similar to: ANNOUNCE: hivex - read and write Windows Registry hives - version 1.3.15 released

I'm pleased to announce the next release of hivex, a library and some tools for reading and writing Windows Registry hive files. Man page: http://libguestfs.org/hivex.3.html Source: http://libguestfs.org/download/hivex/ Git repo: http://git.annexia.org/?p=hivex.git;a=summary Fedora pkg: http://koji.fedoraproject.org/koji/taskinfo?taskID=3267857 This release mainly contains bug fixes.

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

Hi, libhivex seems to do a great job at parsing hives most of the time, but there are some issues with a few registry keys. These can be worked around in the application that uses libhivex, but I think it'd be better if libhivex handled these itself. 1. UTF16 string in REG_SZ that has garbage after the \0\0 There is code in hivex.c to handle this already but I think it has a typo: /*

Move the temporary output of pod2man to the correct name only if pod2man did not fail: this also makes the whole command fail if pod2man fails, e.g. because of wrong markup. --- lib/Makefile.am | 2 +- regedit/Makefile.am | 2 +- sh/Makefile.am | 4 ++-- xml/Makefile.am | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/Makefile.am b/lib/Makefile.am index

Put the "=back" to close the list only after the last element. --- regedit/hivexregedit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/regedit/hivexregedit b/regedit/hivexregedit index 02c382b..cd49063 100755 --- a/regedit/hivexregedit +++ b/regedit/hivexregedit @@ -248,8 +248,6 @@ You should only use this option for quick hacking and debugging of the hive

On a Debian/unstable chroot environment on smetana.debian.org ("Linux smetana 2.6.32-5-sparc64-smp #1 SMP Tue Mar 8 01:00:11 UTC 2011 sparc64 GNU/Linux") node_set_value and node_values fail with a "Bad address" error, see below. I am going to make an attempt at debugging this tonight, any advice would be appreciated. Cheers, -Hilko ,---- | (sid)bengen at

Otherwise we get "Can't open ..." warnings which don't seem to be fatal. --- regedit/Makefile.am | 2 +- sh/Makefile.am | 4 ++-- xml/Makefile.am | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/regedit/Makefile.am b/regedit/Makefile.am index 7977334..476c059 100644 --- a/regedit/Makefile.am +++ b/regedit/Makefile.am @@ -39,6 +39,6 @@

--- ruby/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ruby/Makefile.am b/ruby/Makefile.am index b6654d3..e78ab59 100644 --- a/ruby/Makefile.am +++ b/ruby/Makefile.am @@ -51,7 +51,7 @@ RUBY_SITEARCH := $(shell $(RUBY) -rrbconfig -e "puts RbConfig::CONFIG['sitearchd install: $(MKDIR_P) $(DESTDIR)$(RUBY_SITELIB) $(MKDIR_P)

(Resending since my message from 2 days ago didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints

Hi, While working on Debian packages of hivex 1.2.5, I came across a test failure for the Python bindings with Python 2.7 on the i386 architecture. (The tests ran fine on amd64.) ,---- | $ make -C python check | make[1]: Entering directory `/home/bengen/src/deb/hivex/hivex.git/python' | 010-import.py | 020-open.py | 021-close.py | 200-write.py | python: hivex-py.c:52: get_handle: Assertion

Hi Rich, I've updated hivex to use the latest from gnulib and fixed a few syntax-check failures. With these changes, almost all of "make distcheck" succeeds. (details coming separately) >From c6300c44a1eda1a55a23249fde94882ea5a1c430 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering at redhat.com> Date: Tue, 28 Aug 2012 11:28:40 +0200 Subject: [PATCH hivex 1/2] maint:

On Fri, Oct 04, 2013 at 02:12:08PM +0000, Subramanian, Hari wrote: > To respond to you question about "whether it fails", hivexsh is unable to > open the hive file and it prints this message and exits. I've attached the > verbose logs as requested OK, I understand it now. It is in fact failing, setting errno = ENOSYS and returning an error. > This extract from the logs

Hi Hilko, Thanks a lot for creating this test hive! I think another thing that will trip up Registry programs is value names that include back slashes. For example, under the System hive, the key "\MountedDevices" has child values with names like "\DosDevices\C:" (the leading backslash is a part of the value name). There are many other values that include backslashes. I

Whilst building hivex I'm seeing warnings/errors for the documentation: pod2html complaints: /usr/bin/pod2html: sh/hivexsh.pod: unknown pod directive 'encoding' in paragraph 1. ignoring. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<hivex(3)> in paragraph 8. /usr/bin/pod2html: sh/hivexsh.pod: cannot resolve L<virt-cat(1)> in paragraph 8. /usr/bin/pod2html:

Is there a reason why a previous version of hivex ignored this condition while more recent ones throw an error? I do have some hive files that are failing (I'm yet to validate if they are good or were corrupted some other way). I will do so and share my findings Thanks ~ Hari On 9/24/13 5:20 PM, "Richard W.M. Jones" <rjones@redhat.com> wrote: >On Tue, Sep 24, 2013 at

Rich, Our workflow is something like this: 0. Start with a fresh copy of windows server 2k8 1. We read the system hive and then write to it a bunch of times 2. Boot windows 3. Read from the system hive Hivex reports the failure at step #3. I also noticed that the size of the registry hive observed in step #3 is the same as step #0. Is it possible that hivex issues write that cause a hive file

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid

I just pushed hivex 1.2.6: http://libguestfs.org/download/hivex/ http://git.annexia.org/?p=hivex.git;a=summary You probably want this patch which didn't make it into 1.2.6 too: http://git.annexia.org/?p=hivex.git;a=commitdiff;h=2cf6eef8ff7b7ab642943e67183f0d7491c69f9d This is a bug fix release. Upgrading is not required, unless you are using a big endian machine or are trying to use the

* Richard W.M. Jones: > ACK, same as this libguestfs fix: It looks like I might be able to ship the Debian package for the next version without any specific patches. Hooray! I believe that I have pushed all the changes that I needed in the hivex library itself. How about doing another release? Cheers, -Hilko

Currently 'hivexget' is a very clumsy command line tool which only lets you display a single registry key in a hive file, for example: $ hivexget SOFTWARE '\Microsoft\Windows\TabletPC\TabSetup\' "TabletSetup"=dword:00000000" This is inflexible and got really annoying as I was trying to explore these hive files in preparation for adding write support to hivex.