2:15 p.m.
There are some corrupted registry files that have invalid hbin cells
but are still readable. This patch makes the following changes:
* hivex_open - do not abort with complete failure if we run across a
block with invalid size (unless it's the root block). Instead just
log the event, and move on. This will allow open hives that have
apparent invalid blocks but the ones of potential interest might be
perfectly accessible.
* _hivex_get_children - similiarly, if the's invalid subkey, just skip
it instead of failing so one can continue to browse other valid
subkeys.
The above is similar to the behavior to Windows regedit where one can
load such corrupted hives with e.g. "reg load HKU\Corrupted" and
browse/change it despite some keys might be missing.
---
lib/handle.c | 16 ++++++++++++----
lib/node.c | 21 ++++++++++++---------
2 files changed, 24 insertions(+), 13 deletions(-)
diff --git a/lib/handle.c b/lib/handle.c
index 42fd672..29b9747 100644
--- a/lib/handle.c
+++ b/lib/handle.c
@@ -304,10 +304,18 @@ hivex_open (const char *filename, int flags)
#pragma GCC diagnostic ignored "-Wstrict-overflow"
if (seg_len <= 4 || (seg_len & 3) != 0) {
#pragma GCC diagnostic pop
- SET_ERRNO (ENOTSUP,
- "%s: block size %" PRIi32 " at 0x%zx, bad
registry",
- filename, le32toh (block->seg_len), blkoff);
- goto error;
+ if (is_root) {
+ SET_ERRNO (ENOTSUP,
+ "%s, the root block at 0x%zx has invalid size %" PRIi32
+ ", bad registry",
+ filename, blkoff, le32toh (block->seg_len));
+ goto error;
+ } else {
+ DEBUG (2,
+ "%s: block at 0x%zx has invalid size %" PRIi32 ",
skipping",
+ filename, blkoff, le32toh (block->seg_len));
+ break;
+ }
}
if (h->msglvl >= 2) {
diff --git a/lib/node.c b/lib/node.c
index 822c250..a20bbc5 100644
--- a/lib/node.c
+++ b/lib/node.c
@@ -343,11 +343,10 @@ _hivex_get_children (hive_h *h, hive_node_h node,
*/
size_t nr_children = _hivex_get_offset_list_length (&children);
if (nr_subkeys_in_nk != nr_children) {
- SET_ERRNO (ENOTSUP,
- "nr_subkeys_in_nk = %zu "
- "is not equal to number of children read %zu",
- nr_subkeys_in_nk, nr_children);
- goto error;
+ DEBUG (2,
+ "nr_subkeys_in_nk = %zu "
+ "is not equal to number of children read %zu",
+ nr_subkeys_in_nk, nr_children);
}
out:
@@ -407,8 +406,10 @@ _get_children (hive_h *h, hive_node_h blkoff,
for (i = 0; i < nr_subkeys_in_lf; ++i) {
hive_node_h subkey = le32toh (lf->keys[i].offset);
subkey += 0x1000;
- if (check_child_is_nk_block (h, subkey, flags) == -1)
- return -1;
+ if (check_child_is_nk_block (h, subkey, flags) == -1) {
+ DEBUG (2, "subkey at 0x%zx is not an NK block, skipping", subkey);
+ continue;
+ }
if (_hivex_add_to_offset_list (children, subkey) == -1)
return -1;
}
@@ -435,8 +436,10 @@ _get_children (hive_h *h, hive_node_h blkoff,
for (i = 0; i < nr_offsets; ++i) {
hive_node_h subkey = le32toh (ri->offset[i]);
subkey += 0x1000;
- if (check_child_is_nk_block (h, subkey, flags) == -1)
- return -1;
+ if (check_child_is_nk_block (h, subkey, flags) == -1) {
+ DEBUG (2, "subkey at 0x%zx is not an NK block, skipping", subkey);
+ continue;
+ }
if (_hivex_add_to_offset_list (children, subkey) == -1)
return -1;
}
--
2.9.3