similar to: [PATCH 0/2] hivex shell

Otherwise we get "Can't open ..." warnings which don't seem to be fatal. --- regedit/Makefile.am | 2 +- sh/Makefile.am | 4 ++-- xml/Makefile.am | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/regedit/Makefile.am b/regedit/Makefile.am index 7977334..476c059 100644 --- a/regedit/Makefile.am +++ b/regedit/Makefile.am @@ -39,6 +39,6 @@

Whilst building hivex I'm seeing warnings/errors for the documentation: pod2html complaints: /usr/bin/pod2html: sh/hivexsh.pod: unknown pod directive 'encoding' in paragraph 1. ignoring. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<hivex(3)> in paragraph 8. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<virt-cat(1)> in paragraph 8. /usr/bin/pod2html:

Move the temporary output of pod2man to the correct name only if pod2man did not fail: this also makes the whole command fail if pod2man fails, e.g. because of wrong markup. --- lib/Makefile.am | 2 +- regedit/Makefile.am | 2 +- sh/Makefile.am | 4 ++-- xml/Makefile.am | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/Makefile.am b/lib/Makefile.am index

I tried both hivex-1.2.5 and hivex-1.2.7, same result. The same software hive can be loaded using Windows regedit tool, and had no problem to access the "Classes" key. The other keys under Software (like Microsoft, Wow6432Node, etc.) are OK. Here is the hivexsh output with HIVEX_DEBUG=1 enabled:

Hi, libhivex seems to do a great job at parsing hives most of the time, but there are some issues with a few registry keys. These can be worked around in the application that uses libhivex, but I think it'd be better if libhivex handled these itself. 1. UTF16 string in REG_SZ that has garbage after the \0\0 There is code in hivex.c to handle this already but I think it has a typo: /*

Large values are split into multiple blocks. References to these sub-blocks are kept in a list whose structure seems to be identical to a value list. A "db" record contains information on the number of sub-blocks and a pointer to the list. It is referenced by the vk record. I came across this when comparing the contents of HKLM\SOFTWARE hives from Windows7 systems and finding that

Put the "=back" to close the list only after the last element. --- regedit/hivexregedit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/regedit/hivexregedit b/regedit/hivexregedit index 02c382b..cd49063 100755 --- a/regedit/hivexregedit +++ b/regedit/hivexregedit @@ -248,8 +248,6 @@ You should only use this option for quick hacking and debugging of the hive

Hi Rich, I've updated hivex to use the latest from gnulib and fixed a few syntax-check failures. With these changes, almost all of "make distcheck" succeeds. (details coming separately) >From c6300c44a1eda1a55a23249fde94882ea5a1c430 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering at redhat.com> Date: Tue, 28 Aug 2012 11:28:40 +0200 Subject: [PATCH hivex 1/2] maint:

(Resending since my message from 2 days ago didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints

On Fri, Oct 04, 2013 at 02:12:08PM +0000, Subramanian, Hari wrote: > To respond to you question about "whether it fails", hivexsh is unable to > open the hive file and it prints this message and exits. I've attached the > verbose logs as requested OK, I understand it now. It is in fact failing, setting errno = ENOSYS and returning an error. > This extract from the logs

--- ruby/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ruby/Makefile.am b/ruby/Makefile.am index b6654d3..e78ab59 100644 --- a/ruby/Makefile.am +++ b/ruby/Makefile.am @@ -51,7 +51,7 @@ RUBY_SITEARCH := $(shell $(RUBY) -rrbconfig -e "puts RbConfig::CONFIG['sitearchd install: $(MKDIR_P) $(DESTDIR)$(RUBY_SITELIB) $(MKDIR_P)

Rich, Our workflow is something like this: 0. Start with a fresh copy of windows server 2k8 1. We read the system hive and then write to it a bunch of times 2. Boot windows 3. Read from the system hive Hivex reports the failure at step #3. I also noticed that the size of the registry hive observed in step #3 is the same as step #0. Is it possible that hivex issues write that cause a hive file

One more after this, and "make syntax-check" will pass once more. >From 5c360133c0d4e09531d432abca0629798b87ff39 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering at redhat.com> Date: Mon, 9 Nov 2009 15:14:53 +0100 Subject: [PATCH libguestfs] indent with spaces, not TABs * HACKING: Expand indentation TABs. * configure.ac: Likewise. * daemon/daemon.h: Likewise. *

Hivex is a small, self-contained C library for reading and writing Windows Registry "hive" binary files. I'm pleased to announce version 1.3.15 which you can get from: http://download.libguestfs.org/hivex/ Highlights of this release: - Improved performance by using a cache of iconv handles, especially when dumping out large hives (Hilko Hengen). - Add the ‘hivexregedit

--- sh/hivexsh.pod | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sh/hivexsh.pod b/sh/hivexsh.pod index 7d7fc0a..8b10a6a 100644 --- a/sh/hivexsh.pod +++ b/sh/hivexsh.pod @@ -61,6 +61,13 @@ script, use: #!/usr/bin/hivexsh -f +=item B<-u> + +Use heuristics to tolerate certain levels of corruption within hives. + +This is unsafe but may allow to export/merge valid keys/values

From: Jim Meyering <meyering at redhat.com> * lib/hivex.c (hivex_node_set_value): Remove unnecessary test-before-free. --- lib/hivex.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index d042f4f..a72fa77 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -2748,8 +2748,7 @@ hivex_node_set_value (hive_h *h, hive_node_h node, leave_partial:

This patch series improves, but does not complete, OS X support for hivex. There are several outstanding issues before hivexml and hivexsh can run: * hivexsh uses open_memstream, which doesn't exist in OS X as near as I can see. Unfortunately, I'm inexperienced with autoconf, so I'm not sure how to employ AC_CHECK_FUNCS([open_memstream]) to conditionally add 'sh' to the

Thanks for providing the SOFTWARE and SYSTEM hives. Firstly the SOFTWARE hive has an unusually large 'nk' node, which required me to increase one of the limits in hivex: https://github.com/libguestfs/hivex/commit/bec3f0bb632c4b84a1dfb73eb6333c2ba9834ffb The SYSTEM hive was even more interesting: $ hivexsh system Welcome to hivexsh, the hivex interactive shell for examining

On Fri, Nov 26, 2010 at 10:03:05AM -0800, Yandell, Henri wrote: > We?re looking into using Hivex and came across something odd. While > the license of hivex.c is LGPL 2.1, it appears to require the GPL > 3.0 licensed gnulib package for a few minor functions ( full_read, > full_write and c_toupper ). There are also a few GPL 3.0 build > files. It has always been our intention to

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at