1hivex(3) Windows Registry hivex(3)
2
6 hivex - Windows Registry "hive" extraction library
7
9 #include <hivex.h>
10 hive_h *hivex_open (const char *filename, int flags);
12 int hivex_close (hive_h *h);
13 hive_node_h hivex_root (hive_h *h);
14 char *hivex_node_name (hive_h *h, hive_node_h node);
15 hive_node_h *hivex_node_children (hive_h *h, hive_node_h node);
16 hive_node_h hivex_node_get_child (hive_h *h, hive_node_h node, const char *name);
17 hive_node_h hivex_node_parent (hive_h *h, hive_node_h node);
18 hive_value_h *hivex_node_values (hive_h *h, hive_node_h node);
19 hive_value_h hivex_node_get_value (hive_h *h, hive_node_h node, const char *key);
20 char *hivex_value_key (hive_h *h, hive_value_h val);
21 int hivex_value_type (hive_h *h, hive_value_h val, hive_type *t, size_t *len);
22 char *hivex_value_value (hive_h *h, hive_value_h val, hive_type *t, size_t *len);
23 char *hivex_value_string (hive_h *h, hive_value_h val);
24 char **hivex_value_multiple_strings (hive_h *h, hive_value_h val);
25 int32_t hivex_value_dword (hive_h *h, hive_value_h val);
26 int64_t hivex_value_qword (hive_h *h, hive_value_h val);
27 int hivex_commit (hive_h *h, const char *filename, int flags);
28 hive_node_h hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name);
29 int hivex_node_delete_child (hive_h *h, hive_node_h node);
30 int hivex_node_set_values (hive_h *h, hive_node_h node, size_t nr_values, const hive_set_value *values, int flags);
31 int hivex_node_set_value (hive_h *h, hive_node_h node, const hive_set_value *val, int flags);
32 Link with -lhivex.
34
36 Hivex is a library for extracting the contents of Windows Registry
37 "hive" files. It is designed to be secure against buggy or malicious
38 registry files.
39 Unlike other tools in this area, it doesn't use the textual .REG
41 format, because parsing that is as much trouble as parsing the original
42 binary format. Instead it makes the file available through a C API,
43 and then wraps this API in higher level scripting and GUI tools.
44 There is a separate program to export the hive as XML (see hivexml(1)),
46 or to navigate the file (see hivexsh(1)). There is also a Perl script
47 to export and merge the file as a textual .REG (regedit) file, see
48 hivexregedit(1).
49 If you just want to export or modify the Registry of a Windows virtual
51 machine, you should look at virt-win-reg(1).
52 Hivex is also comes with language bindings for OCaml, Perl and Python.
54
56 "hive_h *"
57 This handle describes an open hive file.
58 "hive_node_h"
60 This is a node handle, an integer but opaque outside the library.
61 Valid node handles cannot be 0. The library returns 0 in some
62 situations to indicate an error.
63 "hive_type"
65 The enum below describes the possible types for the value(s) stored at
66 each node. Note that you should not trust the type field in a Windows
67 Registry, as it very often has no relationship to reality. Some
68 applications use their own types. The encoding of strings is not
69 specified. Some programs store everything (including strings) in
70 binary blobs.
71 enum hive_type {
73 /* Just a key without a value */
74 hive_t_REG_NONE = 0,
75 /* A Windows string (encoding is unknown, but often UTF16-LE) */
76 hive_t_REG_SZ = 1,
77 /* A Windows string that contains %env% (environment variable expansion) */
78 hive_t_REG_EXPAND_SZ = 2,
79 /* A blob of binary */
80 hive_t_REG_BINARY = 3,
81 /* DWORD (32 bit integer), little endian */
82 hive_t_REG_DWORD = 4,
83 /* DWORD (32 bit integer), big endian */
84 hive_t_REG_DWORD_BIG_ENDIAN = 5,
85 /* Symbolic link to another part of the registry tree */
86 hive_t_REG_LINK = 6,
87 /* Multiple Windows strings. See http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx */
88 hive_t_REG_MULTI_SZ = 7,
89 /* Resource list */
90 hive_t_REG_RESOURCE_LIST = 8,
91 /* Resource descriptor */
92 hive_t_REG_FULL_RESOURCE_DESCRIPTOR = 9,
93 /* Resouce requirements list */
94 hive_t_REG_RESOURCE_REQUIREMENTS_LIST = 10,
95 /* QWORD (64 bit integer), unspecified endianness but usually little endian */
96 hive_t_REG_QWORD = 11,
97 };
98 "hive_value_h"
100 This is a value handle, an integer but opaque outside the library.
101 Valid value handles cannot be 0. The library returns 0 in some
102 situations to indicate an error.
