similar to: [PATCH 1/3] lib: Further generalize iconv wrapper function.

On Sun, Nov 24, 2013 at 11:25:53PM +0100, Hilko Bengen wrote: > --- > lib/write.c | 49 ++++++++++++++++++++++++++++++++++--------------- > 1 file changed, 34 insertions(+), 15 deletions(-) > > diff --git a/lib/write.c b/lib/write.c > index dbb8292..72b1f8a 100644 > --- a/lib/write.c > +++ b/lib/write.c > @@ -608,9 +608,17 @@ hivex_node_add_child (hive_h *h,

--- lib/write.c | 50 +++++++++++++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 15 deletions(-) diff --git a/lib/write.c b/lib/write.c index dbb8292..8c4dd8e 100644 --- a/lib/write.c +++ b/lib/write.c @@ -608,9 +608,17 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) return 0; } + size_t recoded_name_len; + int use_utf16 = 0; +

It was brought to my attention that dumping a registry hive causes a lot of time spent in disk I/O activity because iconv_open() and iconv_close() are called for every key. Every iconv_open() call causes /usr/lib/.../gconv/$ENCODING.so to be opened and mapped. The iconv_t handles are now cached in the hive_h struct; they are opened on-demand and re-used. On my ~10 year old Lenovo T60, I have

--- lib/write.c | 49 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 34 insertions(+), 15 deletions(-) diff --git a/lib/write.c b/lib/write.c index dbb8292..72b1f8a 100644 --- a/lib/write.c +++ b/lib/write.c @@ -608,9 +608,17 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) return 0; } + size_t recoded_name_len; + int use_utf16 = 0; +

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

* Richard W.M. Jones: >> - nk->name_len = htole16 (strlen (name)); >> - strcpy (nk->name, name); >> + nk->name_len = htole16 (recoded_name_len); >> + memcpy (nk->name, recoded_name, recoded_name_len); >> + free(recoded_name); > > Please put spaces after function names! It improves readability: Sorry, I'll fix those. I also forgot to add a

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

--- lib/write.c | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/write.c b/lib/write.c index 8c4dd8e..384c6b2 100644 --- a/lib/write.c +++ b/lib/write.c @@ -954,7 +954,6 @@ hivex_node_set_values (hive_h *h, hive_node_h node, for (i = 0; i < nr_values; ++i) { /* Allocate vk record to store this (key, value) pair. */ static const char vk_id[2] = { 'v', 'k' }; -

On Fri, Feb 09, 2018 at 01:52:52AM +0100, Hilko Bengen wrote: > It was brought to my attention that dumping a registry hive causes a > lot of time spent in disk I/O activity because iconv_open() and > iconv_close() are called for every key. Every iconv_open() call causes > /usr/lib/.../gconv/$ENCODING.so to be opened and mapped. > > The iconv_t handles are now cached in the

It was brought to my attention that dumping a registry hive causes a lot of time spent in disk I/O activity because iconv_open() and iconv_close() are called for every key. Every iconv_open() call causes /usr/lib/.../gconv/$ENCODING.so to be opened and mapped. The iconv_t handles are now cached in the hive_h struct; they are opened on-demand and re-used. On my ~10 year old Lenovo T60, I have

On Tuesday 31 December 2013 14:27:11 Richard W.M. Jones wrote: > This patch assumes that iconv doesn't actually modify the > input buffer, even though it is declared as char *. > --- > [...] > @@ -51,10 +51,11 @@ _hivex_recode (char *input_encoding, const char > *input, size_t input_len, errno = err; > return NULL; > } > - char *inp = input; > + const

--- lib/hivex-internal.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index f391b98..d7ce339 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -125,7 +125,19 @@ struct ntreg_hbin_block { struct ntreg_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2];

The infrastructure for modified-time reporting has been essentially unused. These changes report the registry time by treating the time fields as Windows filetime fields stored in little-Endian (which means they can be treated as a single 64-bit little-Endian integer). Some of the code changes necessary include: * Exposing the hive_h structure in the hivex header file (via generator.ml) *

Hi Rich, I find it more readable (and safer to review) to avoid lines longer than 80 columns. When reviewing changes that wrap, I've noticed that it is harder to spot certain types of mistakes in the wrapped portion of a long line. >From 930118b380b35bb33e7719b0eb2ab6b31fa2d7e4 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering at redhat.com> Date: Wed, 13 Apr 2011 16:08:57

Hi, this small series cherry-picks a couple of the portability fixes recently done in libguestfs to hivex. There should be no actual change on Linux. Thanks, -- Pino Pino Toscano (2): normalize iconv handling ruby: fix detection of ruby library bootstrap | 1 + configure.ac | 8 +++++++- lib/utf16.c | 3 +-- 3 files changed, 9 insertions(+), 3 deletions(-) -- 1.9.3

This patch assumes that iconv doesn't actually modify the input buffer, even though it is declared as char *. --- lib/hivex-internal.h | 6 +++--- lib/utf16.c | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 7a548c0..6bc8638 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,9 +268,9 @@

Add nbdkit-floppy-plugin, “inspired” by qemu's VVFAT driver, but without the ability to handle writes. The implementation is pretty complete, supporting FAT32, LFNs, volume labels, timestamps, etc, and it passes both ‘make check’ and ‘make check-valgrind’. Usage is simple; to serve the current directory: $ nbdkit floppy . Then using guestfish (or any NBD client): $ guestfish --ro

--- lib/hivex-internal.h | 6 +++++- lib/node.c | 7 +------ lib/utf16.c | 5 ++--- lib/value.c | 7 +------ 4 files changed, 9 insertions(+), 16 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index d7ce339..4135f58 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,7 +268,11 @@ extern size_t * _hivex_return_offset_list

This patch updates the guestfs_inspect_get_drive_mappings API call to also return drive letters for GPT paritions. Previously this worked only for MBR partitions. This is achieved by matching the GPT partition GUID with the info stored in the blob from HKLM\SYSTEM\MountedDevices\DosDevices keys. For GPT partions this blob contains a "DMIO:ID:" prefix followed by a 16 byte binary GUID.

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to