search for: node_get_child

Good afternoon, I am working with the hivex python bindings and having trouble with an assertion failure. The code I run is based on the blog post from 11/28/10 and is: import hivex h = hivex.Hivex("ntuser.dat") r = h.root() key = h.node_get_child(r) The assert failure happens when I call any of the "node" functions, even "node_name()". The error message I get each time is: python: hivex-py.c:52: get_handle: Assertion 'obj' failed When I print r (h.root() result), I get a long integer "4128". (Wh...

...e node name is always plain ASCII, so no conversion * to UTF-8 is necessary. However we do need to nul-terminate * the string. */ I think hivex should convert the node names from CP1252 (or is it ISO-8859-1?) to UTF-8. Workaround: I do the CP1252 -> UTF8 conversion myself for now 3. node_get_child is slow Documentation issue, it should say that using node_get_child is slow (because registry doesn't have an index, and you do a linear search). Workaround: I create a map of node names to children of a node, a lookup in that is faster than using node_get_child repeatedly 4. hivexml output...

...ion >= '3': + import codecs + def b(x): + return codecs.encode(x) +else: + def b(x): + return x + srcdir = os.environ["srcdir"] if not srcdir: srcdir = "." @@ -32,27 +40,27 @@ assert root h.node_add_child (root, "B") -b = h.node_get_child (root, "B") -assert b +B = h.node_get_child (root, "B") +assert B values = [ { "key": "Key1", "t": 3, "value": "ABC" }, { "key": "Key2", "t": 3, "value": "DEF" } ] -...

.../tc_200_write.rb +++ b/ruby/tests/tc_200_write.rb @@ -23,12 +23,12 @@ class TestWrite < MiniTest::Unit::TestCase refute_nil (h) root = h.root() - assert (root) + refute_nil (root) h.node_add_child(root, "A") h.node_add_child(root, "B") b = h.node_get_child(root, "B") - assert (b) + refute_nil (b) values = [ { :key => "Key1", :type => 3, :value => "ABC" }, diff --git a/ruby/tests/tc_210_setvalue.rb b/ruby/tests/tc_210_setvalue.rb index 62ffd99..736b073 100644 --- a/ruby/tests/tc_210_se...

Hi, I have been working on a Python application that uses hivex. Meanwhile I have encountered some Python bindings issues which could be fixed. The next issue I see now is about the value_value function. This is briefly documented as: "return data length, data type and data of a value". For Perl, Python and OCaml, this is not true. A tuple is returned for both without the length

...ndows.pm @@ -217,24 +217,29 @@ sub _add_viostor_to_registry my $h = Win::Hivex->open ($tmpdir . "/system", write => 1) or die "open system hive: $!"; + # Get the 'Current' ControlSet. This is normally 001, but not always. + my $select = $h->node_get_child($h->root(), 'Select'); + my $current_cs = $h->node_get_value($select, 'Current'); + $current_cs = sprintf("ControlSet%03i", $h->value_dword($current_cs)); + # Make the changes. - my $regedits = ' + my $regedits = <<REGEDITS; ; Edits to...

...be created that is more pythonic (read: easier to use)? I mean, right now you have to use this (with some patches[0][1], also available at git[2]): import hivex from hivex.hive_types import * h = hivex.Hivex("system", write=True) ccs_name = "ControlSet001" ccs = h.node_get_child(h.root(), ccs_name) services = h.node_get_child(ccs, "Services") svc_viostor = h.node_get_child(services, "viostor") start_id = h.node_get_value(svc_viostor, "Start") #node_type, node_value = h.value_value(start_id) dword_value = h.value_dword(start_id) if node_v...

Hallo, I working on GUI interface for users to manipulate Windows Registry. For that I choose to use really excellent library hivex3. Just now I'm performing same test to see, if everything is saved correctly. Most of things work really well, but there is problem with saving some values and his types. Description of problem: For saving values is used function : node_set_values or

...y $h = Win::Hivex->open($sw_local, write => 1) + or die "open hive $sw_local: $!"; + + # Find the node \Microsoft\Windows\CurrentVersion + my $node = $h->root(); + foreach ('Microsoft', 'Windows', 'CurrentVersion') { + $node = $h->node_get_child($node, $_); + } + + # Update DevicePath, but leave everything else as is + my @new; + my $append = ';%SystemRoot%\Drivers\VirtIO'; + foreach my $v ($h->node_values($node)) { + my $key = $h->value_key($v); + my ($type, $data) = $h->value_value($v); + +...

...+ +srcdir = os.environ.get("srcdir") +if not srcdir: + srcdir = "." + +h = hivex.Hivex ("%s/../images/minimal" % srcdir, + write = True) +assert h + +root = h.root () +assert root + +h.node_add_child (root, "ModerateValueParent") + +mvp = h.node_get_child (root, "ModerateValueParent") +assert mvp + +moderate_value = "0123456789ABCDEF" + +values = [ + { "key": "3Bytes", "t": 3, "value": moderate_value[:3] }, + { "key": "16Bytes", "t": 3, "value":...

