search for: lsval

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid

...in_bytes_max (data, len); if (slen > len) len = slen; char *ret = windows_utf16_to_utf8 (data, len); slen is only used to increase length of data, but I think it should be decreasing it (to stop earlier). Example key where problem occurs: software\Microsoft\MediaPlayer\Preferences> lsval hivexsh: lsval: Invalid or incomplete multibyte or wide character "MyPlayLists"=software\Microsoft\MediaPlayer\Preferences> Same for LcnStartLocation key in HKLM\\SOFTWARE\\Microsoft\\Dfrg\\BootOptimizeFunction (it starts with 30 00 00 00 .. some garbage). Printing the key with value...

...FTWARE\> ls ATI Technologies Classes Clients Intel Microsoft ODBC Policies RegisteredApplications Sonic Wow6432Node SOFTWARE\> cd \Microsoft\Windows\TabletPC\TabSetup SOFTWARE\Microsoft\Windows\TabletPC\TabSetup> ls SOFTWARE\Microsoft\Windows\TabletPC\TabSetup> lsval "TabletSetup"=dword:00000000" SOFTWARE\Microsoft\Windows\TabletPC\TabSetup> cd .. SOFTWARE\Microsoft\Windows\TabletPC> ls Snipping Tool TabSetup The (later) write part will enhance this shell to allow hive modifications, but these patches do not contain that change y...

...finding that hivex_value_value would only give me identical first 12 bytes for certain records though the data size had changed. If one runs hivexsh with debug messages enabled, it gives a warning when listing these values, for example: SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate> lsval [...] hivex_value_value: warning: declared data length is longer than the block it is in (data 0x28b9b60, data len 115347, block len 16) "EncodedCtl"=hex(3):64,62,08,00,70,8b,8b,02,00,b2,00,00 --- lib/hivex.c | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file chan...

--- lib/hivex.c | 81 +++++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 66 insertions(+), 15 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index efc27f8..e3c1e05 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -208,6 +208,19 @@ struct ntreg_sk_record { char sec_desc[1]; /* security info follows */ } __attribute__((__packed__)); +struct