There are some linux systems in the wild where the /etc/hostname file
does not contain the configured hostname as sole line in that file. This
file actually allows for comments [1] starting with "#" and the original
logic would extract the comment line instead of the hostname on such
systems. This
On Thu, 2017-03-02 at 17:44 -0500, Dawid Zamirski wrote:
> add udev_settle calls to print_partition_table and
> sgdisk_info_extract_field because the inspect-os calls
> guestfs_part_get_parttype and guestfs_part_get_gpt_guid for all
> parition devices found and this causes
add udev_settle calls to print_partition_table and
sgdisk_info_extract_field because the inspect-os calls
guestfs_part_get_parttype and guestfs_part_get_gpt_guid for all
parition devices found and this causes intermittent with opening block
devices that are certainly present yet RESOLVE_DEVICE
Only when HIVEX_OPEN_UNSAFE flag is set.
There are some corrupted registry files that have invalid hbin cells
but are still readable. This patch makes the following changes:
* hivex_open - do not abort with complete failure if we run across a
block with invalid size (unless it's the root
ng when errors happen that
we can recover from - as separate patches 4 & 5
Regards,
Dawid Zamirski (5):
add HIVEX_OPEN_UNSAFE flag.
lib: change how hbin sections are read.
lib: allow to walk registry with corrupted blocks
hivexsh: add -u flag for HIVEX_OPEN_UNSAFE.
hivexregedit: all
This flag will be used to control behavior of libhivex API functions so
that they tolerate corruption in hives by either using heuristic
recovery from unexpected situations or simply ignore bad registry
keys/values whenever possible.
---
generator/generator.ml | 8
lib/handle.c
via new --unsafe flag. Also make --export catpure, log and skip over
errors when reading subkeys/values so that export in unsafe mode does
not abort at first sign of error.
---
perl/lib/Win/Hivex/Regedit.pm | 59 ++-
regedit/hivexregedit | 20
and pass it to hivex_open. Additionally make hivex_value_value failures
non-critical in this mode when iterating through node children/values.
---
sh/hivexsh.c | 26 --
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/sh/hivexsh.c b/sh/hivexsh.c
index
Only when HIVEX_OPEN_UNSAFE flag is set:
* hivex_open: when looping over hbin sections (aka pages), handle a
case where following hbin section may not begin at exactly at the end
of previous one. If this happens, scan the page section until next
one is found and validate it by checking
On Thu, 2017-02-16 at 08:43 +, Richard W.M. Jones wrote:
> On Wed, Feb 15, 2017 at 10:59:33PM +, Richard W.M. Jones wrote:
> >
> > OK, I ended up turning the warning off. It appears from the
> > info file that the warning is about GCC not being able to make
> > an optimization, not a bug
On Wed, 2017-02-15 at 22:35 +, Richard W.M. Jones wrote:
> On Wed, Feb 15, 2017 at 10:29:41PM +, Richard W.M. Jones wrote:
> > Yes, or even how about this (not tried it):
> >
> > while (off <= h->endpages - 0x1000) {
> > ...
