require 'util/miq-xml'
require 'digest/md5'
require 'metadata/util/win32/remote-registry'
require 'util/miq-encode'
class FleeceHives
def self.collect_hive_data(xmlNode, hiveName, regHnd, xmlCol, fs)
# SAM hive
if hiveName.downcase == "sam"
scanFor = [
["SAM", "HKEY_LOCAL_MACHINE\\SAM\\SAM"],
]
# SYSTEM hive
elsif hiveName.downcase == "system"
# Preprocess some keys by making copies of them so they are not lost during processServices
scanFor = [
# The following are used for system category
["system/network", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters"],
]
scanFor.each { |i| addElement(xmlNode.root, i[0], i[1], xmlCol, true) }
processServices(xmlNode, hiveName, regHnd, xmlCol)
scanFor = [
["system/os", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName"],
["system/os", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment"],
["system/os", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\ProductOptions"],
]
# SOFTWARE hive
elsif hiveName.downcase == "software"
scanFor = [
# The following are used for the system category
["system/network", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards"],
# The following are used for the software category
["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix"],
# ["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Products"],
["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData"],
["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"],
["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths"],
# ["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"],
# ["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce"],
# ["software", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx"],
]
# The following are for the system/os category, but I can't remove it for
# software because it screws up the product keys, due to the way product
# keys are precollected from this key
eNode = MIQRexml.findElement("system/os", xmlCol.root)
eNode = eNode.add_element("key", "keyname" => "CurrentVersion", "fqname" => "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion")
currentOS_ele = regHnd.open(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion")
currentOS_ele.each_element_with_attribute('name') { |e| eNode << e } unless currentOS_ele.nil?
end
scanFor.each { |i| addElement(xmlNode.root, i[0], i[1], xmlCol) } unless scanFor.nil?
case hiveName.downcase
when "software"
begin
postProcessApps(xmlCol, fs)
rescue Exception => err
$log.warn "Exception during Post-process Applications: [#{err}]"
end
begin
collectProductKeys(xmlNode.root, xmlCol, regHnd)
rescue => err
$log.warn "Exception during Collect Product Keys: [#{err}]"
end
end
end
def self.scanRegistry(_c, fs, hives = ["sam", nil, "security", nil, "default", nil, "system", nil, "software", nil])
xmlCol = MiqXml.createDoc("<miq/>")
hives.each_slice(2) do |hive, filter|
regHnd = RemoteRegistry.new(fs)
$log.debug "Loading registry hive [#{hive}]..."
xml = regHnd.loadHive(hive, filter)
$log.debug "Loading registry hive complete."
# File.open("C:/temp/reg_extract_full_#{c}.xml","w"){|f| xml.write(f,0)}
# Scrap details from this hive
$log.debug "Fleecing registry data."
FleeceHives.collect_hive_data(xml, hive, regHnd, xmlCol, fs)
$log.debug "Fleecing complete."
end
# File.open("C:/temp/reg_extract_#{c}.xml","w"){|f| xmlCol.write(f,0)}
xmlCol
end
def self.collectProductKeys(_xml, xmlCol, regHnd)
prodKeys = MIQRexml.findElement("software/productkeys", xmlCol.root)
regHnd.digitalProductKeys.each do |e|
if e.parent && e.parent.attributes['fqname'] && e.parent.attributes['fqname'].downcase != 'software\\microsoft\\windows nt\\currentversion'
pk = productKeys(e)
prodKeys << pk if pk
end
end
end
def self.productKeys(xmlNode)
p = xmlNode.parent
newEle = xmlNode.get_path
t = nil
newEle.each_recursive { |e1| t = e1 }
p.each_element do|e|
if e.attributes['name'] && e.attributes['name'].downcase.include?("product")
x = e.shallow_copy
x.text = e.text
t << x
end
end
ret = nil
begin
ret = newEle.find_first("//*/key[@keyname=\"Microsoft\"]")
ret = ret.elements[1] if ret
rescue => e
end
ret
end
def self.postProcessApps(xmlCol, fs)
appPath = MIQRexml.findRegElement("software/App Paths", xmlCol.root)
return if appPath.nil?
# The icon sections below will need to be uncommented when we are ready to start
# implementing application image uploading.
# iconNode = MIQRexml.findElement("Applications/images", xmlCol.root)
appPath.each_element do|e|
e.each_element_with_attribute('name', '(Default)', max = 1) do|e1|
begin
fileName = e1.text
fileName.tr!("\\", "/")
fileName = fileName[1..-2] if fileName[0, 1] == "\"" && fileName[-1, 1] == "\""
# $log.warn "Processing App - [#{fileName}]"
fh = fs.fileOpen(fileName)
vi = File.getVersionInfo(fh)
# Access application icons
# peData = PEheader.new(fh)
fh.close
# $log.warn "Processing App - [#{fileName}] - VI length:[#{vi.length}]"
if vi.length > 0
e2 = e.add_element('versioninfo')
vi.each_pair { |k, v| e2.add_element("value", "name" => k).add_text(v.to_s) }
end
# if peData.icons.length > 0
# ie = e1.add_element("image",{"file"=>fileName, "count"=>peData.icons.length.to_s, "md5"=>Digest::MD5.hexdigest(peData.icons[0])})
# addIconData(ie, peData, iconNode)
# end
rescue Exception => e
# $log.warn "postProcessApps - [#{fileName}] - error [#{e.to_s}]"
end
end
end
end
def self.addIconData(icon_element, peData, iconNode)
$log.debug "Adding application image: [#{icon_element}]"
# Copy this element into another branch of the xml to store icon binary data
newEle = iconNode.add_element(icon_element.name, icon_element.attributes)
# Encode binary icon data as an element
newEle.add_element("binary", {"type" => "icon"}).add_text(MIQEncode.encode(peData.icons[0]))
end
def self.processServices(xmlNode, _hiveName, _regHnd, xmlCol)
eServices = MIQRexml.findElement("services", xmlCol.root)
eSvcList = MIQRexml.findRegElement("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services", xmlNode.root)
if eSvcList
eSvcList.each_element do |e|
next if e.name != "key"
# Remove child elements's that have children. This data is not being processed on the server
# and adds a lot of extract size to the xml and time for tagging.
e.each_element { |e1| e1.remove! if e1.name == 'key' }
# Create one element referring to the type by name
serviceType = MIQRexml.getChildAttrib(e, "Type", 1).to_i
e2 = e.add_element("value", "name" => "TypeName", "type" => "REG_SZ")
e2.text = if (serviceType & 0x00000001) > 0
"kernel"
elsif (serviceType & 0x00000002) > 0
"filesystem"
elsif ((serviceType & 0x00000010) > 0) || ((serviceType & 0x00000020) > 0)
"win32_service"
else
"misc"
end
eServices << e
end
end
end
def self.addElement(xmlNode, nodeName, regPath, xmlCol, makeCopy = false)
eNode = MIQRexml.findElement(nodeName, xmlCol.root)
eNew = MIQRexml.findRegElement(regPath, xmlNode)
if makeCopy
eNode << MiqXml.createDoc(eNew.to_s).root if eNew
else
eNode << eNew if eNew
end
end
end