search for: hivexsh

Whilst building hivex I'm seeing warnings/errors for the documentation: pod2html complaints: /usr/bin/pod2html: sh/hivexsh.pod: unknown pod directive 'encoding' in paragraph 1. ignoring. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<hivex(3)> in paragraph 8. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<virt-cat(1)> in paragraph 8. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<...

--- sh/hivexsh.pod | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sh/hivexsh.pod b/sh/hivexsh.pod index 7d7fc0a..8b10a6a 100644 --- a/sh/hivexsh.pod +++ b/sh/hivexsh.pod @@ -61,6 +61,13 @@ script, use: #!/usr/bin/hivexsh -f +=item B<-u> + +Use heuristics to tolerate certain levels of corru...

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and cha...

--- ruby/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ruby/Makefile.am b/ruby/Makefile.am index b6654d3..e78ab59 100644 --- a/ruby/Makefile.am +++ b/ruby/Makefile.am @@ -51,7 +51,7 @@ RUBY_SITEARCH := $(shell $(RUBY) -rrbconfig -e "puts RbConfig::CONFIG['sitearchd install: $(MKDIR_P) $(DESTDIR)$(RUBY_SITELIB) $(MKDIR_P)

...From: Jim Meyering <meyering at redhat.com> Date: Tue, 28 Aug 2012 11:28:40 +0200 Subject: [PATCH hivex 1/2] maint: avoid some syntax-check test failures * cfg.mk (_img_regexp): Exempt two VC'd image files from syntax check rules that look for trailing blanks and empty lines at EOF. * sh/hivexsh.pod: Remove trailing spaces. --- cfg.mk | 7 +++++-- sh/hivexsh.pod | 24 ++++++++++++------------ 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/cfg.mk b/cfg.mk index c1334fe..528f722 100644 --- a/cfg.mk +++ b/cfg.mk @@ -14,8 +14,11 @@ gnulib_dir = .gnulib exclude_file...

OS X lacks open_memstream, causing hivexsh to fail to build. This patch defines HAVE_HIVEXSH, setting the only condition to open_memstream existence. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- Makefile.am | 6 +++++- configure.ac | 4 ++++ 2 files changed, 9 insertions(+), 1 deletions(-) diff --git a/Makefile....

...x a6f5ae6..1c2aba8 100644 --- a/sh/Makefile.am +++ b/sh/Makefile.am @@ -71,7 +71,7 @@ $(top_builddir)/html/hivexget.1.html: hivexget.pod --css 'pod.css' \ --htmldir html \ --outfile html/hivexget.1.html \ - sh/hivexget.pod + $(abs_srcdir)/hivexget.pod $(top_builddir)/html/hivexsh.1.html: hivexsh.pod mkdir -p $(top_builddir)/html @@ -79,6 +79,6 @@ $(top_builddir)/html/hivexsh.1.html: hivexsh.pod --css 'pod.css' \ --htmldir html \ --outfile html/hivexsh.1.html \ - sh/hivexsh.pod + $(abs_srcdir)/hivexsh.pod CLEANFILES = $(man_MANS) diff --git a/xml...

This patch series improves, but does not complete, OS X support for hivex. There are several outstanding issues before hivexml and hivexsh can run: * hivexsh uses open_memstream, which doesn't exist in OS X as near as I can see. Unfortunately, I'm inexperienced with autoconf, so I'm not sure how to employ AC_CHECK_FUNCS([open_memstream]) to conditionally add 'sh' to the Makefile.am's SUBDIRS. * The check for...

This patch series adds support for some simple operations on hive files, and I've now tested and verified that those operations work correctly. All except for the last patch (12/12) are ready to be committed. The last patch is WIP. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any

...44 --- a/sh/Makefile.am +++ b/sh/Makefile.am @@ -51,7 +51,7 @@ hivexget.1: hivexget.pod -c "Windows Registry" \ --name "hivexget" \ --release "$(PACKAGE_NAME)-$(PACKAGE_VERSION)" \ - $< > $@-t; mv $@-t $@ + $< > $@-t && mv $@-t $@ hivexsh.1: hivexsh.pod $(POD2MAN) \ @@ -59,7 +59,7 @@ hivexsh.1: hivexsh.pod -c "Windows Registry" \ --name "hivexsh" \ --release "$(PACKAGE_NAME)-$(PACKAGE_VERSION)" \ - $< > $@-t; mv $@-t $@ + $< > $@-t && mv $@-t $@ noinst_DATA = \...

Put the "=back" to close the list only after the last element. --- regedit/hivexregedit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/regedit/hivexregedit b/regedit/hivexregedit index 02c382b..cd49063 100755 --- a/regedit/hivexregedit +++ b/regedit/hivexregedit @@ -248,8 +248,6 @@ You should only use this option for quick hacking and debugging of the hive

...read LGPL hivex full-write LGPL (according to .gnulib/modules/* License field which is what you should look at, *not* the comments at the top of each gnulib source file bizarrely). Therefore I think for the library we are OK. Just to complete the analysis, for the programs we are using: hivexsh c-ctype LGPLv2+ hivexsh xstrtol GPL The Makefiles are GPL, but they don't affect the library or the programs in any way. They constitute a separate program used to build the software. Rich. CC'd to Jim: This analysis is a pain, and gnulib-tool doesn't let you say "I wan...

From: Jim Meyering <meyering at redhat.com> * lib/hivex.c (hivex_node_set_value): Remove unnecessary test-before-free. --- lib/hivex.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index d042f4f..a72fa77 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -2748,8 +2748,7 @@ hivex_node_set_value (hive_h *h, hive_node_h node, leave_partial:

...didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints this message and exits. I've attached the verbose logs as requested This extract from the logs shows that the hivexsh complains content after file offset 0x77c000 is garbage hivex: badsys: trailing garbage at end of file (at 0x77c000, after 1849 p...

...--unsafe arguments respectively, and also be more forgiving when errors happen that we can recover from - as separate patches 4 & 5 Regards, Dawid Zamirski (5): add HIVEX_OPEN_UNSAFE flag. lib: change how hbin sections are read. lib: allow to walk registry with corrupted blocks hivexsh: add -u flag for HIVEX_OPEN_UNSAFE. hivexregedit: allow to pass HIVEX_OPEN_UNSAFE generator/generator.ml | 8 +++++ lib/handle.c | 68 +++++++++++++++++++++++++++++++++++++------ lib/hivex-internal.h | 1 + lib/node.c | 46 ++++++++++++++++++...

...This is inflexible and got really annoying as I was trying to explore these hive files in preparation for adding write support to hivex. The first patch implements a simple interactive shell which allows you to 'cd' around a hive and list out values and subkeys. For example: $ ./hivex/hivexsh SOFTWARE Welcome to hivexsh, the hivex interactive shell for examining Windows Registry binary hive files. Type: 'help' for help summary 'quit' to quit the shell SOFTWARE\> ls ATI Technologies Classes Clients Intel Microsoft ODBC Policies...

...oviding the SOFTWARE and SYSTEM hives. Firstly the SOFTWARE hive has an unusually large 'nk' node, which required me to increase one of the limits in hivex: https://github.com/libguestfs/hivex/commit/bec3f0bb632c4b84a1dfb73eb6333c2ba9834ffb The SYSTEM hive was even more interesting: $ hivexsh system Welcome to hivexsh, the hivex interactive shell for examining Windows Registry binary hive files. Type: 'help' for help summary 'quit' to quit the shell system\> ls ControlSet001 ControlSet002 LastKnownGoodRecovery MountedDevices Select...

Is there a reason why a previous version of hivex ignored this condition while more recent ones throw an error? I do have some hive files that are failing (I'm yet to validate if they are good or were corrupted some other way). I will do so and share my findings Thanks ~ Hari On 9/24/13 5:20 PM, "Richard W.M. Jones" <rjones@redhat.com> wrote: >On Tue, Sep 24, 2013 at

Le 19/11/2014 22:19, Richard W.M. Jones a écrit : > On Wed, Nov 19, 2014 at 10:05:53PM +0100, Nicolas Ecarnot wrote: >> Nov 19 21:54:52 serv-p2v-adm1 sshd[2727]: pam_unix(sshd:session): >> session opened for user root by (uid=0) >> Nov 19 21:54:53 serv-p2v-adm1 sshd[2725]: channel 2: open failed: >> connect failed: Connection refused >> Nov 19 21:54:53

I tried both hivex-1.2.5 and hivex-1.2.7, same result. The same software hive can be loaded using Windows regedit tool, and had no problem to access the "Classes" key. The other keys under Software (like Microsoft, Wow6432Node, etc.) are OK. Here is the hivexsh output with HIVEX_DEBUG=1 enabled: ======================================================================================================== hivex_open: successfully read Windows Registry hive file: pages: 5779 [sml: 4096, lge: 16384] blocks: 461619 [sml: 8, avg: 51, lge: 13752]...