Changeset 116

Timestamp:

12/16/06 22:25:09 (2 years ago)

Author:

kindlund

Message:

Still finishing up registry parser; ran into issues where the registry group blocks were NOT properly alphabetically sorted. As such, I'm having to rely more upon the diff.exe output, in order to determine if each diff block is an add, delete, or change. Updated unit tests across both Registry and Parser modules.

Files:

• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm (modified) (5 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Makefile (modified) (1 diff)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm (modified) (16 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp (modified) (16 diffs)
• honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry_parser.t (modified) (3 diffs)
• honeyclient/branches/bug/42/t/honeyclient_manager_fw.t (modified) (1 diff)
• honeyclient/branches/bug/42/t/test_registry/after.reg (added)
• honeyclient/branches/bug/42/t/test_registry/before.reg (added)

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm

@@ -538 +538 @@
-
-# Helper function, designed to perform a binary diff on two files,
-
-
+
+
+
+
-#
-# Inputs: HoneyClient::Agent::Integrity::Registry object, 
-#         source parser, target parser
-#
-
+
+
-sub _diff {
-    # Extract arguments.
-    my ($self, $src_parser, $tgt_parser) = @_;
-
-
-
+
+
+
-
-    # Get the corresponding file names.
@@ -580 +584 @@
-            $LOG->info("No changes detected in specified data.");
-            _cleanup($fname_tmp);
-offsets, $tgt_offset
+linenums, $tgt_linenum
-        }
-        if ($_ eq "FAILURE\n") {
@@ -591 +595 @@
-
-    do {
-
-
-
+
+
+
+
-        }
-    } while (<$fh>);
-
-    _cleanup($fname_tmp);
-offsets, $tgt_offset
+linenums, $tgt_linenums, $diff_type
-}
-
@@ -623 +628 @@
-    my $after_parser  = $args{'after_parser'};
-
+    # A hashtable reference, containing the latest change found.
+    my $currentChange = { };
+
+    # Indicates if the $currentChange hashtable is not empty.
+    my $currentChangeExists = 0;
+
-    # Array reference, containing hashtables, where each
-    # hashtable represents a change between the before and
@@ -628 +639 @@
-    my $changes = []; 
-
-
+
+
+
+
+
+
+
+
+
+
-    # found, where differences occur between before and
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                } else {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                                old_value => $before_entry_value,
-                                new_value => undef,
-                            };
-                        }
-
-                        # And get the next corresponding key/value pair from the before group.
-                        ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
-
-                    # Else, the after key name exists but the corresponding before key name 
-                    # did not exist -- which means that this is a new key/value pair.
-                    } else {
-
-                        # Check to see if some of this change data already exists...
-                        if (exists($change->{'entries'}->{$after_entry_name})) {
-                            # Sanity check: Looks like an earlier iteration populated
-                            # this change entry with an 'old_value'.  Let's make sure
-                            # the our 'old_value' and 'new_value' are truly different.
-                            if (defined($change->{'entries'}->{$after_entry_name}->{'old_value'}) &&
-                                ($change->{'entries'}->{$after_entry_name}->{'old_value'} ne
-                                 $after_entry_value)) {
-
-                                # Okay, looks like they're different, so only update the new_value.
-                                $change->{'entries'}->{$after_entry_name}->{'new_value'} = $after_entry_value;
-                            } else {
-                                # Looks like they're the same value, so delete the entry completely.
-                                delete($change->{'entries'}->{$after_entry_name});
-                            }
-                        } else {
-                            # If not, then update both old_value and new_value.
-                            $change->{'entries'}->{$after_entry_name} = {
-                                old_value => undef,
