[APP] Kheb v1.1 - File system and registry discovery tool [UPDATE - 20.7.2010]

Elemris · Jul 13, 2010

Introduction
Kheb allows you to see exactly what changes any software makes on your Pocket PC. It works by taking complete snapshots of your PPC's state, and creating a diff file that shows the changes between snapshots.

Kheb is a useful tool for software developers, ROM chefs, and advanced users.

Examples of useful stuff Kheb can do
• Shows you where an application places its files - for example, sometimes the executable and shortcuts are placed in obscure locations, with Kheb you can always find them.
• Security – See for yourself if dubious applications install sneaky registry settings to auto-load, or if they leave traces behind after being uninstalled.
• Helps create a custom CAB or OEM package based on an existing CAB, even if the CAB uses setup.dll to run code during installation. Great for aspiring ROM Chefs.
• Gives you a deeper understanding of how system settings work under the hood.
• Tells you exactly where an application hides its "registration information" after you enter a valid serial number. It can help you avoid going through annoying registration schemes over and over. Note that Kheb isn’t a hacking tool – you still need to properly register first, though Kheb could be used to easily create pre-registered releases.
• Helps you learn – if you’re a software developer, studying real-life examples of registry changes will let you find interesting and useful hooks into the system that you can use in your own software.

UPDATE New version 1.1 released.

Notes
• Requires .NET Compact Framework 3.5
• Please read the help file accessible through the menu for usage instructions.
• A complete snapshot of your device can take several minutes, so be patient...
• If you have network mapped storage, you will probably want to exclude the network directory in kheb.ini.
• I’d like to hear about your experience using Kheb - bug reports, feature requests, usability suggestions are all appreciated.
• If you create a release using Kheb, I'd appreciate it if you mention the program. Thank you!

This free software is provided AS IS, and you, its user, assume all risks when using it.

If you find Kheb useful, and want to support my efforts, please consider a small donation:

Changelog
v1.1
• Improved storage card detection algorithm.
• Improved error reporting - info about the exact problematic registry key\file is written to error.log file.
• Improved error handling - Kheb recovers from most IO problems (permissions, unconnected network filesystems, etc) and continues running.
• New icon

• "Generate OEM from diff" item is only enabled if there are existing diffs.
• Latest diff is auto selected
• More entries in kheb.ini

v1.0
• Initial public release

Ideas for a future version
• gui editor for kheb.ini file
• ability to pause\abort Kheb operation
• ability to run in the background with lowered priority
• Separate kheb.ini into 2 files to allow retaining user setting when upgrading version
• Real time monitoring of registry modifications and filesystem changes
• Ability to add description to diffs
• XDA_UC compatible .reg
• Ability to name snapshots, not just diffs

Elemris

v3patel · Jul 13, 2010

Getting error while taking snapshot

I am getting error whil taking snapshot below are errors if that can help you look into issue.
This happend twice on my first run and second run
I do see files in SC\kheb folder for registry and dirlist but look like dirlist is not completed.

An unexpected error has occurred in Kheb.exe.
Select Quit and then restart this program, or select Details for more information.

Kheb.exe
DirectoryNotFoundException
at System.IO.Directory.InternalGetFileDirectoryNames(String fullPath, Boolean file)
at System.IO.DirectoryInfo.GetDirectories(String searchPattern)
at Kheb.FileDirList.WalkDirectoryTree(DirectoryInfo root, FileVisitorHandler fileVisitor, List`1 ExcludedPaths)
at Kheb.FileDirList.WalkDirectoryTree(DirectoryInfo root, FileVisitorHandler fileVisitor, List`1 ExcludedPaths)
at Kheb.FileDirList.WalkDirectoryTree(DirectoryInfo root, FileVisitorHandler fileVisitor, List`1 ExcludedPaths)
at Kheb.FileDirList.WalkEntireFileSystem(FileVisitorHandler fileVisitor, List`1 ExcludedPaths)
at Kheb.Kheb.SnapshotDirlist(String outputFilename)
at Kheb.Kheb.TakeSnapshot(String snapshotsName, Boolean doRegistry, Boolean doDirlist)
at Kheb.KhebForm.buttonSnapshot_Click(Object sender, EventArgs e)
at System.Windows.Forms.MenuItem.OnClick(EventArgs e)
at System.Windows.Forms.Menu.ProcessMnuProc(Control ctlThis, WM wm, Int32 wParam, Int32 lParam)
at System.Windows.Forms.Form.WnProc(WM wm, Int32 wParam, Int32 lParam)
at System.Windows.Forms.Control._InternalWnProc(WM wm, Int32 wParam, Int32 lParam)
at Microsoft.AGL.Forms.EVL.EnterMainLoop(IntPtr hwnMain)
at System.Windows.Forms.Application.Run(Form fm)
at Kheb.Program.Main()

