search for: unknown6

...ct desc column = acctdesc; mysql:unknown string column = unknown; mysql:munged dial column = mungeddial; mysql:unknown 3 column = unknown3; mysql:logon divs column = logondivs; mysql:hours len column = hourslen; mysql:unknown 5 column = unknown5; mysql:unknown 6 column = unknown6;

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

.../hivex.c @@ -64,7 +64,7 @@ struct ntreg_header { uint32_t sequence2; int64_t last_modified; uint32_t major_ver; /* 1 */ - uint32_t minor_ver; /* 3 */ + uint32_t minor_ver; /* Seen as 3 in XP, 5 in Vista */ uint32_t unknown5; /* 0 */ uint32_t unknown6; /* 1 */ uint32_t offset; /* offset of root key record - 4KB */ @@ -303,7 +303,7 @@ hivex_open (const char *filename, int flags) } /* Check major version. */ - uint32_t major_ver = le32toh (h->hdr->major_ver); + int32_t major_ver = hivex_major_version (h);...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.