search for: subkey_lf

...err, "hivex: get_children: returning ERANGE because " + "nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS (%zu > %d)\n", nr_subkeys_in_nk, HIVEX_MAX_SUBKEYS); errno = ERANGE; goto error; @@ -751,7 +755,8 @@ get_children (hive_h *h, hive_node_h node, subkey_lf += 0x1000; if (!IS_VALID_BLOCK (h, subkey_lf)) { if (h->msglvl >= 2) - fprintf (stderr, "hivex_node_children: returning EFAULT because subkey_lf is not a valid block (0x%zx)\n", + fprintf (stderr, "hivex_node_children: returning EFAULT" + " be...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

...; > break; I wanted to understand the behavior of hivex when we wrote to the end of the hive file (added a new entry under ControlSet001\services). When I do that I get the following error badsys-1-win-add-reg\ControlSet001\services> ls hivex: _hivex_get_children: returning EFAULT because: subkey_lf is not a valid block (0x780020) ls: Bad address badsys-1-win-add-reg\ControlSet001\services> quit Obviously the add/modify was not successful. But regedit parsed the hive successfully. I'll continue to debug this but thought I should send it to the list/you as well Thanks ~ Hari On 10/4...

...reg_nk_record *nk = (struct ntreg_nk_record *) ((char *) h->addr + nkoffset); - nk->flags = htole16 (0x0020); /* key is ASCII. */ + if (use_utf16) + nk->flags = htole16 (0x0000); + else + nk->flags = htole16 (0x0020); nk->parent = htole32 (parent - 0x1000); nk->subkey_lf = htole32 (0xffffffff); nk->subkey_lf_volatile = htole32 (0xffffffff); nk->vallist = htole32 (0xffffffff); nk->classname = htole32 (0xffffffff); - nk->name_len = htole16 (strlen (name)); - strcpy (nk->name, name); + nk->name_len = htole16 (recoded_name_len); + memcpy...

...reg_nk_record *) ((char *) h->addr + nkoffset); > - nk->flags = htole16 (0x0020); /* key is ASCII. */ > + if (use_utf16) > + nk->flags = htole16 (0x0000); > + else > + nk->flags = htole16 (0x0020); > nk->parent = htole32 (parent - 0x1000); > nk->subkey_lf = htole32 (0xffffffff); > nk->subkey_lf_volatile = htole32 (0xffffffff); > nk->vallist = htole32 (0xffffffff); > nk->classname = htole32 (0xffffffff); > - nk->name_len = htole16 (strlen (name)); > - strcpy (nk->name, name); > + nk->name_len = htole16...

--- lib/hivex-internal.h | 8 +++++--- lib/utf16.c | 11 +++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 4135f58..64fd49a 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,11 +268,13 @@ extern size_t * _hivex_return_offset_list (offset_list *list); extern void _hivex_print_offset_list

...reg_nk_record *nk = (struct ntreg_nk_record *) ((char *) h->addr + nkoffset); - nk->flags = htole16 (0x0020); /* key is ASCII. */ + if (use_utf16) + nk->flags = htole16 (0x0000); + else + nk->flags = htole16 (0x0020); nk->parent = htole32 (parent - 0x1000); nk->subkey_lf = htole32 (0xffffffff); nk->subkey_lf_volatile = htole32 (0xffffffff); nk->vallist = htole32 (0xffffffff); nk->classname = htole32 (0xffffffff); - nk->name_len = htole16 (strlen (name)); - strcpy (nk->name, name); + nk->name_len = htole16 (recoded_name_len); + memcpy...

Rich, Our workflow is something like this: 0. Start with a fresh copy of windows server 2k8 1. We read the system hive and then write to it a bunch of times 2. Boot windows 3. Read from the system hive Hivex reports the failure at step #3. I also noticed that the size of the registry hive observed in step #3 is the same as step #0. Is it possible that hivex issues write that cause a hive file