search for: hivex_root

Map the HIVEX_OPEN_UNSAFE flag into the libguestfs API and use it in various places. Rich.

...error."; + "value_value", (RLenTypeVal, [AHive; AValue "val"]), "return data length, data type and data of a value", "\ diff --git a/lib/hivex.c b/lib/hivex.c index 61177d3..d8ffa63 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -585,6 +585,30 @@ hivex_root (hive_h *h) return ret; } +size_t +hivex_node_struct_length (hive_h *h, hive_node_h node) +{ + if (!IS_VALID_BLOCK (h, node) || !BLOCK_ID_EQ (h, node, "nk")) { + errno = EINVAL; + return 0; + } + + struct ntreg_nk_record *nk = (struct ntreg_nk_record *) (h->addr + node);...

...BAD_CAST "name", BAD_CAST name)); + + ret = safe_print_string_attribute (h, writer_v, "name", "name_encoding", name); + if (ret) + fprintf (stderr, "Warning: node_start: safe_print_string_attribute failed, but we're continuing.\n"); if (node == hivex_root (h)) { XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "root", BAD_CAST "1")); @@ -227,7 +277,7 @@ node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) } } - return 0; + return ret; } static int @@ -242,13 +292,16 @@ static vo...

This adds most of the hivex APIs directly to the libguestfs API, so that you can read and write Windows Registry hive files from libguestfs without needing to download and upload hive files from the guest. This is analogous to how Augeas APIs are exposed already (guestfs_aug_*) Also, inspection is now done using the new APIs, which fixes the following bug:

...); - - (* Open the SYSTEM hive. *) - let systemroot = g#inspect_get_windows_systemroot root in - let filename = sprintf "%s/system32/config/SYSTEM" systemroot in - let filename = g#case_sensitive_path filename in - g#hivex_open ~write:true filename; - - let root_node = g#hivex_root () in - - (* Find the 'Current' ControlSet. *) - let current_cs = - let select = g#hivex_node_get_child root_node "Select" in - let valueh = g#hivex_node_get_value select "Current" in - let value = int_of_le32 (g#hivex_value_value valueh) in - s...

A very miscellaneous set of cleanups to how we handle the Windows registry in virt-v2v, firstboot, and inspection code. This should all be straightforward non-controversial refactoring. Some highlights: - Add a new mllib Registry module containing various utility functions that are currently scattered all around. - Only compute the software/system hive paths once during inspection, and

...l/hivexml.c @@ -204,6 +204,10 @@ node_start (hive_h *h, void *writer_v, hive_node_h node, const char *name) XML_CHECK (xmlTextWriterStartElement, (writer, BAD_CAST "node")); XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "name", BAD_CAST name)); + if (node == hivex_root (h)) { + XML_CHECK (xmlTextWriterWriteAttribute, (writer, BAD_CAST "root", BAD_CAST "1")); + } + last_modified = hivex_node_timestamp (h, node); if (last_modified >= 0) { timebuf = filetime_to_8601 (last_modified); -- 1.7.6

...ectly via libguestfs which is more efficient. There are also some test programs here written in Python: https://github.com/libguestfs/hivex/tree/master/python/t Using hivex from Python is no different from using it from C, so just follow any C examples and mentally map them into Python, eg: hivex_root(h) ===> h.root Here is the C API documentation: http://libguestfs.org/hivex.3.html Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux...

Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- generator/generator.ml | 6 ++++++ lib/hivex.c | 6 ++++++ xml/hivexml.c | 9 +++++++++ 3 files changed, 21 insertions(+), 0 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index fc7b483..9e53f4e 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -159,6 +159,12

...ot; + struct hive_h { char *filename; int fd; diff --git a/lib/node.c b/lib/node.c index ed72b51..5090dbe 100644 --- a/lib/node.c +++ b/lib/node.c @@ -34,7 +34,6 @@ #include "hivex.h" #include "hivex-internal.h" -#include "byte_conversions.h" hive_node_h hivex_root (hive_h *h) diff --git a/lib/utf16.c b/lib/utf16.c index d0f2e45..844715c 100644 --- a/lib/utf16.c +++ b/lib/utf16.c @@ -27,7 +27,6 @@ #include "hivex.h" #include "hivex-internal.h" -#include "byte_conversions.h" char * _hivex_windows_utf16_to_utf8 (/* const */...

