a try to check whether it fixes...

The error message: hivex_close: do_hivex_close: you must call 'hivex-open' first to initialize the hivex handle This is the process flow: g = guestfs_create (); guestfs_add_drive_opts (g, diskFile,GUESTFS_ADD_DRIVE_OPTS_FORMAT, "raw",-1); guestfs_launch (g) char **roots = guestfs_inspect_os (g); guestfs_inspect_os returns NULL, guestfs_last_error(g) returns

.../handle.c @@ -31,6 +31,9 @@ #include <errno.h> #include <assert.h> +#include <iconv.h> +#include <pthread.h> + #ifdef HAVE_MMAP #include <sys/mman.h> #else @@ -62,6 +65,32 @@ header_checksum (const hive_h *h) #define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG) +iconv_t * +_hivex_get_iconv (hive_h *h, recode_type t) +{ + pthread_mutex_lock (&h->iconv_cache[t].mutex); + if (h->iconv_cache[t].handle == NULL) { + if (t == utf8_to_latin1) + h->iconv_cache[t].handle = iconv_open ("LATIN1", "UTF-8"); + else if (t...

...intf (stderr, "filetime_to_8601: Error running gmtime_r on timestamp (decimal hundreds of ns: %" PRIu64 ").\n", windows_ticks); + return -1; + } + strftime(buf, bufsize, "%FT%TZ", &time_tm); + return 0; +} + #define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG) +#define TIMESTAMP_BUF_LEN 32 hive_h * hivex_open (const char *filename, int flags) @@ -359,6 +348,15 @@ hivex_open (const char *filename, int flags) goto error; } + /* Last-modified time. */ + h->last_modified = (char *) calloc(1 + TIMESTAMP_BUF_LEN, sizeof(char)); + int ft_rc...

...sary to check return codes, unless they need to be recursive in which case use gl_recursive_lock_* instead. > #ifdef HAVE_MMAP > #include <sys/mman.h> > #else > @@ -62,6 +65,32 @@ header_checksum (const hive_h *h) > > #define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG) > > +iconv_t * > +_hivex_get_iconv (hive_h *h, recode_type t) > +{ > + pthread_mutex_lock (&h->iconv_cache[t].mutex); > + if (h->iconv_cache[t].handle == NULL) { > + if (t == utf8_to_latin1) > + h->iconv_cache[t].handle = iconv_open ("LATIN1&qu...

...intf (stderr, "filetime_to_8601: Error running gmtime_r on timestamp (decimal hundreds of ns: %" PRIu64 ").\n", windows_ticks); + return -1; + } + strftime(buf, bufsize, "%FT%TZ", &time_tm); + return 0; +} + #define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG) +#define TIMESTAMP_BUF_LEN 32 hive_h * hivex_open (const char *filename, int flags) @@ -359,6 +388,15 @@ hivex_open (const char *filename, int flags) goto error; } + /* Last-modified time. */ + h->last_modified = (char *) calloc(1 + TIMESTAMP_BUF_LEN, sizeof(char)); + int ft_rc...

...@ #include <sys/stat.h> #include <errno.h> #include <assert.h> +#include <iconv.h> +#include <glthread/lock.h> #ifdef HAVE_MMAP #include <sys/mman.h> @@ -62,6 +64,32 @@ header_checksum (const hive_h *h) #define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG) +iconv_t * +_hivex_get_iconv (hive_h *h, recode_type t) +{ + glthread_lock_lock (&h->iconv_cache[t].mutex); + if (h->iconv_cache[t].handle == NULL) { + if (t == utf8_to_latin1) + h->iconv_cache[t].handle = iconv_open ("LATIN1", "UTF-8"); + else if (t...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

...strncasecmp((a),(b),(n)) != 0) +#define STRPREFIX(a,b) (strncmp((a),(b),strlen((b))) == 0) + #endif /* GUESTFSD_DAEMON_H */ diff --git a/hivex/hivex.h b/hivex/hivex.h index 14bdcc5..be7feee 100644 --- a/hivex/hivex.h +++ b/hivex/hivex.h @@ -73,6 +73,16 @@ typedef enum hive_type hive_type; #define HIVEX_OPEN_DEBUG 2 #define HIVEX_OPEN_MSGLVL_MASK 3 +#define STREQ(a,b) (strcmp((a),(b)) == 0) +#define STRCASEEQ(a,b) (strcasecmp((a),(b)) == 0) +#define STRNEQ(a,b) (strcmp((a),(b)) != 0) +#define STRCASENEQ(a,b) (strcasecmp((a),(b)) != 0) +#define STREQLEN(a,b,n) (strncmp((a),(b),(n)) == 0) +#define ST...

This adds most of the hivex APIs directly to the libguestfs API, so that you can read and write Windows Registry hive files from libguestfs without needing to download and upload hive files from the guest. This is analogous to how Augeas APIs are exposed already (guestfs_aug_*) Also, inspection is now done using the new APIs, which fixes the following bug:

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.