103 "hive_set_value"
105 The typedef "hive_set_value" is used in conjunction with the
106 "hivex_node_set_values" call described below.
107 struct hive_set_value {
109 char *key; /* key - a UTF-8 encoded ASCIIZ string */
110 hive_type t; /* type of value field */
111 size_t len; /* length of value field in bytes */
112 char *value; /* value field */
113 };
114 typedef struct hive_set_value hive_set_value;
115 To set the default value for a node, you have to pass "key = """.
117 Note that the "value" field is just treated as a list of bytes, and is
119 stored directly in the hive. The caller has to ensure correct encoding
120 and endianness, for example converting dwords to little endian.
121 The correct type and encoding for values depends on the node and key in
123 the registry, the version of Windows, and sometimes even changes
124 between versions of Windows for the same key. We don't document it
125 here. Often it's not documented at all.
126
128 hivex_open
129 hive_h *hivex_open (const char *filename, int flags);
130 Opens the hive named "filename" for reading.
132 Flags is an ORed list of the open flags (or 0 if you don't want to pass
134 any flags). These flags are defined:
135 HIVEX_OPEN_VERBOSE
137 Verbose messages.
138 HIVEX_OPEN_DEBUG
140 Very verbose messages, suitable for debugging problems in the
141 library itself.
142 This is also selected if the "HIVEX_DEBUG" environment variable is
144 set to 1.
145 HIVEX_OPEN_WRITE
147 Open the hive for writing. If omitted, the hive is read-only.
148 See "WRITING TO HIVE FILES" in hivex(3).
150 Returns a new hive handle. On error this returns NULL and sets errno.
152 hivex_close
154 int hivex_close (hive_h *h);
155 Close a hive handle and free all associated resources.
157 Note that any uncommitted writes are not committed by this call, but
159 instead are lost. See "WRITING TO HIVE FILES" in hivex(3).
160 Returns 0 on success. On error this returns -1 and sets errno.
162 This function frees the hive handle (even if it returns an error). The
164 hive handle must not be used again after calling this function.
165 hivex_root
167 hive_node_h hivex_root (hive_h *h);
168 Return root node of the hive. All valid hives must contain a root
170 node.
171 Returns a node handle. On error this returns 0 and sets errno.
173 hivex_node_name
175 char *hivex_node_name (hive_h *h, hive_node_h node);
176 Return the name of the node.
178 Note that the name of the root node is a dummy, such as "$$$PROTO.HIV"
180 (other names are possible: it seems to depend on the tool or program
181 that created the hive in the first place). You can only know the
182 "real" name of the root node by knowing which registry file this hive
183 originally comes from, which is knowledge that is outside the scope of
184 this library.
185 Returns a string. The string must be freed by the caller when it is no
187 longer needed. On error this returns NULL and sets errno.
188 hivex_node_children
190 hive_node_h *hivex_node_children (hive_h *h, hive_node_h node);
191 Return an array of nodes which are the subkeys (children) of "node".
193 Returns a 0-terminated array of nodes. The array must be freed by the
195 caller when it is no longer needed. On error this returns NULL and
196 sets errno.
197 hivex_node_get_child
199 hive_node_h hivex_node_get_child (hive_h *h, hive_node_h node, const char *name);
200 Return the child of node with the name "name", if it exists.
202 The name is matched case insensitively.
204 Returns a node handle. If the node was not found, this returns 0
206 without setting errno. On error this returns 0 and sets errno.
207 hivex_node_parent
209 hive_node_h hivex_node_parent (hive_h *h, hive_node_h node);
210 Return the parent of "node".
212 The parent pointer of the root node in registry files that we have
214 examined seems to be invalid, and so this function will return an error
215 if called on the root node.
