search for: hivex_value_string

On Wednesday, 9 August 2017 19:23:39 CEST Richard W.M. Jones wrote: > hivex has a function hivex_value_string. We were not calling it under > the mistaken belief that because hivex implements this using iconv, > the function wouldn't work inside the daemon. Instead we > reimplemented the functionality in the library. > > This commit deprecates hivex_value_utf8 and removes the library...

On Tue, Sep 12, 2017 at 06:42:11PM +0200, Pino Toscano wrote: > On Wednesday, 9 August 2017 19:23:39 CEST Richard W.M. Jones wrote: > > hivex has a function hivex_value_string. We were not calling it under > > the mistaken belief that because hivex implements this using iconv, > > the function wouldn't work inside the daemon. Instead we > > reimplemented the functionality in the library. > > > > This commit deprecates hivex_value_utf8...

hivex has a function hivex_value_string. We were not calling it under the mistaken belief that because hivex implements this using iconv, the function wouldn't work inside the daemon. Instead we reimplemented the functionality in the library. This commit deprecates hivex_value_utf8 and removes the library side code. It replaces i...

This adds most of the hivex APIs directly to the libguestfs API, so that you can read and write Windows Registry hive files from libguestfs without needing to download and upload hive files from the guest. This is analogous to how Augeas APIs are exposed already (guestfs_aug_*) Also, inspection is now done using the new APIs, which fixes the following bug:

It seems newer versions of VMware Tools for Windows can be uninstalled also when the guest does not run on VMware anymore. Hence, attempt to uninstall them during a conversion, reusing the same code already used to uninstall Parallel Tools. This was tested with the following Windows guests: - Windows 2008r2 - Windows 2012r2 - Windows 2016 - Windows 7 - Windows 8 - Windows 10 Pino Toscano (2):

...mmands pretty_name matchfn extra_uninstall_string = let uninsts = ref [] in Registry.with_hive_readonly g inspect.i_windows_software_hive @@ -146,25 +148,25 @@ let convert (g : G.guestfs) inspect source output rcaps = raise Not_found; let dispname = g#hivex_value_string valueh in - if String.find dispname "Parallels Tools" = -1 && - String.find dispname "Virtuozzo Tools" = -1 then + if not (matchfn dispname) then raise Not_found; let uninstval = "Unins...

--- lib/value.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/lib/value.c b/lib/value.c index db6396f..c4e21ec 100644 --- a/lib/value.c +++ b/lib/value.c @@ -462,7 +462,27 @@ hivex_value_string (hive_h *h, hive_value_h value) return ret; } -/* http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx */ +/* Even though + * http://msdn.microsoft.com/en-us/library/windows/desktop/ms724884.aspx + * and + * http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx + * cl...

...rallels Tools *) + let prltools_rex = PCRE.compile "(Parallels|Virtuozzo) Tools" in let prltools_uninsts = let uninsts = ref [] in @@ -146,8 +147,7 @@ let convert (g : G.guestfs) inspect source output rcaps = raise Not_found; let dispname = g#hivex_value_string valueh in - if not (Str.string_match (Str.regexp ".*\\(Parallels\\|Virtuozzo\\) Tools.*") - dispname 0) then + if not (PCRE.matches prltools_rex dispname) then raise Not_found; let unins...

* Richard W.M. Jones: > ACK to this patch as it only affects the deprecated hivex_value_dword > and hivex_value_qword functions, making them a little bit more useful. I didn't see anything about those functions being "deprecated". What did I miss? Cheers, -Hilko

(renaming subject as I am partially getting off-topic) On Sunday 10 August 2014 16:26:07 Richard W.M. Jones wrote: > > The next issue I see now is about the value_value function. This is > > briefly documented as: "return data length, data type and data of a > > value". > > > > For Perl, Python and OCaml, this is not true. A tuple is returned > >

...= List.filter ((<>) "") path in + (if is_absolute then "/" else "") ^ String.concat "/" path + +(* Note that we cannot use iconv here because inside the appliance + * all i18n databases are deleted. For the same reason we cannot + * use functions like hivex_value_string, as they also use iconv + * internally. + * + * https://en.wikipedia.org/wiki/UTF-16 + * Also inspired by functions in glib's glib/gutf8.c + *) +let rec utf16le_to_utf8 instr = + (* If the length is odd and the last character is ASCII NUL, just + * drop that. (If it's not ASCII NUL, the...

