search for: msglvl

...filename, le32toh (block->seg_len), blkoff); errno = ENOTSUP; goto error; @@ -586,7 +588,8 @@ hivex_node_name (hive_h *h, hive_node_h node) size_t seg_len = block_len (h, node, NULL); if (sizeof (struct ntreg_nk_record) + len - 1 > seg_len) { if (h->msglvl >= 2) - fprintf (stderr, "hivex_node_name: returning EFAULT because node name is too long (%zu, %zu)\n", + fprintf (stderr, "hivex_node_name: returning EFAULT because node name" + " is too long (%zu, %zu)\n", len, seg_len); errno...

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid (db block 0x%zx, block list 0x%zx, data block 0x%zx)\ > - data_offset, blocklist_offset, subblock_offset); > + data...

...e__((__packed__)); + static uint32_t header_checksum (const hive_h *h) { @@ -1418,22 +1431,60 @@ hivex_value_value (hive_h *h, hive_value_h value, * instead. */ size_t blen = block_len (h, data_offset, NULL); - if (len > blen - 4 /* subtract 4 for block header */) { - if (h->msglvl >= 2) - fprintf (stderr, "hivex_value_value: warning: declared data length " - "is longer than the block it is in " - "(data 0x%zx, data len %zu, block len %zu)\n", - data_offset, len, blen); - len = blen - 4; - -...

..._h *h, hive_value_h value, hive_type *t, size_t *len) return 0; } +hive_value_h +hivex_value_data_cell_offset (hive_h *h, hive_value_h value, size_t *len) +{ + if (!IS_VALID_BLOCK (h, value) || !BLOCK_ID_EQ (h, value, "vk")) { + errno = EINVAL; + return 0; + } + + if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_data_cell_offset: value=0x%zx\n", value); + struct ntreg_vk_record *vk = (struct ntreg_vk_record *) (h->addr + value); + + size_t data_len; + int is_inline; + + data_len = le32toh (vk->data_len); + is_inline = !!(data_len & 0x8000...

..._h *h, hive_value_h value, hive_type *t, size_t *len) return 0; } +hive_value_h +hivex_value_data_cell_offset (hive_h *h, hive_value_h value, size_t *len) +{ + if (!IS_VALID_BLOCK (h, value) || !BLOCK_ID_EQ (h, value, "vk")) { + errno = EINVAL; + return 0; + } + + if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_data_cell_offset: value=0x%zx\n", value); + struct ntreg_vk_record *vk = (struct ntreg_vk_record *) (h->addr + value); + + size_t data_len; + int is_inline; + + data_len = le32toh (vk->data_len); + is_inline = !!(data_len & 0x8000...

...t; header_checksum (const hive_h *h) > { > @@ -1418,22 +1431,60 @@ hivex_value_value (hive_h *h, hive_value_h value, > * instead. > */ > size_t blen = block_len (h, data_offset, NULL); > - if (len > blen - 4 /* subtract 4 for block header */) { > - if (h->msglvl >= 2) > - fprintf (stderr, "hivex_value_value: warning: declared data length " > - "is longer than the block it is in " > - "(data 0x%zx, data len %zu, block len %zu)\n", > - data_offset, len, blen); > -...

...e__((__packed__)); + static uint32_t header_checksum (const hive_h *h) { @@ -1418,22 +1431,70 @@ hivex_value_value (hive_h *h, hive_value_h value, * instead. */ size_t blen = block_len (h, data_offset, NULL); - if (len > blen - 4 /* subtract 4 for block header */) { - if (h->msglvl >= 2) - fprintf (stderr, "hivex_value_value: warning: declared data length " - "is longer than the block it is in " - "(data 0x%zx, data len %zu, block len %zu)\n", - data_offset, len, blen); - len = blen - 4; - -...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

...enerator.ml index 31478cd..f1aa799 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -695,6 +695,46 @@ extern \"C\" { /* NOTE: This API is documented in the man page hivex(3). */ /* Hive handle. */ +struct hive_h { + char *filename; + int fd; + size_t size; + int msglvl; + int writable; + + /* Registry file, memory mapped if read-only, or malloc'd if writing. */ + union { + char *addr; + struct ntreg_header *hdr; + }; + + /* Use a bitmap to store which file offsets are valid (point to a + * used block). We only need to store 1 bit per 32 bits of...

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

...rupt registry files. */ - /* - fprintf (stderr, "hivex: %s: ignoring trailing garbage at end of file (at %zu, after %zu pages)\n", - filename, off, h->pages); - */ + /* NB: This error is seemingly common in uncorrupt registry files. */ + if (h->msglvl >= 2) + fprintf (stderr, "hivex: %s: ignoring trailing garbage at end of file (at %zu, after %zu pages)\n", + filename, off, h->pages); Break; http://git.annexia.org/?p=hivex.git;a=commitdiff;h=5439842dc591accbf620a5f76dd6f04ad4d5c971 In your experien...