216 Returns a node handle. On error this returns 0 and sets errno.
218 hivex_node_values
220 hive_value_h *hivex_node_values (hive_h *h, hive_node_h node);
221 Return the array of (key, value) pairs attached to this node.
223 Returns a 0-terminated array of values. The array must be freed by the
225 caller when it is no longer needed. On error this returns NULL and
226 sets errno.
227 hivex_node_get_value
229 hive_value_h hivex_node_get_value (hive_h *h, hive_node_h node, const char *key);
230 Return the value attached to this node which has the name "key", if it
232 exists.
233 The key name is matched case insensitively.
235 Note that to get the default key, you should pass the empty string ""
237 here. The default key is often written "@", but inside hives that has
238 no meaning and won't give you the default key.
239 Returns a value handle. On error this returns 0 and sets errno.
241 hivex_value_key
243 char *hivex_value_key (hive_h *h, hive_value_h val);
244 Return the key (name) of a (key, value) pair. The name is reencoded as
246 UTF-8 and returned as a string.
247 The string should be freed by the caller when it is no longer needed.
249 Note that this function can return a zero-length string. In the
251 context of Windows Registries, this means that this value is the
252 default key for this node in the tree. This is usually written as "@".
253 Returns a string. The string must be freed by the caller when it is no
255 longer needed. On error this returns NULL and sets errno.
256 hivex_value_type
258 int hivex_value_type (hive_h *h, hive_value_h val, hive_type *t, size_t *len);
259 Return the data length and data type of the value in this (key, value)
261 pair. See also "hivex_value_value" which returns all this information,
262 and the value itself. Also, "hivex_value_*" functions below which can
263 be used to return the value in a more useful form when you know the
264 type in advance.
265 Returns 0 on success. On error this returns -1 and sets errno.
267 hivex_value_value
269 char *hivex_value_value (hive_h *h, hive_value_h val, hive_type *t, size_t *len);
270 Return the value of this (key, value) pair. The value should be
272 interpreted according to its type (see "hive_type").
273 The value is returned as an array of bytes (of length "len"). The
275 value must be freed by the caller when it is no longer needed. On
276 error this returns NULL and sets errno.
277 hivex_value_string
279 char *hivex_value_string (hive_h *h, hive_value_h val);
280 If this value is a string, return the string reencoded as UTF-8 (as a C
282 string). This only works for values which have type "hive_t_string",
283 "hive_t_expand_string" or "hive_t_link".
284 Returns a string. The string must be freed by the caller when it is no
286 longer needed. On error this returns NULL and sets errno.
287 hivex_value_multiple_strings
289 char **hivex_value_multiple_strings (hive_h *h, hive_value_h val);
290 If this value is a multiple-string, return the strings reencoded as
292 UTF-8 (in C, as a NULL-terminated array of C strings, in other language
293 bindings, as a list of strings). This only works for values which have
294 type "hive_t_multiple_strings".
295 Returns a NULL-terminated array of C strings. The strings and the
297 array must all be freed by the caller when they are no longer needed.
298 On error this returns NULL and sets errno.
299 hivex_value_dword
301 int32_t hivex_value_dword (hive_h *h, hive_value_h val);
302 If this value is a DWORD (Windows int32), return it. This only works
304 for values which have type "hive_t_dword" or "hive_t_dword_be".
305 hivex_value_qword
307 int64_t hivex_value_qword (hive_h *h, hive_value_h val);
308 If this value is a QWORD (Windows int64), return it. This only works
310 for values which have type "hive_t_qword".
311 hivex_commit
313 int hivex_commit (hive_h *h, const char *filename, int flags);
314 Commit (write) any changes which have been made.
316 "filename" is the new file to write. If "filename" is null/undefined
318 then we overwrite the original file (ie. the file name that was passed
319 to "hivex_open").
320 Note this does not close the hive handle. You can perform further
322 operations on the hive after committing, including making more
323 modifications. If you no longer wish to use the hive, then you should
324 close the handle after committing.
325 The flags parameter is unused. Always pass 0.
327 Returns 0 on success. On error this returns -1 and sets errno.
329 hivex_node_add_child
331 hive_node_h hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name);
332 Add a new child node named "name" to the existing node "parent". The
334 new child initially has no subnodes and contains no keys or values.
