Bug 803699

Summary: libguestfs inspection fails on Windows XP: libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices
Product: Red Hat Enterprise Linux 6 Reporter: Richard W.M. Jones <rjones>
Component: libguestfsAssignee: Richard W.M. Jones <rjones>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3CC: grant_williamson, leiwang, malittle, mbooth, moli, qguan, qwan, virt-maint, walicki
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: libguestfs-1.16.12-1.el6 Doc Type: Bug Fix
Doc Text:
No Documentation needed
Story Points: ---
Clone Of: 803664 Environment:
Last Closed: 2012-06-20 07:01:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 803664    
Bug Blocks:    

Comment 1 Richard W.M. Jones 2012-03-15 13:40:26 UTC
Reported that this doesn't occur with 1.7.17 (RHEL 6.2), which
is not surprising since that didn't support drive letter mappings.
Setting Regression keyword.

Comment 3 Richard W.M. Jones 2012-03-15 13:51:59 UTC
How to reproduce (this is rather complicated).

(1) Start with a regular Windows XP guest which you can edit and
destroy (ie. make a copy).  You will also need guestfish,
libguestfs-winsupport (on RHEL) and hivexsh tools installed.

(2) Download the SYSTEM hive from this guest:

guestfish -a winxp.img -m /dev/sda1 \
  download /WINDOWS/system32/config/system system

[The name /WINDOWS/system32/config/system might have different
capitalization]

(3) Open it with hivexsh and delete the MountedDevices node:

hivexsh -w system
ls
cd MountedDevices
del
commit

(4) Verify in hivexsh that the MountedDevices node has been deleted:

hivexsh system
ls
# MountedDevices should *not* appear in the list

(5) Upload the modified SYSTEM hive back into the guest:

guestfish -a winxp.img -m /dev/sda1 \
  upload system /WINDOWS/system32/config/system

(6) Now you have prepared a guest which demonstrates the bug.
With virt-inspector2 you'll see this error:

virt-inspector2 -a winxp.img
libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices
virt-inspector: no operating system could be detected inside this disk image.

This may be because the file is not a disk image, or is not a virtual machine
image, or because the OS type is not understood by libguestfs.

NOTE for Red Hat Enterprise Linux 6 users: for Windows guest support you must
install the separate libguestfs-winsupport package.

If you feel this is an error, please file a bug report including as much
information about the disk image as possible.

Comment 4 Richard W.M. Jones 2012-03-15 13:57:46 UTC
Patch posted:
https://www.redhat.com/archives/libguestfs/2012-March/msg00089.html

Comment 7 Qixiang Wan 2012-03-26 03:03:58 UTC
Verified with libguestfs-1.16.12-1.el6.x86_64.

Followed comment 3 to prepared a windows guest image, with the old libguestfs (libguestfs-1.16.10-1) I can reproduce the error, and with the latest package (libguestfs-1.16.12-1), virt-inspector2 can get correct result.

Before fix:
-----------
# rpm -q libguestfs
libguestfs-1.16.10-1.el6.x86_64
# virt-inspector2 -a winxp.raw
libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices
virt-inspector2: no operating system could be detected inside this disk image.

This may be because the file is not a disk image, or is not a virtual machine
image, or because the OS type is not understood by libguestfs.

NOTE for Red Hat Enterprise Linux 6 users: for Windows guest support you must
install the separate libguestfs-winsupport package.

If you feel this is an error, please file a bug report including as much
information about the disk image as possible.

After fix:
-----------
# rpm -q libguestfs
libguestfs-1.16.12-1.el6.x86_64
# virt-inspector2 -a winxp.raw
<?xml version="1.0"?>
<operatingsystems>
  <operatingsystem>
    <root>/dev/sda1</root>
    <name>windows</name>
    <arch>i386</arch>
    <distro>windows</distro>
    <product_name>Microsoft Windows XP</product_name>
    <major_version>5</major_version>
    <minor_version>1</minor_version>
    <windows_systemroot>/WINDOWS</windows_systemroot>
    <windows_current_control_set>ControlSet001</windows_current_control_set>
    <hostname>redhat-212b19d7</hostname>
    <format>installed</format>
    <mountpoints>
      <mountpoint dev="/dev/sda1">/</mountpoint>
    </mountpoints>
    <filesystems>
      <filesystem dev="/dev/sda1">
        <type>ntfs</type>
        <uuid>96F4C2FBF4C2DC9D</uuid>
      </filesystem>
    </filesystems>
    <applications>
      <application>
        <name>Iozone 3.282</name>
        <display_name>Iozone 3.282</display_name>
      </application>
      <application>
        <name>Notepad++</name>
        <display_name>Notepad++</display_name>
        <version>5.6.6</version>
        <url>http://notepad-plus.sourceforge.net/</url>
      </application>
      <application>
        <name>Red Hat Paravirtualized Xen Drivers for Windows(R)</name>
        <display_name>Red Hat Paravirtualized Xen Drivers for Windows(R) 1.3.12</display_name>
        <version>1.3.12</version>
        <publisher>Red Hat, Inc.</publisher>
        <url>http://www.redhat.com</url>
      </application>
      <application>
        <name>winscp3_is1</name>
        <display_name>WinSCP 4.2.7</display_name>
        <version>4.2.7</version>
        <install_path>C:\Program Files\WinSCP\</install_path>
        <publisher>Martin Prikryl</publisher>
        <url>http://winscp.net/</url>
      </application>
      <application>
        <name>{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}</name>
        <display_name>WebFldrs XP</display_name>
        <version>9.50.7523</version>
        <publisher>Microsoft Corporation</publisher>
      </application>
    </applications>
  </operatingsystem>
</operatingsystems>

Comment 8 Richard W.M. Jones 2012-04-26 12:25:05 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No Documentation needed

Comment 10 errata-xmlrpc 2012-06-20 07:01:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0774.html