[Libguestfs] hivex: Make node names and value names with embedded null characters accessible

Hilko Bengen bengen at hilluzination.de
Wed Jan 8 00:26:23 UTC 2014


On Windows, there exist at least two APIs for dealing with the
Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works
with null-terminated ASCII or UTF-16 strings. The native API
(ZwCreateKey, etc.), on the other hand works with UTF-16 strings that
are stored as buffers+length and may contain null characters. Malware
authors have been relying on the Win32 API's inability to properly
work with such names for several years.

These changes make such names accessible from hivex.




More information about the Libguestfs mailing list