similar to: [PATCH hivex] regedit: Add implicit nul-termination when importing strings.

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

From: Jim Meyering <meyering at redhat.com> * lib/hivex.c (hivex_node_set_value): Remove unnecessary test-before-free. --- lib/hivex.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/lib/hivex.c b/lib/hivex.c index d042f4f..a72fa77 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -2748,8 +2748,7 @@ hivex_node_set_value (hive_h *h, hive_node_h node, leave_partial:

As described here previously: https://www.redhat.com/archives/libguestfs/2010-March/msg00129.html Here is the three part patch to reimplement virt-win-reg to support exporting and merging Windows Registry entries in the 'regedit' format. Tested by me on a local Windows VM. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-top is 'top'

This new option allows you to only export what you care about from a registry hive by specifying a max recursion depth. Michael Meyer (1): hivexregedit: add --max-depth option for exports perl/lib/Win/Hivex/Regedit.pm | 14 ++++++++++++-- regedit/hivexregedit | 18 +++++++++++++++++- 2 files changed, 29 insertions(+), 3 deletions(-) -- 2.14.3 (Apple Git-98)

--- perl/lib/Win/Hivex/Regedit.pm | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/perl/lib/Win/Hivex/Regedit.pm b/perl/lib/Win/Hivex/Regedit.pm index 2b17036..f0dbb50 100644 --- a/perl/lib/Win/Hivex/Regedit.pm +++ b/perl/lib/Win/Hivex/Regedit.pm @@ -153,8 +153,8 @@ sub reg_import #print STDERR "reg_import: parsing <<<$_>>>\n";

--- perl/lib/Win/Hivex/Regedit.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/perl/lib/Win/Hivex/Regedit.pm b/perl/lib/Win/Hivex/Regedit.pm index 34426f1..2b17036 100644 --- a/perl/lib/Win/Hivex/Regedit.pm +++ b/perl/lib/Win/Hivex/Regedit.pm @@ -144,6 +144,7 @@ sub reg_import # this is fairly common in pasted regedit files. $lineno++; chomp; + s/\r$//;

Put the "=back" to close the list only after the last element. --- regedit/hivexregedit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/regedit/hivexregedit b/regedit/hivexregedit index 02c382b..cd49063 100755 --- a/regedit/hivexregedit +++ b/regedit/hivexregedit @@ -248,8 +248,6 @@ You should only use this option for quick hacking and debugging of the hive

This is the first part (of three) of a set of changes to support merging Windows Registry entries from the common 'regedit' format. https://bugzilla.redhat.com/show_bug.cgi?id=575738 This adds a Perl library Win::Hivex::Regedit which supports two functions for importing and exporting the format. I've tested this on some real output from the Windows regedit.exe program successfully.

Hi, Few changes in hivex, sent as series to be clearly identified as hivex ones. After these patches, what about a new release of it? The last one is basically one year old, and the changes after 1.3.11 make hivex build and work fine on FreeBSD (and maybe more non-Linux OSes). Thanks, Pino Toscano (3): Fix shebang in perl scripts Update gnulib to latest. Update .gitignore with more

A very miscellaneous set of cleanups to how we handle the Windows registry in virt-v2v, firstboot, and inspection code. This should all be straightforward non-controversial refactoring. Some highlights: - Add a new mllib Registry module containing various utility functions that are currently scattered all around. - Only compute the software/system hive paths once during inspection, and

Hi Rich, I'm still working on validating whether the trailing zeroes were introduced by hivex or by windows (though I highly doubt it's hivex). But since it's part of a more complex workflow which is not that easy to modify, it's still a work in progress In the meanwhile, I wanted to be sure that ignoring the condition when hivex saw these trailing zeroes was the right solution.

This patch series adds support for some simple operations on hive files, and I've now tested and verified that those operations work correctly. All except for the last patch (12/12) are ready to be committed. The last patch is WIP. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any

* Richard W.M. Jones: > ACK, same as this libguestfs fix: It looks like I might be able to ship the Debian package for the next version without any specific patches. Hooray! I believe that I have pushed all the changes that I needed in the hivex library itself. How about doing another release? Cheers, -Hilko

I tried both hivex-1.2.5 and hivex-1.2.7, same result. The same software hive can be loaded using Windows regedit tool, and had no problem to access the "Classes" key. The other keys under Software (like Microsoft, Wow6432Node, etc.) are OK. Here is the hivexsh output with HIVEX_DEBUG=1 enabled:

Is there a reason why a previous version of hivex ignored this condition while more recent ones throw an error? I do have some hive files that are failing (I'm yet to validate if they are good or were corrupted some other way). I will do so and share my findings Thanks ~ Hari On 9/24/13 5:20 PM, "Richard W.M. Jones" <rjones@redhat.com> wrote: >On Tue, Sep 24, 2013 at

Thanks very much for the responses on my last three issues. I've incorporated the appropriate changes into the budding Debian package. I feel embarrassed to raise this one, but in the interests of shutting lintian up maybe this could be fixed at some point: I: hivex: spelling-error-in-manpage usr/share/man/man1/hivexregedit.1.gz reencode re-encode I: libhivex-perl: spelling-error-in-manpage

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to

Rich, Our workflow is something like this: 0. Start with a fresh copy of windows server 2k8 1. We read the system hive and then write to it a bunch of times 2. Boot windows 3. Read from the system hive Hivex reports the failure at step #3. I also noticed that the size of the registry hive observed in step #3 is the same as step #0. Is it possible that hivex issues write that cause a hive file

[Partly using the mailing list as a backup again ...] This commit changes virt-v2v to make registry changes to all ControlSets, not just the CurrentControlSet. Not sure what difference if any this would make. Rich.

I note that LICENSES and README state LGPL v2.1 but there are other files with other licenses, most obviously many shell script files such as: regedit/hivexregedit sh/example* Also some Makefiles: perl/Makefile.am sh/Makefile.am ...etc... find . -type f | while read filename; \ do if grep -iqs 'general public license' $filename; then \ if grep -viqs 'lesser' $filename; then