Red Hat Bugzilla – Bug 803699
libguestfs inspection fails on Windows XP: libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices
Last modified: 2012-06-20 03:01:19 EDT
Reported that this doesn't occur with 1.7.17 (RHEL 6.2), which is not surprising since that didn't support drive letter mappings. Setting Regression keyword.
How to reproduce (this is rather complicated). (1) Start with a regular Windows XP guest which you can edit and destroy (ie. make a copy). You will also need guestfish, libguestfs-winsupport (on RHEL) and hivexsh tools installed. (2) Download the SYSTEM hive from this guest: guestfish -a winxp.img -m /dev/sda1 \ download /WINDOWS/system32/config/system system [The name /WINDOWS/system32/config/system might have different capitalization] (3) Open it with hivexsh and delete the MountedDevices node: hivexsh -w system ls cd MountedDevices del commit (4) Verify in hivexsh that the MountedDevices node has been deleted: hivexsh system ls # MountedDevices should *not* appear in the list (5) Upload the modified SYSTEM hive back into the guest: guestfish -a winxp.img -m /dev/sda1 \ upload system /WINDOWS/system32/config/system (6) Now you have prepared a guest which demonstrates the bug. With virt-inspector2 you'll see this error: virt-inspector2 -a winxp.img libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices virt-inspector: no operating system could be detected inside this disk image. This may be because the file is not a disk image, or is not a virtual machine image, or because the OS type is not understood by libguestfs. NOTE for Red Hat Enterprise Linux 6 users: for Windows guest support you must install the separate libguestfs-winsupport package. If you feel this is an error, please file a bug report including as much information about the disk image as possible.
Patch posted: https://www.redhat.com/archives/libguestfs/2012-March/msg00089.html
Upstream commit: https://github.com/libguestfs/libguestfs/commit/91cede3465cd2496a01a89d5c8815df7c326c2ec
Verified with libguestfs-1.16.12-1.el6.x86_64. Followed comment 3 to prepared a windows guest image, with the old libguestfs (libguestfs-1.16.10-1) I can reproduce the error, and with the latest package (libguestfs-1.16.12-1), virt-inspector2 can get correct result. Before fix: ----------- # rpm -q libguestfs libguestfs-1.16.10-1.el6.x86_64 # virt-inspector2 -a winxp.raw libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices virt-inspector2: no operating system could be detected inside this disk image. This may be because the file is not a disk image, or is not a virtual machine image, or because the OS type is not understood by libguestfs. NOTE for Red Hat Enterprise Linux 6 users: for Windows guest support you must install the separate libguestfs-winsupport package. If you feel this is an error, please file a bug report including as much information about the disk image as possible. After fix: ----------- # rpm -q libguestfs libguestfs-1.16.12-1.el6.x86_64 # virt-inspector2 -a winxp.raw <?xml version="1.0"?> <operatingsystems> <operatingsystem> <root>/dev/sda1</root> <name>windows</name> <arch>i386</arch> <distro>windows</distro> <product_name>Microsoft Windows XP</product_name> <major_version>5</major_version> <minor_version>1</minor_version> <windows_systemroot>/WINDOWS</windows_systemroot> <windows_current_control_set>ControlSet001</windows_current_control_set> <hostname>redhat-212b19d7</hostname> <format>installed</format> <mountpoints> <mountpoint dev="/dev/sda1">/</mountpoint> </mountpoints> <filesystems> <filesystem dev="/dev/sda1"> <type>ntfs</type> <uuid>96F4C2FBF4C2DC9D</uuid> </filesystem> </filesystems> <applications> <application> <name>Iozone 3.282</name> <display_name>Iozone 3.282</display_name> </application> <application> <name>Notepad++</name> <display_name>Notepad++</display_name> <version>5.6.6</version> <url>http://notepad-plus.sourceforge.net/</url> </application> <application> <name>Red Hat Paravirtualized Xen Drivers for Windows(R)</name> <display_name>Red Hat Paravirtualized Xen Drivers for Windows(R) 1.3.12</display_name> <version>1.3.12</version> <publisher>Red Hat, Inc.</publisher> <url>http://www.redhat.com</url> </application> <application> <name>winscp3_is1</name> <display_name>WinSCP 4.2.7</display_name> <version>4.2.7</version> <install_path>C:\Program Files\WinSCP\</install_path> <publisher>Martin Prikryl</publisher> <url>http://winscp.net/</url> </application> <application> <name>{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}</name> <display_name>WebFldrs XP</display_name> <version>9.50.7523</version> <publisher>Microsoft Corporation</publisher> </application> </applications> </operatingsystem> </operatingsystems>
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: No Documentation needed
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2012-0774.html