Show
Ignore:
Timestamp:
01/10/07 14:06:43 (2 years ago)
Author:
kindlund
Message:

Merged trunk changes back into exp branch, in order to prepare for final merge back into trunk.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/branches/exp/stephenson-link_scoring

    • Property sc:bug-fix-release-branch set to 0.9

  • honeyclient/branches/exp/stephenson-link_scoring/lib/HoneyClient/Agent.pm

    • Property svn:executable deleted
    • Property svn:keywords set to Id "$file"
    r13 r153  
    55# Description: Central library used for agent-based operations. 
    66# 
    7 # CVS: $Id: Agent.pm 1049 2006-06-28 16:37:41Z flindiakos $ 
     7# CVS: $Id$ 
    88# 
    99# @author knwang, ttruong, kindlund 
    …… 
    3838=head1 VERSION 
    3939 
    40 $Rev: 1626 $ 
     400.92 
    4141 
    4242=head1 SYNOPSIS 
    …… 
    7979 
    8080    # Set our package version. 
    81     $VERSION = 0.9; 
     81    $VERSION = 0.92; 
    8282 
    8383    @ISA = qw(Exporter); 
    …… 
    210210# TODO: Update unit tests to include 'dclone' 
    211211use Storable qw(nfreeze thaw dclone); 
     212$Storable::Deparse = 1; 
     213$Storable::Eval = 1; 
    212214 
    213215# Include Base64 Libraries 
    …… 
    236238our $PERFORM_INTEGRITY_CHECKS : shared = 
    237239    getVar(name => "perform_integrity_checks"); 
     240 
     241# A globally shared, serialized hashtable, containing the 
     242# initialized integrity state of the VM -- ready to be checked 
     243# against, at any time. 
     244our $integrityState : shared = undef; 
    238245 
    239246# A globally shared, serialized hashtable, containing data per 
    …… 
    359366        $driverUpdateQueues{$driverName} = new Thread::Queue; 
    360367    } 
     368 
     369    # Perform initial integrity baseline check. 
     370    #my $integrity = undef; 
     371    #if ($PERFORM_INTEGRITY_CHECKS) { 
     372    #    print "Initializing Integrity Check...\n"; 
     373    #    # TODO: Initialize Integrity Checks 
     374    #    $integrity = HoneyClient::Agent::Integrity->new(); 
     375    #    $integrity->initAll(); 
     376    #} 
     377    #$integrityState = $integrity->serialize(); 
    361378 
    362379    # Release data lock. 
    …… 
    688705            eval { 
    689706 
    690                 my $integrity = undef; 
    691                 if ($PERFORM_INTEGRITY_CHECKS) { 
    692                     print "Initializing Filesystem Integrity Check...\n"; 
    693                     # TODO: Initialize Integrity Checks 
    694                     $integrity = HoneyClient::Agent::Integrity->new(); 
    695                     $integrity->initAll(); 
    696                 } 
    697   
    698707                ################################### 
    699708                ### Driver Initialization Phase ### 
    700709                ################################### 
     710 
     711                # Initially set local integrity object to undef. 
     712                my $integrity = undef; 
    701713                 
    702714                # Initially set all driver objects to undef.  
    …… 
    705717                # Acquire lock on stored driver state. 
    706718                $data = _lock(); 
     719 
     720                if ($PERFORM_INTEGRITY_CHECKS) { 
     721                    # XXX: WARNING - The $integrityState object data is NOT thread-safe 
     722                    # (since it relies on external data stored on the file system). 
     723                    # As such, do NOT try to call integrity checks on multiple, simultaneous 
     724                    # asynchronous threaded drivers. 
     725                    #$integrity = thaw($integrityState); 
     726                    # Perform initial integrity baseline check. 
     727                    print "Initializing Integrity Check...\n"; 
     728                    # TODO: Initialize Integrity Checks 
     729                    $integrity = HoneyClient::Agent::Integrity->new(); 
     730                    $integrity->initAll(); 
     731 
     732                    # TODO: Delete this. 
     733                    #$Data::Dumper::Indent = 1; 
     734                    #$Data::Dumper::Terse = 1; 
     735                    #print "Integrity: " . Dumper($integrity) . "\n"; 
     736                } 
    707737 
    708738                # Now, initialize each driver object.  
    …… 
    805835                    # For now, we update a scalar called 'is_compromised' within 
    806836                    # the $data->{$driverName}->{'status'} sub-hashtable. 
    807                     print "Performing Filesystem Integrity Check...\n"; 
     837                    print "Performing Integrity Checks...\n"; 
    808838                    if ($integrity->checkAll()) { 
    809839                        print "Integrity Check: FAILED\n"; 
    …… 
    10991129=head1 SEE ALSO 
    11001130 
    1101 XXX: Fill this in. 
    1102  
    1103 XXX: If you have a mailing list, mention it here. 
    1104  
    1105 XXX: If you have a web site set up for your module, mention it here. 
     1131L<http://www.honeyclient.org/trac> 
    11061132 
    11071133=head1 REPORTING BUGS 
    11081134 
    1109 XXX: Mention website/mailing list to use, when reporting bugs. 
     1135L<http://www.honeyclient.org/trac/newticket> 
    11101136 
    11111137=head1 ACKNOWLEDGEMENTS 

  • honeyclient/branches/exp/stephenson-link_scoring/lib/HoneyClient/Agent/Driver.pm

    • Property svn:executable deleted
    • Property svn:keywords set to Id "$file"
    r13 r153  
    66#              HoneyClient VM. 
    77# 
    8 # CVS: $Id: Driver.pm 1412 2006-10-18 20:33:18Z kindlund $ 
     8# CVS: $Id$ 
    99# 
    1010# @author knwang, ttruong, kindlund 
    …… 
    3838=head1 VERSION 
    3939 
    40 This documentation refers to HoneyClient::Agent::Driver version 1.0. 
     40This documentation refers to HoneyClient::Agent::Driver version 0.92. 
    4141 
    4242=head1 SYNOPSIS 
    …… 
    120120 
    121121    # Set our package version. 
    122     $VERSION = 0.9; 
     122    $VERSION = 0.92; 
    123123 
    124124    @ISA = qw(Exporter); 
    …… 
    160160# Make sure Log::Log4perl loads 
    161161BEGIN { use_ok('Log::Log4perl', qw(:nowarn)) 
    162         or diag("Can't load Log::Log4perl package. Check to make sure the package library is correctly linsted within the path."); 
     162        or diag("Can't load Log::Log4perl package. Check to make sure the package library is correctly listed within the path."); 
    163163        
    164164        # Suppress all logging messages, since we need clean output for unit testing. 
    …… 
    697697L<perltoot/"Autoloaded Data Methods"> 
    698698 
    699 XXX: If you have a mailing list, mention it here. 
    700  
    701 XXX: If you have a web site set up for your module, mention it here. 
     699L<http://www.honeyclient.org/trac> 
    702700 
    703701=head1 REPORTING BUGS 
    704702 
    705 XXX: Mention website/mailing list to use, when reporting bugs. 
     703L<http://www.honeyclient.org/trac/newticket> 
    706704 
    707705=head1 AUTHORS 

  • honeyclient/branches/exp/stephenson-link_scoring/lib/HoneyClient/Agent/Driver/Browser.pm

    • Property svn:keywords set to Id "$file"
    r147 r153  
    77#              HoneyClient VM. 
    88# 
    9 # CVS: $Id: Browser.pm 1423 2006-11-6 14:21:47Z stephenson $ 
     9# CVS: $Id$ 
    1010# 
    1111# @author knwang, kindlund, stephenson 
    …… 
    4040=head1 VERSION 
    4141 
    42 This documentation refers to HoneyClient::Agent::Driver::Browser version 1.0. 
     42This documentation refers to HoneyClient::Agent::Driver::Browser version 0.92. 
    4343 
    4444=head1 SYNOPSIS 
    …… 
    8484  $browser->{links_to_visit}->{'http://www.mitre.org'} = 1; 
    8585 
    86   # Now, drive IE for one iteration. 
     86  # Now, drive the browser for one iteration. 
    8787  $browser->drive(); 
    8888 
    …… 
    9090 
    9191This library allows the Agent module to drive an instance of any broswer, 
    92 running inside the HoneyClient VM.  The purpose 
    93 of this module is to programmatically navigate the browser to different 
    94 websites, in order to become purposefully infected with new malware. 
    95 The module implements the logic necessary to decide the order in which 
    96 the 
     92running inside the HoneyClient VM.  The purpose of this module is to 
     93programmatically navigate the browser to different websites, in order to 
     94become purposefully infected with new malware. 
    9795 
    9896This module is object-oriented in design, retaining all state information 
    …… 
    157155 
    158156    # Set our package version. 
    159     $VERSION = 0.9; 
     157    $VERSION = 0.92; 
    160158 
    161159    # Define inherited modules. 
    …… 
    175173    # Do not simply export all your public functions/methods/constants. 
    176174 
    177     # This allows declaration use HoneyClient::Agent::Driver::IE ':all'; 
     175    # This allows declaration use HoneyClient::Agent::Driver::Browser ':all'; 
    178176    # If you do not need this, moving things directly into @EXPORT or @EXPORT_OK 
    179177    # will save memory. 
    …… 
    213211 
    214212# Use Storable Library 
     213# TODO: Need unit testing. 
    215214use Storable qw(dclone); 
    216215 
    …… 
    240239=head1 DEFAULT PARAMETER LIST 
    241240 
    242 When an IE B<$object> is instantiated using the B<new()> function, 
     241When a Browser B<$object> is instantiated using the B<new()> function, 
    243242the following parameters are supplied default values.  Each value 
    244243can be overridden by specifying the new (key => value) pair into the 
    …… 
    302301This parameter is a hashtable of fully qualified URLs, such that each 
    303302URL shares a common B<hostname>.  This is an internal hashtable used 
    304 by the IE driver that should be initially empty.  As the IE driver 
    305 extracts and removes new URLs off the B<links_to_visit> hashtable, 
     303by the Browser driver that should be initially empty.  As the Browser 
     304driver extracts and removes new URLs off the B<links_to_visit> hashtable, 
    306305driving the browser to each URL, any B<relative> links found are 
    307306added into this hashtable; any B<external> links found are added 
    …… 
    364363=over 4 
    365364 
    366 A string containing the process name of the Internet Explorer 
    367 browser application, as it appears in the Task Manager.  This is 
    368 usually called "iexplore.exe". 
     365A string containing the process name of the  browser application, 
     366as it appears in the Task Manager. 
    369367 
    370368=back 
    …… 
    458456    ignore_links_timed_out  => getVar(name => "ignore_links_timed_out"), 
    459457 
    460     # A string containing the process name of the Internet Explorer 
    461     # browser application, as it appears in the Task Manager.  This is 
    462     # usually called "iexplore.exe". 
     458    # A string containing the process name of the browser application, 
     459    # as it appears in the Task Manager. 
    463460    process_name            => getVar(name => "process_name"), 
    464461 
    …… 
    499496# 'links_to_visit' hashtable is checked. 
    500497# 
    501 # Inputs: HoneyClient::Agent::Driver::IE object 
     498# Inputs: HoneyClient::Agent::Driver::Browser object 
    502499# Outputs: link, or undef if all applicable scalars/hashtables are empty 
    503500sub _getNextLink { 
    …… 
    718715# already in the hashtable. 
    719716# 
    720 # Inputs: HoneyClient::Agent::Driver::IE object, url to validate 
     717# Inputs: HoneyClient::Agent::Driver::Browser object, url to validate 
    721718# Outputs: url if valid, empty string if invalid 
    722719sub _validateLink { 
    …… 
    805802=head1 METHODS IMPLEMENTED 
    806803 
    807 The following functions have been implemented by the IE driver.  Many 
     804The following functions have been implemented by the Browser driver.  Many 
    808805of these methods were implementations of the parent Driver interface. 
    809806 
    …… 
    812809Driver interface, see the L<HoneyClient::Agent::Driver> documentation. 
    813810 
    814 =head2 HoneyClient::Agent::Driver::IE->new($param => $value, ...) 
     811=head2 HoneyClient::Agent::Driver::Browser->new($param => $value, ...) 
    815812 
    816813=over 4 
    817814 
    818 Creates a new IE driver object, which contains a hashtable 
     815Creates a new Browser driver object, which contains a hashtable 
    819816containing any of the supplied "param => value" arguments. 
    820817 
    …… 
    826823corresponding $value(s) B<must> also be specified. 
    827824 
    828 I<Output>: The instantiated IE driver B<$object>, fully initialized. 
     825I<Output>: The instantiated Browser driver B<$object>, fully initialized. 
    829826 
    830827=back 
    …… 
    888885=pod 
    889886 
    890 =head2 $object->drive() 
     887=head2 $object->drive(url => $url) 
    891888 
    892889=over 4 
    893890 
    894 Drives an instance of Microsoft Internet Explorer for one iteration, 
     891Drives an instance of the browser for one iteration, 
    895892navigating to the next URL and updating the driver's corresponding 
    896893internal hashtables accordingly. 
    …… 
    900897the "DEFAULT PARAMETER LIST" section. 
    901898 
    902 Once a drive() iteration has completed, the corresponding Microsoft 
    903 Internet Explorer browser process is terminated.  Thus, each call to 
    904 drive() invokes a new instance of the browser. 
    905  
    906 I<Output>: The updated IE driver B<$object>, containing state information 
    907 from driving Microsoft Internet Explorer for one iteration. 
    908  
    909 B<Warning>: This method will B<croak> if the IE driver object is B<unable> 
     899Once a drive() iteration has completed, the corresponding browser process  
     900is terminated.  Thus, each call to drive() invokes a new instance of the  
     901browser. 
     902 
     903I<Inputs>: 
     904 B<$url> is an optional argument, specifying the next immediate URL the browser must drive to. 
     905 
     906I<Output>: The updated Browser driver B<$object>, containing state information 
     907from driving the browser for one iteration. 
     908 
     909B<Warning>: This method will B<croak> if the Browser driver object is B<unable> 
    910910to navigate to a new link, because its list of links to visit is empty. 
    911911 
    …… 
    10461046=over 4 
    10471047 
    1048 Returns the next URL that the Microsoft Internet Explorer browser will 
    1049 navigate to, upon the next subsequent call to the B<$object>'s drive() 
    1050 method. 
     1048Returns the next URL that the browser will navigate to, upon the next 
     1049subsequent call to the B<$object>'s drive() method. 
    10511050 
    10521051I<Output>: The next URL that the browser will be driven to.  The returned 
    1053 data may be undef, if the IE driver is finished and there are no links 
     1052data may be undef, if the Browser driver is finished and there are no links 
    10541053left to navigate to. 
    10551054 
    …… 
    11011100 
    11021101Returns the next set of server hostnames and/or IP addresses that the 
    1103 Microsoft Internet Explorer browser will contact, upon the next subsequent 
    1104 call to the B<$object>'s drive() method. 
     1102browser will contact, upon the next subsequent call to the B<$object>'s 
     1103drive() method. 
    11051104 
    11061105Specifically, the returned data is a reference to a hashtable, containing 
    …… 
    13821381=over 4 
    13831382 
    1384 Indicates if the IE driver B<$object> has driven the Microsoft Internet 
    1385 Explorer browser to all possible links it has found within its hashtables 
     1383Indicates if the Browser driver B<$object> has driven the browser   
     1384process to all possible links it has found within its hashtables 
    13861385and is unable to navigate the browser further without additional, external 
    13871386input. 
    13881387 
    1389 I<Output>: True if the IE driver B<$object> is finished, false otherwise. 
    1390  
    1391 B<Note>: Additional links can be fed to this IE driver at any time, by 
     1388I<Output>: True if the Browser driver B<$object> is finished, false otherwise. 
     1389 
     1390B<Note>: Additional links can be fed to this Browser driver at any time, by 
    13921391simply adding new hashtable entries to the B<links_to_visit> hashtable 
    13931392within the B<$object>. 
    13941393 
    13951394For example, if you wanted to add the URL "http://www.mitre.org" 
    1396 to the IE driver B<$object>, simply use the following code: 
     1395to the Browser driver B<$object>, simply use the following code: 
    13971396 
    13981397  $object->{links_to_visit}->{'http://www.mitre.org'} = 1; 
    …… 
    14341433=over 4 
    14351434 
    1436 Returns the current status of the IE driver B<$object>, as it's state 
     1435Returns the current status of the Browser driver B<$object>, as it's state 
    14371436exists, between subsequent calls to $object->driver(). 
    14381437 
    14391438Specifically, the data returned is a reference to a hashtable, 
    14401439containing specific statistical information about the status 
    1441 of the IE driver's progress, between iterations of driving the 
    1442 Microsoft Internet Explorer browser. 
     1440of the Browser driver's progress, between iterations of driving the 
     1441browser process. 
    14431442 
    14441443The following is an example hashtable, containing all the 
    …… 
    14571456 
    14581457I<Output>: A corresponding B<$hashref>, containing statistical information 
    1459 about the IE driver's progress, as previously mentioned. 
     1458about the Browser driver's progress, as previously mentioned. 
    14601459 
    14611460# XXX: Resolve this, per parent Driver description. 
    …… 
    15251524 
    15261525=head1 BUGS & ASSUMPTIONS 
    1527  
    1528 This module makes extensive use of the Win32::IE::Mechanize module. 
    1529 Any bugs found within that library will most likely be present here. 
    15301526 
    15311527In a nutshell, this object is nothing more than a blessed anonymous 
    …… 
    15361532or overriding (key => value) pairs. 
    15371533 
    1538 However, additional links can be fed to any IE driver at any time, by 
     1534However, additional links can be fed to any Browser driver at any time, by 
    15391535simply adding new hashtable entries to the B<links_to_visit> hashtable 
    15401536within the B<$object>. 
    15411537 
    15421538For example, if you wanted to add the URL "http://www.mitre.org" 
    1543 to the IE driver B<$object>, simply use the following code: 
     1539to the Browser driver B<$object>, simply use the following code: 
    15441540 
    15451541  $object->{links_to_visit}->{'http://www.mitre.org'} = 1; 
    15461542 
    1547 XXX: At some point, we may want to replace all the instances of '1' 
    1548 with more useful data, like a sub-hashtable that contains a set of 
    1549 L<Win32::OLE> options that would be fed directly into each 
    1550 instance of Win32::IE::Mechanize->new(%options). 