-                                new_value => $after_entry_value,
-                            };
-                        }
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                    }
-                }
+
+                # Once we're out of the previous loop, then we are finished enumerating
+                # all key/value pairs corresponding to the identical group in either files.
+
+                # And get the next group to compare from both files.
+                $before_group = $self->_nextGroup($before_parser);
+                $after_group  = $self->_nextGroup($after_parser);
+
+                # Else, if the after group doesn't exist, or if the before group exists and the
+                # before group name is alphabetically earlier than the after group name...
+                # but verify that our $diff_type signifies a deletion (otherwise, the groups
+                # may not be sorted alphabetically).
+            } elsif (!defined($after_group) || defined($before_group) &&
+                     (($diff_type eq 'd') &&
+                      ($self->_cmpGroup($before_group, $after_group) < 0))) {
+
+                # Scenario:
+                # Directory was deleted.
+
+                # Save the change.
+                $currentChange->{'key'} = $before_group;
+                $currentChange->{'status'} = "deleted";
+                $currentChange->{'entries'} = { };
+
+                # Get the first key/value pair from this before group.
+                ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
+
+                # While there are key/values within this before group.
+                while (defined($before_entry_name)) {
+                    $currentChange->{'entries'}->{$before_entry_name} = {
+                        old_value => $before_entry_value,
+                        new_value => undef,
+                    };
+
+                    # And get the next corresponding key/value pair from the before group.
+                    ($before_entry_name, $before_entry_value) = $self->_nextVal($before_parser);
+                }
+
+                # Get the next group from the before file.
+                $before_group = $self->_nextGroup($before_parser);
+
+                # Else, the after group exists but the corresponding before group
+                # did not exist -- which means that this is a new group.
+            } else {
+                # Scenario:
+                # Directory was added.
+
+                # Save the change.
+                $currentChange->{'key'} = $after_group;
+                $currentChange->{'status'} = "added";
+                $currentChange->{'entries'} = { };
+
+                # Get the first key/value pair from this after group.
+                ($after_entry_name, $after_entry_value) = $self->_nextVal($after_parser);
+
+                # While there are key/values within this after group.
+                while (defined($after_entry_name)) {
+
+                    $currentChange->{'entries'}->{$after_entry_name} = {
+                        old_value => undef,
+                        new_value => $after_entry_value,
+                    };
+
+                    # Get the next key/value pair from the after group.
+                    ($after_entry_name, $after_entry_value) = $self->_nextVal($after_parser);
+                }
+
+                # Get the next group from the after file.
+                $after_group = $self->_nextGroup($after_parser);
-            }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-            }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-            }
-
-
-
+
+
+
+
-        }
-
-        # Transform the 'entries' sub-key from a nested hash structure,
-        # into an array of separate hashtables.
-        if (exists($change->{'entries'})) {
-            my $entries = [ ];
-            while (my ($key, $value) = each(%{$change->{'entries'}})) {
-                push (@{$entries}, {
-                        name      => $key,
-                        old_value => $value->{'old_value'},
-                        new_value => $value->{'new_value'},
-                });
-            }
-            $change->{'entries'} = $entries;
-        }
-
-        # Push the change onto our array of changes.
-        if (scalar(keys(%{$change}))) {
-            push(@{$changes}, $change);
-        }
-    }
-
-
-
-
-
-
+
+
-}
-

