Red Hat Bugzilla – Bug 717583
hivex fails to parse W2K3 x64 hive, returning ENOTSUP because ri-record offset does not point to lf/lh
Last modified: 2013-08-03 19:59:37 EDT
Description of problem:
I think this is a case of ri-record pointing to a second level
ri-record which we've never seen before, but I have not had
time to look into this in detail.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
See the software hive attached to the email message above.
There is a potential fix, which needs review, posted upstream:
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.
(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)
More information and reason for this action is here:
The fix was added to hivex last year
although write support still doesn't work.
I have opened a separate bug about write support (bug 987463).
Therefore I am closing this bug.
19 part patch posted upstream:
This should be fixed in hivex 1.3.8 which is available here:
and in Fedora Rawhide.
hivex-1.3.8-1.fc19 has been submitted as an update for Fedora 19.
hivex-1.3.8-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.