Greetings, I am suffering of several weird errors which show randomly and make me suspect some concurrency issue. Libguestfs version is 1.28.1, linux kernel 3.16, libvirt 1.2.9 and qemu 2.1. What I'm trying to do is comparing the disk state at two different point of a guest execution. Disk snapshots are taken through libvirt in different moments (I am aware of caching issue), from such

...loop: new request, len 0x5c hivex: hivex_open: successfully read Windows Registry hive file: pages: 8593 [sml: 4096, lge: 16384] blocks: 712962 [sml: 8, avg: 53, lge: 16352] blocks used: 697410 bytes used: 36983920 libguestfs: trace: hivex_open = 0 libguestfs: trace: hivex_root guestfsd: main_loop: proc 350 (hivex_open) took 0.15 seconds guestfsd: main_loop: new request, len 0x28 guestfsd: main_loop: proc 352 (hivex_root) took 0.00 seconds libguestfs: trace: hivex_root = 4128 libguestfs: trace: hivex_node_get_child 4128 "Microsoft" guestfsd: main_loop: new reque...

...[["upload"; "$srcdir/../data/minimal"; "/hivex_open"]; + [["upload"; "$datadir/minimal"; "/hivex_open"]; ["hivex_open"; "/hivex_open"; ""; ""; "false"]; ["hivex_root"]; (* in this hive, it returns 0x1020 *) ["hivex_node_name"; "0x1020"]; @@ -10856,11 +10856,11 @@ See also: C<guestfs_hivex_value_utf8>." }; optional = Some "hivex"; tests = [ InitScratchFS, Always, TestRun ( - [["...

...t_modified = hivex_node_mtime (h, node); + if (h->msglvl >= 2) + fprintf(stderr, "hivex__visit_node: last_modified: %s\n", last_modified ? last_modified : "NULL" ); if (!name) return skip_bad ? 0 : -1; + + /* Report extra for hive's root node. */ + if (node == hivex_root (h)) { + //Produce mtime for hive, not present node + if (vtor->node_mtime && vtor->node_mtime (h, opaque, node, h->last_modified) == -1) + goto error; + } + if (vtor->node_start && vtor->node_start (h, opaque, node, name) == -1) goto error; + i...

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18

...is longer than the block it is in " + "(data 0x%zx, data len %zu, block len %zu)\n", data_offset, len, blen); len = blen - 4; } @@ -1502,7 +1527,9 @@ hivex_visit (hive_h *h, const struct hivex_visitor *visitor, size_t len, return hivex_visit_node (h, hivex_root (h), visitor, len, opaque, flags); } -static int hivex__visit_node (hive_h *h, hive_node_h node, const struct hivex_visitor *vtor, char *unvisited, void *opaque, int flags); +static int hivex__visit_node (hive_h *h, hive_node_h node, + const struct hivex_visitor *vtor, + char *unv...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

...nTypeVal -> pr " VALUE rv = rb_hash_new ();\n"; pr " rb_hash_aset (rv, ID2SYM (rb_intern (\"len\")), INT2NUM (len));\n"; diff --git a/lib/hivex.c b/lib/hivex.c index 4b9fcf0..04ceed3 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -585,6 +585,30 @@ hivex_root (hive_h *h) return ret; } +size_t +hivex_node_struct_length (hive_h *h, hive_node_h node) +{ + if (!IS_VALID_BLOCK (h, node) || !BLOCK_ID_EQ (h, node, "nk")) { + errno = EINVAL; + return 0; + } + + struct ntreg_nk_record *nk = (struct ntreg_nk_record *) (h->addr + node);...

...[["upload"; "$srcdir/../data/minimal"; "/hivex_open"]; + [["upload"; "$datadir/minimal"; "/hivex_open"]; ["hivex_open"; "/hivex_open"; ""; ""; "false"]; ["hivex_root"]; (* in this hive, it returns 0x1020 *) ["hivex_node_name"; "0x1020"]; @@ -10844,11 +10850,11 @@ See also: C<guestfs_hivex_value_utf8>." }; optional = Some "hivex"; tests = [ InitScratchFS, Always, TestRun ( - [["...

...[["upload"; "$srcdir/../data/minimal"; "/hivex_open"]; + [["upload"; "$datadir/minimal"; "/hivex_open"]; ["hivex_open"; "/hivex_open"; ""; ""; "false"]; ["hivex_root"]; (* in this hive, it returns 0x1020 *) ["hivex_node_name"; "0x1020"]; @@ -11029,11 +11035,11 @@ See also: C<guestfs_hivex_value_utf8>." }; optional = Some "hivex"; tests = [ InitScratchFS, Always, TestRun ( - [["...