similar to: [PATCH] hivex: Added gnulib includes from builddir, as suggested by the Gnulib documentation; link hivexml against libgnu.

I'm trying to build hivex 1.2.7 on Ubuntu 10.04, and get the following failure: Making all in xml make[2]: Entering directory `/opt/sandbox/src/hivex/hivex-1.2.7/xml' CC hivexml-hivexml.o CCLD hivexml hivexml-hivexml.o: In function `main': /opt/sandbox/src/hivex/hivex-1.2.7/xml/hivexml.c:86: undefined reference to `rpl_getopt'

Hi, I'm trying to compile hivex library that I just discovered. I'd use binaries but I only have an i386 ubuntu and debian so I tryied to compile. ./configure finished with incouraging:: ----------------------------------------------------------- Thank you for downloading hivex 1.3.3 This is how we have configured the optional components for you today: OCaml bindings

This patch series improves, but does not complete, OS X support for hivex. There are several outstanding issues before hivexml and hivexsh can run: * hivexsh uses open_memstream, which doesn't exist in OS X as near as I can see. Unfortunately, I'm inexperienced with autoconf, so I'm not sure how to employ AC_CHECK_FUNCS([open_memstream]) to conditionally add 'sh' to the

--- configure.ac | 2 +- images/Makefile.am | 5 +++-- lib/Makefile.am | 14 +++++++------- ocaml/Makefile.am | 3 ++- ocaml/t/hivex_300_fold.ml | 3 +-- python/run-python-tests | 25 ------------------------- python/run-python-tests.in | 25 +++++++++++++++++++++++++ 7 files changed, 39 insertions(+), 38 deletions(-) delete mode

hivexml on OS X was failing with a symbol-not-found error while dynamically linking. Adding iconv to libhivex fixes the issue and lets OS X process 'images/large' with hivexml. It took careful iconv autotool additions to get compilation working in Fedora as well, but these two lines build and run on OS X 10.6 and 10.8, and Fedora 17 and 18. Unfortunately, a separate issue is revealed

Hello all, I've been testing hivexml in OS X, and came across an inconsistency in building. Some while back, I hit a snag with iconv in OS X, where basically this would happen when a hive of any sophistication (greater than hivex/images/small) was processed: >$ xml/hivexml images/large >test.xml >dyld: lazy symbol binding failed: Symbol not found: _iconv_open > Referenced from:

Hi, libhivex seems to do a great job at parsing hives most of the time, but there are some issues with a few registry keys. These can be worked around in the application that uses libhivex, but I think it'd be better if libhivex handled these itself. 1. UTF16 string in REG_SZ that has garbage after the \0\0 There is code in hivex.c to handle this already but I think it has a typo: /*

--- xml/hivexml.c | 5 ++++- xml/hivexml.pod | 7 +++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/xml/hivexml.c b/xml/hivexml.c index b496bb6..8ba6594 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -95,7 +95,7 @@ main (int argc, char *argv[]) int open_flags = 0; int visit_flags = 0; - while ((c = getopt (argc, argv, "dk")) != EOF) { + while ((c =

Dealing with "1601-01-01T00:00:00Z" is unnecessarily awkward, especially since the value only represents a 0 found in the data. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- xml/hivexml.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/xml/hivexml.c b/xml/hivexml.c index cf11676..5030c24 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@

Greetings. I am new to this list. I am writing to you about hivexml. Richard Jones told me that he was considering abandoning this program. Instead, I am willing to take over maintenance of it. I am involved in computer forensics. I are in the midst of developing an XML standard to describe the Windows Registry. There are several programs that export the windows registry at XML. I have

New feature: If the root node of the XML root is the hive root node, denote with attribute/value root="1". Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- xml/hivexml.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/xml/hivexml.c b/xml/hivexml.c index 2967ac9..f29c80c 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -204,6 +204,10 @@

Reporting value data in attributes has two advantages: * The output of hivexml breaks Python expat processing if binary data makes it out. This was observed in Software hives. * Not having child text makes room for child elements. Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- xml/hivexml.c | 25 ++++++++++++++++++++----- 1 files changed, 20 insertions(+), 5 deletions(-) diff

This changeset adds byte run reporters for node and value metadata in the hivexml program. This location reporting required several new ABI functions, which required new ABI return types. One benefit to the byte run functions is additional sanity checks, which have revealed new data or parsing errors when run on M57 patents images. An example error: Image: Charlie, 2009-12-11, available at

Signed-off-by: Alex Nelson <ajnelson at cs.ucsc.edu> --- xml/hivexml.c | 42 ++++++++++++++++++++++++++++++++++-------- 1 files changed, 34 insertions(+), 8 deletions(-) diff --git a/xml/hivexml.c b/xml/hivexml.c index d38e9d4..1a75593 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -247,6 +247,32 @@ node_end (hive_h *h, void *writer_v, hive_node_h node, const char *name) return 0;

Hi all, The linking problem I found yesterday appears to be because of the built-in iconv in OS X. So, this is a request for patch or pointers: What needs to happen with configure.ac or the iconv.m4 macro file to link an iconv library _besides_ the one in /usr/local/lib? That's the tl;dr, full explanation follows. That library lacks the x86_64 architecture: $ file

On Tue, Jan 31, 2012 at 12:21:44PM -0500, Todd Mummert wrote: > I've made some changes to hivexml.c, that I think addresses the > invalid XML that is being generated (as of version 1.3.3). I'm only > addressing invalid XML characters in string values and string-lists. > As I saw mentioned in earlier forum messages >

This patch adds value_byte_runs and node_byte_runs. Each byte run represents the offset and length of a data structure within the hive, one per node, and one or two per value depending on the length of the value data. These byte run functions also add additional data sanity checks as a hive is being parsed, mainly checking that a node address actually points to a node, and similarly for values.

All, Greetings. I am new to this mailing list. We have been working with XML for digital forensics. One of the areas that we wish to create a schema for is the representation of registry entries. We are interested in hivexml as a tool for extracting the registry as an XML representation. In our discussion with possible users, we have generally come to the conclusion that it is useful to

This patch revises the value type information printed. It is also somewhat a test of how open to revision the output of a program is according to RedHat's policies, of which I am not very aware beyond strongly guaranteeing ABI compatability. Alex Nelson (1): Change value type output to standard names xml/hivexml.c | 42 ++++++++++++++++++++++++++++++++++-------- 1 files changed, 34

This patch adds value_byte_runs and node_byte_runs. Each byte run represents the offset and length of a data structure within the hive, one per node, and one or two per value depending on the length of the value data. These byte run functions also add additional data sanity checks as a hive is being parsed, mainly checking that a node address actually points to a node, and similarly for values.