...xt", "hivex")) +require 'hivex' + +class TestRLenValue < Test::Unit::TestCase + def test_RLenValue + h = Hivex::open("../images/rlenvalue_test_hive", {}) + assert_not_nil (h) + + root = h.root () + assert_not_nil (root) + + moderate_value_node = h.node_get_child (root, "ModerateValueParent") + assert_not_nil (moderate_value_node) + + moderate_value_value = h.node_get_value (moderate_value_node, "33Bytes") + + r = h.value_data_cell_offset (moderate_value_value) + assert_equal (r[:len], 37) + assert_equal (r[:off], 8712) +...

--- python/t/120-rlenvalue.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/t/120-rlenvalue.py b/python/t/120-rlenvalue.py index ebc48f5..a9b2129 100644 --- a/python/t/120-rlenvalue.py +++ b/python/t/120-rlenvalue.py @@ -38,5 +38,5 @@ moderate_value_node = h.node_get_child (root, "ModerateValueParent") moderate_value_value = h.node_get_value (moderate_value_node, "33Bytes") r = h.value_data_cell_offset (moderate_value_value) -assert r[0] == 37L -assert r[1] == 8712L +assert r[0] == 37 +assert r[1] == 8712 -- 1.8.5.2

...eturned + * length and offset for this value cell should be 37 bytes, position + * 8712. + *) + +open Unix +open Printf +let (//) = Filename.concat + +let () = + let h = Hivex.open_file "../images/rlenvalue_test_hive" [] in + let root = Hivex.root h in + let moderate_value_node = Hivex.node_get_child h root "ModerateValueParent" in + let moderate_value_value = Hivex.node_get_value h moderate_value_node "33Bytes" in + let (data_len, data_off) = Hivex.value_data_cell_offset h moderate_value_value in + assert ( (data_off == (Obj.magic 8712:Hivex.value)) && (data_len...

...- ,---- | (sid)bengen at smetana:~/hivex.git/ocaml$ make check | make check-TESTS | make[1]: Entering directory `/home/bengen/hivex.git/ocaml' | PASS: t/hivex_005_load | PASS: t/hivex_010_open | PASS: t/hivex_020_root | 01 non-existent file | 02 closed handle | 03 write to read-only file | 04 node_get_child node not found | PASS: t/hivex_100_errors | PASS: t/hivex_110_gc_handle | PASS: t/hivex_200_write | Fatal error: exception Hivex.Error("node_values", 9, "Bad address") | FAIL: t/hivex_300_fold | =================== | 1 of 7 tests failed | =================== | make[1]: *** [chec...

...re tests => 7; + +use Win::Hivex; + +my $srcdir = $ENV{srcdir} || "."; + +my $h = Win::Hivex->open ("$srcdir/../images/minimal", write => 1); +ok ($h); + +my $root = $h->root (); +ok ($root); + +$h->node_add_child ($root, "B"); +ok (1); + +my $b = $h->node_get_child ($root, "B"); +ok ($b); + +my $values = [ + { key => "Key1", t => 3, value => "ABC" }, + { key => "Key2", t => 3, value => "DEF" } + ]; +$h->node_set_values ($b, $values); +ok (1); + +my $value1 = { key => "Key3...

...re tests => 7; + +use Win::Hivex; + +my $srcdir = $ENV{srcdir} || "."; + +my $h = Win::Hivex->open ("$srcdir/../images/minimal", write => 1); +ok ($h); + +my $root = $h->root (); +ok ($root); + +$h->node_add_child ($root, "B"); +ok (1); + +my $b = $h->node_get_child ($root, "B"); +ok ($b); + +my $values = [ + { key => "Key1", t => 3, value => "ABC" }, + { key => "Key2", t => 3, value => "DEF" } + ]; +$h->node_set_values ($b, $values); +ok (1); + +my $value1 = { key => "Key3...

--- images/README | 14 ++++++++++++ images/mkzero/Makefile | 9 ++++++++ images/mkzero/mkzero.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ images/special | Bin 0 -> 8192 bytes 4 files changed, 82 insertions(+) create mode 100644 images/mkzero/Makefile create mode 100644 images/mkzero/mkzero.c create mode 100644 images/special diff --git a/images/README

Hi, This patch series is based on a prior patch[1], splitting off changes as requested and incorporating feedback from Richard Jones. It introduces type validation to avoid segmentation faults (instead, it reports an exception) and fixes handling of the bytes type in Python 3. Major changes since that series: - Drop newly introduced support for integer types for DWORD/QWORDS - Reject Unicode

...check_windows_system_registry: cannot locate HKLM\\SYSTEM\\%s\\Services\\Tcpip\\Parameters and/or Hostname key\n%!" current_control_set; + None + +(* Raises [Not_found] if the node is not found. *) +and get_node h node = function + | [] -> node + | x :: xs -> + let node = Hivex.node_get_child h node x in + get_node h node xs + +(* NB: This function DOES NOT test for the existence of the file. It + * will return non-NULL even if the file/directory does not exist. + * You have to call guestfs_is_file{,_opts} etc. + *) +and case_sensitive_path_silently path = + try + Some (Realpat...

v10: https://www.redhat.com/archives/libguestfs/2017-July/msg00245.html No actual change here, but I rebased and retested. Also this series now does not depend on any other patch series since everything else needed is upstream. Rich.