335 The sk-record (security descriptor) is inherited from the parent.
336 The parent must not have an existing child called "name", so if you
338 want to overwrite an existing child, call "hivex_node_delete_child"
339 first.
340 Returns a node handle. On error this returns 0 and sets errno.
342 hivex_node_delete_child
344 int hivex_node_delete_child (hive_h *h, hive_node_h node);
345 Delete the node "node". All values at the node and all subnodes are
347 deleted (recursively). The "node" handle and the handles of all
348 subnodes become invalid. You cannot delete the root node.
349 Returns 0 on success. On error this returns -1 and sets errno.
351 hivex_node_set_values
353 int hivex_node_set_values (hive_h *h, hive_node_h node, size_t nr_values, const hive_set_value *values, int flags);
354 This call can be used to set all the (key, value) pairs stored in
356 "node".
357 "node" is the node to modify.
359 The flags parameter is unused. Always pass 0.
361 "values" is an array of (key, value) pairs. There should be
363 "nr_values" elements in this array.
364 Any existing values stored at the node are discarded, and their
366 "hive_value_h" handles become invalid. Thus you can remove all values
367 stored at "node" by passing "nr_values = 0".
368 Returns 0 on success. On error this returns -1 and sets errno.
370 hivex_node_set_value
372 int hivex_node_set_value (hive_h *h, hive_node_h node, const hive_set_value *val, int flags);
373 This call can be used to replace a single "(key, value)" pair stored in
375 "node". If the key does not already exist, then a new key is added.
376 Key matching is case insensitive.
377 "node" is the node to modify.
379 The flags parameter is unused. Always pass 0.
381 "value" is a single (key, value) pair.
383 Existing "hive_value_h" handles become invalid.
385 Returns 0 on success. On error this returns -1 and sets errno.
387
389 The hivex library supports making limited modifications to hive files.
390 We have tried to implement this very conservatively in order to reduce
391 the chance of corrupting your registry. However you should be careful
392 and take back-ups, since Microsoft has never documented the hive
393 format, and so it is possible there are nuances in the reverse-
394 engineered format that we do not understand.
395 To be able to modify a hive, you must pass the "HIVEX_OPEN_WRITE" flag
397 to "hivex_open", otherwise any write operation will return with errno
398 "EROFS".
399 The write operations shown below do not modify the on-disk file
401 immediately. You must call "hivex_commit" in order to write the
402 changes to disk. If you call "hivex_close" without committing then any
403 writes are discarded.
404 Hive files internally consist of a "memory dump" of binary blocks (like
406 the C heap), and some of these blocks can be unused. The hivex library
407 never reuses these unused blocks. Instead, to ensure robustness in the
408 face of the partially understood on-disk format, hivex only allocates
409 new blocks after the end of the file, and makes minimal modifications
410 to existing structures in the file to point to these new blocks. This
411 makes hivex slightly less disk-efficient than it could be, but disk is
412 cheap, and registry modifications tend to be very small.
413 When deleting nodes, it is possible that this library may leave
415 unreachable live blocks in the hive. This is because certain parts of
416 the hive disk format such as security (sk) records and big data (db)
417 records and classname fields are not well understood (and not
418 documented at all) and we play it safe by not attempting to modify
419 them. Apart from wasting a little bit of disk space, it is not thought
420 that unreachable blocks are a problem.
421 WRITE OPERATIONS WHICH ARE NOT SUPPORTED
423 · Changing the root node.
424 · Creating a new hive file from scratch. This is impossible at
426 present because not all fields in the header are understood. In
427 the hivex source tree is a file called "images/minimal" which could
428 be used as the basis for a new hive (but caveat emptor).
429 · Modifying or deleting single values at a node.
431 · Modifying security key (sk) records or classnames. Previously we
433 did not understand these records. However now they are well-
434 understood and we could add support if it was required (but nothing
435 much really uses them).
436
438 The visitor pattern is useful if you want to visit all nodes in the
439 tree or all nodes below a certain point in the tree.
440 First you set up your own "struct hivex_visitor" with your callback
442 functions.
443 Each of these callback functions should return 0 on success or -1 on
445 error. If any callback returns -1, then the entire visit terminates
446 immediately. If you don't need a callback function at all, set the
447 function pointer to NULL.