    1551  
    1552 In general, the IE driver does B<not> know how many links it will 
     1543In general, the Browser driver does B<not> know how many links it will 
    15531544ultimately end up browsing to, until it conducts an exhaustive 
    15541545spider of all initial URLs supplied.  As such, expect the output 
    …… 
    15691560=head1 SEE ALSO 
    15701561 
    1571 Win32::IE::Mechanize 
    1572  
    1573 Win32::OLE 
    1574  
    1575 XXX: If you have a mailing list, mention it here. 
    1576  
    1577 XXX: If you have a web site set up for your module, mention it here. 
     1562L<http://www.honeyclient.org/trac> 
    15781563 
    15791564=head1 REPORTING BUGS 
    15801565 
    1581 XXX: Mention website/mailing list to use, when reporting bugs. 
     1566L<http://www.honeyclient.org/trac/newticket> 
    15821567 
    15831568=head1 AUTHORS 
    …… 
    15881573 
    15891574Darien Kindlund, E<lt>kindlund@mitre.orgE<gt> 
     1575 
     1576Brad Stephenson, E<lt>stephenson@mitre.orgE<gt> 
    15901577 
    15911578=head1 COPYRIGHT & LICENSE 

  • honeyclient/branches/exp/stephenson-link_scoring/lib/HoneyClient/Agent/Driver/Browser/FF.pm

    • Property svn:keywords set to Id "$file"

  • honeyclient/branches/exp/stephenson-link_scoring/lib/HoneyClient/Agent/Driver/Browser/IE.pm

    • Property svn:executable deleted
    • Property svn:keywords set to Id "$file"
    r13 r153  
    77#              HoneyClient VM. 
    88# 
    9 # CVS: $Id: IE.pm 1599 2006-11-08 20:04:30Z kindlund $ 
     9# CVS: $Id$ 
    1010# 
    1111# @author knwang, ttruong, kindlund, stephenson 
    …… 
    4343=head1 VERSION 
    4444 
    45 This documentation refers to HoneyClient::Agent::Driver::Browser::IE version 1.0. 
     45This documentation refers to HoneyClient::Agent::Driver::Browser::IE version 0.92. 
    4646 
    4747=head1 SYNOPSIS 
    …… 
    7474 
    7575    # Set our package version. 
    76     $VERSION = 0.9; 
     76    $VERSION = 0.92; 
    7777 
    7878    # Define inherited modules. 

  • honeyclient/branches/exp/stephenson-link_scoring/lib/HoneyClient/Agent/Integrity.pm

    • Property svn:keywords set to Id "$file"
    r13 r153  
    11################################################################################ 
    2 # Created on:  June 1, 2006 
     2# Created on:  June 01, 2006 
    33# Package:     HoneyClient::Agent 
    44# File:        Integrity.pm 
    5 # Description: Module for checking the system integrity for possible modification 
     5# Description: Module for checking the system integrity for possible 
     6#              modifications. 
    67# 
    78# @author knwang, xkovah, ttruong 
    …… 
    2627################################################################################ 
    2728 
    28  
    29  
    3029=pod 
    3130 
    …… 
    3938=head1 VERSION 
    4039 
    41 0.08 
     400.92 
    4241 
    4342=head1 SYNOPSIS 
    …… 
    105104can_ok('HoneyClient::Agent::Integrity', 'initFileSystem'); 
    106105can_ok('HoneyClient::Agent::Integrity', 'checkFileSystem'); 
    107 can_ok('HoneyClient::Agent::Integrity', 'initRegistry'); 
    108 can_ok('HoneyClient::Agent::Integrity', 'checkRegistry'); 
    109 use HoneyClient::Agent::Integrity qw(initAll checkAll initRegistry checkRegistry initFileSystem checkFileSystem); 
     106use HoneyClient::Agent::Integrity qw(initAll checkAll initFileSystem checkFileSystem); 
    110107 
    111108# Make sure HoneyClient::Util::Config loads. 
    …… 
    134131 
    135132# Make sure Storable loads. 
    136 BEGIN { use_ok('Storable', qw(dclone)) or diag("Can't load Storable package.  Check to make sure the package library is correctly listed within the path."); } 
     133BEGIN { use_ok('Storable', qw(dclone nfreeze thaw)) or diag("Can't load Storable package.  Check to make sure the package library is correctly listed within the path."); } 
    137134require_ok('Storable'); 
    138135can_ok('Storable', 'dclone'); 
    139 use Storable qw(dclone); 
     136can_ok('Storable', 'nfreeze'); 
     137can_ok('Storable', 'thaw'); 
     138use Storable qw(dclone nfreeze thaw); 
    140139 
    141140###Testing Globals### 
    …… 
    159158# Include Global Configuration Processing Library 
    160159use HoneyClient::Util::Config qw(getVar); 
     160use HoneyClient::Agent::Integrity::Registry; 
    161161use File::Find qw(find); 
    162162#use Win32::TieRegistry; 
    163163use Digest::MD5; 
    164164use MIME::Base64; 
    165 use Switch; 
    166 use Storable qw(dclone); 
     165use Storable qw(nfreeze thaw dclone); 
     166$Storable::Deparse = 1; 
     167$Storable::Eval = 1; 
    167168use Data::Dumper; 
     169use File::Basename qw(dirname); 
    168170 
    169171BEGIN { 
    …… 
    173175 
    174176    # Set our package version. 
