Changeset 137

Timestamp:

01/23/09 17:58:43 (16 years ago)

Author:

tim

Message:

Added error messages to most parse functions in regfi

Relaxed validation requirements on NK types and missing value data

Location:

trunk

Files:

• include/regfi.h (modified) (1 diff)
• lib/regfi.c (modified) (42 diffs)
• src/common.c (modified) (2 diffs)
• src/reglookup.c (modified) (19 diffs)

trunk/include/regfi.h

@@ -111 +111 @@
 #define REGFI_VK_MAX_DATA_LENGTH   1024*1024
 
+
 /* NK record types */
+/* XXX: This is starting to look like this is a flags field.  
+ *      Need to decipher the meaning of each flag.
+ */
 #define REGFI_NK_TYPE_LINKKEY      0x0010
 #define REGFI_NK_TYPE_NORMALKEY    0x0020
  /* XXX: Unknown key type that shows up in Vista registries */
 #define REGFI_NK_TYPE_UNKNOWN1     0x1020
+ /* XXX: Unknown key types that shows up in W2K3 registries */
+#define REGFI_NK_TYPE_UNKNOWN2     0x4020
+#define REGFI_NK_TYPE_UNKNOWN3     0x0000  /* XXX: This type seems to have UTF-16 names!!! */
 #define REGFI_NK_TYPE_ROOTKEY1     0x002c
  /* XXX: Unknown root key type that shows up in Vista registries */
 #define REGFI_NK_TYPE_ROOTKEY2     0x00ac
+
+#if 0
+/* Initial hypothesis of NK flags: */
+#define REGFI_NK_FLAG_LINK         0x0010
+/* The name will be in ASCII if this next bit is set, otherwise UTF-16LE */
+#define REGFI_NK_FLAG_ASCIINAME    0x0020
+/* These next two combine to form the "c" on both known root key types */
+#define REGFI_NK_FLAG_ROOT1        0x0008
+#define REGFI_NK_FLAG_ROOT2        0x0004
+/* These next two show up on normal-seeming keys in Vista and W2K3 registries */
+#define REGFI_NK_FLAG_UNKNOWN1     0x4000
+#define REGFI_NK_FLAG_UNKNOWN2     0x1000
+/* This next one shows up on root keys in some Vista "software" registries */
+#define REGFI_NK_FLAG_UNKNOWN3     0x0080
+#endif
+
 
 

trunk/lib/regfi.c

@@ -701 +701 @@
   if(!regfi_parse_cell(file->fd, offset, sk_header, REGFI_SK_MIN_LENGTH,
                        &cell_length, &unalloc))
-    return NULL;
+  {
+    regfi_add_message(file, "ERROR: Could not parse SK record cell"
+                      " at offset 0x%.8X.", offset);
+    return NULL;
+  }
    
   if(sk_header[0] != 's' || sk_header[1] != 'k')
-    return NULL;
-  
+  {
+    regfi_add_message(file, "ERROR: Magic number mismatch in parsing SK record"
+                      " at offset 0x%.8X.", offset);
+    return NULL;
+  }
+
   ret_val = (REGFI_SK_REC*)zalloc(sizeof(REGFI_SK_REC));
   if(ret_val == NULL)
@@ -721 +729 @@
      || (strict && ret_val->cell_size != (ret_val->cell_size & 0xFFFFFFF8)))
   {
+    regfi_add_message(file, "ERROR: Invalid cell size found while parsing SK"
+                      " record at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -737 +747 @@
   if(ret_val->desc_size + REGFI_SK_MIN_LENGTH > ret_val->cell_size)
   {
+    regfi_add_message(file, "ERROR: Security descriptor too large for cell"
+                      " while parsing SK record at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -752 +764 @@
      || length != ret_val->desc_size)
   {
+    regfi_add_message(file, "ERROR: Failed to read security descriptor"
+                      " while parsing SK record at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -758 +772 @@
   if(!(ret_val->sec_desc = winsec_parse_desc(sec_desc_buf, ret_val->desc_size)))
   {
+    regfi_add_message(file, "ERROR: Failed to parse security descriptor"
+                      " while parsing SK record at offset 0x%.8X.", offset);
     free(sec_desc_buf);
     free(ret_val);
@@ -777 +793 @@
 
   if(!regfi_parse_cell(file->fd, offset, NULL, 0, &cell_length, &unalloc))
-    return NULL;
+  {
+    regfi_add_message(file, "ERROR: Failed to read cell header"
+                      " while parsing value list at offset 0x%.8X.", offset);
+    return NULL;
+  }
 
   if(cell_length != (cell_length & 0xFFFFFFF8))
@@ -786 +806 @@
   }
   if((num_values * sizeof(uint32)) > cell_length-sizeof(uint32))
-    return NULL;
+  {
+    regfi_add_message(file, "ERROR: Too many values found"
+                      " while parsing value list at offset 0x%.8X.", offset);
+    return NULL;
+  }
 
   read_len = num_values*sizeof(uint32);
@@ -796 +820 @@
   if((regfi_read(file->fd, (uint8*)ret_val, &length) != 0) || length != read_len)
   {
+    regfi_add_message(file, "ERROR: Failed to read value pointers"
+                      " while parsing value list at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -811 +837 @@
          || ((ret_val[i] & 0xFFFFFFF8) != ret_val[i]))
       {
+        regfi_add_message(file, "ERROR: Invalid value pointer (0x%.8X) found"
+                          " while parsing value list at offset 0x%.8X.", 
+                          ret_val[i], offset);
         free(ret_val);
         return NULL;
@@ -906 +935 @@
   {
     regfi_add_message(file, "ERROR: Could not load NK record at"
-                      " offset 0x%.8X.\n", offset);
+                      " offset 0x%.8X.", offset);
     return NULL;
   }
@@ -937 +966 @@
       {
         regfi_add_message(file, "ERROR: Could not load value list"
-                          " for NK record at offset 0x%.8X.\n",
+                          " for NK record at offset 0x%.8X.",
                           offset);
         free(nk);
@@ -1034 +1063 @@
 REGFI_FILE* regfi_open(const char* filename)
 {
+  struct stat sbuf;
   REGFI_FILE* rb;
   REGFI_HBIN* hbin = NULL;
-  uint32 hbin_off;
+  uint32 hbin_off, file_length;
   int fd;
   bool rla;
@@ -1047 +1077 @@
   }
   
+  /* Determine file length.  Must be at least big enough 
+   * for the header and one hbin. 
+   */
+  if (fstat(fd, &sbuf) == -1)
+    return NULL;
+  file_length = sbuf.st_size;
+  if(file_length < REGFI_REGF_SIZE+REGFI_HBIN_ALLOC)
+    return NULL;
+
   /* read in an existing file */
   if ((rb = regfi_parse_regf(fd, true)) == NULL) 
@@ -1054 +1093 @@
     return NULL;
   }
-  
+  rb->file_length = file_length;  
+
   rb->hbins = range_list_new();
   if(rb->hbins == NULL)
@@ -1069 +1109 @@
   while(hbin && rla)
   {
+    rla = range_list_add(rb->hbins, hbin->file_off, hbin->block_size, hbin);
     hbin_off = hbin->file_off + hbin->block_size;
-    rla = range_list_add(rb->hbins, hbin->file_off, hbin->block_size, hbin);
+    /*fprintf(stderr, "file_length=%.8X,hbin_off=%.8X,hbin->block_size=%.8X,hbin->next_block=%.8X\n", 
+      file_length, hbin_off, hbin->block_size, hbin->next_block);*/
     hbin = regfi_parse_hbin(rb, hbin_off, true);
   }
@@ -1550 +1592 @@
   uint8 file_header[REGFI_REGF_SIZE];
   uint32 length;
-  uint32 file_length;
-  struct stat sbuf;
   REGFI_FILE* ret_val;
-
-  /* Determine file length.  Must be at least big enough 
-   * for the header and one hbin. 
-   */
-  if (fstat(fd, &sbuf) == -1)
-    return NULL;
-  file_length = sbuf.st_size;
-  if(file_length < REGFI_REGF_SIZE+REGFI_HBIN_ALLOC)
-    return NULL;
 
   ret_val = (REGFI_FILE*)zalloc(sizeof(REGFI_FILE));
@@ -1568 +1599 @@
 
   ret_val->fd = fd;
-  ret_val->file_length = file_length;
 
   length = REGFI_REGF_SIZE;
@@ -1630 +1660 @@
 
   if(lseek(file->fd, offset, SEEK_SET) == -1)
-    return NULL;
+  {
+    regfi_add_message(file, "ERROR: Seek failed"
+                      " while parsing hbin at offset 0x%.8X.", offset);
+    return NULL;
+  }
 
   length = REGFI_HBIN_HEADER_SIZE;
@@ -1637 +1671 @@
     return NULL;
 
-
   if(lseek(file->fd, offset, SEEK_SET) == -1)
-    return NULL;
+  {
+    regfi_add_message(file, "ERROR: Seek failed"
+                      " while parsing hbin at offset 0x%.8X.", offset);
+    return NULL;
+  }
 
   if(!(hbin = (REGFI_HBIN*)zalloc(sizeof(REGFI_HBIN)))) 
@@ -1648 +1685 @@
   if(strict && (memcmp(hbin->magic, "hbin", 4) != 0))
   {
+    /* XXX: add this back in when we have configurable verbosity. */
+    /*    regfi_add_message(file, "INFO: Magic number mismatch (%.2X %.2X %.2X %.2X)"
+                      " while parsing hbin at offset 0x%.8X.", hbin->magic[0],
+                      hbin->magic[1], hbin->magic[2], hbin->magic[3], offset); */
     free(hbin);
     return NULL;
@@ -1654 +1695 @@
   hbin->first_hbin_off = IVAL(hbin_header, 0x4);
   hbin->block_size = IVAL(hbin_header, 0x8);
+    /*fprintf(stderr, "hbin->block_size field => %.8X\n", IVAL(hbin_header, 0x8));*/
+  /*  hbin->block_size = IVAL(hbin_header, 0x8);*/
   /* this should be the same thing as hbin->block_size but just in case */
   hbin->next_block = IVAL(hbin_header, 0x1C);
@@ -1667 +1710 @@
      || (hbin->block_size & 0xFFFFF000) != hbin->block_size)
   {
+    regfi_add_message(file, "ERROR: The hbin offset is not aligned"
+                      " or runs off the end of the file"
+                      " while parsing hbin at offset 0x%.8X.", offset);
     free(hbin);
     return NULL;
@@ -1689 +1735 @@
   if(!regfi_parse_cell(file->fd, offset, nk_header, REGFI_NK_MIN_LENGTH,
                        &cell_length, &unalloc))
-     return NULL;
- 
+  {
+    regfi_add_message(file, "ERROR: Could not parse cell header"
+                      " while parsing NK record at offset 0x%.8X.", offset);
+    return NULL;
+  }
+
   /* A bit of validation before bothering to allocate memory */
   if((nk_header[0x0] != 'n') || (nk_header[0x1] != 'k'))
   {
     regfi_add_message(file, "ERROR: Magic number mismatch in parsing NK record"
-                      " at offset 0x%.8X.\n", offset);
+                      " at offset 0x%.8X.", offset);
     return NULL;
   }
@@ -1703 +1753 @@
   {
     regfi_add_message(file, "ERROR: Failed to allocate memory while"
-                      " parsing NK record at offset 0x%.8X.\n", offset);
+                      " parsing NK record at offset 0x%.8X.", offset);
     return NULL;
   }
@@ -1716 +1766 @@
   {
     regfi_add_message(file, "ERROR: A length check failed while parsing"
-                      " NK record at offset 0x%.8X.\n", offset);
+                      " NK record at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -1728 +1778 @@
      && (ret_val->key_type != REGFI_NK_TYPE_ROOTKEY2)
      && (ret_val->key_type != REGFI_NK_TYPE_LINKKEY)
-     && (ret_val->key_type != REGFI_NK_TYPE_UNKNOWN1))
-  {
-    regfi_add_message(file, "ERROR: Unknown key type (0x%.4X) while parsing"
-                      " NK record at offset 0x%.8X.\n", ret_val->key_type,
+     && (ret_val->key_type != REGFI_NK_TYPE_UNKNOWN1)
+     && (ret_val->key_type != REGFI_NK_TYPE_UNKNOWN2)
+     && (ret_val->key_type != REGFI_NK_TYPE_UNKNOWN3))
+  {
+    regfi_add_message(file, "WARN: Unknown key type (0x%.4X) while parsing"
+                      " NK record at offset 0x%.8X.", ret_val->key_type,
                       offset);
-    free(ret_val);
-    return NULL;
   }
 
