similar to: [PATCH] Add a cache for iconv_t handles to hive_t

It was brought to my attention that dumping a registry hive causes a lot of time spent in disk I/O activity because iconv_open() and iconv_close() are called for every key. Every iconv_open() call causes /usr/lib/.../gconv/$ENCODING.so to be opened and mapped. The iconv_t handles are now cached in the hive_h struct; they are opened on-demand and re-used. On my ~10 year old Lenovo T60, I have

On Fri, Feb 09, 2018 at 01:52:52AM +0100, Hilko Bengen wrote: > It was brought to my attention that dumping a registry hive causes a > lot of time spent in disk I/O activity because iconv_open() and > iconv_close() are called for every key. Every iconv_open() call causes > /usr/lib/.../gconv/$ENCODING.so to be opened and mapped. > > The iconv_t handles are now cached in the

--- lib/hivex-internal.h | 8 +++++--- lib/utf16.c | 11 +++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 4135f58..64fd49a 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,11 +268,13 @@ extern size_t * _hivex_return_offset_list (offset_list *list); extern void _hivex_print_offset_list

--- lib/write.c | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/write.c b/lib/write.c index 8c4dd8e..384c6b2 100644 --- a/lib/write.c +++ b/lib/write.c @@ -954,7 +954,6 @@ hivex_node_set_values (hive_h *h, hive_node_h node, for (i = 0; i < nr_values; ++i) { /* Allocate vk record to store this (key, value) pair. */ static const char vk_id[2] = { 'v', 'k' }; -

--- lib/write.c | 50 +++++++++++++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 15 deletions(-) diff --git a/lib/write.c b/lib/write.c index dbb8292..8c4dd8e 100644 --- a/lib/write.c +++ b/lib/write.c @@ -608,9 +608,17 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) return 0; } + size_t recoded_name_len; + int use_utf16 = 0; +

On Sun, Nov 24, 2013 at 11:25:53PM +0100, Hilko Bengen wrote: > --- > lib/write.c | 49 ++++++++++++++++++++++++++++++++++--------------- > 1 file changed, 34 insertions(+), 15 deletions(-) > > diff --git a/lib/write.c b/lib/write.c > index dbb8292..72b1f8a 100644 > --- a/lib/write.c > +++ b/lib/write.c > @@ -608,9 +608,17 @@ hivex_node_add_child (hive_h *h,

This line was accidentally removed in 77fe74fc, causing bug #1145056 (Bugzilla) to resurface. --- lib/utf16.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/utf16.c b/lib/utf16.c index e099548..67fa996 100644 --- a/lib/utf16.c +++ b/lib/utf16.c @@ -58,6 +58,7 @@ _hivex_recode (hive_h *h, recode_type t, /* Reset errno here because we don't want to accidentally * return

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to

This patch assumes that iconv doesn't actually modify the input buffer, even though it is declared as char *. --- lib/hivex-internal.h | 6 +++--- lib/utf16.c | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 7a548c0..6bc8638 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,9 +268,9 @@

--- lib/hivex-internal.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index f391b98..d7ce339 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -125,7 +125,19 @@ struct ntreg_hbin_block { struct ntreg_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2];

On Tuesday 31 December 2013 14:27:11 Richard W.M. Jones wrote: > This patch assumes that iconv doesn't actually modify the > input buffer, even though it is declared as char *. > --- > [...] > @@ -51,10 +51,11 @@ _hivex_recode (char *input_encoding, const char > *input, size_t input_len, errno = err; > return NULL; > } > - char *inp = input; > + const

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18

Hello Richard As discussed in the IRC channel, when merging a moderately large reg file (~35MB) to a hiv file (~118 MB); hivex generates a huge hiv file (~580 MB). These changes address that by creating a list of unallocated blocks and reassigning unused blocks. I used https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md as a reference for the

--- lib/write.c | 49 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 34 insertions(+), 15 deletions(-) diff --git a/lib/write.c b/lib/write.c index dbb8292..72b1f8a 100644 --- a/lib/write.c +++ b/lib/write.c @@ -608,9 +608,17 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) return 0; } + size_t recoded_name_len; + int use_utf16 = 0; +

--- lib/hivex-internal.h | 1 + lib/utf16.c | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 6bc8638..7f4cc3c 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -277,6 +277,7 @@ extern char * _hivex_recode (const char *input_encoding, _hivex_recode ("LATIN1", _input, _len, "UTF-8",

--- lib/hivex-internal.h | 6 +++++- lib/node.c | 7 +------ lib/utf16.c | 5 ++--- lib/value.c | 7 +------ 4 files changed, 9 insertions(+), 16 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index d7ce339..4135f58 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,7 +268,11 @@ extern size_t * _hivex_return_offset_list

On Sat, Jan 11, 2014 at 12:12:47AM +0100, Hilko Bengen wrote: > --- > lib/value.c | 8 +------- > 1 file changed, 1 insertion(+), 7 deletions(-) > > diff --git a/lib/value.c b/lib/value.c > index 65404d7..e700c84 100644 > --- a/lib/value.c > +++ b/lib/value.c > @@ -207,14 +207,8 @@ hivex_value_key (hive_h *h, hive_value_h value) > struct ntreg_vk_record *vk =

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

On Tue, Jan 22, 2019 at 04:43:31PM -0500, Michael Meyer wrote: > This line was accidentally removed in 77fe74fc, causing > bug #1145056 (Bugzilla) to resurface. > --- > lib/utf16.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/lib/utf16.c b/lib/utf16.c > index e099548..67fa996 100644 > --- a/lib/utf16.c > +++ b/lib/utf16.c > @@ -58,6 +58,7 @@

Thanks Rich! Just curious, when's the next hivex release scheduled to be tagged? Best, Michael On Tue, Jan 22, 2019 at 5:22 PM Richard W.M. Jones <rjones@redhat.com> wrote: > On Tue, Jan 22, 2019 at 04:43:31PM -0500, Michael Meyer wrote: > > This line was accidentally removed in 77fe74fc, causing > > bug #1145056 (Bugzilla) to resurface. > > --- > >