448 struct hivex_visitor {
450 int (*node_start) (hive_h *, void *opaque, hive_node_h, const char *name);
451 int (*node_end) (hive_h *, void *opaque, hive_node_h, const char *name);
452 int (*value_string) (hive_h *, void *opaque, hive_node_h, hive_value_h,
453 hive_type t, size_t len, const char *key, const char *str);
454 int (*value_multiple_strings) (hive_h *, void *opaque, hive_node_h,
455 hive_value_h, hive_type t, size_t len, const char *key, char **argv);
456 int (*value_string_invalid_utf16) (hive_h *, void *opaque, hive_node_h,
457 hive_value_h, hive_type t, size_t len, const char *key,
458 const char *str);
459 int (*value_dword) (hive_h *, void *opaque, hive_node_h, hive_value_h,
460 hive_type t, size_t len, const char *key, int32_t);
461 int (*value_qword) (hive_h *, void *opaque, hive_node_h, hive_value_h,
462 hive_type t, size_t len, const char *key, int64_t);
463 int (*value_binary) (hive_h *, void *opaque, hive_node_h, hive_value_h,
464 hive_type t, size_t len, const char *key, const char *value);
465 int (*value_none) (hive_h *, void *opaque, hive_node_h, hive_value_h,
466 hive_type t, size_t len, const char *key, const char *value);
467 int (*value_other) (hive_h *, void *opaque, hive_node_h, hive_value_h,
468 hive_type t, size_t len, const char *key, const char *value);
469 /* If value_any callback is not NULL, then the other value_*
470 * callbacks are not used, and value_any is called on all values.
471 */
472 int (*value_any) (hive_h *, void *opaque, hive_node_h, hive_value_h,
473 hive_type t, size_t len, const char *key, const char *value);
474 };
475 hivex_visit
477 int hivex_visit (hive_h *h, const struct hivex_visitor *visitor, size_t len, void *opaque, int flags);
478 Visit all the nodes recursively in the hive "h".
480 "visitor" should be a "hivex_visitor" structure with callback
482 fields filled in as required (unwanted callbacks can be set to
483 NULL). "len" must be the length of the 'visitor' struct (you
484 should pass "sizeof (struct hivex_visitor)" for this).
485 This returns 0 if the whole recursive visit was completed
487 successfully. On error this returns -1. If one of the callback
488 functions returned an error than we don't touch errno. If the
489 error was generated internally then we set errno.
490 You can skip bad registry entries by setting "flag" to
492 "HIVEX_VISIT_SKIP_BAD". If this flag is not set, then a bad
493 registry causes the function to return an error immediately.
494 This function is robust if the registry contains cycles or pointers
496 which are invalid or outside the registry. It detects these cases
497 and returns an error.
498 hivex_visit_node
500 int hivex_visit_node (hive_h *h, hive_node_h node, const struct hivex_visitor *visitor, size_t len, void *opaque);
501 Same as "hivex_visit" but instead of starting out at the root, this
503 starts at "node".
504
506 Note: To understand the relationship between hives and the common
507 Windows Registry keys (like "HKEY_LOCAL_MACHINE") please see the
508 Wikipedia page on the Windows Registry.
509 The Windows Registry is split across various binary files, each file
511 being known as a "hive". This library only handles a single hive file
512 at a time.
513 Hives are n-ary trees with a single root. Each node in the tree has a
515 name.
516 Each node in the tree (including non-leaf nodes) may have an arbitrary
518 list of (key, value) pairs attached to it. It may be the case that one
519 of these pairs has an empty key. This is referred to as the default
520 key for the node.
521 The (key, value) pairs are the place where the useful data is stored in
523 the registry. The key is always a string (possibly the empty string
524 for the default key). The value is a typed object (eg. string, int32,
525 binary, etc.).
526 RELATIONSHIP TO .REG FILES
528 The hivex C library does not care about or deal with Windows .REG
529 files. Instead we push this complexity up to the Perl Win::Hivex(3)
530 library and the Perl programs hivexregedit(1) and virt-win-reg(1).
531 Nevertheless it is useful to look at the relationship between the
532 Registry and .REG files because they are so common.
533 A .REG file is a textual representation of the registry, or part of the
535 registry. The actual registry hives that Windows uses are binary
536 files. There are a number of Windows and Linux tools that let you
537 generate .REG files, or merge .REG files back into the registry hives.
