Hi all, I apologize, the disk images' links appear to be broken at the moment. I have informed the maintainer, and he has acknowledged the problem and will fix that soon. --Alex On Sep 1, 2011, at 18:17 , Alex Nelson wrote: > This changeset adds byte run reporters for node and value metadata in the > hivexml program. This location reporting required several new ABI > functions, which required new ABI return types. One benefit to the byte > run functions is additional sanity checks, which have revealed new data > or parsing errors when run on M57 patents images. An example error: > Image: Charlie, 2009-12-11, available at <http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>;. > hive: C:/WINDOWS/system32/config/SECURITY > Address 12624 is processed as a value, but it has a node signature. > > Alex Nelson (7): > generator: Add new return type to ABI: RSize > hivex: Split value_key function into value_key and value_key_len > generator: Add new return types to ABI: RLenNode and RLenValue > hivex: Add metadata length functions for nodes and values > hivex: Add offset-&-length function for long value data > hivexml: Report attributes in values instead of text. > hivexml: Add byte run reporting functions > > generator/generator.ml | 169 +++++++++++++++++++++++++++++++++++++++++++++++- > lib/hivex.c | 115 +++++++++++++++++++++++++++++--- > xml/hivexml.c | 127 ++++++++++++++++++++++++++++++++---- > 3 files changed, 385 insertions(+), 26 deletions(-) > > -- > 1.7.6 > > > > _______________________________________________ > Libguestfs mailing list > Libguestfs(a)redhat.com > https://www.redhat.com/mailman/listinfo/libguestfs

On Fri, Sep 02, 2011 at 09:24:11AM -0700, Alex Nelson wrote: > Hi all, > > The image repository problem is resolved. The particular disk image I referenced is here: > https://domex.nps.edu/corp/scenarios/2009-m57/drives/charlie-2009-12-11.aff > via https://domex.nps.edu/corp/scenarios/2009-m57/drives/ > via the link below. > > Two hives on which hivexml fails are attached. If it is better to attach them to a bug report, please let me know. > > To be clear, this appears to be an error in hivex that my change set reveals, not creates. The two hives you attached seem OK to me. hivexml appears to process both files just fine. What error/etc am I looking for? There are only two bugs in hivex concerning the handling of hives that I am aware of (one is a bug in ReactOS, the other is more serious): - https://bugzilla.redhat.com/show_bug.cgi?id=717583 hivex fails to parse W2K3 x64 hive, returning ENOTSUP because ri-record offset does not point to lf/lh - https://bugzilla.redhat.com/show_bug.cgi?id=709327 hivex cannot read registry hives from ReactOS To file bugs against hivex, go here: https://bugzilla.redhat.com/enter_bug.cgi?component=hivex&product=Fedora Include all relevant details, preferably attaching a hive which demonstrates the failure, and instructions on how to easily reproduce the failure.

Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to F#) http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora