search for: nr_subkeys_in_nk

...eturning EFAULT because node name" + " is too long (%zu, %zu)\n", len, seg_len); errno = EFAULT; return NULL; @@ -733,7 +736,8 @@ get_children (hive_h *h, hive_node_h node, /* Arbitrarily limit the number of subkeys we will ever deal with. */ if (nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS) { if (h->msglvl >= 2) - fprintf (stderr, "hivex: get_children: returning ERANGE because nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS (%zu > %d)\n", + fprintf (stderr, "hivex: get_children: returning ERANGE because " + "nr_su...

...} if (h->msglvl >= 2) { diff --git a/lib/node.c b/lib/node.c index 822c250..35c0731 100644 --- a/lib/node.c +++ b/lib/node.c @@ -343,11 +343,10 @@ _hivex_get_children (hive_h *h, hive_node_h node, */ size_t nr_children = _hivex_get_offset_list_length (&children); if (nr_subkeys_in_nk != nr_children) { - SET_ERRNO (ENOTSUP, - "nr_subkeys_in_nk = %zu " - "is not equal to number of children read %zu", - nr_subkeys_in_nk, nr_children); - goto error; + DEBUG(2, + "nr_subkeys_in_nk = %zu " +...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

...de_h node) +{ + if (!IS_VALID_BLOCK (h, node) || !block_id_eq(h, node, "nk")) { + SET_ERRNO( EINVAL, "invalid block or not an 'nk' block"); + return 0; + } + + struct ntreg_nk_record *nk = + (struct ntreg_nk_record *) ((char *) h->addr + node); + + size_t nr_subkeys_in_nk = le32toh(nk->nr_subkeys); + + return nr_subkeys_in_nk; +} + /* Very inefficient, but at least having a separate API call * allows us to make it more efficient in future. */ -- - Kevin Haroldsen (kupiakos)

Hello, The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

...8, avg: 51, lge: 13752] blocks used: 456044 bytes used: 23608640 Welcome to hivexsh, the hivex interactive shell for examining Windows Registry binary hive files. Type: 'help' for help summary 'quit' to quit the shell Software\> cd Classes hivex_node_children: nr_subkeys_in_nk = 13, nr_subkeys_in_lf = 13 Software\Classes> ls get_children: returning ENOTSUP because ri-record offset does not point to lf/lh (0x49020) ls: Operation not supported Software\Classes> ============================================================================================= -Michael ---...

[This email is either empty or too large to be displayed at this time]

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special