The first three patches were posted previously: https://www.redhat.com/archives/libguestfs/2010-July/msg00082.html The last two patches in this series change guestfish -i to use this new code. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to

These three patches (two were previously posted) can do simple operating system inspection in C. Example of use: ><fs> add-ro rhel55.img ><fs> run ><fs> inspect-os /dev/VolGroup00/LogVol00 ><fs> inspect-get-type /dev/VolGroup00/LogVol00 linux ><fs> inspect-get-distro /dev/VolGroup00/LogVol00 rhel ><fs> inspect-get-arch

Previously discussed here: https://www.redhat.com/archives/libguestfs/2010-August/msg00002.html -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://et.redhat.com/~rjones/virt-df/

...urn _hivex_windows_latin1_to_utf8 (vk->name, len); + return _hivex_recode (h, latin1_to_utf8, vk->name, len, NULL); } else { - return _hivex_windows_utf16_to_utf8 (vk->name, len); + return _hivex_recode (h, utf16le_to_utf8, vk->name, len, NULL); } } @@ -471,7 +471,7 @@ hivex_value_string (hive_h *h, hive_value_h value) if (slen < len) len = slen; - char *ret = _hivex_windows_utf16_to_utf8 (data, len); + char *ret = _hivex_recode (h, utf16le_to_utf8, data, len, NULL); free (data); if (ret == NULL) return NULL; @@ -538,7 +538,7 @@ hivex_value_multiple_string...

Some of the data in names and string values were being unsafely printed, causing some types of XML processors to fail (e.g. Python's Expat). This patch checks for printability of each character and outputs base64 with an encoding attribute for unsafe data. --- xml/hivexml.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++-------- 1 files changed, 64 insertions(+), 11 deletions(-)

...t;name, len); > + return _hivex_recode (h, latin1_to_utf8, vk->name, len, NULL); > } else { > - return _hivex_windows_utf16_to_utf8 (vk->name, len); > + return _hivex_recode (h, utf16le_to_utf8, vk->name, len, NULL); > } > } > > @@ -471,7 +471,7 @@ hivex_value_string (hive_h *h, hive_value_h value) > if (slen < len) > len = slen; > > - char *ret = _hivex_windows_utf16_to_utf8 (data, len); > + char *ret = _hivex_recode (h, utf16le_to_utf8, data, len, NULL); > free (data); > if (ret == NULL) > return NULL; > @@...

...urn _hivex_windows_latin1_to_utf8 (vk->name, len); + return _hivex_recode (h, latin1_to_utf8, vk->name, len, NULL); } else { - return _hivex_windows_utf16_to_utf8 (vk->name, len); + return _hivex_recode (h, utf16le_to_utf8, vk->name, len, NULL); } } @@ -471,7 +471,7 @@ hivex_value_string (hive_h *h, hive_value_h value) if (slen < len) len = slen; - char *ret = _hivex_windows_utf16_to_utf8 (data, len); + char *ret = _hivex_recode (h, utf16le_to_utf8, data, len, NULL); free (data); if (ret == NULL) return NULL; @@ -538,7 +538,7 @@ hivex_value_multiple_string...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

This patch is just for discussion. There are still a couple of issues that I'm trying to fix. One is that all of the test guests I have, even ones with static IPs, have multiple interfaces, some using DHCP, so the conditions for adding the Powershell script don't kick in. This makes testing very awkward. However a bigger issue is that I think the premise is wrong. In some registries