search for: rerrdispose

...iles changed, 385 insertions(+), 26 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index c98e625..b607421 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -45,11 +45,14 @@ and ret = | RErr (* 0 = ok, -1 = error *) | RErrDispose (* Disposes handle, see hivex_close. *) | RHive (* Returns a hive_h or NULL. *) + | RSize (* Returns size_t or 0. *) | RNode (* Returns hive_node_h or 0. *) | RNodeNotFound...

Hi, When an integer argument is passed as value, node_set_value segfaults. Reproducer is at the end of this message The backtrace points at hivex-py.c, function get_value. While obj is non-NULL, `bytes = PyUnicode_AsUTF8String (obj);` returns NULL. Kind regards, Peter https://lekensteyn.nl #!/usr/bin/env python3 import hivex, sys h = hivex.Hivex(sys.argv[1]) print(h) val = {

Hi, This patch series is based on a prior patch[1], splitting off changes as requested and incorporating feedback from Richard Jones. It introduces type validation to avoid segmentation faults (instead, it reports an exception) and fixes handling of the bytes type in Python 3. Major changes since that series: - Drop newly introduced support for integer types for DWORD/QWORDS - Reject Unicode

...TO HIVE FILES>. +=item HIVEX_OPEN_UNSAFE + +Open the hive in unsafe mode that enables heuristics to handle corrupted hives. + +This may allow to read or write registry keys/values that appear intact in an +otherwise corrupted hive. Use at your own risk. + =back"; "close", (RErrDispose, [AHive]), diff --git a/lib/handle.c b/lib/handle.c index d33c1d0..a4982dd 100644 --- a/lib/handle.c +++ b/lib/handle.c @@ -83,6 +83,7 @@ hivex_open (const char *filename, int flags) DEBUG (2, "created handle %p", h); h->writable = !!(flags & HIVEX_OPEN_WRITE); + h->uns...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at