Hi I'm just posting this here in case someone is interested in building hivex on Windows (mingw32). The attached patch allows building the lib but not the tools (hivexsh etc..) as there are some more problems to solve. In short terms, this patch replaces file i/o functions and mmap(), munmap() with their win32api pendants. cu -- Unix _IS_ user friendly - it's just selective about

...amp;time_tm) == NULL) { + fprintf (stderr, "filetime_to_8601: Error running gmtime_r on timestamp (decimal hundreds of ns: %" PRIu64 ").\n", windows_ticks); + return -1; + } + strftime(buf, bufsize, "%FT%TZ", &time_tm); + return 0; +} + #define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG) +#define TIMESTAMP_BUF_LEN 32 hive_h * hivex_open (const char *filename, int flags) @@ -359,6 +388,15 @@ hivex_open (const char *filename, int flags) goto error; } + /* Last-modified time. */ + h->last_modified = (char *) calloc(1 + TIME...

--- lib/hivex.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index 13d7556..8a774de 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -543,6 +543,9 @@ hivex_close (hive_h *h) free (h->filename); free (h); + if (h->msglvl >= 1) + fprintf (stderr, "hivex_close\n"); + return r; } -- 1.7.2.1

...->addr + node); + size_t name_len = le16toh (nk->name_len); + /* -1 to avoid double-counting the first name character */ + size_t ret = name_len + sizeof (struct ntreg_nk_record) - 1; + int used; + size_t seg_len = block_len (h, node, &used); + if (ret > seg_len) { + if (h->msglvl >= 2) + fprintf (stderr, "hivex_node_struct_length: returning EFAULT because" + " node name is too long (%zu, %zu)\n", name_len, seg_len); + errno = EFAULT; + return 0; + } + return ret; +} + char * hivex_node_name (hive_h *h, hive_node_h node) {...

Am 29.03.16 um 13:57 schrieb Marcelo Ricardo Leitner: > Em 29-03-2016 03:46, G?tz Reinicke - IT Koordinator escreveu: >> Am 28.03.16 um 16:23 schrieb Marcelo Ricardo Leitner: >>> Em 28-03-2016 06:27, G?tz Reinicke escreveu: >>>> Hi, >>>> >>>> may be someone has an idea: >>>> >>>> We have three supermicron servers with

...= 1; + } else { + DEBUG(2, + "%s: block at 0x%zx (page 0x%zx) has invalid size %" + PRIi32", skipping\n", + filename, blkoff, off, le32toh (block->seg_len)); + break; + } } if (h->msglvl >= 2) { diff --git a/lib/node.c b/lib/node.c index 822c250..35c0731 100644 --- a/lib/node.c +++ b/lib/node.c @@ -343,11 +343,10 @@ _hivex_get_children (hive_h *h, hive_node_h node, */ size_t nr_children = _hivex_get_offset_list_length (&children); if (nr_subkeys_in_nk != nr_childre...

..._OPEN_UNSAFE); h->filename = strdup (filename); if (h->filename == NULL) goto error; diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 26f4964..9a497ed 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -41,6 +41,7 @@ struct hive_h { size_t size; int msglvl; /* 1 = verbose, 2 or 3 = debug */ int writable; + int unsafe; /* Registry file, memory mapped if read-only, or malloc'd if writing. */ union { -- 2.9.3

.../* > - fprintf (stderr, "hivex: %s: ignoring trailing garbage at end of file (at %zu, after %zu pages)\n", > - filename, off, h->pages); > - */ > + /* NB: This error is seemingly common in uncorrupt registry files. */ > + if (h->msglvl >= 2) > + fprintf (stderr, "hivex: %s: ignoring trailing garbage at end of file (at %zu, after %zu pages)\n", > + filename, off, h->pages); > Break; > > http://git.annexia.org/?p=hivex.git;a=commitdiff;h=5439842dc591accbf620a5f76dd6f04ad...

...eturn 0; + } else { + if (len) + *len = data_len + 4; /* Include 4 header length bytes */ + } + + size_t data_offset = le32toh (vk->data_offset); + data_offset += 0x1000; /* Add 0x1000 because everything's off by 4KiB */ + if (!IS_VALID_BLOCK (h, data_offset)) { + if (h->msglvl >= 2) + fprintf (stderr, "hivex_value_data_cell_offset: returning EFAULT because data " + "offset is not a valid block (0x%zx)\n", + data_offset); + errno = EFAULT; + return 0; + } + return data_offset; +} + char * hivex_value_value...