similar to: [PATCH 01/14] hivexsh: Document some peculiarities of the "cd" command.

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18

$ gcc -O2 -c -Woverlength-strings stupid.c stupid.c: In function ?insert_lf_record?: stupid.c:22: warning: string length ?7394? is greater than the length ?509? ISO C90 compilers are required to support Without -O2 the error message goes away. Even ISO C99 compilers don't help - they raise the limit to a mere 4095 bytes. Rich. -- Richard Jones, Virtualization Group, Red Hat

Hi Rich, I find it more readable (and safer to review) to avoid lines longer than 80 columns. When reviewing changes that wrap, I've noticed that it is harder to spot certain types of mistakes in the wrapped portion of a long line. >From 930118b380b35bb33e7719b0eb2ab6b31fa2d7e4 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering at redhat.com> Date: Wed, 13 Apr 2011 16:08:57

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

Whilst building hivex I'm seeing warnings/errors for the documentation: pod2html complaints: /usr/bin/pod2html: sh/hivexsh.pod: unknown pod directive 'encoding' in paragraph 1. ignoring. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<hivex(3)> in paragraph 8. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<virt-cat(1)> in paragraph 8. /usr/bin/pod2html:

--- ruby/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ruby/Makefile.am b/ruby/Makefile.am index b6654d3..e78ab59 100644 --- a/ruby/Makefile.am +++ b/ruby/Makefile.am @@ -51,7 +51,7 @@ RUBY_SITEARCH := $(shell $(RUBY) -rrbconfig -e "puts RbConfig::CONFIG['sitearchd install: $(MKDIR_P) $(DESTDIR)$(RUBY_SITELIB) $(MKDIR_P)

--- sh/hivexsh.pod | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sh/hivexsh.pod b/sh/hivexsh.pod index 7d7fc0a..8b10a6a 100644 --- a/sh/hivexsh.pod +++ b/sh/hivexsh.pod @@ -61,6 +61,13 @@ script, use: #!/usr/bin/hivexsh -f +=item B<-u> + +Use heuristics to tolerate certain levels of corruption within hives. + +This is unsafe but may allow to export/merge valid keys/values

This patch series adds support for some simple operations on hive files, and I've now tested and verified that those operations work correctly. All except for the last patch (12/12) are ready to be committed. The last patch is WIP. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any

Put the "=back" to close the list only after the last element. --- regedit/hivexregedit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/regedit/hivexregedit b/regedit/hivexregedit index 02c382b..cd49063 100755 --- a/regedit/hivexregedit +++ b/regedit/hivexregedit @@ -248,8 +248,6 @@ You should only use this option for quick hacking and debugging of the hive

This patch series improves, but does not complete, OS X support for hivex. There are several outstanding issues before hivexml and hivexsh can run: * hivexsh uses open_memstream, which doesn't exist in OS X as near as I can see. Unfortunately, I'm inexperienced with autoconf, so I'm not sure how to employ AC_CHECK_FUNCS([open_memstream]) to conditionally add 'sh' to the

From: Jim Meyering <meyering at redhat.com> * lib/hivex.c (hivex_node_set_value): Remove unnecessary test-before-free. --- lib/hivex.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index d042f4f..a72fa77 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -2748,8 +2748,7 @@ hivex_node_set_value (hive_h *h, hive_node_h node, leave_partial:

On Fri, Nov 26, 2010 at 10:03:05AM -0800, Yandell, Henri wrote: > We?re looking into using Hivex and came across something odd. While > the license of hivex.c is LGPL 2.1, it appears to require the GPL > 3.0 licensed gnulib package for a few minor functions ( full_read, > full_write and c_toupper ). There are also a few GPL 3.0 build > files. It has always been our intention to

(Resending since my message from 2 days ago didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints

Is there a reason why a previous version of hivex ignored this condition while more recent ones throw an error? I do have some hive files that are failing (I'm yet to validate if they are good or were corrupted some other way). I will do so and share my findings Thanks ~ Hari On 9/24/13 5:20 PM, "Richard W.M. Jones" <rjones@redhat.com> wrote: >On Tue, Sep 24, 2013 at

Le 19/11/2014 22:19, Richard W.M. Jones a écrit : > On Wed, Nov 19, 2014 at 10:05:53PM +0100, Nicolas Ecarnot wrote: >> Nov 19 21:54:52 serv-p2v-adm1 sshd[2727]: pam_unix(sshd:session): >> session opened for user root by (uid=0) >> Nov 19 21:54:53 serv-p2v-adm1 sshd[2725]: channel 2: open failed: >> connect failed: Connection refused >> Nov 19 21:54:53

OS X lacks open_memstream, causing hivexsh to fail to build. This patch defines HAVE_HIVEXSH, setting the only condition to open_memstream existence. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- Makefile.am | 6 +++++- configure.ac | 4 ++++ 2 files changed, 9 insertions(+), 1 deletions(-) diff --git a/Makefile.am b/Makefile.am index 8d69c55..dbab38a 100644 ---

I recenetly came across a Windows XP image, where one REG_QWORD value (HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0\0\ExecTime) would be displayed by hivexsh but hivex_value_qword() would return -1. It turned out that the data length of this value was 16 bytes instead of 8. There is no problem in simply interpreting the first 4 (DWORD) or 8 (QWORD)

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid

I note that LICENSES and README state LGPL v2.1 but there are other files with other licenses, most obviously many shell script files such as: regedit/hivexregedit sh/example* Also some Makefiles: perl/Makefile.am sh/Makefile.am ...etc... find . -type f | while read filename; \ do if grep -iqs 'general public license' $filename; then \ if grep -viqs 'lesser' $filename; then