Skip to content

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also compare across forks.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also compare across forks.
Commits on Sep 22, 2011
@ajnelson hivexml: Do not print null input times
Dealing with "1601-01-01T00:00:00Z" is unnecessarily awkward, especially
since the value only represents a 0 found in the data.

Signed-off-by: Alex Nelson <>
Commits on Oct 22, 2011
@rwmjones rwmjones regedit: Fix syntax for deleting registry keys (RHBZ#737944).
Previously we parsed -[...] to delete a registry key, but this is not
correct.  It should be [-...].  Reference:
Commits on Oct 24, 2011
@rwmjones rwmjones Version 1.3.2. 168c413
@rwmjones rwmjones Fix conditional test for HAVE_HIVEXSH.
This fixes commit 0a28041.
Commits on Nov 19, 2011
@rwmjones rwmjones python: Support Python 3 (RHBZ#752916). 207402a
Commits on Nov 22, 2011
@hillu hillu out of tree build: ruby 48d2e0d
Commits on Nov 29, 2011
@rwmjones rwmjones Revert "out of tree build: ruby"
This reverts commit 48d2e0d.

This commit breaks the ordinary build:

make[2]: Entering directory `/home/rjones/d/hivex/ruby'
rake build
rake/rdoctask is deprecated.  Use rdoc/task instead (in RDoc 2.4.2+)
rake/gempackagetask is deprecated.  Use rubygems/package_task instead
top_srcdir=$(pwd)/..; top_builddir=$(pwd)/..; export ARCHFLAGS="-arch $(uname -m)"; mkdir -p ./ext/guestfs; cd ./hivex; ruby #(EXT_CONF} --with-_hivex-include=$top_srcdir/lib --with-_hivex-lib=$top_builddir/lib/.libs
sh: line 0: cd: ./hivex: No such file or directory
@rwmjones rwmjones Update to latest gnulib (RHBZ#756981). 2751429
@rwmjones rwmjones Version 1.3.3. 1cdc08c
Commits on Nov 30, 2011
@hillu hillu out of tree build: ruby (second take) 70e2fda
Commits on Dec 01, 2011
@hillu hillu hivex: Added gnulib includes from builddir, as suggested by the Gnuli…
…b documentation; link hivexml against libgnu.

    Since some modules (`getopt', for example) may copy files
    into the build directory, `top_builddir/lib' is needed as well as
    `top_srcdir/lib'. -- GNU Gnulib manual, section 2.2 Initial import

This fixes an in-tree build failure on a Debian/sid system (see
below). hivexml could be built out-of-tree, but it turned out that due
to a missing include path, in this case the system's getopt
implementation was used insted of Gnulib's.

make[2]: Entering directory `«SRCDIR»/xml'
gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I..    -DLOCALEBASEDIR=\""/usr/local/share/locale"\" -I../gnulib/lib -I../lib -I/usr/include/libxml2     -g -O2 -MT hivexml-hivexml.o -MD -MP -MF .deps/hivexml-hivexml.Tpo -c -o hivexml-hivexml.o `test -f 'hivexml.c' || echo './'`hivexml.c
mv -f .deps/hivexml-hivexml.Tpo .deps/hivexml-hivexml.Po
/bin/bash ../libtool  --tag=CC   --mode=link gcc -std=gnu99 -DLOCALEBASEDIR=\""/usr/local/share/locale"\" -I../gnulib/lib -I../lib -I/usr/include/libxml2     -g -O2   -o hivexml hivexml-hivexml.o ../lib/ -lxml2
libtool: link: gcc -std=gnu99 -DLOCALEBASEDIR=\"/usr/local/share/locale\" -I../gnulib/lib -I../lib -I/usr/include/libxml2 -g -O2 -o .libs/hivexml hivexml-hivexml.o  ../lib/.libs/ /usr/lib/
hivexml-hivexml.o: In function `main':
«SRCDIR»/xml/hivexml.c:96: undefined reference to `rpl_getopt'
«SRCDIR»/xml/hivexml.c:110: undefined reference to `rpl_optind'
«SRCDIR»/xml/hivexml.c:154: undefined reference to `rpl_optind'
collect2: ld returned 1 exit status
make[2]: *** [hivexml] Error 1
make[2]: Leaving directory `«SRCDIR»/xml'
Commits on Dec 09, 2011
@hillu hillu hivex: Fix Ruby bindings for 1.9; let the user explicitly choose ruby…
…, rake
Commits on Dec 20, 2011
@rwmjones rwmjones hivexml: Remove unused variable. 233ac98
Commits on Jan 05, 2012
@ajnelson Add test hive and generator script
Signed-off-by: Alex Nelson <>
@ajnelson generator: Add new return type to ABI: RLenValue
RLenValue is similar to RLenType, though with one less argument.  This
required adding additional conversion functions for several languages'

Signed-off-by: Alex Nelson <>
@ajnelson hivex: Add offset-&-length function for long value data
This patch adds value_data_cell_offset to the hivex ABI, to report the
hive space used for long (>4 bytes) value data.

Signed-off-by: Alex Nelson <>

RWMJ: Rewrote the description of this function to make it clearer.
@ajnelson ocaml: Add unit test for new RLenValue type
Signed-off-by: Alex Nelson <>
@ajnelson perl: Add unit test for new RLenValue type
Signed-off-by: Alex Nelson <>
@ajnelson python: Add unit test for new RLenValue type
Signed-off-by: Alex Nelson <>
@ajnelson ruby: Add unit test for new RLenValue type
Signed-off-by: Alex Nelson <>
Commits on Mar 13, 2012
@rwmjones rwmjones builds: Disable -Wno-missing-field-initializers and enable some other…
… warnings.
@rwmjones rwmjones Ignore perl/MYMETA.json 1b65188
@rwmjones rwmjones Update gnulib to latest. 6a5449c
@rwmjones rwmjones Add wrapper script from libguestfs. df61bc0
@rwmjones rwmjones Distribute 'images/rlenvalue_test_hive' in tarball. 0eaf03a
@rwmjones rwmjones Version 1.3.4. ea5ae28
@rwmjones rwmjones Fix ruby tests for ruby 1.9. ea14438
@rwmjones rwmjones Version 1.3.5. 0e60aa6
Commits on Mar 30, 2012
@rwmjones rwmjones RHEL 5: configure: Fix test for caml_raise_with_args. 7fdaaf4
@rwmjones rwmjones RHEL 5: build: Fix some C99-isms that confuse old gcc. 0030147
@rwmjones rwmjones RHEL 5: build: Define builddir, abs_srcdir if they don't exist. ebd2da9
Commits on May 11, 2012
@ajnelson hivexml: Add byte run reporting functions
This patch adds value_byte_runs and node_byte_runs.  Each byte run
represents the offset and length of a data structure within the hive,
one per node, and one or two per value depending on the length of the
value data.

These byte run functions also add additional data sanity checks as a
hive is being parsed, mainly checking that a node address actually
points to a node, and similarly for values.
@rwmjones rwmjones Update to latest gnulib. af590d3
Commits on May 15, 2012
@rwmjones rwmjones python: Fix python tests.
$(srcdir) isn't expanded by configure.
Commits on Jun 12, 2012
@rwmjones rwmjones Version 1.3.6. 7ab9182
Commits on Aug 28, 2012
Jim Meyering maint: avoid some syntax-check test failures
* (_img_regexp): Exempt two VC'd image files from syntax
check rules that look for trailing blanks and empty lines at EOF.
* sh/hivexsh.pod: Remove trailing spaces.
Jim Meyering build: update gnulib submodule to latest 95fe2b1
Jim Meyering tests: avoid spurious failure when run in non-srcdir build
* ocaml/t/ Avoid spurious failure when the
test is run in a non-srcdir (aka VPATH) build.  I.e., open a
$srcdir-relative name, rather than assuming $srcdir is ".".
Jim Meyering maint: remove unnecessary mkdir -p
* ocaml/ (install-data-hook): Remove unneeded mkdir -p.
It's job is handled by the very next mkdir -p.
Commits on Sep 03, 2012
@hillu hillu Fixed checks for libpython features
The python3.1 package shipped with Debian/squeeze does not have the
'mu' suffix that was assumed before.

RWMJ: This was originally formulated for libguestfs, but the same
patch applies to hivex and fixes the following bug reported against
Gentoo by Joshua Rich:
@rwmjones rwmjones Add ./configure --disable-ocaml option.
The code is copied from libguestfs.
@rwmjones rwmjones Add ./configure --disable-perl option.
The code is copied from libguestfs.
@rwmjones rwmjones Add ./configure --disable-python option.
The code is copied from libguestfs.
@rwmjones rwmjones Fix detection of Ruby C extensions library.
The code is copied from libguestfs.
Commits on Oct 11, 2012
Peter Fokker patch for read support of "li"-records from "ri" intermediate

Thank you for creating the hivex-library. Studying your source code helped
me a great deal to better understand the internals of the Windows Registry.

However, while I was browsing a real-world SOFTWARE-hive (XP, SP3) I
could not browse to the '\Classes' key. Instead I got this (debug)-message:

    get_children: returning ENOTSUP because ri-record offset does not
point to lf/lh (0x49020)

I tracked this issue down and I discovered that the intermediate
"ri"-record may not only contain offsets to "lf" and "lh" but to
"li"-records too.

Attached is a patch against hivex.c v1.3.3 that recognises
"li"-records referenced from "ri"-records. For me this fixed the issue
with browsing the '\Classes' key.

Note that I have not fixed the related problem of rewriting
"li"-records when inserting a new subkey or deleting an
existing one. This sure would cause problems when I were to
add/delete a subkey to/from '\Classes'.

The original patch submitted is here:
Changes made:
 - Removed commented-out code for writing.
 - Re-added some checking code to reduce the delta of this patch
   to the previous code.  The checks can be removed in a separate
   patch if necessary.
@rwmjones rwmjones Version 1.3.7. 0d69e08
Commits on Nov 22, 2012
@rwmjones rwmjones regedit: Update unix2dos command in man page (thanks Skippy VonDrake). ad2d1c8
Commits on Dec 10, 2012
@rwmjones rwmjones ocaml: Stable dependencies. bf9f075
@rwmjones rwmjones sh: Don't leak 'data' along error path (found by Coverity). cf77da0
@rwmjones rwmjones sh: Don't leak 'data' when printing (found by Coverity). d584396
@rwmjones rwmjones Rewrite and simplify hivex_node_set_value.
Coverity pointed to multiple use-of-uninitialized-value errors in this
function.  However the function was incredibly hard to follow, so I
couldn't really tell if this was a real problem or not.  In any case,
I rewrote the function to be more sane.
Commits on Dec 27, 2012
@rwmjones rwmjones arm: Prevent cast-align warnings.
The implicit alignment of char* is 1 byte, so on ARM we get a
cast-align warning whenever we try to cast this to a larger type
(eg. casting to uint32_t).

The implicit alignment of void* is whatever malloc returns, and so
this can be cast to any type.

The cost of this is that we have to add (char *) casts all over the
code, but this seems unavoidable.

Thanks: Leif Lindholm, Peter Robinson.
Commits on Jan 24, 2013
@rwmjones rwmjones python: Make class derive from 'object'.
For an overview, see this question and the links from there:
Commits on Feb 15, 2013
@rwmjones rwmjones ruby: Use updated rake package names, but allow fallback to the old n…
@rwmjones rwmjones automake: Force serial-tests.
In automake 1.13, parallel tests is the default.
@rwmjones rwmjones ruby: Use RbConfig instead of Config.
This works as well on Ruby 1.8.
Commits on Apr 05, 2013
@ajnelson Remove obsolete AM serial-tests
Per recommendations at:

Also per build failure in Fedora 17.  Automake v1.11.6.

Signed-off-by: Alex Nelson <>
@ajnelson Mac OS X: Link iconv in libhivex
hivexml on OS X was failing with a symbol-not-found error while
dynamically linking.  Adding iconv to libhivex fixes the issue and lets
OS X process 'images/large' with hivexml.

It took careful iconv autotool additions to get compilation working in
Fedora as well, but these two lines build and run on OS X 10.6 and
10.8, and Fedora 17 and 18.

Unfortunately, a separate issue is revealed here in OS X, as some of
the hivexml value data appears as Kanji.  However, that is an issue
distinct from getting the program to run.

Signed-off-by: Alex Nelson <>
Commits on Apr 29, 2013
@hillu hillu Build and test Perl bindings out-of-tree.
Remaining issue: The C file that is generated from XS is still built
in the source directory
Commits on May 24, 2013
@hillu hillu Fix bindings for python 3.3 (as shipped with Debian and Ubuntu). 8730d4c
@hillu hillu Build Python extension with PEP-3149 compliant suffix if defined. a672bbb
@rwmjones rwmjones perl: Ignore run-perl-tests (generated script). 72e2abf
Commits on May 30, 2013
@hillu hillu Revert "Build and test Perl bindings out-of-tree."
There seems to be no sane way to build/test an
ExtUtils::MakeMaker-based project in a separate directory and get
identical results.

This reverts commit 8874667.
@hillu hillu Revert "perl: Ignore run-perl-tests (generated script)."
This reverts commit 72e2abf.
Commits on Jun 19, 2013
@hillu hillu Relax size checks for integer types
I recenetly came across a Windows XP image, where one REG_QWORD value
(HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0\0\ExecTime)
would be displayed by hivexsh but hivex_value_qword() would return -1.

It turned out that the data length of this value was 16 bytes instead
of 8.

There is no problem in simply interpreting the first 4 (DWORD) or
8 (QWORD) bytes -- if there are enough bytes to be interpreted.
Commits on Jun 25, 2013
@hillu hillu Add read support for "big data" blocks to hivex
Large values are split into multiple blocks. References to these
sub-blocks are kept in a list whose structure seems to be identical to
a value list.

A "db" record contains information on the number of sub-blocks and a
pointer to the list. It is referenced by the vk record.

I came across this when comparing the contents of HKLM\SOFTWARE hives
from Windows7 systems and finding that hivex_value_value would only give
me identical first 12 bytes for certain records though the data size had
changed. If one runs hivexsh with debug messages enabled, it gives a
warning when listing these values, for example:

SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate> lsval
hivex_value_value: warning: declared data length is longer than the
block it is in (data 0x28b9b60, data len 115347, block len 16)
Commits on Jun 28, 2013
Daniel Gillen hivex: Add O_BINARY flag to open calls for platforms where this isn't…
… the default (such as Win32)
@rwmjones rwmjones commit: Set O_CLOEXEC or FD_CLOEXEC on the file descriptor. 3ae8736
Commits on Jul 23, 2013
@rwmjones rwmjones lib: Cast h->addr to char* in macro.
This is a fix for commit f8b62e4.
Commits on Jul 24, 2013
@rwmjones rwmjones build: Ignore .gdb_history file. 89a689e
@rwmjones rwmjones build: Add *~ to CLEANFILES. 3b6fda4
@rwmjones rwmjones lib: Move the 'offset_list' struct into a separate compilation unit. c7e93f0
@rwmjones rwmjones Revert "patch for read support of "li"-records from "ri" intermediate"
This reverts commit c29d262.
@rwmjones rwmjones lib: Add some debugging. 282f8eb
@rwmjones rwmjones lib: Add a DEBUG macro and use it instead of fprintf.
Allows us to control the format of debug messages more carefully.
@rwmjones rwmjones lib: Add macros for setting errno and checking if the hive is writable.
This is code cleanup, but there are a couple of small changes:

 - the msglvl for errno explanations moves from debug (2) to verbose (1)

 - add and tidy up some of the error messages
@rwmjones rwmjones Fix .gitignore. b3c871e
@rwmjones rwmjones lib: Split up the large file lib/hivex.c into multiple small source f…
@rwmjones rwmjones lib: get_children: Document the function, and small non-functional cl…
Commits on Jul 25, 2013
@rwmjones rwmjones lib: get_children: Use offset_list limits to limit length of returned…
… lists.

This will allow us to change the function to work recursively, and
still enforce these limits.
@rwmjones rwmjones lib: get_children: Refactor this into two functions.
Although this change seems rather large, including removing a large
block of dead code, there should be no functional change.
@rwmjones rwmjones lib: get_children: Factor out valid block test into separate function.
Just refactoring, no functional change.
@rwmjones rwmjones lib: get_children: Add additional check that each child is an nk block. 0661ec6
@rwmjones rwmjones lib: get_children: Handle ri-record by just recursing.
No functional change.
@rwmjones rwmjones lib: get_children: Add a check that we don't overrun ri-record when r…
@rwmjones rwmjones lib: get_children: Handle li-records as intermediate nodes (RHBZ#7175… aae468d
@rwmjones rwmjones lib: node_add_child: Factor out subkey insertion into separate function.
No functional change.
@rwmjones rwmjones lib: node_add_child: Handle li-records as intermediate notes (RHBZ#98…

This commit implements adding a child to a registry key that uses
li-records for intermediate nodes.
@rwmjones rwmjones lib: node_add_child: Checks that we don't extend records beyond maxim…
…um number of subkeys permitted.

Previously we didn't check this, so it was possible that
nr_subkeys/nr_offsets would wrap around to 0.
@rwmjones rwmjones build: Add a ./run script.
As with libguestfs and other projects, this script allows you to run
programs without installing them first, eg:

  ./run ./regedit/hivexregedit ...

It also simplifies writing the tests.
@rwmjones rwmjones tests: Add extra-tests directory to go with hivex-test-data. 392d2bc
@rwmjones rwmjones build: Add 'make maintainer-tag' rule (copied from libguestfs). 09d0c09
@rwmjones rwmjones translations: Change transifex download URL. b4dfa2e
@rwmjones rwmjones Version 1.3.8. b95a693
Commits on Jul 26, 2013
@rwmjones rwmjones extra-tests: Add a test of node insertion in real hives. 469e697
Commits on Sep 10, 2013
@rwmjones rwmjones lib/write: Add some debugging messages. 7254819
@rwmjones rwmjones ppc: iconv: Source is UTF-16LE not just UTF-16.
On big endian architectures like PowerPC, "UTF-16" means "UTF-16BE"!
@rwmjones rwmjones lib: Add attribute((packed)) on inner struct.
Apparently this attribute is not "inherited" from the outer struct to
the inner struct.
@rwmjones rwmjones ppc: handle: Display block id in debug output portably.
On PowerPC, 'char' is 'unsigned char', whereas on everything else it
is 'signed char'.  Therefore the block id fields got printed
differently (unsigned integers on ppc, signed numbers everywhere

Change this debug message to be more informative and portable.
@rwmjones rwmjones lib: Add debugging of return values from _hivex_get_children.
The debugging is commented out as it's huge and wasn't especially
@rwmjones rwmjones ppc: Fix endianness bug which caused node_add_child to fail.
Code used:

  le32toh (reg_field + 0x1000)

instead of the correct version:

  le32toh (reg_field) + 0x1000

The first incorrect form adds 0x1000 to the possibly byte-swapped
registry field, corrupting it.

I used the following command to look for problems in the remaining
code but did not find any:

  git grep -P 'le\d+toh\s*\([^)]*\+'

NOTE that 'htole32 (reg_field - 0x1000)' is correct.
Commits on Oct 16, 2013
@ajnelson lib: Promote byte_conversions.h #include to hivex-internal.h
This patch addresses a build failure in OS X.  Running git-bisect on a
straightforward build (bootstrap,, configure, make, make
install) showed this as the "Bad commit:"

The issue is that hivex-internal.h uses le32toh in a static inline
function.  In case `configure` doesn't find le32toh, byte_conversions.h
defines it.  But hivex-internal.h doesn't include the safety definition.

OS X demonstrates this a problem.  Neither endian.h nor byteswap.h are
found with `configure` in OS X 10.8.5 (XCode 5), but the headers are
both found in Fedora 19 and Ubuntu 13.04.  This patch to
further logs that only ntohl is available for byte swaps:

    @@ -153,6 +153,8 @@ AC_REPLACE_FUNCS([mmap])
     dnl Functions.

    +AC_CHECK_FUNCS([le32toh ntohl bswap_32 __bswap_32])

(As an aside, it's curious that a missing byteswap.h didn't cause
hivex-internal.h to fail to build.)
(As another aside, this is an interesting example of lazy symbol
binding failing with an inline function.)

The problem is resolved by having hivex-internal.h include
byte_conversions.h.  This obviates most of the other direct inclusions
of byte_conversions.h.  (One persists under sh/.)

This patch builds and runs hivexml on images/large fine in Ubuntu 13.04
and Fedora 19.  It also allows builds to succeed in OS X, but doesn't
run hivexml for an unrelated reason.  The _iconv_open
symbol-not-found issue, that I thought was previously resolved
(491ba0f), resurfaced.

Signed-off-by: Alex Nelson <>
Commits on Nov 22, 2013
@hillu hillu Document ntreg_nk_record.flags 4e46355
@hillu hillu Handle UTF-16-LE-encoded key/value names a6f99ed
@hillu hillu Correctly handle latin1-encoded key/value names 2a0a11e
Commits on Nov 26, 2013
@hillu hillu lib: Further generalize iconv wrapper function. 99027f7
@hillu hillu lib: Add function that encodes UTF-8 to "packed" strings or UTF-16LE …
…as Windows does
@hillu hillu lib: Add support for creating nodes (keys) and values with UTF-16LE-e…
…ncoded names
Commits on Dec 31, 2013
@rwmjones rwmjones lib: write: Remove unused variable. 1a4d66b
@rwmjones rwmjones lib: utf16: Fix const-correctness issues in _hivex_recode function.
This patch assumes that iconv doesn't actually modify the
input buffer, even though it is declared as char *.
Commits on Jan 08, 2014
@hillu hillu lib: Add internal function to calculate strlen for strings encoded in…
… Latin1 or UTF-16LE
@hillu hillu lib: Mind character encoding in value_key_len, add matching node_name…
…_len function

Since iconv() does not treat null characters as special, this makes it
possible to read node names and value keys with embedded null
characters. which are not displayed at all by Windows Regedit.
@hillu hillu generator: use node_name_len, value_key_len API in bindings 64f5a2a
Commits on Jan 10, 2014
@rwmjones rwmjones Fix const-correctness in _hivex_utf8_strlen function.
Plus a whitespace fix.
Commits on Jan 13, 2014
@hillu hillu Add a minimal hive with "special" keys and values 1a95c03
@hillu hillu lib: Use vk->len for string conversion 2e5d3af
@hillu hillu perl: Add test for "special" keys and values a182e40
@hillu hillu python: Add test for "special" keys and values d2c39ff
@hillu hillu perl: Properly decode node names, value keys from UTF-8 40fff10
@hillu hillu python: Python 3 no longer recognizes long integers d6e3178
@hillu hillu python: fix test runner so scripts are found when building out-of-tree ee7eb78
@hillu hillu ruby: Fix tests for out-of-tree build, simplify test scripts 8da024e
@hillu hillu ruby: Properly declare UTF-8 encoding on node names, value keys fd84c5e
@hillu hillu ruby: Add test for "special" keys and values 1197bd5
@hillu hillu Tweak STDOUT, STDERR instead of depending on utf8::all 8253b25
Commits on Jan 14, 2014
@hillu hillu lib: Make empty strings in REG_MULTI_SZ values available. 59e31ee
Commits on Jan 15, 2014
@hillu hillu Python 2.6 does not have sysconfig. 21ded1e
@hillu hillu python: Fix encoding for "special" test script
Hopefully. Python's unicode history is a mess.
@hillu hillu python: Produce Unicode strings in get_* methods 74c7cd0
@hillu hillu python: Get rid of to_string function in test script
Since values are now returned as strings in Python2 and Python3,
treating them as bytes in Python 3 would break tests.
Commits on Jan 16, 2014
@hillu hillu ruby: find files to install in correct directories when building out-…
@hillu hillu Make sure that pod2html finds the POD file when building out-of-tree
Otherwise we get "Can't open ..." warnings which don't seem to be fatal.
@hillu hillu ruby: Support 'make INSTALLDIRS=vendor install' for Ruby
(This is the same change as 87c9ec881cb695724e01d9f6fc9df996d4c67cb6
in libguestfs.)
@hillu hillu ruby: Fix fallback to rake/rdoctask for old rake.
(This is the same change as 480bd3a6d8a56b37936b08c94eb99f0921fe65de
in libguestfs.)
Commits on Jan 17, 2014
@rwmjones rwmjones Version 1.3.9. b1abc44
Commits on Feb 03, 2014
@hillu hillu python: value_value no longer generates Unicode strings
This fixes Github issue #2 reported by "kupiakos".

Commits on Feb 07, 2014
@hillu hillu Use correct constant in diagnostic error message ad32d89
@hillu hillu Bump value size limit
I actually encountered a binary value with 1033680 bytes.
Commits on Mar 26, 2014
@rwmjones rwmjones lib: Fix memory leak (found by Coverity). 39cc765
Commits on Apr 23, 2014
@ptoscano ptoscano ruby: tests: isolate boilerplate in common file
Isolate in a common file all the standard boilerplate in tests, i.e. the
import of the test framework and the guestfs module (including the
import path hack needed for the latter).

(This is the same change as fbae7f3e69ce598c52af71ec204f8dbd0a9ce5e5
in libguestfs.)
@ptoscano ptoscano ruby: tests: convert from Test::Unit to MiniTest (RHBZ#1090407)
Convert the tests to the MiniTest test framework, but keeping the usage
of the old Test::Unit as fallback in case MiniTest is not available.
In the latter case, use a bit of "glue" to make the old API look like
the new API, so we can just rely on the newer MiniTest API.

(This is the same change as 2f5e9066db817f75b245f256abc0c64dd1ae54eb
in libguestfs.)
@rwmjones rwmjones gitignore: Ignore run-ruby-tests (generated). 6e7d2b0
@rwmjones rwmjones Update gnulib to latest.
This update enables the -Wjump-misses-init warning, so we have to
disable it in, since a lot of hivex code does this.
@rwmjones rwmjones Version 1.3.10. aca0a4d
Commits on May 14, 2014
@rwmjones rwmjones perl: Provide alternate definition of newSVpvn_utf8 for older Perl.
Commit 40fff10 uses newSVpvn_utf8.
This macro did not exist in Perl < 5.12, but we can use newSVpvn

Also update the associated test script:

- Don't use 'done_testing'.  Not supported by ancient Perl.

- Skip the tests entirely on ancient Perl.
Commits on May 20, 2014
@rwmjones rwmjones generator: Fix a spelling mistake in the documentation (RHBZ#1099286). cea8dbf
Commits on Aug 07, 2014
@Lekensteyn Lekensteyn Fix garbage return value on error
If str contains invalid characters, ret is not initialised. Caught by
Clang static analyzer.
@Lekensteyn Lekensteyn Fix overly long assertion string
With GCC 4.9.1 I get a -Woverlength-strings warning:
hivex-internal.h:123:23: error: string length ‘3823’ is greater than ...
   (STREQLEN (((struct ntreg_hbin_block *)((char *) (h)->addr + (offs)))->id, (eqid), 2))

The compile command can be shortened to:

    cd lib && cpp -DHAVE_CONFIG_H -I.. -I../gnulib/lib  -I. \
        -Woverlength-strings -Werror -g -O2 write.c

After that, be amazed at the huge assertion string produced by the
macro which is also visible in (two times).

To fix that mess, use an inline function. The `STR*` macros were moved
and a string.h header added since STREQLEN is used in the function.
Commits on Aug 08, 2014
@Lekensteyn Lekensteyn Silence dead assigmnents/initialization/increments
Some of these assignments were introduced in commit
c9d5cd0 ("hivex: Fix allocations that
may move C heap buffer."), but turn out to be unnecessary (unused).
Replace the assignments by a comment in case someone extends the code

Caught by Clang static analyzer.
@Lekensteyn Lekensteyn Avoid calling calloc(0, x)
The return value for zero-size allocations is implementation-defined
(can be NULL or a unique pointer for free()). Just return early here as
there is nothing to print.

Caught by Clang static analyzer.
Commits on Aug 12, 2014
@Lekensteyn Lekensteyn python: expose package version
Exposing the module version through the `__version__` property conforms
to PEP-396. The recommended versioning scheme is specified in

@Lekensteyn Lekensteyn python: move module to separate directory
This allows submodules to be added under the 'hivex' namespace. A new
`pythonmoddir` variable was added for separating and the
Python hivex module.
@Lekensteyn Lekensteyn python: export hive_types constants
Instead of using magic numbers or copying the numbers all over place,
make the hive type constants available so you can do:

    import hivex
    from hivex.hive_types import *

    h = hivex.Hivex ("../images/minimal", write = True)
    new_value = { "key": "abc", "t": REG_BINARY, "value": b"xyz" }
    h.node_set_value (h.root (), new_value)
@rwmjones rwmjones Ignore python/hivex directory.
It contains only generated files.
Commits on Aug 18, 2014
@Lekensteyn Lekensteyn python: use errors more specific than RuntimeError
KeyError is documented as:
"Raised when a mapping (dictionary) key is not found in the set of
existing keys."

TypeError is documented as:
"Raised when an operation or function is applied to an object of
inappropriate type."

RuntimeError is documented as:
"Raised when an error is detected that doesn’t fall in any of the other

Let's be more specific with exceptions. The exception all inherit from
StandardError (and from Exception), but not from RuntimeError, so this
might need some code changes (if users would catch this specific error).
However, this behavior was not documented so it is perfectly fine to
change it.
@Lekensteyn Lekensteyn python: use PyErr_NoMemory
If malloc fails, just throw a NoMemory exception rather than showing
"RuntimeError: Cannot allocate memory".
@Lekensteyn Lekensteyn python: check some types for get_value
Recognise early that a value passed to node_get_value is not a dict
rather than spitting out "no 'key' element in dictionary".

Detect errors for invalid `t` elements instead of silently using `-1`.
@Lekensteyn Lekensteyn python: fix crash by validating key and value
User-visible changes: no crashes if you try to pass a non-str type as
key/value in Python 3. Exceptions are thrown rather than silently
ignoring type violations (such as passing a Unicode string as value
in Python 2).

Until now, Python 2 keys and values were assumes to be bytes, in
Python 3 these were seen as Unicode strings instead. Remove the
compile-check for a deprecated Python 2 function (`PyString_AsString`)
and check for byte types instead.

For keys, accept both strings and bytes as the common case is to pass
a ASCII string name. (The `\u20ac` Unicode character (Euro-sign) is
apparently also valid as key name, verified with Python 3 and
Windows 7).

For values, be more conservative and reject all types except bytes. This
better matches the C API and removes the burden of character conversion
from the wrapper. Instead, callers should know the correct encoding
and terminate strings.

Modify tests to specify bytes instead of strings. (Otherwise Python 3
would break while Python 2 still passes.)
@Lekensteyn Lekensteyn python: add heavier tests for setvalue
Ensure that invalid types are not silently ignored (and test to avoid
@Lekensteyn Lekensteyn generator: Fix mixed tabs/spaces
vim :set ts=8 :retab
Commits on Sep 22, 2014
@rwmjones rwmjones value: Set errno = 0 on non-error path in hivex_value_data_cell_offse…
…t (RHBZ#1145056).

hivex_value_data_cell_offset may return 0 to indicate that the data is
inline.  This is not an error return, but it was possible for errno to
have a random (non-zero) value along this path.  Explicitly set errno
= 0 on this path.

Thanks: Wei Shi
@rwmjones rwmjones hivexml: Tidy up error handling and printing. 914d9b9
Commits on Oct 30, 2014
@rwmjones rwmjones handle: Refuse to open files < 8192 bytes in size.
These cannot be valid hives, since they don't contain a full header
page and at least a single page of data (in other words they couldn't
contain a root node).

Thanks: Mahmoud Al-Qudsi
@rwmjones rwmjones handle: Check that pages do not extend beyond the end of the file.
Thanks: Mahmoud Al-Qudsi
@rwmjones rwmjones extra-tests: Add trivial fuzz tester.
Could be improved greatly, but it's a start.
@rwmjones rwmjones Version 1.3.11.
Also update translations from transifex.
Commits on Nov 06, 2014
@ptoscano ptoscano normalize iconv handling
Since the signature of iconv() changes between implementations (the
constness of the second parameter, in particular), make use of the iconv
module of gnulib to handle these potential differences.

(This is a reduced version of 57512e778558c5b93cfa360c83836c2cf8fc5908
in libguestfs.)
@ptoscano ptoscano ruby: fix detection of ruby library
Query RbConfig::CONFIG for "libdir", and use that when trying to link to
the ruby library.  This fixes the libruby detection when it is installed
in a non-standard library directory.

(This is the same change as 3d02e53c48266669675cc237f61ae2c4e1816e66
in libguestfs.)
Commits on Nov 13, 2014
@ptoscano ptoscano lib: write: fix memory leak
Free the "blocks" array got from _hivex_get_children.

Thanks: Mahmoud Al-Qudsi
Commits on Nov 14, 2014
@rwmjones rwmjones lib: Increase HIVEX_MAX_VALUE_LEN to 8000000.
I encountered a hive that contained a key of 3_886_561 bytes length in
a key called 'HKLM\SYSTEM\ControlSet001\services\mfeavfk' (apparently
belonging to "McAfee Anti-virus software").

The previous limit was set arbitrarily at 2_000_000 bytes.  Increase
it to cope with this larger key.
Commits on Nov 20, 2014
@rwmjones rwmjones lib: Increase HIVEX_MAX_SUBKEYS to 25000.
Thanks Nicolas Ecarnot who found a HKLM\SOFTWARE hive from a Windows
XP machine which had an nk containing 18254 subkeys ( > current limit
of 15000).
@rwmjones rwmjones lib: Don't leak errno from _hivex_recode function.
If iconv returns E2BIG, that's an internal indication for us, and not
an error.  Don't leak the errno up to the user, as happened here:

Thanks Nicolas Ecarnot.
Commits on Feb 21, 2015
@rwmjones rwmjones Move upstream translations from Tranifex to Zanata.
This is at the request of the Fedora localization team.
For further information see:
@rwmjones rwmjones Update translations from Zanata.
Note this includes new translations for: German, Basque, Hungarian,
Japanese, Portuguese and Serbian.
Commits on Oct 02, 2015
@rwmjones rwmjones Update translations from Zanata. 139f0d5
@rbuj rbuj add Catalan b70ee08
Commits on Oct 05, 2015
@ptoscano ptoscano Fix shebang in perl scripts
Instead of hardcoding the location of perl (assuming it is installed in
/usr), use /usr/bin/env to run it, and thus picking it from $PATH.
This makes it possible to run these scripts also on installations with
perl in a different prefix than /usr.

Also, given that we want enable warnings on scripts, turn the -w
previously in shebang to explicit "use warnings;" in scripts which
didn't have it before.

(This is the same change as d98c9c0e0b4d259f49825fc360bc7e6cafbdd644
in libguestfs.)
@ptoscano ptoscano Update gnulib to latest. 036f64e
@ptoscano ptoscano Update .gitignore with more gnulib files. 51c469a
@rwmjones rwmjones Version 1.3.12. 120e0b2
@rwmjones rwmjones Fix EXTRA_DIST.
This fixes commit 6047a47.
Commits on Oct 21, 2015
@ptoscano ptoscano build: pass $(MAKE) to run-perl-tests
Instead of hardcoding "make" in run-perl-tests, pass the actual name of
make from the Makefile; the default is still "make", mostly to use the
script without having to set $MAKE.
Commits on Oct 29, 2015
@rwmjones rwmjones Don't fail if libxml2 is not installed (RHBZ#1276364).
If no libxml2 found, don't compile hivexml, but compile the
rest of the library.
@rwmjones rwmjones Update gnulib to latest. 58db4d7
@rwmjones rwmjones lib: Turn off -Warray-bounds warnings.
Causes false positives about our use of [1] for arbitrary length
arrays embedded in structs.
@rwmjones rwmjones lib: h->last_modified field is signed, so use correct printf formatter. 65e5d12
@rwmjones rwmjones lib: block->seg_len is signed, use correct printf formatter. 0a78219
@rwmjones rwmjones hive_type enum needs %u printf formatter. d74d3d5
@rwmjones rwmjones sh: Cast value to unsigned type when printing dword: field. 7595668
@rwmjones rwmjones sh: Use %u formatter to print enum strtol_error. ff081cf
@rwmjones rwmjones Enable more warnings in configure.
Includes some minor fixes in hivexsh.c to deal with the new warnings.
@rwmjones rwmjones Version 1.3.13. 5b214f5