    175     $VERSION = 0.9; 
     177    $VERSION = 0.92; 
    176178 
    177179    @ISA = qw(Exporter); 
    178180 
    179181    # Symbols to export on request 
    180     @EXPORT = qw(new initAll checkAll initRegistry checkRegistry initFileSystem checkFileSystem); 
     182    @EXPORT = qw(new initAll checkAll); 
    181183 
    182184    # Items to export into callers namespace by default. Note: do not export 
    …… 
    208210#Used *for now* to signal whether any changes occured (if they == 1) 
    209211my $g_fs_changes = 0; 
    210 my $g_reg_changes = 0; 
    211  
    212 #Used to initialize a default registry space to check if they don't specify anything when creating the object 
    213 my @default_reg_check_array = ("HKEY_LOCAL_MACHINE", "HKEY_CLASSES_ROOT", "HKEY_CURRENT_USER", "HKEY_USERS", "HKEY_CURRENT_CONFIG"); 
    214  
    215 #I have no idea why slashes need to be triple-slashes since it's single quoted, but that's what works... 
    216 #also, of course [ and ] and any other special characters you find need to be escaped 
    217 my @default_reg_exclude_array = (   '\[HKEY_LOCAL_MACHINE\\\SOFTWARE\\\Microsoft\\\Cryptography\\\RNG\]',  
    218                         '\[HKEY_CURRENT_USER\\\SessionInformation\]', 
    219                         '\[HKEY_USERS\\\.+\\\SessionInformation\]',  
    220                         '\[HKEY_LOCAL_MACHINE\\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\WindowsUpdate\\\Auto Update\]',  
    221                         '\[HKEY_USERS\\\.+\\\Software\\\Microsoft\\\Windows\\\CurrentVersion\\\Explorer\\\UserAssist\\\.*\\\Count\]',  
    222                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\CurrentControlSet\\\Services\\\.+\\\Parameters\\\Tcpip\]', 
    223                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\CurrentControlSet\\\Services\\\Tcpip\\\Parameters\\\Interfaces\\\.+\]', 
    224                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\CurrentControlSet\\\Services\\\Dhcp\\\Parameters\]', 
    225                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\ControlSet.+\\\Services\\\.+\\\Parameters\\\Tcpip\]', 
    226                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\ControlSet.+\\\Services\\\Tcpip\\\Parameters\\\Interfaces\\\.+\]', 
    227                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\ControlSet.+\\\Services\\\Dhcp\\\Parameters\]', 
    228                         '\[HKEY_LOCAL_MACHINE\\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\BITS]', 
    229                         '\[HKEY_USERS\\\.+\\\Software\\\Microsoft\\\Windows\\\CurrentVersion\\\Explorer\\\UserAssist\\\.+\\\Count\]', 
    230                         '\[HKEY_CURRENT_USER\\\Software\\\Microsoft\\\Windows\\\CurrentVersion\\\Explorer\\\UserAssist\\\.+\\\Count\]', 
    231                         '\[HKEY_LOCAL_MACHINE\\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\Group Policy\\\State\\\Machine\\\Extension-List\\\.+\]', 
    232                         '\[HKEY_LOCAL_MACHINE\\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\Group Policy\\\State\\\.+\\\Extension-List\\\.+\]', 
    233                         '\[HKEY_USERS\\\.+\\\Software\\\Microsoft\\\Windows\\\ShellNoRoam\\\BagMRU\]', 
    234                         '\[HKEY_CURRENT_USER\\\Software\\\Microsoft\\\Windows\\\ShellNoRoam\\\BagMRU\]', 
    235                         '\[HKEY_CURRENT_USER\\\Volatile Environment\]', 
    236                         '\[HKEY_USERS\\\.+\\\UNICODE Program Groups\]', 
    237                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\ControlSet.+\\\Services\\\SharedAccess\\\Epoch\]', 
    238                         '\[HKEY_LOCAL_MACHINE\\\SYSTEM\\\CurrentControlSet\\\Services\\\SharedAccess\\\Epoch\]', 
    239                         ); 
    240  
    241 my @default_file_exclude_array = (  '/cygdrive/c/cygwin/tmp/changes.txt', 
    242                         '/cygdrive/c/cygwin/tmp/cleanfile.txt', 
    243                         '/cygdrive/c/Documents and Settings/Administrator/Desktop/honeyclient', 
    244                         '/cygdrive/c/WINDOWS/Prefetch/', 
    245                         '/cygdrive/c/WINDOWS/WindowsUpdate.log', 
    246                         '/cygdrive/c/WINDOWS/Debug/UserMode/userenv.log', 
    247                         '/cygdrive/c/WINDOWS/SoftwareDistribution/DataStore/', 
    248                         '/cygdrive/c/WINDOWS/SchedLgU.Txt', 
    249                         '/cygdrive/c/WINDOWS/SoftwareDistribution/ReportingEvents.log', 
