Changeset 1108

Timestamp:

01/11/08 16:55:41 (8 months ago)

Author:

kindlund

Message:

Updated fingerprint data model to reflect new Ruby database structure.

Files:

• honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm (modified) (14 diffs)

honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm

@@ -437 +437 @@
-  $changes = {
-    #A reference to an anonymous array of process objects
-
+os_
-        'name' => "C:\WINDOWS\system32\Notepad.exe", # The process name as a full path
-        'pid' => 1000,              # The Windows system process ID
@@ -450 +450 @@
-        
-        #OPTIONAL, its existence signifies that we saw this process be created
-_time
+
-        
-        #OPTIONAL, its existence signifies that we saw this process be terminated
-terminated_time
+stopped
-
-        #A reference to an anonymous array of registry objects
-istry
+keys
-            # The registry directory name in regedit
-            'key_name' => 'HKEY_LOCAL_MACHINE\Software...',
-
-
+_at
-
-            #The specific registry event type which took place, as given by it's Windows name
-_type
+
-                                QueryValueKey, EnumerateKey | EnumerateValueKey | 
-                                SetValueKey | DeleteValueKey | DeleteKey },
@@ -472 +472 @@
-            #The "type" which shows up in regedit. It is only possible to create the first 
-            # 6 types by manually using regedit (and REG_NONE is only indirect, for instance
-_type
+
-            'value_type' => { REG_NONE | REG_SZ | REG_BINARY | REG_DWORD | 
-                                REG_EXPAND_SZ | REG_MULTI_SZ | REG_LINK | 
@@ -485 +485 @@
-        
-        #A reference to an anonymous array of file system objects
-file_system
+process_files
-            #The full path and name of the file which was effected
-            'name'  => 'C:\WINDOWS\SYSTEM32...',
-
-_type
-
-
+
+
+_at
-            
-            #OPTIONAL, this will not exist for deleted files
@@ -546 +546 @@
-    else{
-        %changes = (
-
+os_
-        );
-
@@ -596 +596 @@
-    my @tmp_toks = split("\",\"",$capdump[0]);
-    $tmp_toks[0] =~ s/^"(.*)/$1/;
-compromise_time
+time_at
-    my $line_num = 0;
-
@@ -618 +618 @@
-                #If the object already exists as something which didn't have anything filled in, then fill it in
-                if($ret == 1){
-
+
+
-                    $proc_push = 0; 
-                }
@@ -628 +629 @@
-                'parent_pid' => $toks[$P_PARENT_PID],
-                'parent_name' => $toks[$P_PARENT_NAME],
-
-
-
+
+
+
+
-            };
-        }
@@ -645 +647 @@
-                    'pid' => $toks[$R_PROC_PID],
-                    'name' => $toks[$R_PROC_NAME],
-istry
-file_system
+keys
+process_files
-                }; 
-                $proc_push = 1;
@@ -665 +667 @@
-                }
-                my $reg_obj = {
-
-_type
+_at
+
-                    'key_name' => $sanit_key_name,
-                    'value_name' => $toks[$R_VALUE_NAME],
@@ -672 +674 @@
-                    'value' => $toks[$R_VALUE],
-                };
-istry
+keys
-            }
-            elsif($toks[$ENTRY_TYPE] eq "file"){
-
-                #Build the filesystem object and put it in to the proc object
-file_system
+process_files
-                if(scalar(@{$fs_ref}) == 0 || $fs_ref->[-1]->{'name'} ne $toks[$F_NAME] ||
-_type
+
-                      
-                    my $file_obj = {
-                        'name' => $toks[$F_NAME],
-_type
-
+
+_at
-                    };
-                    if($toks[$F_EVENT_TYPE] ne "Delete"){
@@ -741 +743 @@
-                            };
-                        }
-file_system
+process_files
-                    }
-
@@ -752 +754 @@
-    }#end foreach
-
-
+os_
-#    $Data::Dumper::Terse = 1;
-#    $Data::Dumper::Indent = 1;
@@ -762 +764 @@
-    # If any changes were found, write them out to the
-    # filesystem.
-
+os_
-        if (!open(CHANGE_FILE, ">>" . $self->{changes_found_file})) {
-            $LOG->error("Unable to write changes to file '" . $self->{changes_found_file} . "'.");