similar to: Is there any other way for accessing .hive files?

Hey, In windows we have a concept of "hive" in the registry. I'm trying to load the hive to wine registry, but wine is not able to recognizing the format of hive. Please help me out. Thanks, karthik

In windows to load .hive files there is a option in file menu "load hive". But there is no such option in wine registry menu. can wine handle .hive files?

Hi Rich, I'm still working on validating whether the trailing zeroes were introduced by hivex or by windows (though I highly doubt it's hivex). But since it's part of a more complex workflow which is not that easy to modify, it's still a work in progress In the meanwhile, I wanted to be sure that ignoring the condition when hivex saw these trailing zeroes was the right solution.

Rich, Our workflow is something like this: 0. Start with a fresh copy of windows server 2k8 1. We read the system hive and then write to it a bunch of times 2. Boot windows 3. Read from the system hive Hivex reports the failure at step #3. I also noticed that the size of the registry hive observed in step #3 is the same as step #0. Is it possible that hivex issues write that cause a hive file

Is there a reason why a previous version of hivex ignored this condition while more recent ones throw an error? I do have some hive files that are failing (I'm yet to validate if they are good or were corrupted some other way). I will do so and share my findings Thanks ~ Hari On 9/24/13 5:20 PM, "Richard W.M. Jones" <rjones@redhat.com> wrote: >On Tue, Sep 24, 2013 at

Hi Hilko, Thanks a lot for creating this test hive! I think another thing that will trip up Registry programs is value names that include back slashes. For example, under the System hive, the key "\MountedDevices" has child values with names like "\DosDevices\C:" (the leading backslash is a part of the value name). There are many other values that include backslashes. I

(Resending since my message from 2 days ago didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

This new option allows you to only export what you care about from a registry hive by specifying a max recursion depth. Michael Meyer (1): hivexregedit: add --max-depth option for exports perl/lib/Win/Hivex/Regedit.pm | 14 ++++++++++++-- regedit/hivexregedit | 18 +++++++++++++++++- 2 files changed, 29 insertions(+), 3 deletions(-) -- 2.14.3 (Apple Git-98)

Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- generator/generator.ml | 6 ++++++ lib/hivex.c | 6 ++++++ xml/hivexml.c | 9 +++++++++ 3 files changed, 21 insertions(+), 0 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index fc7b483..9e53f4e 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -159,6 +159,12

Hi, I was hoping I could modify a locally mounted registry hive using regpatch and a .reg file but the -F argument seems to have no function. (Strace shows it ignores it and just operates on /var/lib/samba/private/hklm.ldb) Below is output with debug on. rfm6 at ubuntuSSDx64:cp /mnt/xp/WINDOWS/system32/config/software /tmp/software rfm6 at ubuntuSSDx64:/tmp/config$ sudo regpatch -d=10 -F

I'm pleased to announce the next release of hivex, a library and some tools for reading and writing Windows Registry hive files. Man page: http://libguestfs.org/hivex.3.html Source: http://libguestfs.org/download/hivex/ Git repo: http://git.annexia.org/?p=hivex.git;a=summary Fedora pkg: http://koji.fedoraproject.org/koji/taskinfo?taskID=3267857 This release mainly contains bug fixes.

A very miscellaneous set of cleanups to how we handle the Windows registry in virt-v2v, firstboot, and inspection code. This should all be straightforward non-controversial refactoring. Some highlights: - Add a new mllib Registry module containing various utility functions that are currently scattered all around. - Only compute the software/system hive paths once during inspection, and

Hive <http://hadoop.apache.org/hive/> is a data warehouse infrastructure built on top of Hadoop that provides tools to enable easy data summarization, adhoc querying and analysis of large datasets data stored in Hadoop files. It provides a mechanism to put structure on this data and it also provides a simple query language called QL which is based on SQL and which enables users familiar with

The major and minor version were being reported in a debug message. This patch adds the version information to the ABI and reports with hivexml. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- generator/generator.ml | 10 ++++++++++ lib/hivex.c | 32 +++++++++++++++++++++++++++----- xml/hivexml.c | 24 ++++++++++++++++++++++++ 3 files changed, 61

[Forwarding to the proper list] We use hivex for one of our projects and I see the following diff committed to the hivex project (source link provided) that ignores trailing garbage. But this code has been reverted to no ignore this condition in later version of hivex - /* This error is seemingly common in uncorrupt registry files. */ - /* - fprintf (stderr, "hivex: %s:

--- images/README | 14 ++++++++++++ images/mkzero/Makefile | 9 ++++++++ images/mkzero/mkzero.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ images/special | Bin 0 -> 8192 bytes 4 files changed, 82 insertions(+) create mode 100644 images/mkzero/Makefile create mode 100644 images/mkzero/mkzero.c create mode 100644 images/special diff --git a/images/README

Hello, The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be

I have found a strange issue related to hivex/ntfs-3g. After opening a system hive on a volume mounted by ntfs-3g, any access to the Windows directory results device or resource busy error. The patch below fix it by closing the hive file handle in hivex_open() call in the writable path because the handle never been used after its content been read into memory. --- hivex-1.2.5.orig/lib/hivex.c

I tried both hivex-1.2.5 and hivex-1.2.7, same result. The same software hive can be loaded using Windows regedit tool, and had no problem to access the "Classes" key. The other keys under Software (like Microsoft, Wow6432Node, etc.) are OK. Here is the hivexsh output with HIVEX_DEBUG=1 enabled: