Fwd: hivex: patch for read support of "li"-records from "ri" intermediate
by Richard W.M. Jones
[The bug which this fixes is:
https://bugzilla.redhat.com/show_bug.cgi?id=717583 ]
----- Forwarded message from Peter Fokker <peter(a)berestijn.nl> -----
Date: Thu, 8 Mar 2012 11:37:06 +0100 (CET)
From: Peter Fokker <peter(a)berestijn.nl>
To: rjones(a)redhat.com
Cc: Peter Fokker <peter(a)berestijn.nl>
Subject: hivex: patch for read support of "li"-records from "ri"
intermediate
User-Agent: SquirrelMail/1.4.9a
Richard,
Thank you for creating the hivex-library. Studying your source code helped
me a great deal to better understand the internals of the Windows Registry.
However, while I was browsing a real-world SOFTWARE-hive (XP, SP3) I
could not browse to the '\Classes' key. Instead I got this (debug)-message:
get_children: returning ENOTSUP because ri-record offset does not
point to lf/lh (0x49020)
I tracked this issue down and I discovered that the intermediate
"ri"-record may not only contain offsets to "lf" and "lh" but to
"li"-records too.
Attached is a patch against hivex.c v1.3.3 that recognises
"li"-records referenced from "ri"-records. For me this fixed the issue
with browsing the '\Classes' key.
Note that I have not fixed the related problem of rewriting
"li"-records when inserting a new subkey or deleting an
existing one. This sure would cause problems when I were to
add/delete a subkey to/from '\Classes'.
I would very much appreciate it if would be so kind to take a look at
my patch, allthough I cannot blame you if you immediately dump this
unsollicited message+patch from some random stranger from The Netherlands.
Kind regards,
--Peter Fokker
--
Peter Fokker <peter(a)berestijn.nl>
Ingenieursbureau PSD +31 35 695 29 99 / +31 644 238 568
Stargardlaan 7 1404 BC Bussum, The Netherlands
----- End forwarded message -----
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines. Supports shell scripting,
bindings from many languages. http://libguestfs.org
12 years, 1 month
New tool proposal
by Wanlong Gao
Hi Rich,
We just talked about a new tool virt-diff which can diff files
between two guest, suggested by Kamezawa Hiroyuki <kamezawa.hiroyu(a)jp.fujitsu.com>
things like below,
# virt-diff -Nru --guest=Guest0 --guest=Guest1 /etc/hosts
Any thought about this?
Another question, what do you think about implement iptables,
firewall, yum, rpm, etc into libguestfs?
Thanks,
Wanlong Gao
12 years, 4 months
Re: [Libguestfs] Ocaml and pthread_atfork()
by Richard W.M. Jones
On Thu, May 03, 2012 at 02:00:27PM +1000, Tony Breeds wrote:
> Hi All,
> Firstly I apologize if this is noise. I elected to not file a
> bugzilla as the problem seems to be powerpc specific and with the limited
> resources for Fedora developers it would seem unfair.
>
> I was recently trying to build a "current" libguestfs from the f16
> branch[1]. During the build I hit:
>
> (extracted from rpmbuild)
>
> [tony@sneetch ~]$ bash -x tmp/ocaml-test.sh
> + cd rpmbuild/BUILD/libguestfs-1.16.9/ocaml/
> + LD_LIBRARY_PATH=../src/.libs
> + ocamlfind ocamlc -g -warn-error CDEFLMPSUVYZX -I . -package unix,threads -thread -linkpkg mlguestfs.cma t/guestfs_070_threads.cmo -o t/guestfs_070_threads.bc
> File "_none_", line 1, characters 0-1:
> Error: Error on dynamically loaded library: /usr/lib64/ocaml/stublibs/dllthreads.so: /usr/lib64/ocaml/stublibs/dllthreads.so: undefined symbol: pthread_atfork
>
> I did a quick bit of googling and found:
> http://ryanarn.blogspot.com.au/2011/07/curious-case-of-pthreadatfork-on.html
>
> which seems to explain what's going on to my naive eye anyway.
>
> I've tried a few different CFLAGS/patches to
> otherlibs/systhreads/Makefile to try and induce pthreads_atfork() to be
> resolved and linked during the ocaml build. Nothing I try works.
>
> Does anyone have any ideas on how to solve this?
>
> I'm happy to do the heavy lifting I just don't have the background in
> ocaml to solve this by myself.
>
> Yours Tony
>
> [1] I suspects that as a result of the demotion to secondary and things
> languishing there we skipped a few builds.
It looks like the PPC64 OCaml package is buggy. Can you compile any
threaded program at all, eg:
echo 'print_endline "hello"' > test.ml
ocamlfind c -package threads -thread test.ml -linkpkg -o test
./test
Unfortunately I don't have access to ppc64, so there's no way I can
even look at bugs in this area, let alone fix them.
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine. Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/
12 years, 5 months
windows xp see 'unknow partition'
by me,apporc
Hi,
I use guestfs.part_disk to partition one disk with 'mbr' and formated it
to ntfs, then attach this disk to one windows xp virtual machine.
But this windows xp can't recognise that partition, it says 'uknown
partition'
Why it is so, and how to solve it? May someone help me with this problem?
Thanks.
12 years, 5 months
virt-sysprep on Windows Guest
by Wanlong Gao
Hi Rich, folks,
I wont to start doing the windows guest support for virt-sysprep,
Any thoughts?
What do you think should be prepared on a new cloned windows guest?
Thanks,
Wanlong Gao
12 years, 6 months
Re: [Libguestfs] NTFS(-3g) large alternate data streams
by Richard W.M. Jones
(I meant to copy this message to the mailing list)
On Mon, May 28, 2012 at 05:49:36PM +0100, Richard W.M. Jones wrote:
>
> This file has an approx 48 MB ADS:
>
> ><fs> ll /Temp/
> total 13
> drwxrwxrwx 1 root root 0 May 28 17:28 .
> drwxrwxrwx 1 root root 4096 Nov 1 2011 ..
> -rwxrwxrwx 1 root root 13 Oct 5 2011 ADS_test.txt
> ><fs> getxattrs /Temp/ADS_test.txt
> libguestfs: error: getxattrs: getxattr: Argument list too long
>
> The code in libguestfs tries to allocate enough space to store the
> return value using malloc. There is a correct check on the return
> from malloc, so I don't believe there is any possible DoS here. It
> also frees the buffer along the return path. [However through an
> abundance of caution I'm going to modify this code to add an upper
> limit, see below.]
>
> In any case what actually fails is the kernel call:
>
> vlen = getxattr (path, /* name of xattr */,
> /* return pointer */,
> /* ~ 48 MB */);
>
> because I was wrong before when I said there was no limit at all. In
> fact the limit in the kernel is XATTR_SIZE_MAX == 65536.
>
> So essentially there is no chance of returning ADSes using the
> standard way. You'll have to use the ntfs-3g streams_interface=windows
> mount option.
>
> Rich.
>
> --
> Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
> virt-p2v converts physical machines to virtual machines. Boot with a
> live CD or over the network (PXE) and turn machines into Xen guests.
> http://et.redhat.com/~rjones/virt-p2v
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines. Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://et.redhat.com/~rjones/virt-top
12 years, 6 months