    250                         '/cygdrive/c/WINDOWS/system32/config/SysEvent.Evt', 
    251                         '/cygdrive/c/WINDOWS/PCHEALTH/HELPCTR/DataColl/', 
    252                         #Can't be included cause it's user specific 
    253                         #'/cygdrive/c/WINDOWS/SoftwareDistribution/WuRedir/9482F4B4-E343-43B6-B170-9A65BC822C77/wuredir.cab.bak', 
    254                         '/cygdrive/c/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader/', 
    255                         '/cygdrive/c/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles/', 
    256                         '/cygdrive/c/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles/', 
    257                         '/cygdrive/c/Documents and Settings/Administrator/Application Data/Talkback/MozillaOrg/Firefox15/Win32/2006050817/permdata.box', 
    258                         '/cygdrive/c/Documents and Settings/Administrator/Cookies/index.dat', 
    259                         '/cygdrive/c/Documents and Settings/Administrator/Local Settings/History/History.IE5/', 
    260                         '/cygdrive/c/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5', 
    261                         '/cygdrive/c/Documents and Settings/Administrator/Recent/', 
    262                         '/cygdrive/c/Program Files/Mozilla Firefox/updates/', 
    263                         '/cygdrive/c/Program Files/Mozilla Firefox/active-update.xml', 
    264                         '/cygdrive/c/Program Files/Mozilla Firefox/updates.xml', 
    265                         ); 
     212 
     213# XXX: All dirs must NEVER end in a trailing slash. 
     214my @default_file_exclude_array = ( 
     215    '/cygdrive/c/cygwin/tmp/changes.txt', 
     216    '/cygdrive/c/cygwin/tmp/cleanfile.txt', 
     217    '/cygdrive/c/cygwin/home/Administrator', 
     218    '/cygdrive/c/Documents and Settings/Administrator/Desktop/honeyclient', 
     219    '/cygdrive/c/WINDOWS/Prefetch', 
     220    '/cygdrive/c/WINDOWS/WindowsUpdate.log', 
     221    '/cygdrive/c/WINDOWS/Debug/UserMode/userenv.log', 
     222    '/cygdrive/c/WINDOWS/SoftwareDistribution/DataStore', 
     223    '/cygdrive/c/WINDOWS/SchedLgU.Txt', 
     224    '/cygdrive/c/WINDOWS/SoftwareDistribution/ReportingEvents.log', 
     225    '/cygdrive/c/WINDOWS/system32/config/SysEvent.Evt', 
     226    '/cygdrive/c/WINDOWS/system32/wbem', 
     227    '/cygdrive/c/WINDOWS/PCHEALTH/HELPCTR/DataColl', 
     228    '/cygdrive/c/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader', 
     229    '/cygdrive/c/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles', 
     230    '/cygdrive/c/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles', 
     231    '/cygdrive/c/Documents and Settings/Administrator/Application Data/Talkback/MozillaOrg/Firefox15/Win32/2006050817/permdata.box', 
     232    '/cygdrive/c/Documents and Settings/Administrator/Cookies/index.dat', 
     233    '/cygdrive/c/Documents and Settings/Administrator/Local Settings/History/History.IE5', 
     234    '/cygdrive/c/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5', 
     235    '/cygdrive/c/Documents and Settings/Administrator/Recent', 
     236    '/cygdrive/c/Program Files/Mozilla Firefox/updates', 
     237    '/cygdrive/c/Program Files/Mozilla Firefox/active-update.xml', 
     238    '/cygdrive/c/Program Files/Mozilla Firefox/updates.xml', 
     239    '/cygdrive/c/WINDOWS/SoftwareDistribution/WuRedir', 
     240    '/cygdrive/c/WINDOWS/SYSTEM32/config/SecEvent.Evt', 
     241    '/cygdrive/c/WINDOWS/SYSTEM32/config/SysEvent.Evt', 
     242    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/INDEX.BTR', 
     243    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/INDEX.MAP', 
     244    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/MAPPING.VER', 
     245    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/MAPPING1.MAP', 
     246    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/MAPPING2.MAP', 
     247    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/OBJECTS.DATA', 
     248    '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/OBJECTS.MAP', 
     249); 
    266250 
    267251 
    268252my %PARAMS = ( 
    269253 
    270     ### Files which are read in only ### 
    271     # List of files and directories to check during filesystem checking 
    272     file_checklist => getVar(name => "file_checklist", namespace => "HoneyClient::Agent::Integrity"), 
     254    # Contains the Registry object, once initialized. 
     255    _registry => undef, 
     256 
     257    # XXX: Clean the rest of these variables up. 
