If this flag is omitted (as in the case for all existing callers)
then the hive is still opened read-only.
We add a 'writable' flag to the hive handle, and we change the way
that the hive file (data) is stored. The data is still mmapped if
the file is opened read-only, since that is more efficient and allows
us to handle larger hives. However if we need to write to the file
then we have to read it all into memory, since if we had to extend the
file we need to realloc that data.
Note the manpage section L</WRITING TO HIVE FILES> comes in a later
commit.
arpa_inet
c-ctype
closeout
arpa_inet
c-ctype
closeout
gitlog-to-changelog
gnu-make
gnumakefile
gitlog-to-changelog
gnu-make
gnumakefile
hivex.h \
byte_conversions.h
hivex.h \
byte_conversions.h
-libhivex_la_LDFLAGS = -version-info 0:0:0
-libhivex_la_CFLAGS = \
- $(WARN_CFLAGS) $(WERROR_CFLAGS)
+libhivex_la_LDFLAGS = -version-info 0:0:0 $(LTLIBINTL) $(LTLIBTHREAD)
+libhivex_la_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
+libhivex_la_CPPFLAGS = -I$(top_srcdir)/gnulib/lib
bin_PROGRAMS = hivexml hivexsh
bin_SCRIPTS = hivexget
bin_PROGRAMS = hivexml hivexsh
bin_SCRIPTS = hivexget
hivexml_SOURCES = \
hivexml.c
hivexml_SOURCES = \
hivexml.c
-hivexml_LDADD = libhivex.la $(LIBXML2_LIBS)
+hivexml_LDADD = libhivex.la $(LIBXML2_LIBS) ../gnulib/lib/libgnu.la
hivexml_CFLAGS = \
-I$(top_srcdir)/src \
-DLOCALEBASEDIR=\""$(datadir)/locale"\" \
hivexml_CFLAGS = \
-I$(top_srcdir)/src \
-DLOCALEBASEDIR=\""$(datadir)/locale"\" \
This is a self-contained library for reading Windows Registry "hive"
binary files.
This is a self-contained library for reading Windows Registry "hive"
binary files.
-It is totally dedicated to reading the files and doesn't deal with
-writing or modifying them in any way.
-
Unlike many other tools in this area, it doesn't use the textual .REG
format for output, because parsing that is as much trouble as parsing
the original binary format. Instead it makes the file available
Unlike many other tools in this area, it doesn't use the textual .REG
format for output, because parsing that is as much trouble as parsing
the original binary format. Instead it makes the file available
#include <sys/stat.h>
#include <assert.h>
#include <sys/stat.h>
#include <assert.h>
+#include "full-read.h"
+
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
#define STREQ(a,b) (strcmp((a),(b)) == 0)
#define STRCASEEQ(a,b) (strcasecmp((a),(b)) == 0)
//#define STRNEQ(a,b) (strcmp((a),(b)) != 0)
#define STREQ(a,b) (strcmp((a),(b)) == 0)
#define STRCASEEQ(a,b) (strcasecmp((a),(b)) == 0)
//#define STRNEQ(a,b) (strcmp((a),(b)) != 0)
int fd;
size_t size;
int msglvl;
int fd;
size_t size;
int msglvl;
- /* Memory-mapped (readonly) registry file. */
+ /* Registry file, memory mapped if read-only, or malloc'd if writing. */
union {
char *addr;
struct ntreg_header *hdr;
union {
char *addr;
struct ntreg_header *hdr;
if (h->msglvl >= 2)
fprintf (stderr, "hivex_open: created handle %p\n", h);
if (h->msglvl >= 2)
fprintf (stderr, "hivex_open: created handle %p\n", h);
+ h->writable = !!(flags & HIVEX_OPEN_WRITE);
h->filename = strdup (filename);
if (h->filename == NULL)
goto error;
h->filename = strdup (filename);
if (h->filename == NULL)
goto error;
- h->fd = open (filename, O_RDONLY);
+ h->fd = open (filename, O_RDONLY | O_CLOEXEC);
if (h->fd == -1)
goto error;
if (h->fd == -1)
goto error;
h->size = statbuf.st_size;
h->size = statbuf.st_size;
- h->addr = mmap (NULL, h->size, PROT_READ, MAP_SHARED, h->fd, 0);
- if (h->addr == MAP_FAILED)
- goto error;
