Bug 1296624

Summary:	editing a large hive gives "Numerical result out of range"
Product:	[Community] Virtualization Tools	Reporter:	Sebastian J. Bronner <waschtl>
Component:	libguestfs	Assignee:	Richard W.M. Jones <rjones>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	ptoscano, rbalakri, waschtl
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-14 12:31:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Sebastian J. Bronner 2016-01-07 16:46:45 UTC

Description of problem:
=======================

When libhivex to traverse large registry hives (~ 83 MB), such as C:\Windows\System32\config\SOFTWARE, libhivex generates a "Numerical result out of range" error and aborts.

Version-Release number of selected component:
=============================================

libhivex-bin 1.3.11
libhivex0 1.3.11

How reproducible:
=================

always with large hives (tested with 83 MB hive)

Steps to Reproduce:
===================

1. Take a hive large hive from C:\Windows\System32\config from an actively used Windows system. Your best bet is probably SOFTWARE.

2. Run the following command:
   hivexml SOFTWARE > SOFTWARE.xml

Actual results:
===============

The program aborts with exit code 1 and output:
hivex_visit: SOFTWARE: Numerical result out of range

The XML file is incomplete (in my case it had reached a size of 102 MB).

Expected results:
=================

The program should completely dump the hive into the XML file without aborting or giving an error message.

Additional info:
================

I tested traversing the same SOFTWARE hive using ntpasswd's reged -x (export feature). This was sucessful. I was also able to apply the changes I wanted to apply without any issues. For that reason, I have a hunch that the hive format has been extended again in Windows 7.

The ntpasswd project refers to a document written by a German that helped them achieve full support for hive files up to Windows 8.1. I thought it may be of help to libhivex as well. See http://pogostick.net/~pnh/ntpasswd/editor.html and http://pogostick.net/~pnh/ntpasswd/WinReg.txt .

Comment 1 Richard W.M. Jones 2016-01-07 16:55:30 UTC

Version 1.3.11 is over a year old.  Please try a newer version.

"Numerical result of out range" is ERANGE, and the meaning (as
described in hivex(3)) is that a field in the registry is too
large.

hivex has a number of compiled-in limits:

https://github.com/libguestfs/hivex/blob/master/lib/hivex-internal.h#L325-L329

designed to stop malformed hives from exploiting the host. A valid
but unusual hive can hit these limits.

The only way to increase these is to recompile hivex.  However I
don't know which particular limit you are hitting - you'll need to
run hivex with debugging enabled to determine that.

We have already increased these limits since 1.3.11, in response
to finding valid hives which used larger numbers of keys etc. so running
a newer version of hivex may not hit the limit at all.

BTW we already support hivex up to and including Windows 8.1 (and
beyond).  You don't need to keep posting those links.

Comment 2 Sebastian J. Bronner 2016-01-14 12:31:06 UTC

That was it. The new version handles the same large hive without a hitch.

Thanks for the info about the compiled-in limits and their purpose and the link to the code. That helps me understand the complexity of the possible issues better.

Thanks, too, for mentioning the hive versions supported. That was something I couldn't get from the documentation at http://libguestfs.org/. Sorry for the spam.