Elemris · Jul 13, 2010

v3patel, thank you for the detailed error report, I'm looking into it.
Update: There is some specific directory on your device that Kheb can't handle - perhaps a temporary directory or one that is used by other apps. Posted a new version that should handle the problem, please try it as I can't reproduce the issue. It might be possible to see which directory is causing the problem by looking at where the dirlist file stopped.

p107r0 · Jul 13, 2010

also errors right after start
HTC Leo, ROM 1.66.479.2 (76641) WWE

Code:

Kheb.exe
IOException

at System.IO.__Error.WinIOError(Int32 errorCode, String str)
as System.IO.Directory.InternalCreateDirectory(String fullPath, Sting path)
at System.IO.Directory.CreateDirectory(String path)
at Kheb.Kheb.FetchDirectoryListing(String directory)
at Kheb.Kheb.FetchSnapshotList()
at Kheb.KhebForm.RefreshForm()
at Kheb.KhebForm..ctor()
at Kheb.Program.Main()

PS. anyone knows how could I copy the above error report instead of having to retype it from device?

Elemris · Jul 13, 2010

p107r0 said:
also errors right after start
HTC Leo, ROM 1.66.479.2 (76641) WWE

Code:

Kheb.exe IOException at System.IO.__Error.WinIOError(Int32 errorCode, String str) as System.IO.Directory.InternalCreateDirectory(String fullPath, Sting path) at System.IO.Directory.CreateDirectory(String path) at Kheb.Kheb.FetchDirectoryListing(String directory) at Kheb.Kheb.FetchSnapshotList() at Kheb.KhebForm.RefreshForm() at Kheb.KhebForm..ctor() at Kheb.Program.Main()

PS. anyone knows how could I copy the above error report instead of having to retype it from device?

This error means Kheb tries to create the "\Storage Card\Kheb\Snapshots" directory and the operation fails due to an IO error.

Could you try creating the directory manually, then running Kheb and telling me what happened? the directories are named:
"\Storage Card\Kheb\snapshots"
"\Storage Card\Khed\diff"

Also is your storage card named "Storage Card" ? Kheb should recognize the storage regardless of name, but it could be a problem.

v3patel · Jul 13, 2010

use http://mymobiler.com/

p107r0 said:
also errors right after start
HTC Leo, ROM 1.66.479.2 (76641) WWE

PS. anyone knows how could I copy the above error report instead of having to retype it from device?

if you are using active sync then use my mobiler http://mymobiler.com/
I use it not just copy paste but for screen shot and many other things

p107r0 · Jul 13, 2010

Elemris said:
Could you try creating the directory manually, then running Kheb and telling me what happened? the directories are named:
"\Storage Card\Kheb\snapshots"
"\Storage Card\Khed\diff"
Also is your storage card named "Storage Card" ? Kheb should recognize the storage regardless of name, but it could be a problem.

Card is indeed named "Storage Card", created both dirs as advised:
Storage Card\Kheb\Snapshots
Storage Card\Kheb\diff
the same error pops up

v3patel said:
use my mobiler

thanks!! I have it, played with it, liked it, yet somehow it never occured to me I could use it with some purpose...

v3patel · Jul 13, 2010

Erro again

Elemris said:
v3patel, thank you for the detailed error report, I'm looking into it.
Update: There is some specific directory on your device that Kheb can't handle - perhaps a temporary directory or one that is used by other apps. Posted a new version that should handle the problem, please try it as I can't reproduce the issue. It might be possible to see which directory is causing the problem by looking at where the dirlist file stopped.

it errored again
last files in dirlist are

\Windows\eT9DisInput.dll 129197743296870237
\Windows\eT9ime.dll 129197743296870237

next file in list is eT9MyWords.exe hopefully this may help.

Elemris · Jul 13, 2010

v3patel, p107r0 - I'm contacting you privately to figure these issues out. It's amazing how different each device can be. Thanks for your help!

LiKBeAsT · Jul 14, 2010

Amazing program! Useful to every kind of user; power-user, programer etc..

Thank you very very much,
Keep it up!

starbase64 · Jul 14, 2010

Hi,

the snapshot function crashes, error log is attached.

with friendly greet

starbase64

mike2nl · Jul 14, 2010

It likes very interesting. Will test for some days and report back here.

J Raymond · Jul 14, 2010

So far...

Running on HTC Imagio with stock ROM runs fine.
Installed with no errors to storage card, runs off storage card.
I did a snap shot, then waited and then I did a diff and it very properly found a diff in the sync'ing status.

I like this idea of knowing what's changing in the registry when installing software.

willcor · Jul 15, 2010

have touch hd..with 6.1 stock rom .....
Kheb v1.0 ..working very, very smooth ..no errors
this is really a very" usefull tool ".... a must have ?
thank you
willcor

illi · Jul 15, 2010

I could do the Snapshots & Diff but Help produces the following error:

Code:

Kheb.exe
Win32Exception

   at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)
   at System.Diagnostics.Process.Start()
   at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
   at Kheb.KhebForm.menuItemHelp_Click(Object sender, EventArgs e)
   at System.Windows.Forms.MenuItem.OnClick(EventArgs e)
   at System.Windows.Forms.Menu.ProcessMnuProc(Control ctlThis, WM wm, Int32 wParam, Int32 lParam)
   at System.Windows.Forms.Form.WnProc(WM wm, Int32 wParam, Int32 lParam)
   at System.Windows.Forms.Control._InternalWnProc(WM wm, Int32 wParam, Int32 lParam)
   at Microsoft.AGL.Forms.EVL.EnterMainLoop(IntPtr hwnMain)
   at System.Windows.Forms.Application.Run(Form fm)
   at Kheb.Program.Main()

Kheb is installed on SDCard.

Farmer Ted · Jul 15, 2010

Really nice job! I already have SK Tracker, but I like the way this tool dumps the registry and the full device directory with each snapshot. The OEM option is also really handy-it's great having the reg keys dumped directly to one file.

Elemris · Jul 15, 2010

illi said:

I could do the Snapshots & Diff but Help produces the following error:

Code:

Kheb.exe
Win32Exception

   at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)
   at System.Diagnostics.Process.Start()
   at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
   at Kheb.KhebForm.menuItemHelp_Click(Object sender, EventArgs e)
   at System.Windows.Forms.MenuItem.OnClick(EventArgs e)
   at System.Windows.Forms.Menu.ProcessMnuProc(Control ctlThis, WM wm, Int32 wParam, Int32 lParam)
   at System.Windows.Forms.Form.WnProc(WM wm, Int32 wParam, Int32 lParam)
   at System.Windows.Forms.Control._InternalWnProc(WM wm, Int32 wParam, Int32 lParam)
   at Microsoft.AGL.Forms.EVL.EnterMainLoop(IntPtr hwnMain)
   at System.Windows.Forms.Application.Run(Form fm)
   at Kheb.Program.Main()

Kheb is installed on SDCard.

Thanks for the report. "Help" opens the kheb.html file in your browser. If that doesn't work on your device, you can just look at the kheb.html manually, it's in the Program Files\Kheb directory.

Is it possible you don't have a browser installed? Or perhaps no program is defined to handle html files?

Elemris · Jul 15, 2010

starbase64 said:
Hi,

the snapshot function crashes, error log is attached.

with friendly greet

starbase64

Thanks, the error means a specific registry key is causing problems. I'll look into it. Meanwhile, your can try the snapshot and diff for the file system only, by unchecking "Registry" in the "Storage Sites" menu.

illi · Jul 16, 2010

Elemris said:
Thanks for the report. "Help" opens the kheb.html file in your browser. If that doesn't work on your device, you can just look at the kheb.html manually, it's in the Program Files\Kheb directory.

Is it possible you don't have a browser installed? Or perhaps no program is defined to handle html files?

I have IE in ROM but the default browser, Opera Mobile 10, is installed on SDCard. I think there is a problem with my ROM; clicking the html files returns an error saying that there is no application associated... I still get an error even if I force open by these two browsers. So it is not your apps problem.

Thank you for sharing.

wingman1487 · Jul 16, 2010

Suggestion for .reg export file

This will come in handy for me (and others) who use the XDA_UC ability of custom ROMs. Instead of the current outputted .reg file where at the top of the file it says 'REGEDIT4' It would be beneficial to put it in the XDA_UC form with 'Windows Registry Editor Version 5.00' and 2 blank lines at the end (So it can be read from the file after flashing) Just a thought though. Great app!

[APP] Kheb v1.1 - File system and registry discovery tool [UPDATE - 20.7.2010]

Retired Recognized Developer

Attachments

Senior Member

Retired Recognized Developer

Senior Member

Retired Recognized Developer

Senior Member

Senior Member

Senior Member

Retired Recognized Developer

Member

Senior Member

Attachments

Senior Member

Member

Senior Member

Senior Member

Senior Member

Retired Recognized Developer

Retired Recognized Developer

Senior Member

Senior Member

Similar threads