+ if (!h->writable) {
+ h->addr = mmap (NULL, h->size, PROT_READ, MAP_SHARED, h->fd, 0);
+ if (h->addr == MAP_FAILED)
+ goto error;
- if (h->msglvl >= 2)
- fprintf (stderr, "hivex_open: mapped file at %p\n", h->addr);
+ if (h->msglvl >= 2)
+ fprintf (stderr, "hivex_open: mapped file at %p\n", h->addr);
+ } else {
+ h->addr = malloc (h->size);
+ if (h->addr == NULL)
+ goto error;
+
+ if (full_read (h->fd, h->addr, h->size) < h->size)
+ goto error;
+ }
/* Check header. */
if (h->hdr->magic[0] != 'r' ||
/* Check header. */
if (h->hdr->magic[0] != 'r' ||
int err = errno;
if (h) {
free (h->bitmap);
int err = errno;
if (h) {
free (h->bitmap);
- if (h->addr && h->size && h->addr != MAP_FAILED)
- munmap (h->addr, h->size);
+ if (h->addr && h->size && h->addr != MAP_FAILED) {
+ if (!h->writable)
+ munmap (h->addr, h->size);
+ else
+ free (h->addr);
+ }
if (h->fd >= 0)
close (h->fd);
free (h->filename);
if (h->fd >= 0)
close (h->fd);
free (h->filename);
- munmap (h->addr, h->size);
+ if (!h->writable)
+ munmap (h->addr, h->size);
+ else
+ free (h->addr);
r = close (h->fd);
free (h->filename);
free (h);
r = close (h->fd);
free (h->filename);
free (h);
typedef enum hive_type hive_type;
typedef enum hive_type hive_type;
+/* Bitmask of flags passed to hivex_open. */
#define HIVEX_OPEN_VERBOSE 1
#define HIVEX_OPEN_DEBUG 2
#define HIVEX_OPEN_VERBOSE 1
#define HIVEX_OPEN_DEBUG 2
-#define HIVEX_OPEN_MSGLVL_MASK 3
+#define HIVEX_OPEN_MSGLVL_MASK (HIVEX_OPEN_VERBOSE|HIVEX_OPEN_DEBUG)
+#define HIVEX_OPEN_WRITE 4
extern hive_h *hivex_open (const char *filename, int flags);
extern int hivex_close (hive_h *h);
extern hive_h *hivex_open (const char *filename, int flags);
extern int hivex_close (hive_h *h);
libhivex is a library for extracting the contents of Windows Registry
"hive" files. It is designed to be secure against buggy or malicious
libhivex is a library for extracting the contents of Windows Registry
"hive" files. It is designed to be secure against buggy or malicious
-registry files, and to have limited functionality (writing or
-modifying these files is not in the scope of this library).
Unlike many other tools in this area, it doesn't use the textual .REG
format for output, because parsing that is as much trouble as parsing
Unlike many other tools in this area, it doesn't use the textual .REG
format for output, because parsing that is as much trouble as parsing
Opens the hive named C<filename> for reading.
Flags is an ORed list of the open flags (or C<0> if you don't
Opens the hive named C<filename> for reading.
Flags is an ORed list of the open flags (or C<0> if you don't
-want to pass any flags). Currently the only
-flags defined are:
+want to pass any flags). These flags are defined:
This is also selected if the C<HIVEX_DEBUG> environment variable
is set to 1.
This is also selected if the C<HIVEX_DEBUG> environment variable
is set to 1.
+=item HIVEX_OPEN_WRITE
+
+Open the hive for writing. If omitted, the hive is read-only.
+
+See L</WRITING TO HIVE FILES>.
+
=back
C<hivex_open> returns a hive handle. On error this returns NULL and
=back
C<hivex_open> returns a hive handle. On error this returns NULL and
Close a hive handle and free all associated resources.
Close a hive handle and free all associated resources.
+Note that any uncommitted writes are I<not> committed by this call,
+but instead are lost. See L</WRITING TO HIVE FILES>.
+
Returns 0 on success. On error this returns -1 and sets errno.
=back
Returns 0 on success. On error this returns -1 and sets errno.
=back