libyal / libregf Goto Github PK

Library and tools to access the Windows NT Registry File (REGF) format

License: GNU Lesser General Public License v3.0

Shell 3.06% C 84.03% Makefile 1.11% C++ 0.35% Python 0.87% PowerShell 1.28% M4 8.73% Roff 0.57%

libregf's Introduction

The name libyal was initially a pun on the naming theme of the various library 
projects. Now it serves the purpose of providing an overview of the available 
projects in a single location and as a home for scripts to help maintain the 
projects.

For more information see:

* Project documentation: https://github.com/libyal/libyal/wiki/Home
* Overiew of available projects: https://github.com/libyal/libyal/wiki/Overview

libregf's People

Contributors

Stargazers

Watchers

libregf's Issues

regfmount: No such file or directory

fix issue with accessing:

regf/Classes/CLSID/{33D9A760-90C8-11d0-BD43-00A0C911CE86}/Instance/Indeo\\x,2\\x*e video 5.10 Compression Filter

Complete REG_MULTI_SZ support

Complete REG_MULTI_SZ support in library and Python bindings

Full regf specifications

Fortunately, @msuhanov has already done all the hard work of reverse engineering for you.
All registry hive specifications can be found at msuhanov/regf.

Improve format documentation

Check order of security key links
- Working document says previous then next. CM_KEY_SECURITY says flink then blink.
Add information about transaction logs

Unable to open corrupted SOFTWARE hive

regview tool opens this file succeessfully 😞

Sample file attached: https://onedrive.live.com/redir?resid=83CBBEF6B31667E8%218506

Extend Python development documentation on how to retrieve keys and values

It would help to get started to have some minimal doc for the Python bindings.

input folder not being created inside test folder after make check

Screenshot from 2019-03-20 17-46-52
Screenshot attached. Please check.

Error parsing SYSTEM hive from Win8.1 x64

Sample SYSTEM hive file if needed: https://onedrive.live.com/redir?resid=83cbbef6b31667e8!8242&authkey=!AAqSoudsdHI9zi4&ithint=file%2c

libregf v20191221 segfaults on OpenBSD

Hello,

First of all, thank you for all your work.

I have a problem on OpenBSD with the newer version of libregf with plaso version 20200121.
When I run the regression tests of plaso with the libregf version 20191221, I have a segfault.

Details:

Tests the ExamineEvent and CompileReport functions on a SYSTEM file. ... Segmentation fault (core dumped)

Backtrace:

#0  0x00001f9a235969bd in libregf_internal_multi_string_read_data (internal_multi_string=0x1f9a382b4d80, 
    data=0x1f9a32a99a20 "", data_size=2, error=0x7f7ffffd3540) at libregf_multi_string.c:358
#1  0x00001f9a235a1e42 in libregf_value_item_get_value_multi_string (value_item=0x1f9a99f8fb40, 
    file_io_handle=0x1f9abc7a0100, multi_string=0x7f7ffffd3538, error=0x7f7ffffd3540)
    at libregf_value_item.c:2900
#2  0x00001f9a2359d543 in libregf_value_get_value_multi_string (value=0x1f9a241d89c0, 
    multi_string=0x7f7ffffd3538, error=0x7f7ffffd3540) at libregf_value.c:1800
#3  0x00001f9ae642e586 in pyregf_value_get_data_as_multi_string (pyregf_value=0x1f9a445a2ed0, arguments=0x0)
    at pyregf_value.c:1172
#4  0x00001f9a92e8eafb in _PyMethodDef_RawFastCallKeywords () from /usr/local/lib/libpython3.7m.so.0.0
#5  0x00001f9a92e95782 in _PyMethodDescr_FastCallKeywords () from /usr/local/lib/libpython3.7m.so.0.0
#6  0x00001f9a92f6a2f4 in ?? () from /usr/local/lib/libpython3.7m.so.0.0

Don't hesitate if I miss some information.

Best regards,

Sigalpes.

regfexport - print full path to the key

print full path to the key

corruption scenario: large data segments > 16344 bytes

Hello.

At present, size of a single full data segment is calculated in the following way: size of a cell - 2*4. But Windows is using the hard-coded value: 16344 (and only the last data segment may have a smaller size: value size - bytes read while parsing previous segments).

libyal / libregf Goto Github PK

libregf's Introduction

libregf's People

Contributors

Stargazers

Watchers

Forkers

libregf's Issues

Recommend Projects

Recommend Topics

Recommend Org