Forums

Skip to content

Advanced search
  • Quick links
    • Unanswered topics
    • Active topics
    • Search
  • FAQ
  • Login
  • Register
  • Board index Assistance Unsupported Software
  • Search

app-crypt/chntpw ... on read only Win10 NTFS... what the...?

This forum covers all Gentoo-related software not officially supported by Gentoo. Ebuilds/software posted here might harm the health and stability of your system(s), and are not supported by Gentoo developers. Bugs/errors caused by ebuilds from overlays.gentoo.org are covered by this forum, too.
Post Reply
Advanced search
5 posts • Page 1 of 1
Author
Message
eccerr0r
Watchman
Watchman
Posts: 10239
Joined: Thu Jul 01, 2004 6:51 pm
Location: almost Mile High in the USA
Contact:
Contact eccerr0r
Website

app-crypt/chntpw ... on read only Win10 NTFS... what the...?

  • Quote

Post by eccerr0r » Tue Aug 26, 2025 4:07 pm

Okay, yes app-crypt/chntpw is technically in portage and "supported" but this might be an unsupported mode of operation.

I have a windows 10 install on an NVMe I bought with a used system. So I mounted the disk readonly and tried

Code: Select all

$ cd windows/System32/config
$ xxd SAM|head -2
00000000: 7265 6766 7700 0000 7700 0000 0000 0000  regfw...w.......
00000010: 0000 0000 0100 0000 0500 0000 0000 0000  ................
$ chntpw -l SAM
chntpw version 1.00 140201, (c) Petter N Hagen
openHive(SAM) failed: Read-only file system, trying read-only
openHive(): read error: : Read-only file system
chntpw: Unable to open/read a hive, exiting..
$ sampasswd -l SAM
openHive(SAM) failed: Read-only file system, trying read-only
openHive(): read error: : Read-only file system
sampasswd: ERROR: Unable to open/read registry hive, cannot continue
What the heck? Need read/write access to list the contents of the SAM file?
I don't get it... is there something funny going on here with chntpw/sampasswd and Windows somehow requiring read/write access to view the contents of the SAM registry?
Intel Core i7 2700K/Radeon Firepro W2100/24GB DDR3/800GB SSD
What am I supposed watching?
Top
rab0171610
l33t
l33t
Posts: 720
Joined: Sat Dec 24, 2022 1:41 am

  • Quote

Post by rab0171610 » Tue Aug 26, 2025 6:32 pm

https://superuser.com/questions/1010229 ... -read-only
I would guess that Windows had fastboot enabled and shutdown in hibernation mode which puts the disk in read only mode. See the link for more information.
Maybe something there will give you an idea on a workaround.
Top
eccerr0r
Watchman
Watchman
Posts: 10239
Joined: Thu Jul 01, 2004 6:51 pm
Location: almost Mile High in the USA
Contact:
Contact eccerr0r
Website

  • Quote

Post by eccerr0r » Tue Aug 26, 2025 10:41 pm

Well, actually I mounted the disk readonly so it's readonly for my reason!

Just found it weird that to read something, it requires write access... That's very messed up imho! Do I need to image the media to experiment?

--

I copied the file SAM to tmpfs /tmp and it seems to work ... what gives.
Intel Core i7 2700K/Radeon Firepro W2100/24GB DDR3/800GB SSD
What am I supposed watching?
Top
rab0171610
l33t
l33t
Posts: 720
Joined: Sat Dec 24, 2022 1:41 am

  • Quote

Post by rab0171610 » Tue Aug 26, 2025 11:54 pm

It appears that the ebuild in the Gentoo repo downloads the source code from:
https://pogostick.net/~pnh/ntpasswd/chn ... 140201.zip
I downloaded and looked at that source code.

I also noticed this:
https://bugs-devel.debian.org/cgi-bin/b ... g=762508#6
"Fails to read from read-only filesystems; uses buggy read logic and error detection"

Code: Select all

Package: chntpw
Version: 1.0-1
Severity: important
Tags: upstream patch

   chntpw fails to read files from read-only filesystems, despite
having some logic to handle this:

# chntpw -e /c/Windows/System32/config/SOFTWARE
chntpw version 1.00 140201, (c) Petter N Hagen
openHive(/c/Windows/System32/config/SOFTWARE) failed: Read-only file system, trying read-only
openHive(): read error: : Read-only file system
chntpw: Unable to open/read a hive, exiting..
#

   This is due to using errno as an error checking mechanism; it should
only be used when one knows a function has failed. The attached patch
fixes this problem. It also adds support for the non-fatal EINTR error,
and fixes yet another bug where the last read size is used in a check
instead of the whole file size.
You can find a list of patches that were accepted into Debian chntpw package over the years here:
https://sources.debian.org/patches/chntpw/140201-1/
Specifically, the one discussed above : 12_readonly_filesystem
Here is the direct link to said patch:
https://sources.debian.org/data/main/c/ ... filesystem
I do not see any such patch in my system in the ebuild directory:
/var/db/repos/gentoo/app-crypt/chntpw/files
I also read the downloaded source code (from the Gentoo ebuild), specifically the file that patch would apply to, ntreg.c .
It does not appear to have the fixed (patched) code and still uses the original code.
Here is a text version of the patch:
https://sources.debian.org/data/main/c/ ... filesystem
Maybe you can incorporate that patch into a your own personal chntpw ebuild.

Code: Select all

--- chntpw-1.0.orig/ntreg.c
+++ chntpw-1.0/ntreg.c
@@ -4241,9 +4241,9 @@ struct hive *openHive(char *filename, in
   do {  /* On some platforms read may not block, and read in chunks. handle that */
     r = read(hdesc->filedesc, hdesc->buffer + rt, hdesc->size - rt);
     rt += r;
-  } while ( !errno && (rt < hdesc->size) );
+  } while ( (r > 0 || (r < 0 && errno == EINTR)) && (rt < hdesc->size) );
 
-  if (errno) { 
+  if (r < 0) {
     perror("openHive(): read error: ");
     closeHive(hdesc);
     return(NULL);
@@ -4255,10 +4255,10 @@ struct hive *openHive(char *filename, in
     return(NULL);
   }
 
-  if (r < sizeof (*hdesc)) {
+  if (rt < sizeof (*hdesc)) {
     fprintf(stderr,
 	    "file is too small; got %d bytes while expecting %d or more\n",
-	    r, sizeof (*hdesc));
+	    rt, sizeof (*hdesc));
     closeHive(hdesc);
     return(NULL);
   }
*** Also, I noticed the Gentoo package is looking for a new maintainer. Maybe you would be the perfect person to take it over and incorporate any of those 15 patches that might be deemed suitable for the Gentoo ebuild. ***
Top
eccerr0r
Watchman
Watchman
Posts: 10239
Joined: Thu Jul 01, 2004 6:51 pm
Location: almost Mile High in the USA
Contact:
Contact eccerr0r
Website

  • Quote

Post by eccerr0r » Wed Aug 27, 2025 12:43 am

TBH I don't want to be a maintainer solely for the reason I don't want to have to go through a proxy, alas I see the reason for why they don't go and trust everyone... it needs to be secure...
Intel Core i7 2700K/Radeon Firepro W2100/24GB DDR3/800GB SSD
What am I supposed watching?
Top
Post Reply

5 posts • Page 1 of 1

Return to “Unsupported Software”

Jump to
  • Assistance
  • ↳   News & Announcements
  • ↳   Frequently Asked Questions
  • ↳   Installing Gentoo
  • ↳   Multimedia
  • ↳   Desktop Environments
  • ↳   Networking & Security
  • ↳   Kernel & Hardware
  • ↳   Portage & Programming
  • ↳   Gamers & Players
  • ↳   Other Things Gentoo
  • ↳   Unsupported Software
  • Discussion & Documentation
  • ↳   Documentation, Tips & Tricks
  • ↳   Gentoo Chat
  • ↳   Gentoo Forums Feedback
  • ↳   Duplicate Threads
  • International Gentoo Users
  • ↳   中文 (Chinese)
  • ↳   Dutch
  • ↳   Finnish
  • ↳   French
  • ↳   Deutsches Forum (German)
  • ↳   Diskussionsforum
  • ↳   Deutsche Dokumentation
  • ↳   Greek
  • ↳   Forum italiano (Italian)
  • ↳   Forum di discussione italiano
  • ↳   Risorse italiane (documentazione e tools)
  • ↳   Polskie forum (Polish)
  • ↳   Instalacja i sprzęt
  • ↳   Polish OTW
  • ↳   Portuguese
  • ↳   Documentação, Ferramentas e Dicas
  • ↳   Russian
  • ↳   Scandinavian
  • ↳   Spanish
  • ↳   Other Languages
  • Architectures & Platforms
  • ↳   Gentoo on ARM
  • ↳   Gentoo on PPC
  • ↳   Gentoo on Sparc
  • ↳   Gentoo on Alternative Architectures
  • ↳   Gentoo on AMD64
  • ↳   Gentoo for Mac OS X (Portage for Mac OS X)
  • Board index
  • All times are UTC
  • Delete cookies

© 2001–2026 Gentoo Foundation, Inc.

Powered by phpBB® Forum Software © phpBB Limited

Privacy Policy