search for: hivex_value_value

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid (db block 0x%zx, block list 0x%zx, data block 0x%zx)\ > - data_offset, bl...

...uot;db" */ + uint16_t nr_blocks; + uint32_t blocklist_offset; + uint32_t unknown1; +} __attribute__((__packed__)); + +struct ntreg_db_block { + int32_t seg_len; + char data[1]; +} __attribute__((__packed__)); + static uint32_t header_checksum (const hive_h *h) { @@ -1418,22 +1431,60 @@ hivex_value_value (hive_h *h, hive_value_h value, * instead. */ size_t blen = block_len (h, data_offset, NULL); - if (len > blen - 4 /* subtract 4 for block header */) { - if (h->msglvl >= 2) - fprintf (stderr, "hivex_value_value: warning: declared data length " -...

...hose structure seems to be identical to a value list. A "db" record contains information on the number of sub-blocks and a pointer to the list. It is referenced by the vk record. I came across this when comparing the contents of HKLM\SOFTWARE hives from Windows7 systems and finding that hivex_value_value would only give me identical first 12 bytes for certain records though the data size had changed. If one runs hivexsh with debug messages enabled, it gives a warning when listing these values, for example: SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate> lsval [...] hivex_value_value:...

..._offset; > + uint32_t unknown1; > +} __attribute__((__packed__)); > + > +struct ntreg_db_block { > + int32_t seg_len; > + char data[1]; > +} __attribute__((__packed__)); > + > static uint32_t > header_checksum (const hive_h *h) > { > @@ -1418,22 +1431,60 @@ hivex_value_value (hive_h *h, hive_value_h value, > * instead. > */ > size_t blen = block_len (h, data_offset, NULL); > - if (len > blen - 4 /* subtract 4 for block header */) { > - if (h->msglvl >= 2) > - fprintf (stderr, "hivex_value_value: warning: declared data...

...y: returning EFAULT because key length is too long (%zu, %zu)\n", + fprintf (stderr, "hivex_value_key: returning EFAULT" + " because key length is too long (%zu, %zu)\n", len, seg_len); errno = EFAULT; return NULL; @@ -1207,7 +1228,8 @@ hivex_value_value (hive_h *h, hive_value_h value, /* Arbitrarily limit the length that we will read. */ if (len > HIVEX_MAX_VALUE_LEN) { if (h->msglvl >= 2) - fprintf (stderr, "hivex_value_value: returning ERANGE because data length > HIVEX_MAX_VALUE_LEN (%zu > %d)\n", +...

...e Windows guest. *) > > + (* Find the 'Current' ControlSet. *) > + let get_current_cs root = > + let select = g#hivex_node_get_child root "Select" in > + let valueh = g#hivex_node_get_value select "Current" in > + let value = int_of_le32 (g#hivex_value_value valueh) in > + sprintf "ControlSet%03Ld" value in > + > let rec configure_firstboot () = > (match installer with > | None -> () > @@ -302,14 +309,8 @@ if errorlevel 3010 exit /b 0 > (* Update the SYSTEM hive. When this function is called the...

Greetings, I am suffering of several weird errors which show randomly and make me suspect some concurrency issue. Libguestfs version is 1.28.1, linux kernel 3.16, libvirt 1.2.9 and qemu 2.1. What I'm trying to do is comparing the disk state at two different point of a guest execution. Disk snapshots are taken through libvirt in different moments (I am aware of caching issue), from such

...x_value_list *> libguestfs: trace: hivex_value_key 4496744 guestfsd: main_loop: proc 357 (hivex_node_values) took 0.00 seconds guestfsd: main_loop: new request, len 0x30 libguestfs: trace: hivex_value_key = "CurrentVersion" libguestfs: trace: hivex_value_utf8 4496744 libguestfs: trace: hivex_value_value 4496744 guestfsd: main_loop: proc 359 (hivex_value_key) took 0.00 seconds guestfsd: main_loop: new request, len 0x30 libguestfs: trace: hivex_value_value = "6\x00.\x001\x00\x00\x00" libguestfs: trace: hivex_value_utf8 = "6.1" libguestfs: trace: hivex_value_key 4496792 guestfsd:...