538 Notable amongst them is Microsoft's REGEDIT program (formerly known as
539 REGEDT32).
540 A typical .REG file will contain many sections looking like this:
542 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Stack]
544 "@"="Generic Stack"
545 "TileInfo"="prop:System.FileCount"
546 "TilePath"=str(2):"%systemroot%\\system32"
547 "ThumbnailCutoff"=dword:00000000
548 "FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
549 6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,\
550 33,00,32,00,5c,00,73,00,65,00,61,00,72,00,63,00,68,00,66,00,\
551 6f,00,6c,00,64,00,65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,\
552 2d,00,39,00,30,00,32,00,38,00,00,00,d8
553 Taking this one piece at a time:
555 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Stack]
557 This is the path to this node in the registry tree. The first part,
559 "HKEY_LOCAL_MACHINE\SOFTWARE" means that this comes from a hive file
560 called "C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE". "\Classes\Stack" is the
561 real path part, starting at the root node of the "SOFTWARE" hive.
562 Below the node name is a list of zero or more key-value pairs. Any
564 interior or leaf node in the registry may have key-value pairs
565 attached.
566 "@"="Generic Stack"
568 This is the "default key". In reality (ie. inside the binary hive) the
570 key string is the empty string. In reg files this is written as "@"
571 but this has no meaning either in the hives themselves or in this
572 library. The value is a string (type 1 - see "enum hive_type" above).
573 "TileInfo"="prop:System.FileCount"
575 This is a regular (key, value) pair, with the value being a type 1
577 string. Note that inside the binary file the string is likely to be
578 UTF-16 encoded. This library converts to and from UTF-8 strings
579 transparently.
580 "TilePath"=str(2):"%systemroot%\\system32"
582 The value in this case has type 2 (expanded string) meaning that some
584 %...% variables get expanded by Windows. (This library doesn't know or
585 care about variable expansion).
586 "ThumbnailCutoff"=dword:00000000
588 The value in this case is a dword (type 4).
590 "FriendlyTypeName"=hex(2):40,00,....
592 This value is an expanded string (type 2) represented in the reg file
594 as a series of hex bytes. In this case the string appears to be a
595 UTF-16 string.
596
598 Many functions in this library set errno to indicate errors. These are
599 the values of errno you may encounter (this list is not exhaustive):
600 ENOTSUP
602 Corrupt or unsupported Registry file format.
603 ENOKEY
605 Missing root key.
606 EINVAL
608 Passed an invalid argument to the function.
609 EFAULT
611 Followed a Registry pointer which goes outside the registry or
612 outside a registry block.
613 ELOOP
615 Registry contains cycles.
616 ERANGE
618 Field in the registry out of range.
619 EEXIST
621 Registry key already exists.
622 EROFS
624 Tried to write to a registry which is not opened for writing.
625
627 HIVEX_DEBUG
628 Setting HIVEX_DEBUG=1 will enable very verbose messages. This is
629 useful for debugging problems with the library itself.
630
632 hivexget(1), hivexml(1), hivexsh(1), hivexregedit(1), virt-win-reg(1),
633 Win::Hivex(3), guestfs(3), <http://libguestfs.org/>, virt-cat(1),
634 virt-edit(1), <http://en.wikipedia.org/wiki/Windows_Registry>.
635
637 Richard W.M. Jones ("rjones at redhat dot com")
638
640 Copyright (C) 2009-2010 Red Hat Inc.
641 Derived from code by Petter Nordahl-Hagen under a compatible license:
643 Copyright (C) 1997-2007 Petter Nordahl-Hagen.
644 Derived from code by Markus Stephany under a compatible license:
646 Copyright (C) 2000-2004 Markus Stephany.
647 This library is free software; you can redistribute it and/or modify it
649 under the terms of the GNU Lesser General Public License as published
650 by the Free Software Foundation; version 2.1 of the License only.
651 This library is distributed in the hope that it will be useful, but
653 WITHOUT ANY WARRANTY; without even the implied warranty of
654 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
655 Lesser General Public License for more details.
656hivex-1.2.5 2010-12-23 hivex(3)