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Makefile

@@ -6 +6 @@
-clean:
-    rm -f Parser.pm
+    rm -f Parser.3pm
-
-all: Parser

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm

@@ -490 +490 @@
-        $_[0]->YYData->{'in_group'} = 0;
-        $LOG->debug("Found NEWLINE token ending at offset (" . pos($_[0]->YYData->{DATA}) . ").");
+        $_[0]->YYData->{'line_count'}++;
-        return ("NEWLINE", "\n");
-    }
@@ -513 +514 @@
-            $_[0]->YYData->{'in_group'} = 1;
-            $LOG->debug("Found DIR_NAME token ending at offset (" . pos($_[0]->YYData->{DATA}) . ").");
+            $_[0]->YYData->{'last_group_line_number'} = $_[0]->YYData->{'line_count'};
+            $_[0]->YYData->{'line_count'}++;
-            return ("DIR_NAME", $1);
-        }
@@ -519 +522 @@
-        if ($_[0]->YYData->{DATA} =~ m/\GREGEDIT4\n/cg) {
-            $LOG->debug("Found HEADER token ending at offset (" . pos($_[0]->YYData->{DATA}) . ").");
+            $_[0]->YYData->{'line_count'}++;
-            return ("HEADER", "REGEDIT4\n");
-        }
@@ -547 +551 @@
-                $_[0]->YYData->{'in_value'} = 0;
-                $LOG->debug("Found KEY_VALUE token ending at offset (" . pos($_[0]->YYData->{DATA}) . ").");
+                $_[0]->YYData->{'line_count'} += 1 + @{[$1 =~ /\n/g]};
-                return ("KEY_VALUE", $1);
-            }
@@ -554 +559 @@
-                $_[0]->YYData->{'in_value'} = 0;
-                $LOG->debug("Found KEY_VALUE token ending at offset (" . pos($_[0]->YYData->{DATA}) . ").");
+                $_[0]->YYData->{'line_count'} += 1 + @{[$1 =~ /\n/g]};
-                return ("KEY_VALUE", $1);
-            }
@@ -631 +637 @@
-    # Total number of key/value pairs parsed.
-    $self->YYData->{'entry_count'} = 0;
+
+    # Total number of lines parsed.
+    $self->YYData->{'line_count'} = 0;
+
+    # Last line number that corresponded to a group separation point.
+    $self->YYData->{'last_group_line_number'} = 0;
-
-    # Progress bar information.
@@ -656 +668 @@
-    $LOG->debug("Starting group index process.");
-
-
+
+
-
-    my $registryGroup = $self->nextGroup();
-    while(scalar(keys(%{$registryGroup}))) {
+        push (@{$self->YYData->{'group_index_offsets'}}, $self->YYData->{'input_pos'});
+        push (@{$self->YYData->{'group_index_linenums'}}, $self->YYData->{'last_group_line_number'});
-        $registryGroup = $self->nextGroup();
-        push (@{$self->YYData->{'group_index'}}, $self->YYData->{'input_pos'});
-    }
-
@@ -678 +692 @@
-# see the Search::Binary POD documentation.
-#
-parser
+arrayref
-# Outputs: comparison, last_valid_array_index
-sub _search {
@@ -692 +706 @@
-
-    # Perform a comparison, if the array entry is defined.
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-    }
-
@@ -797 +819 @@
-        $parser->_index();
-    } else {
-
+
+
-    }
-
@@ -1143 +1166 @@
-=pod
-
-seekToNearestGroup(absolute_offset => $offset
+getCurrentLineCount(
-
-=over 4
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-will seek the parser to the nearest group found B<before>
-the specified offset.
@@ -1154 +1227 @@
- B<$offset> is an required parameter, specifying the absolute offset
-within the file to seek to.
+ B<$linenum> is a required parameter, specifying the absolute line
+number within the file to seek to.
+ B<$index> is an optional parameter, specifying to seek to a group
+before or after the target group.  If unspecified, $index = 0.
-
-I<Outputs>: None.
+
+B<Notes>: Either B<$offset> or B<$linnum> must be specified.  To seek to the
+target group, specify $index = 0 or leave undefined.  To seek to the previous
+group before the target group, specify $index = -1.  To seek to the next
+group after the target group, specify $index = 1.
+
+Once called, B<all> corresponding statistical counters will be reset.  This means,
+that the output from $object->dirsParsed() and $object->entriesParsed() will be
+zero, if called immediately after this function.
-
-=back
@@ -1168 +1254 @@
-my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file, index_groups => 1);
-
-$parser->seekToNearestGroup(absolute_offset => 84);
-
-# Verify Test Group #2
-$nextGroup = $parser->nextGroup();
-$expectedGroup = {
-    key     => 'HKEY_CURRENT_USER\Testing Group 2',
@@ -1191 +1274 @@
-    }, ],
-};
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+