@@ -1775 +1825 @@
     if(strict)
     {
+      regfi_add_message(file, "ERROR: Contents too large for cell"
+                        " while parsing NK record at offset 0x%.8X.", offset);
       free(ret_val);
       return NULL;
@@ -1805 +1857 @@
      || length != ret_val->name_length)
   {
+    regfi_add_message(file, "ERROR: Failed to read key name"
+                      " while parsing NK record at offset 0x%.8X.", offset);
     free(ret_val->keyname);
     free(ret_val);
@@ -1823 +1877 @@
     }
     else
+    {
       ret_val->classname = NULL;
-    /*
+      regfi_add_message(file, "WARN: Could not find hbin for class name"
+                        " while parsing NK record at offset 0x%.8X.", offset);
+    }
+    /* XXX: Should add this back and make it more strict?
     if(strict && ret_val->classname == NULL)
         return NULL;
     */
   }
-
+  /*
+if(ret_val->key_type == 0x0000 || ret_val->key_type == 0x4020)
+{
+  fprintf(stderr, "INFO: keyname=%s,classname=%s,unalloc=%d,num_subkeys=%d,num_values=%d\n",
+          ret_val->keyname,ret_val->classname,unalloc,ret_val->num_subkeys,ret_val->num_values);
+}
+  */
   return ret_val;
 }
@@ -1846 +1910 @@
   {
     if(!regfi_parse_cell(file->fd, offset, NULL, 0, &cell_length, &unalloc))
+    {
+      regfi_add_message(file, "ERROR: Could not parse cell header"
+                        " while parsing class name at offset 0x%.8X.", offset);
         return NULL;
+    }
 
     if((cell_length & 0xFFFFFFF8) != cell_length)
+    {
+      regfi_add_message(file, "ERROR: Cell length not a multiple of 8"
+                        " while parsing class name at offset 0x%.8X.", offset);
       return NULL;
-    
+    }
+
     if(cell_length > max_size)
     {
+      regfi_add_message(file, "WARN: Cell stretches past hbin boundary"
+                        " while parsing class name at offset 0x%.8X.", offset);
       if(strict)
         return NULL;
@@ -1860 +1934 @@
     if((cell_length - 4) < *name_length)
     {
+      regfi_add_message(file, "WARN: Class name is larger than cell_length"
+                        " while parsing class name at offset 0x%.8X.", offset);
       if(strict)
         return NULL;
@@ -1872 +1948 @@
          || length != *name_length)
       {
+        regfi_add_message(file, "ERROR: Could not read class name"
+                          " while parsing class name at offset 0x%.8X.", offset);
         free(ret_val);
         return NULL;
       }
-
-      /*printf("==> cell_length=%d, classname_length=%d, max_bytes_subkeyclassname=%d\n", cell_length, ret_val->classname_length, ret_val->max_bytes_subkeyclassname);*/
     }
   }
@@ -1898 +1974 @@
   if(!regfi_parse_cell(file->fd, offset, vk_header, REGFI_VK_MIN_LENGTH,
                        &cell_length, &unalloc))
-    return NULL;
+  {
+    regfi_add_message(file, "ERROR: Could not parse cell header"
+                      " while parsing VK record at offset 0x%.8X.", offset);
+    return NULL;
+  }
 
   ret_val = (REGFI_VK_REC*)zalloc(sizeof(REGFI_VK_REC));
@@ -1912 +1992 @@
      || ret_val->cell_size != (ret_val->cell_size & 0xFFFFFFF8))
   {
+    regfi_add_message(file, "ERROR: Invalid cell size encountered"
+                      " while parsing VK record at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -1924 +2006 @@
      *      0xFFFF. 
      */
+    regfi_add_message(file, "ERROR: Magic number mismatch"
+                      " while parsing VK record at offset 0x%.8X.", offset);
     free(ret_val);
     return NULL;
@@ -1941 +2025 @@
     if(ret_val->name_length + REGFI_VK_MIN_LENGTH + 4 > ret_val->cell_size)
     {
+      regfi_add_message(file, "WARN: Name too long for remaining cell space"
+                        " while parsing VK record at offset 0x%.8X.", offset);
       if(strict)
       {
@@ -1966 +2052 @@
        || length != ret_val->name_length)
     {
+      regfi_add_message(file, "ERROR: Could not read value name"
+                        " while parsing VK record at offset 0x%.8X.", offset);
       free(ret_val->valuename);
       free(ret_val);
@@ -2004 +2092 @@
       }
       else
+      {
+        regfi_add_message(file, "WARN: Could not find hbin for data"
+                          " while parsing VK record at offset 0x%.8X.", offset);
         ret_val->data = NULL;
-    }
-
-    if(strict && (ret_val->data == NULL))
-    {
-      free(ret_val->valuename);
-      free(ret_val);
-      return NULL;
+      }
+    }
+
+    if(ret_val->data == NULL)
+    {
+      regfi_add_message(file, "WARN: Could not parse data record"
+                        " while parsing VK record at offset 0x%.8X.", offset);
     }
   }
@@ -2027 +2118 @@
   bool unalloc;
 
-  /* The data is stored in the offset if the size <= 4 */
+  /* The data is typically stored in the offset if the size <= 4 */
   if (length & REGFI_VK_DATA_IN_OFFSET)
   {
     length = length & ~REGFI_VK_DATA_IN_OFFSET;
     if(length > 4)
+    {
+      regfi_add_message(file, "ERROR: Data in offset but length > 4"
+                        " while parsing data record at offset 0x%.8X.", 
+                        offset);
       return NULL;
+    }
 
     if((ret_val = (uint8*)zalloc(sizeof(uint8)*length)) == NULL)
@@ -2044 +2140 @@
     if(!regfi_parse_cell(file->fd, offset, NULL, 0,
                          &cell_length, &unalloc))
+    {
+      regfi_add_message(file, "ERROR: Could not parse cell while"
+                        " parsing data record at offset 0x%.8X.", offset);
       return NULL;
+    }
 
     if((cell_length & 0xFFFFFFF8) != cell_length)
+    {
+      regfi_add_message(file, "ERROR: Cell length not multiple of 8"
+                        " while parsing data record at offset 0x%.8X.",
+                        offset);
       return NULL;
+    }
 
     if(cell_length > max_size)
     {
+      regfi_add_message(file, "WARN: Cell extends past hbin boundary"
+                        " while parsing data record at offset 0x%.8X.", 
+                        offset);
       if(strict)
         return NULL;
@@ -2063 +2171 @@
        *      such as 53392.
        */
+      regfi_add_message(file, "WARN: Data length (0x%.8X) larger than"
+                        " remaining cell length (0x%.8X)"
+                        " while parsing data record at offset 0x%.8X.", 
+                        length, cell_length - 4, offset);
       if(strict)
         return NULL;
@@ -2076 +2188 @@
        || read_length != length)
     {
+      regfi_add_message(file, "ERROR: Could not read data block while"
+                        " parsing data record at offset 0x%.8X.", offset);
       free(ret_val);
       return NULL;

trunk/src/common.c

@@ -38 +38 @@
 }
 
+void printMsgs(REGFI_ITERATOR* iter)
+{
+  char* msgs = regfi_get_messages(iter->f);
+  if(msgs != NULL)
+  {
+    fprintf(stderr, "%s", msgs);
+    free(msgs);
+  }
+}
+
 
 /* Returns a newly malloc()ed string which contains original buffer,
@@ -205 +215 @@
  * is the responsibility of the caller to free both a non-NULL return
  * value, and a non-NULL (*error_msg).
+ */
+/* XXX: Part of this function's logic should be pushed into the regfi API.
+ *      The structures should be parsed and stored with VK records and only 
+ *      escaped/encoded later in reglookup and reglookup-recover.
  */
 static char* data_to_ascii(unsigned char* datap, uint32 len, uint32 type, 

trunk/src/reglookup.c

@@ -67 +67 @@
   if(size > REGFI_VK_MAX_DATA_LENGTH)
   {
-    fprintf(stderr, "WARNING: value data size %d larger than "
+    fprintf(stderr, "WARN: value data size %d larger than "
             "%d, truncating...\n", size, REGFI_VK_MAX_DATA_LENGTH);
     size = REGFI_VK_MAX_DATA_LENGTH;
@@ -90 +90 @@
   {
     if(conv_error == NULL)
-      fprintf(stderr, "WARNING: Could not quote value for '%s/%s'.  "
+      fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
               "Memory allocation failure likely.\n", prefix, quoted_name);
     else if(print_verbose)
-      fprintf(stderr, "WARNING: Could not quote value for '%s/%s'.  "
+      fprintf(stderr, "WARN: Could not quote value for '%s/%s'.  "
               "Returned error: %s\n", prefix, quoted_name, conv_error);
   }
@@ -129 +129 @@
 
 
-
-/* XXX: Each chunk must be unquoted after it is split out. 
- *      Quoting syntax may need to be standardized and pushed into the API 
- *      to deal with this issue and others.
- */
 char** splitPath(const char* s)
 {
@@ -200 +195 @@
 
 /* Returns a quoted path from an iterator's stack */
-/* XXX: Some way should be found to integrate this into regfi's API 
- *      The problem is that the escaping is sorta reglookup-specific.
- */
 char* iter2Path(REGFI_ITERATOR* i)
 {
@@ -273 +265 @@
 
 
-void printValueList(REGFI_ITERATOR* i, char* prefix)
+void printValueList(REGFI_ITERATOR* iter, char* prefix)
 {
   const REGFI_VK_REC* value;
 
-  value = regfi_iterator_first_value(i);
+  value = regfi_iterator_first_value(iter);
   while(value != NULL)
   {
     if(!type_filter_enabled || (value->type == type_filter))
       printValue(value, prefix);
-    value = regfi_iterator_next_value(i);
-  }
-}
-
-
-void printKey(REGFI_ITERATOR* i, char* full_path)
+    value = regfi_iterator_next_value(iter);
+    printMsgs(iter);
+  }
+}
+
+
+void printKey(REGFI_ITERATOR* iter, char* full_path)
 {
   static char empty_str[1] = "";
@@ -300 +293 @@
   struct tm* tmp_time_s = NULL;
   const REGFI_SK_REC* sk;
-  const REGFI_NK_REC* k = regfi_iterator_cur_key(i);
+  const REGFI_NK_REC* k = regfi_iterator_cur_key(iter);
 
   *tmp_time = nt_time_to_unix(&k->mtime);
@@ -306 +299 @@
   strftime(mtime, sizeof(mtime), "%Y-%m-%d %H:%M:%S", tmp_time_s);
 
-  if(print_security && (sk=regfi_iterator_cur_sk(i)))
+  if(print_security && (sk=regfi_iterator_cur_sk(iter)))
   {
     owner = regfi_get_owner(sk->sec_desc);
@@ -340 +333 @@
       {
         if(print_verbose)
-          fprintf(stderr, "WARNING: While converting classname"
+          fprintf(stderr, "WARN: While converting classname"
                   " for key '%s': %s.\n", full_path, error_msg);
         free(error_msg);
@@ -348 +341 @@
       quoted_classname = empty_str;
 
+    printMsgs(iter);
     printf("%s,KEY,,%s,%s,%s,%s,%s,%s\n", full_path, mtime, 
            owner, group, sacl, dacl, quoted_classname);
@@ -373 +367 @@
   const REGFI_NK_REC* sub = NULL;
   char* path = NULL;
-  char* msgs = NULL;
   int key_type = regfi_type_str2val("KEY");
   bool print_this = true;
@@ -379 +372 @@
   root = cur = regfi_iterator_cur_key(iter);
   sub = regfi_iterator_first_subkey(iter);
-  msgs = regfi_get_messages(iter->f);
-  if(msgs != NULL)
-    fprintf(stderr, "%s", msgs);
+  printMsgs(iter);
+
   if(root == NULL)
     bailOut(EX_DATAERR, "ERROR: root cannot be NULL.\n");
@@ -392 +384 @@
       if(path == NULL)
         bailOut(EX_OSERR, "ERROR: Could not construct iterator's path.\n");
-      
+
       if(!type_filter_enabled || (key_type == type_filter))
         printKey(iter, path);
@@ -407 +399 @@
         /* We're done with this sub-tree, going up and hitting other branches. */
         if(!regfi_iterator_up(iter))
+        {
+          printMsgs(iter);
           bailOut(EX_DATAERR, "ERROR: could not traverse iterator upward.\n");
-        
+        }
+
         cur = regfi_iterator_cur_key(iter);
         if(cur == NULL)
+        {
+          printMsgs(iter);
           bailOut(EX_DATAERR, "ERROR: unexpected NULL for key.\n");
-        
+        }
+
         sub = regfi_iterator_next_subkey(iter);
       }
@@ -422 +420 @@
        */
       if(!regfi_iterator_down(iter))
+      {
+        printMsgs(iter);
         bailOut(EX_DATAERR, "ERROR: could not traverse iterator downward.\n");
+      }
 
       cur = sub;
@@ -428 +429 @@
       print_this = true;
     }
+    printMsgs(iter);
   } while(!((cur == root) && (sub == NULL)));
 
@@ -479 +481 @@
   if(!regfi_iterator_walk_path(iter, tmp_path))
   {
+    printMsgs(iter);
     free(tmp_path);
     return 0;
@@ -489 +492 @@
 
     value = regfi_iterator_cur_value(iter);
+    printMsgs(iter);
     tmp_path_joined = iter2Path(iter);
 
@@ -503 +507 @@
   else if(regfi_iterator_find_subkey(iter, path[i]))
   {
+    printMsgs(iter);
     if(print_verbose)
       fprintf(stderr, "VERBOSE: Found final path element as key.\n");
 
     if(!regfi_iterator_down(iter))
+    {
+      printMsgs(iter);
       bailOut(EX_DATAERR, "ERROR: Unexpected error on traversing path filter key.\n");
+    }
 
     return 2;
   }
+  printMsgs(iter);
 
   if(print_verbose)
@@ -625 +634 @@
   {
     retr_path_ret = retrievePath(iter, path);
+    printMsgs(iter);
     freePath(path);
 
     if(retr_path_ret == 0)
-      fprintf(stderr, "WARNING: specified path not found.\n");
+      fprintf(stderr, "WARN: specified path not found.\n");
     else if (retr_path_ret == 2)
       printKeyTree(iter);