search

EricZimmerman / Registry

Full featured, offline Registry parser in C#
MIT License
225 stars 50 forks source link

The library doesn't extend the hive size when applying transaction log entries #24

Open msuhanov opened 11 months ago

msuhanov commented 11 months ago

Hello.

The error message is: RE-1

The problem is here: https://github.com/EricZimmerman/Registry/blob/2c8b9a47e58f6046ef3060b7f1735f9d2ac8327e/Registry/TransactionLog.cs#L211

The problem is that the library doesn't support the extension of the hive file size, so an attempt to write beyond the current end of the hive file results in the exception shown above.

To resolve the issue, you need to read the "Hive bins data size" field of the log entry being applied and extend the hiveBytes length accordingly.

EricZimmerman commented 10 months ago

so if i am understanding this correctly, the dirty pages in the hive do not simply overwrite other pages in the main hive, but can EXPAND them?

so this becomes not a buffer copy per se, but potentially increasing the size of the data being written into the middle of the hive?

its not just a matter of adding extra data to the end of hiveBytes tho, as all the data would have to be moved when inserting the dirty page?

Its not clear if hiveBytes just needs made bigger and the pages still get overwritten as is. that is certainly a bit easier to do, but seems like other data has the possibility to be overwritten.

do you happen to have the GrownHive test file in your yarp repo? i didnt see it

EricZimmerman commented 2 weeks ago

To resolve the issue, you need to read the "Hive bins data size" field of the log entry being applied and extend the hiveBytes length accordingly.

do i literally just add that number of bytes to the size of the array/file @msuhanov ?