Red Hat Bugzilla – Bug 1262641
hivexsh failed to open Windows registry hive
Last modified: 2015-09-14 05:15:24 EDT
Created attachment 1073001 [details]
Compressed Windows registry hive
Description of problem:
hivexsh failed to open certain Windows registry hive. Here is an output of the following command 'hivexsh -d SOFTWARE':
hivex_open: created handle 0x19c3030
hivex_open: mapped file at 0x7fd50ebf7000
hivex: SOFTWARE: not a Windows NT Registry hive file
hivexsh: failed to open hive file: SOFTWARE: Operation not supported
Version-Release number of selected component (if applicable):
Try to load attached hive with hivexsh
Steps to Reproduce:
1. Load attached hive
An error is displayed: "hivexsh failed to open certain Windows registry hive"
A hive is successfully loaded
It is SOFTWARE hive from Windows 8
It is also reproduced on CentOS 7.1 with hivex 1.3.10
The hive is missing the first 0x2700000 bytes (about 40 MB), which
all appear as zeros. A normal hive file -- as far as we know -- would
begin with the magic signature "regf" followed by a header.
for the kind of thing we expect at the start of the hive.
The file contains some 'hbin' sections.
While it is possible this is some kind of hive we have never seen
before, I suspect that actually the file is corrupt.
Interesting... The hive was taken from offline image of Windows 8. The image was set up and running under Virtual Box on CentOS 6.7. And OS VM is working. I will try to setup VM once again and post result here.
Richard, I repeated all steps from the scratch (starting from installing fresh copy of the Windows 8) and it appeared that everything works as expected. As you said header of registry hive is 'regf' and this time hivex reads it without a problem. You can close or delete this ticket.
Thanks for checking. Closing per comment 5.