similar to: [PATCH] Increase HIVEX_MAX_VALUES

Hello, We've been seeing an increasing number of software hives containing subkey and value counts that exceed the limits defined in hivex-internal.h (https://github.com/libguestfs/hivex/blob/1.3.13/lib/hivex-internal.h#L325-L327). Since hivex abruptly aborts when it comes across a key with more subkeys or values than the defined limits, it's breaking some functionality in our cloud. The

> /* These limits are in place to stop really stupid stuff and/or exploits. */ > -#define HIVEX_MAX_SUBKEYS 25000 > -#define HIVEX_MAX_VALUES 10000 > +#define HIVEX_MAX_SUBKEYS 3600000 > +#define HIVEX_MAX_VALUES 110000 > #define HIVEX_MAX_VALUE_LEN 8000000 > #define HIVEX_MAX_ALLOCATION 1000000 Do you have the alternate patch that just increases

This patch updates the guestfs_inspect_get_drive_mappings API call to also return drive letters for GPT paritions. Previously this worked only for MBR partitions. This is achieved by matching the GPT partition GUID with the info stored in the blob from HKLM\SYSTEM\MountedDevices\DosDevices keys. For GPT partions this blob contains a "DMIO:ID:" prefix followed by a 16 byte binary GUID.

This patch updates the guestfs_inspect_get_drive_mappings API call to also return drive letters for GPT paritions. Previously this worked only for MBR partitions. This is achieved by matching the GPT partition GUID with the info stored in the blob from HKLM\SYSTEM\MountedDevices\DosDevices keys. For GPT partions this blob contains a "DMIO:ID:" prefix followed by a 16 byte binary GUID.

Hi Hilko, Thanks a lot for creating this test hive! I think another thing that will trip up Registry programs is value names that include back slashes. For example, under the System hive, the key "\MountedDevices" has child values with names like "\DosDevices\C:" (the leading backslash is a part of the value name). There are many other values that include backslashes. I

This patch updates the guestfs_inspect_get_drive_mappings API call to also return drive letters for GPT paritions. Previously this worked only for MBR partitions. This is achieved by matching the GPT partition GUID with the info stored in the blob from HKLM\SYSTEM\MountedDevices\DosDevices keys. For GPT partions this blob contains a "DMIO:ID:" prefix followed by a 16 byte binary GUID.

> Do you have the alternate patch that just increases the limits to 1.5x what you need? I've attached an updated patch that increases the limits based on the counts observed in the Microsoft\Windows NT\CurrentVersion subkey of the software hive. > We're building a list of (up to) HIVEX_MAX_SUBKEYS * 4 bytes (not counting intermediate blocks) in the _get_children function. While

Hi Rich, I find it more readable (and safer to review) to avoid lines longer than 80 columns. When reviewing changes that wrap, I've noticed that it is harder to spot certain types of mistakes in the wrapped portion of a long line. >From 930118b380b35bb33e7719b0eb2ab6b31fa2d7e4 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering at redhat.com> Date: Wed, 13 Apr 2011 16:08:57

Thanks Rich! Just curious, when's the next hivex release scheduled to be tagged? Best, Michael On Tue, Jan 22, 2019 at 5:22 PM Richard W.M. Jones <rjones@redhat.com> wrote: > On Tue, Jan 22, 2019 at 04:43:31PM -0500, Michael Meyer wrote: > > This line was accidentally removed in 77fe74fc, causing > > bug #1145056 (Bugzilla) to resurface. > > --- > >

From: "Richard W.M. Jones" <rjones at redhat.com> When a Windows guest doesn't have a HKLM\SYSTEM\MountedDevices node, inspection fails. However inspection should not completely fail just because we cannot get the drive letter mapping from a guest. --- src/inspect_fs_windows.c | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) diff --git

--- hivex/hivexsh.pod | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hivex/hivexsh.pod b/hivex/hivexsh.pod index 277e3ae..9336798 100644 --- a/hivex/hivexsh.pod +++ b/hivex/hivexsh.pod @@ -100,7 +100,14 @@ or even: Path elements (node names) are matched case insensitively, and characters like space, C<*>, and C<?> have I<no> special

Thanks for providing the SOFTWARE and SYSTEM hives. Firstly the SOFTWARE hive has an unusually large 'nk' node, which required me to increase one of the limits in hivex: https://github.com/libguestfs/hivex/commit/bec3f0bb632c4b84a1dfb73eb6333c2ba9834ffb The SYSTEM hive was even more interesting: $ hivexsh system Welcome to hivexsh, the hivex interactive shell for examining

--- lib/value.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/value.c b/lib/value.c index c4e21ec..f222b41 100644 --- a/lib/value.c +++ b/lib/value.c @@ -334,7 +334,7 @@ hivex_value_value (hive_h *h, hive_value_h value, /* Arbitrarily limit the length that we will read. */ if (len > HIVEX_MAX_VALUE_LEN) { SET_ERRNO (ERANGE, "data length >

On Fri, Feb 05, 2016 at 12:15:32PM -0500, Dawid Zamirski wrote: > This patch updates the guestfs_inspect_get_drive_mappings API call to > also return drive letters for GPT paritions. Previously this worked > only for MBR partitions. This is achieved by matching the GPT partition > GUID with the info stored in the blob from > HKLM\SYSTEM\MountedDevices\DosDevices keys. For GPT

On Fri, 2016-02-05 at 18:08 +0000, Richard W.M. Jones wrote: > On Fri, Feb 05, 2016 at 12:15:32PM -0500, Dawid Zamirski wrote: > > This patch updates the guestfs_inspect_get_drive_mappings API call > > to > > also return drive letters for GPT paritions. Previously this worked > > only for MBR partitions. This is achieved by matching the GPT > > partition > >

Mostly a line-for-line translation of the C inspection code. --- daemon/Makefile.am | 2 + daemon/inspect_fs.ml | 6 + daemon/inspect_fs_windows.ml | 491 ++++++++++++++++++++++++++++++++++++++++++ daemon/inspect_fs_windows.mli | 24 +++ 4 files changed, 523 insertions(+) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index a4657ed86..80314a524 100644 ---

Le 19/11/2014 22:19, Richard W.M. Jones a écrit : > On Wed, Nov 19, 2014 at 10:05:53PM +0100, Nicolas Ecarnot wrote: >> Nov 19 21:54:52 serv-p2v-adm1 sshd[2727]: pam_unix(sshd:session): >> session opened for user root by (uid=0) >> Nov 19 21:54:53 serv-p2v-adm1 sshd[2725]: channel 2: open failed: >> connect failed: Connection refused >> Nov 19 21:54:53

CentOS 4.1, Xen 2.0.7. My dom0 is booting up but can''t get to the outside network because eth0 won''t start due to, apparently, Xen providing a different mac address than expected. How do I tell Xen to start eth0 at the bootup with a specific mac address that lines up with the HWADDR= line in my ifcfg-eth0? Note that a normal bootup into CentOS 4.1 outside of the Grub Xen bootup

I actually encountered a binary value with 1033680 bytes. --- lib/hivex-internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 7f4cc3c..bfd24c8 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -321,7 +321,7 @@ extern int _hivex_get_values (hive_h *h, hive_node_h node, hive_value_h **values /* These limits

Hi, I''m a newbie to Xen and I need some help. I saw user ''datto'' had a similar problem but changed to FC4 to resolve it. I''m currently running FC3 and Xen2.0.7. I did the usual ''make install'' and I can boot into Xen dom0. However, my network card is not working. The driver is found in the linux-2.6.11.12-xen0 tree but not selected. I