System hives about hiveswarming HOT 5 CLOSED

@MaxstarPCW Please use v1.3 that you can download in the Releases section.
https://github.com/stormshield/HiveSwarming/releases/tag/v1.3

from hiveswarming.

Hello @MaxstarPCW

The SYSTEM, SOFTWARE hives, etc. can have subkeys with different security descriptors, as the installed components in your operating system can register themselves and set the security for their keys.

Such hives, where keys do not have the same security descriptor, cause the RegLoadAppKey API to fail, and this is documented by Microsoft. There is no way to use this user-land API with these hives.

So This is not something that could be fixed.

from hiveswarming.

Hello @MaxstarPCW
You are right, the problem is that we try to map the registry hive with a desired access mask that is too much.
I will publish a release.

from hiveswarming.

Hi,

Thank you very much for the quick response. I've just tested the latest build with a copy of the COMPONENTS hive and and it works like a charm.

But, when I try to convert a copy of the DRIVERS hive I get the error below. (This copy is not corrupted, the primary and secondary sequence numbers are good. And I'm able to load the hive using regedit or RegistryExplorer.

C:\Tools\HiveSwarming>hiveswarming.exe --hive-to-reg-file DRIVERS DRIVERS.reg
Loading hive file DRIVERS:
ERROR 800703f1 (The configuration registry database is corrupt. )

I get the same error trying to convert the system, software, and all the other hives.

from hiveswarming.

Hi,

I am familiar with the security descriptors, but error 800703f1 (ERROR_BADDB / Dirty Hive) may cause any confusion. This error message generally indicates that the primary an secondary sequence numbers do not match. So perhaps a "NOT SUPPORTED" message is more relevant.

Anyway thanks for this great tool, I really like it!

from hiveswarming.