Bug 1822889
| Summary: | hivexml fails to convert Windows 10 Registry | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | YongkuiGuo <yoguo> | ||||||||
| Component: | hivex | Assignee: | Richard W.M. Jones <rjones> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | YongkuiGuo <yoguo> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | unspecified | ||||||||||
| Version: | 7.9 | ||||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | hivex-1.3.10-6.10.el7 | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2020-09-29 20:38:58 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
YongkuiGuo
2020-04-10 10:17:50 UTC
Created attachment 1677770 [details]
Registry file
Created attachment 1677771 [details]
hivexml debug output
Fails to run the following command, maybe the same error. #virt-win-reg images/Win10-64-hvm.raw 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners' --debug ... hivex: hivex_open: successfully read Windows Registry hive file: pages: 15901 [sml: 4096, lge: 16384] blocks: 1196270 [sml: 8, avg: 55, lge: 16352] blocks used: 1195740 bytes used: 66568120 exporting \Microsoft\Windows\CurrentVersion\SideBySide\Winners from software with prefix HKEY_LOCAL_MACHINE\SOFTWARE ... at /usr/bin/virt-win-reg line 361. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners] hivex: _hivex_get_values: nr_values = 0 hivex: _hivex_get_children: returning ERANGE because: nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS (17009 > 15000) node_children: Numerical result out of range at /usr/lib64/perl5/vendor_perl/Win/Hivex/Regedit.pm line 621. hivex: hivex_close: hivex_close rjones, could you take a look at this issue if you are available? Sorry for missing this. The pertinent point is indeed this one: hivex: _hivex_get_children: returning ERANGE because: nr_subkeys_in_nk > HIVEX_MAX_SUBKEYS (17009 > 15000) This limit was lifted twice since RHEL 7 was released, in: https://github.com/libguestfs/hivex/commit/bec3f0bb632c4b84a1dfb73eb6333c2ba9834ffb#diff-1ca1183b8a0f460c0afef5b4322d82b4 https://github.com/libguestfs/hivex/commit/4b024fa031251fbeacb6ecf2821d8d027d59de0d#diff-1ca1183b8a0f460c0afef5b4322d82b4 We could easily backport one of both of these patches to RHEL 7.x if there is time. I will devel ack this bug, although as it is not a customer bug maybe we will not actually do this at such a late stage in the RHEL 7 cycle. Verified with package:
hivex-1.3.10-6.10.el7.x86_64
Steps:
1. On rhel7.9 host
# guestfish -a Win10-64-hvm.raw
><fs> set-program virt-trickery
><fs> run
><fs> mount /dev/sda2 /
><fs> download /Windows/System32/config/SOFTWARE /tmp/Win10-64-hvm.software
><fs> quit
2.
# hivexml /tmp/Win10-64-hvm.software
It works well. No error output.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (hivex bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4022 |