...e Windows guest. *) > > + (* Find the 'Current' ControlSet. *) > + let get_current_cs root = > + let select = g#hivex_node_get_child root "Select" in > + let valueh = g#hivex_node_get_value select "Current" in > + let value = int_of_le32 (g#hivex_value_value valueh) in > + sprintf "ControlSet%03Ld" value in > + > let rec configure_firstboot () = > (match installer with > | None -> () > @@ -302,13 +309,7 @@ if errorlevel 3010 exit /b 0 > (* Update the SYSTEM hive. When this function is called the...

--- lib/value.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/value.c b/lib/value.c index c4e21ec..f222b41 100644 --- a/lib/value.c +++ b/lib/value.c @@ -334,7 +334,7 @@ hivex_value_value (hive_h *h, hive_value_h value, /* Arbitrarily limit the length that we will read. */ if (len > HIVEX_MAX_VALUE_LEN) { SET_ERRNO (ERANGE, "data length > HIVEX_MAX_VALUE_LEN (%zu > %d)", - len, HIVEX_MAX_SUBKEYS); + len, HIVEX_MAX_VALUE_LEN);...

Wait for driver installations fired by the PnP manager to complete before running firstboot scripts. The first patch is a minor refactoring to pave the way for the second patch. The latter contains the bulk of the changes as well as the description of the idea. Roman Kagan (2): v2v:windows: factor out getting CurrentControlSet v2v:windows: prevent conflicts with PnP on firstboot --- v1

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

...uot;{4d36e967-e325-11ce-bfc1-08002be10318}"] in + match strg_cls with + | None -> () + | Some strg_cls -> + let lfkey = "LowerFilters" in + let valueh = g#hivex_node_get_value strg_cls lfkey in + if valueh <> 0L then ( + let data = g#hivex_value_value valueh in + let filters = String.nsplit "\000" (Regedit.decode_utf16le data) in + let filters = List.filter ( + fun x -> x <> "prl_strg" && x <> "" + ) filters in + let filters = List.map ( +...

...; - - let root_node = g#hivex_root () in - - (* Find the 'Current' ControlSet. *) - let current_cs = - let select = g#hivex_node_get_child root_node "Select" in - let valueh = g#hivex_node_get_value select "Current" in - let value = int_of_le32 (g#hivex_value_value valueh) in - sprintf "ControlSet%03Ld" value in - - (* Add a new rhsrvany service to the system registry to execute firstboot. - * NB: All these edits are in the HKLM\SYSTEM hive. No other - * hive may be modified here. - *) - let regedits = [ - [ current_cs;...

v1 was here with much discussion: https://www.redhat.com/archives/libguestfs/2018-December/msg00048.html v2: - Fix the case where there are multiple interfaces. Note this does not preserve order correctly (see patch for comment on why that is a hard problem). - Preserve name servers. This patch is still for discussion only. I'd like to see what might be done to get this upstream

* Richard W.M. Jones: > ACK to this patch as it only affects the deprecated hivex_value_dword > and hivex_value_qword functions, making them a little bit more useful. I didn't see anything about those functions being "deprecated". What did I miss? Cheers, -Hilko

..."offset is not a valid block (0x%zx)\n", + data_offset); + errno = EFAULT; + return 0; + } + + if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_data_cell_offset: data_offset=%zx\n", data_offset); + + return data_offset; +} + char * hivex_value_value (hive_h *h, hive_value_h value, hive_type *t_rtn, size_t *len_rtn) -- 1.7.4.4

..."offset is not a valid block (0x%zx)\n", + data_offset); + errno = EFAULT; + return 0; + } + + if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_data_cell_offset: data_offset=%zx\n", data_offset); + + return data_offset; +} + char * hivex_value_value (hive_h *h, hive_value_h value, hive_type *t_rtn, size_t *len_rtn) -- 1.7.6.4

...if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_data_cell_offset: returning EFAULT because data " + "offset is not a valid block (0x%zx)\n", + data_offset); + errno = EFAULT; + return 0; + } + return data_offset; +} + char * hivex_value_value (hive_h *h, hive_value_h value, hive_type *t_rtn, size_t *len_rtn) -- 1.7.6

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18