> > }
>
> In fact this doesn't work either :-(
>
> I'll have
On Wed, 2017-02-15 at 16:50 -0500, Dawid Zamirski wrote:
> On Wed, 2017-02-15 at 21:14 +, Richard W.M. Jones wrote:
> > On Wed, Feb 15, 2017 at 02:28:41PM -0500, Dawid Zamirski wrote:
> > > Correct, however there's also no guarantee that seeking by 4k in
> > > "
On Wed, 2017-02-15 at 21:14 +, Richard W.M. Jones wrote:
> On Wed, Feb 15, 2017 at 02:28:41PM -0500, Dawid Zamirski wrote:
> > Correct, however there's also no guarantee that seeking by 4k in
> > "garbage" data would not land you in registry data that happens to
>
There are some corrupted registry files that have invalid hbin cells
but are still readable. This patch makes the following changes:
* hivex_open - do not abort with complete failure if we run across a
block with invalid size (unless it's the root block). Instead just
log the event, and move
On Wed, 2017-02-15 at 18:52 +, Richard W.M. Jones wrote:
> On Wed, Feb 15, 2017 at 01:48:29PM -0500, Dawid Zamirski wrote:
> > On Wed, 2017-02-15 at 16:54 +, Richard W.M. Jones wrote:
> > > On Tue, Feb 14, 2017 at 12:05:20PM -0500, Dawid Zamirski wrote:
> > > &
On Wed, 2017-02-15 at 16:54 +, Richard W.M. Jones wrote:
> On Tue, Feb 14, 2017 at 12:05:20PM -0500, Dawid Zamirski wrote:
> > * hivex_open: when looping over hbin sections (aka pages), handle a
> > case where following hbin section may not begin at exactly at the
> >
ch does not have to
be true and GCC7 is correct.
Regards,
Dawid Zamirski (2):
lib: change how hbin sections are read.
lib: allow to walk registry with corrupted blocks
lib/handle.c | 55 ++-
lib/node.c | 21
* hivex_open: when looping over hbin sections (aka pages), handle a
case where following hbin section may not begin at exactly at the end
of previous one. If this happens, scan the page section until next
one is found and validate it by checking declared offset with actual
one - if they
There are some corrupted registry files that have invalid hbin cells
but are still readable. This patch makes the following changes:
* hivex_open - do not abort with complete failure if we run across a
block with invalid size (unless it's the root block). Instead just
log the event, and move
lty block with debug message
Regards,
Dawid Zamirski (2):
lib: change how hbin sections are read.
lib: allow to walk registry with corrupted blocks
lib/handle.c | 55 ++-
lib/node.c | 21 -
2 files changed, 58 inserti
* hivex_open: when looping over hbin sections (aka pages), handle a
case where following hbin section may not begin at exactly at the end
of previous one. If this happens, scan the page section until next
one is found and validate it by checking declared offset with actual
one - if they
On Tue, 2017-02-14 at 14:30 +, Richard W.M. Jones wrote:
> On Wed, Feb 08, 2017 at 04:36:31PM -0500, Dawid Zamirski wrote:
> > There are some corrupted registry files that have invalid hbin
> > cells
> > but are still readable. This patch makes the following changes:
>
Hi Rich,
Thanks for taking time to review my patches.
On Tue, 2017-02-14 at 14:30 +, Richard W.M. Jones wrote:
> On Wed, Feb 08, 2017 at 04:36:31PM -0500, Dawid Zamirski wrote:
> > =
> > +if (is_root) {
> > + bad_root_block = 1;
> > +} el
This patch updates the guestfs_inspect_get_drive_mappings API call to
also return drive letters for GPT paritions. Previously this worked
only for MBR partitions. This is achieved by matching the GPT partition
GUID with the info stored in the blob from
HKLM\SYSTEM\MountedDevices\DosDevices keys.
This patch updates the guestfs_inspect_get_drive_mappings API call to
also return drive letters for GPT paritions. Previously this worked
only for MBR partitions. This is achieved by matching the GPT partition
GUID with the info stored in the blob from
HKLM\SYSTEM\MountedDevices\DosDevices keys.
This patch updates the guestfs_inspect_get_drive_mappings API call to
also return drive letters for GPT paritions. Previously this worked
only for MBR partitions. This is achieved by matching the GPT partition
GUID with the info stored in the blob from
HKLM\SYSTEM\MountedDevices\DosDevices keys.
On Fri, 2016-02-05 at 18:08 +, Richard W.M. Jones wrote:
> On Fri, Feb 05, 2016 at 12:15:32PM -0500, Dawid Zamirski wrote:
> > This patch updates the guestfs_inspect_get_drive_mappings API call
> > to
> > also return drive letters for GPT paritions. Previously this wo
27 matches
Mail list logo
