[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [Libguestfs] [PATCH] Relax size checks for integer types

On Wed, Jun 19, 2013 at 06:57:33PM +0200, Hilko Bengen wrote:
> I recenetly came across a Windows XP image, where one REG_QWORD value
> (HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0\0\ExecTime)
> would be displayed by hivexsh but hivex_value_qword() would return -1.
> It turned out that the data length of this value was 16 bytes instead
> of 8.
> There is no problem in simply interpreting the first 4 (DWORD) or
> 8 (QWORD) bytes -- if there are enough bytes to be interpreted.

Yeah .. turns out that the type field in hives is mostly useless and
occasionally harmful.  It bears no relationship to what the field
might actually contain.

ACK to this patch as it only affects the deprecated hivex_value_dword
and hivex_value_qword functions, making them a little bit more useful.


Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]