search for: le32toh

...in XP, 5 in Vista */ uint32_t unknown5; /* 0 */ uint32_t unknown6; /* 1 */ uint32_t offset; /* offset of root key record - 4KB */ @@ -303,7 +303,7 @@ hivex_open (const char *filename, int flags) } /* Check major version. */ - uint32_t major_ver = le32toh (h->hdr->major_ver); + int32_t major_ver = hivex_major_version (h); if (major_ver != 1) { fprintf (stderr, "hivex: %s: hive file major version %" PRIu32 " (expected 1)\n", @@ -312,6 +312,16 @@ hivex_open (const char *filename, int flags) goto er...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

...roject.org/wiki/MinGW http://www.annexia.org/fedora_mingw -------------- next part -------------- >From 14fa3081bdc88ef8c356bcbb1ea1e350d6452ee3 Mon Sep 17 00:00:00 2001 From: Richard Jones <rjones at redhat.com> Date: Tue, 19 Jan 2010 15:21:06 +0000 Subject: [PATCH 2/2] hivex: Add missing le32toh conversion around field access. This was missing. It only worked because we test on a little endian platform. --- hivex/hivex.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hivex/hivex.c b/hivex/hivex.c index 1f5c08b..d8e599b 100644 --- a/hivex/hivex.c +++ b/hive...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

This patch addresses a build failure in OS X. Running git-bisect on a straightforward build (bootstrap, autogen.sh, configure, make, make install) showed this as the "Bad commit:" 3e7c039799cddc45517350cc917eb10715f33fec The issue is that hivex-internal.h uses le32toh in a static inline function. In case `configure` doesn't find le32toh, byte_conversions.h defines it. But hivex-internal.h doesn't include the safety definition. OS X demonstrates this a problem. Neither endian.h nor byteswap.h are found with `configure` in OS X 10.8.5 (XCode 5), but th...

Hello, The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be

...16); if (values[i].len <= 4) /* store it inline */ memcpy (&vk->data_offset, values[i].value, values[i].len); @@ -985,9 +1005,9 @@ hivex_node_set_values (hive_h *h, hive_node_h node, vk->data_offset = htole32 (offs - 0x1000); } - if (name_len * 2 > le32toh (nk->max_vk_name_len)) - /* * 2 for UTF16-LE "reencoding" */ - nk->max_vk_name_len = htole32 (name_len * 2); + size_t utf16_len = use_utf16 ? recoded_name_len : recoded_name_len * 2; + if (utf16_len > le32toh (nk->max_vk_name_len)) + nk->max_vk_name_len...

...int used; > seg_len = block_len (h, blkoff, &used); > if (seg_len <= 4 || (seg_len & 3) != 0) { > - SET_ERRNO (ENOTSUP, > - "%s: block size %" PRIi32 " at 0x%zx, bad registry", > - filename, le32toh (block->seg_len), blkoff); > - goto error; > + if (is_root) { > + bad_root_block = 1; > + } else { > + DEBUG(2, As before, space before parens in function and macro calls. > @@ -408,7 +407,7 @@ _get_children (hive_h *h, hive_node_h blkof...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

...<= 4) /* store it inline */ > memcpy (&vk->data_offset, values[i].value, values[i].len); > @@ -985,9 +1004,9 @@ hivex_node_set_values (hive_h *h, hive_node_h node, > vk->data_offset = htole32 (offs - 0x1000); > } > > - if (name_len * 2 > le32toh (nk->max_vk_name_len)) > - /* * 2 for UTF16-LE "reencoding" */ > - nk->max_vk_name_len = htole32 (name_len * 2); > + size_t utf16_len = use_utf16 ? recoded_name_len : recoded_name_len * 2; * 2 - see above. > + if (utf16_len > le32toh (nk->max_vk_n...

...r *filename, int flags) int used; seg_len = block_len (h, blkoff, &used); if (seg_len <= 4 || (seg_len & 3) != 0) { - SET_ERRNO (ENOTSUP, - "%s: block size %" PRIi32 " at 0x%zx, bad registry", - filename, le32toh (block->seg_len), blkoff); - goto error; + if (is_root) { + bad_root_block = 1; + } else { + DEBUG(2, + "%s: block at 0x%zx (page 0x%zx) has invalid size %" + PRIi32", skipping\n", + filename,...

...only 32 chars are stored, name is probably truncated)\n" " root offset 0x%x + 0x1000\n" @@ -374,6 +380,7 @@ hivex_open (const char *filename, int flags) " checksum 0x%x (calculated 0x%x)\n", major_ver, le32toh (h->hdr->minor_ver), le32toh (h->hdr->sequence1), le32toh (h->hdr->sequence2), + h->last_modified, name ? name : "(conversion failed)", le32toh (h->hdr->offset), le32toh (h->hdr->blocks),...

...only 32 chars are stored, name is probably truncated)\n" " root offset 0x%x + 0x1000\n" @@ -374,6 +374,8 @@ hivex_open (const char *filename, int flags) " checksum 0x%x (calculated 0x%x)\n", major_ver, le32toh (h->hdr->minor_ver), le32toh (h->hdr->sequence1), le32toh (h->hdr->sequence2), + h->last_modified, + le64toh (h->hdr->last_modified), name ? name : "(conversion failed)", le32toh (h->hdr->of...

--- lib/hivex-internal.h | 8 +++++--- lib/utf16.c | 11 +++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 4135f58..64fd49a 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,11 +268,13 @@ extern size_t * _hivex_return_offset_list (offset_list *list); extern void _hivex_print_offset_list

...16); if (values[i].len <= 4) /* store it inline */ memcpy (&vk->data_offset, values[i].value, values[i].len); @@ -985,9 +1004,9 @@ hivex_node_set_values (hive_h *h, hive_node_h node, vk->data_offset = htole32 (offs - 0x1000); } - if (name_len * 2 > le32toh (nk->max_vk_name_len)) - /* * 2 for UTF16-LE "reencoding" */ - nk->max_vk_name_len = htole32 (name_len * 2); + size_t utf16_len = use_utf16 ? recoded_name_len : recoded_name_len * 2; + if (utf16_len > le32toh (nk->max_vk_name_len)) + nk->max_vk_name_len...

...only 32 chars are stored, name is probably truncated)\n" " root offset 0x%x + 0x1000\n" @@ -374,6 +414,8 @@ hivex_open (const char *filename, int flags) " checksum 0x%x (calculated 0x%x)\n", major_ver, le32toh (h->hdr->minor_ver), le32toh (h->hdr->sequence1), le32toh (h->hdr->sequence2), + h->last_modified, + le64toh (h->hdr->last_modified), name ? name : "(conversion failed)", le32toh (h->hdr->of...

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

..."(data 0x%zx, data len %zu)\n", + data_offset, len); + errno = EINVAL; + free (ret); + return NULL; + } + struct ntreg_db_record *db = + (struct ntreg_db_record *) ((char *) h->addr + data_offset); + size_t blocklist_offset = le32toh (db->blocklist_offset); + blocklist_offset += 0x1000; + size_t nr_blocks = le16toh (db->nr_blocks); + if (!IS_VALID_BLOCK (h, blocklist_offset)) { + if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_value: warning: blocklist is not a " +...

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid