Changeset 112

Timestamp:

12/14/06 03:48:53 (2 years ago)

Author:

kindlund

Message:

Identified slowdown culprit: XML::XPath using $` (which is bad). Developed patch file.

Files:

• honeyclient/branches/bug/42/etc/honeyclient.xml (modified) (1 diff)
• honeyclient/branches/bug/42/etc/honeyclient_log.conf (modified) (1 diff)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm (modified) (5 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm (modified) (8 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp (modified) (1 diff)
• honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry_parser.t (modified) (2 diffs)

honeyclient/branches/bug/42/etc/honeyclient.xml

@@ -72 +72 @@
-            </timeout>
-            <Browser>
-    
-   
-   
+ 
+    
+    
-                    1
-                </ignore_links_timed_out>
-   
-   
+    
+    
-                    iexplore.exe
-                </process_name>
-   
+    
-                    -1
-                </max_relative_links_to_visit>
-   
-    
-   
-   
+    
+ 
+    
+    
-                        1
-                    </ignore_links_timed_out>
-   
-   
+    
+    
-                        iexplore.exe
-                    </process_name>
-   
+    
-                        -1
-                    </max_relative_links_to_visit>
-    
+ 
-                <FF>
-   
+    
-                        5
-                    </max_relative_links_to_visit>
-   
-   
+    
+    
-                        none
-                    </http_proxy>
-   
+    
-                        C:\Program Files\Mozilla Firefox\firefox.exe
-                    </ff_exec>
-   
+    
-            </Browser>
-            <EmailClient>

honeyclient/branches/bug/42/etc/honeyclient_log.conf

@@ -61 +61 @@
-log4perl.rootLogger=DEBUG, Screen
-# Suppress Parser Debugging Messages
-# Note: If you want to change the logging level for the parser, then
-# you must also edit the Parser.pm file directly, as this setting
-# is only enforced within the Parser.pm file.
-log4perl.logger.HoneyClient.Agent.Integrity.Registry.Parser=INFO, Screen
-log4perl.appender.Screen=Log::Log4perl::Appender::Screen

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm

@@ -407 +407 @@
-        }
-
-
+
+
-
-        # Preemptively unlink the file, to prevent any other process from mucking with it.
@@ -559 +560 @@
-
-    # Perform diff operation.
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            $LOG->fatal("Error: Unable to diff '" . $src_filename . "' against '" . $tgt_filename ."'.");
-            Carp::croak("Error: Unable to diff '" . $src_filename . "' against '" . $tgt_filename ."'.");
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -733 +1027 @@
-        $LOG->info("Before file '" . $args{'before_file'} . "' manually specified; " .
-                   "using this file as basis, instead of any previous registry snapshot.");
-
+
+
-        $self->{_filenames}->{$before_parser} = $args{'before_file'};
-    }
@@ -742 +1037 @@
-        $LOG->info("After file '" . $args{'after_file'} . "' manually specified; " .
-                   "using this file for comparison, instead of snapshotting the registry.");
-
+
+
-        $self->{_filenames}->{$after_parser} = $args{'after_file'};
-    }
@@ -779 +1075 @@
-    return $changes;
-}        
-
-# TODO: Comment this.
-sub _compare {
-
-    # Extract arguments.
-    my ($self, %args) = @_;
-
-    my $before_parser = $args{'before_parser'};
-    my $after_parser  = $args{'after_parser'};
-
-    # Array reference, containing hashtables, where each
-    # hashtable represents a change between the before and
-    # after parsers.
-    my $changes = []; 
-
-    # Array references, reflecting collection of offsets
-    # found, where differences occur between before and
-    # after the specified files.
-    #my ($before_offsets, $after_offsets) = $self->_diff($before_parser, $after_parser);
-
-    # Start with the first registry group from both files.
-    my $before_group = $self->_nextGroup($before_parser);
-    my $after_group  = $self->_nextGroup($after_parser);
-
-    # A hashtable reference, containing the latest change found.
-    my $change = { };
-
-    # While we are able to read the next key from either file...
-    while (defined($before_group) || defined($after_group)) {
-
-        # Reset the change hashref.
-        $change = { };
-
-        # If the next group name extracted from both files is identical... 
-        if (defined($before_group) && defined($after_group) &&
-            ($self->_cmpGroup($before_group, $after_group) == 0)) {
-
-            # Extract the next key/value pair corresponding to this group from
-            # both files.
-            my ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
-            my ($after_entry_name, $after_entry_value)   = $self->_nextVal($after_parser);
-
-            # While this key name exists in either file...
-            while (defined($before_entry_name) || defined($after_entry_name)) {
-
-                # If the key name matches in both files...
-                if (defined($before_entry_name) && defined($after_entry_name) &&
-                    $self->_cmpEntryName($before_entry_name, $after_entry_name) == 0) {
-
-                    # If the corresponding values in both files are
-                    # DIFFERENT...
-                    if ($before_entry_value ne $after_entry_value) {
-
-                        # Scenario:
-                        # Same directory name, same entry key name,
-                        # but different entry values.
-
-                        # Save the change.
-                        $change->{'key'} = $before_group;
-                        $change->{'status'} = "changed";
-                        $change->{'entries'}->{$before_entry_name} = {
-                            old_value => $before_entry_value,
-                            new_value => $after_entry_value,
-                        };
-                    }
-
-                    # Get the next corresponding key/value pair from this group.
-                    ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
-                    ($after_entry_name, $after_entry_value)   = $self->_nextVal($after_parser);
-
-                # Else, the key names are different in both files...
-                } else {
-
-                    # Scenario:
-                    # Same directory name, different entry key names.
-
-                    # Save the change.
-                    $change->{'key'} = $before_group;
-                    $change->{'status'} = "changed";
-
-                    # If the after key name doesn't exist, or if the before key 
-                    # name exists and the before name is alphabetically earlier
-                    # than the after key name...
-                    if (!defined($after_entry_name) || defined($before_entry_name) &&
-                        $self->_cmpEntryName($before_entry_name, $after_entry_name) < 0) {
-
-                        # Then we know that the before key name got deleted
-                        # in the after file.
-                        # Check to see if some of this change data already exists...
-                        if (exists($change->{'entries'}->{$before_entry_name})) {
-
-                            # Sanity check: Looks like an earlier iteration populated
-                            # this change entry with a 'new_value'.  Let's make sure
-                            # the our 'old_value' and 'new_value' are truly different.
-                            if (defined($change->{'entries'}->{$before_entry_name}->{'new_value'}) &&
-                                ($change->{'entries'}->{$before_entry_name}->{'new_value'} ne
-                                 $before_entry_value)) {
-
-                                # Okay, looks like they're different, so only update the old_value.
-                                $change->{'entries'}->{$before_entry_name}->{'old_value'} = $before_entry_value;
-                            } else {
-                                # Looks like they're the same value, so delete the entry completely.
-                                delete($change->{'entries'}->{$before_entry_name});
-                            }
-                        } else {
-                            # If not, then update both old_value and new_value.
-                            $change->{'entries'}->{$before_entry_name} = {
-                                old_value => $before_entry_value,
-                                new_value => undef,
-                            };
-                        }
-
-                        # And get the next corresponding key/value pair from the before group.
-                        ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
-
-                    # Else, the after key name exists but the corresponding before key name 
-                    # did not exist -- which means that this is a new key/value pair.
-                    } else {
-
-                        # Check to see if some of this change data already exists...
-                        if (exists($change->{'entries'}->{$after_entry_name})) {
-                            # Sanity check: Looks like an earlier iteration populated
-                            # this change entry with an 'old_value'.  Let's make sure
-                            # the our 'old_value' and 'new_value' are truly different.
-                            if (defined($change->{'entries'}->{$after_entry_name}->{'old_value'}) &&
-                                ($change->{'entries'}->{$after_entry_name}->{'old_value'} ne
-                                 $after_entry_value)) {
-
-                                # Okay, looks like they're different, so only update the new_value.
-                                $change->{'entries'}->{$after_entry_name}->{'new_value'} = $after_entry_value;
-                            } else {
-                                # Looks like they're the same value, so delete the entry completely.
-                                delete($change->{'entries'}->{$after_entry_name});
-                            }
-                        } else {
-                            # If not, then update both old_value and new_value.
-                            $change->{'entries'}->{$after_entry_name} = {
-                                old_value => undef,
-                                new_value => $after_entry_value,
-                            };
-                        }
-
-                        # And get the next corresponding key/value pair from the after group.
-                        ($after_entry_name, $after_entry_value) = $self->_nextVal($after_parser);
-                    }
-                }
-            }
-
-            # Once we're out of the previous loop, then we are finished enumerating
-            # all key/value pairs corresponding to the identical group in either files.
-
-            # And get the next group to compare from both files.
-            $before_group = $self->_nextGroup($before_parser);
-            $after_group  = $self->_nextGroup($after_parser);
-
-        # Else, if the after group doesn't exist, or if the before group exists and the
-        # before group name is alphabetically earlier than the after group name...
-        } elsif (!defined($after_group) || defined($before_group) &&
-                 $self->_cmpGroup($before_group, $after_group) < 0) {
-
-            # Get the length of the before group.
-            my $before_group_length = length($before_group);
-
-            # Scenario:
-            # Directory was deleted.
-
-            # Save the change.
-            $change->{'key'} = $before_group;
-            $change->{'status'} = "deleted";
-            $change->{'entries'} = { };
-
-            # Get the first key/value pair from this before group.
-            my ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
-
-            # While there are key/values within this before group.
-            while (defined($before_entry_name)) {
-                $change->{'entries'}->{$before_entry_name} = {
-                    old_value => $before_entry_value,
-                    new_value => undef,
-                };
-
-                # And get the next corresponding key/value pair from the before group.
-                ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
-            }
-
-            # Get the next group from the before file.
-            $before_group = $self->_nextGroup($before_parser);
-
-        # Else, the after group exists but the corresponding before group
-        # did not exist -- which means that this is a new group.
-        } else {
-            # Scenario:
-            # Directory was added.
-
-            # Save the change.
-            $change->{'key'} = $after_group;
-            $change->{'status'} = "added";
-            $change->{'entries'} = { };
-
-            # Get the first key/value pair from this after group.
-            my ($after_entry_name, $after_entry_value) = $self->_nextVal($after_parser);
-
-            # While there are key/values within this after group.
-            while (defined($after_entry_name)) {
-
-                $change->{'entries'}->{$after_entry_name} = {
-                    old_value => undef,
-                    new_value => $after_entry_value,
-                };
-
-                # Get the next key/value pair from the after group.
-                ($after_entry_name, $after_entry_value) = $self->_nextVal($after_parser);
-            }
-
-            # Get the next group from the after file.
-            $after_group = $self->_nextGroup($after_parser);
-        }
-
-        # Transform the 'entries' sub-key from a nested hash structure,
-        # into an array of separate hashtables.
-        if (exists($change->{'entries'})) {
-            my $entries = [ ];
-            while (my ($key, $value) = each(%{$change->{'entries'}})) {
-                push (@{$entries}, {
-                        name      => $key,
-                        old_value => $value->{'old_value'},
-                        new_value => $value->{'new_value'},
-                });
-            }
-            $change->{'entries'} = $entries;
-        }
-
-        # Push the change onto our array of changes.
-        if (scalar(keys(%{$change}))) {
-            push(@{$changes}, $change);
-        }
-    }
-
-    # TODO: delete this, eventually.
-    print "Complete list: " . Dumper($changes) . "\n";
-    return $changes;
-}
-
-1;

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm

@@ -102 +102 @@
-use Carp ();
-
+# Include Global Configuration Processing Library 
+use HoneyClient::Util::Config qw(getVar);
+
-# Include Logging Library
-use Log::Log4perl qw(:easy);
-# Temporarily Initialize Logging Subsystem
-# XXX: We hard code the logging format here, since it appears that
-#      calling 'use HoneyClient::Util::Config qw(getVar);' slows down
-#      the parser by a factor of 10x (not sure why).
-Log::Log4perl->init_once({
-    "log4perl.rootLogger"                               => "INFO, Screen",
-    "log4perl.appender.Screen"                          => "Log::Log4perl::Appender::Screen",
-    "log4perl.appender.Screen.stderr"                   => 0,
-    "log4perl.appender.Screen.Threshold"                => "INFO",
-    "log4perl.appender.Screen.layout"                   => "Log::Log4perl::Layout::PatternLayout",
-    "log4perl.appender.Screen.layout.ConversionPattern" => "%d{yyyy-MM-dd HH:mm:ss} %5p [%M] (%F:%L) - %m%n",
-});
-
-
-# Use Dumper Library.
@@ -383 +373 @@
-         'registry', 0,
-sub
-5
+4
-{
-            $LOG->debug("Reached end of input stream.");
@@ -393 +383 @@
-         'registry', 1,
-sub
-6
+5
-{
-            $LOG->debug("Reached end of input stream.");
@@ -403 +393 @@
-         'registry', 2,
-sub
-6
+5
-{
-            $LOG->debug("Reached end of input stream.");
@@ -425 +415 @@
-         'group', 2,
-sub
-8
+7
-{
-            my $ret = { };
@@ -444 +434 @@
-         'group', 1,
-sub
-9
+8
-{
-            my $ret = { };
@@ -469 +459 @@
-         'entry', 2,
-sub
-2
+1
-{
-            my $entry = {
@@ -484 +474 @@
-}
-
-3
+2
-
-

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp

@@ -85 +85 @@
-use Carp ();
-
+# Include Global Configuration Processing Library 
+use HoneyClient::Util::Config qw(getVar);
+
-# Include Logging Library
-use Log::Log4perl qw(:easy);
-# Temporarily Initialize Logging Subsystem
-# XXX: We hard code the logging format here, since it appears that
-#      calling 'use HoneyClient::Util::Config qw(getVar);' slows down
-#      the parser by a factor of 10x (not sure why).
-Log::Log4perl->init_once({
-    "log4perl.rootLogger"                               => "INFO, Screen",
-    "log4perl.appender.Screen"                          => "Log::Log4perl::Appender::Screen",
-    "log4perl.appender.Screen.stderr"                   => 0,
-    "log4perl.appender.Screen.Threshold"                => "INFO",
-    "log4perl.appender.Screen.layout"                   => "Log::Log4perl::Layout::PatternLayout",
-    "log4perl.appender.Screen.layout.ConversionPattern" => "%d{yyyy-MM-dd HH:mm:ss} %5p [%M] (%F:%L) - %m%n",
-});
-
-
-# Use Dumper Library.

honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry_parser.t

@@ -61 +61 @@
-use Fcntl qw(:seek);
-
+# Make sure Search::Binary loads
+BEGIN { use_ok('Search::Binary')
+        or diag("Can't load Search::Binary package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('Search::Binary');
+can_ok('Search::Binary', 'binary_search');
+use Search::Binary;
+
+# Make sure Term::ProgressBar loads
+BEGIN { use_ok('Term::ProgressBar')
+        or diag("Can't load Term::ProgressBar package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('Term::ProgressBar');
+use Term::ProgressBar;
+
-# Make sure HoneyClient::Agent::Integrity::Registry::Parser loads
-BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry::Parser')
@@ -282 +295 @@
-
-
+# =begin testing
+{
+my ($nextGroup, $expectedGroup);
+my $test_registry_file = $ENV{PWD} . "/" . getVar(name      => "registry_file",
+                                                  namespace => "HoneyClient::Agent::Integrity::Registry::Parser::Test");
+
+# Create a generic Parser object, with test state data.
+my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file, index_groups => 1);
+
+$parser->seekToNearestGroup(absolute_offset => 84);
+
+# Verify Test Group #2
+$nextGroup = $parser->nextGroup();
+$expectedGroup = {
+    key     => 'HKEY_CURRENT_USER\Testing Group 2',
+    entries => [ {
+        name  => '@',
+        value => '\\"Annoying=Value\\"',
+    }, {
+