     258    ### Files which are read in only ### 
     259    # List of files and directories to check during filesystem checking 
     260    file_checklist => getVar(name => "file_checklist", namespace => "HoneyClient::Agent::Integrity"), 
    273261     
    274262    # List of files or directories to exclude if found in subdirs during 
    275263    # filesystem check. 
    276     file_exclude => getVar(name => "file_exclude", namespace => "HoneyClient::Agent::Integrity"), 
    277      
    278     # List of registry keys to check 
    279     reg_list_to_check   => getVar(name => "reg_list_to_check", namespace => "HoneyClient::Agent::Integrity"), 
     264    file_exclude => getVar(name => "file_exclude", namespace => "HoneyClient::Agent::Integrity"), 
    280265     
    281266    ### Files to write and read ### 
    282267    # File to store hashes for files selected during the baseline 
    283    clean_file => getVar(name => "clean_file", namespace => "HoneyClient::Agent::Integrity"), 
     268    clean_file => getVar(name => "clean_file", namespace => "HoneyClient::Agent::Integrity"), 
    284269     
    285270    # File to write any found changes to 
    286    change_file => getVar(name => "change_file", namespace => "HoneyClient::Agent::Integrity"), 
     271    change_file => getVar(name => "change_file", namespace => "HoneyClient::Agent::Integrity"), 
    287272     
    288     # Stores baseline for the registry. Always appended with a number 
    289     clean_reg => getVar(name => "clean_reg", namespace => "HoneyClient::Agent::Integrity"), 
     273    #vars 
     274    file_exclude_hash => undef, #hash, holds files to exclude 
     275    file_list => undef, #list, files to check when checking filesystem 
    290276     
    291     # Stores the current state of the registry to check against the 
    292     # clean state 
    293     current_reg => getVar(name => "current_reg", namespace => "HoneyClient::Agent::Integrity"), 
    294      
    295     # The file for the diff command to redirect it's output to. 
    296     # Always appended with a number. 
    297     diffs => getVar(name => "diffs", namespace => "HoneyClient::Agent::Integrity"), 
    298  
    299     #vars 
    300     file_exclude_hash => undef, #hash, holds files to exclude 
    301     file_list => undef, #list, files to check when checking filesystem 
    302     reg1 => undef,      #list,  holds entire contents of first file to diff 
    303     reg2 => undef,      #list, holds entire contents of second file to diff 
    304      
    305     #array that holds the locations in the registry to check 
    306     reg_check_array => undef, 
    307     #array that holds the registry locations that should be excluded from the detected changes 
    308     reg_exclude_array => undef,  
    309  
    310277    #works exactly like the reg_exclude_array, and is initialized in a similar way 
    311     file_exclude_array => undef, 
    312  
    313     changes => undef,   #multi-dimensional array used for holding individual instances of a diff output 
    314     g_count => -1,  #highest level index for, each $g_count will be a different instance of a diff grouping 
     278    file_exclude_array => undef, 
     279 
     280    changes => undef,   #multi-dimensional array used for holding individual instances of a diff output 
    315281); 
    316282 
    …… 
    379345 
    380346sub initAll { 
    381 my $self = shift; 
    382     $self->initRegistry(); 
     347    my $self = shift; 
     348    # XXX: initRegistry() MUST be called before initFileSystem, since initRegistry 
     349    # creates new files that must exist to be added to the exclusion list for 
     350    # initFileSystem. 
     351    $self->{'_registry'} = HoneyClient::Agent::Integrity::Registry->new(); 
    383352    $self->initFileSystem(); 
    384353} 
    …… 
    395364 
    396365sub checkAll { 
    397 my $self = shift; 
    398 my $retval; 
    399  
    400     #Add any new created checks here 
    401   
    402     $self->startCheckProcesses();   #currently a dummy method that just returns 
     366    my $self = shift; 
     367    my $retval; 
     368 
    403369    # If at all possible we want the (faster) registry checks to short circut 
    404370    # the overall checks so we don't have to do the very slow filesystem checks. 
    405     $retval = $self->checkRegistry(); 
    406     if($retval){ 
    407         return $retval; 
    408     } 
    409     $retval = $self->checkFileSystem(); 
     371    my $changes = $self->{'_registry'}->check(); 
     372    if (scalar(@{$changes})) { 
     373        print "Registry has changed:\n"; 
     374        foreach my $change (@{$changes}) { 
     375            print $change->{'key'} . " (" . $change->{'status'} . ")\n"; 
     376        } 
     377        open CHANGES, ">>$self->{change_file}" or die "Cannot open $self->{change_file}: $!\n";      
     378        $Data::Dumper::Terse = 1; 
     379        $Data::Dumper::Indent = 1; 
     380        print CHANGES Dumper($changes); 
     381        close CHANGES; 
     382        return $changes; 
     383    } 
     384    print "No registry changes have occurred.\n"; 
     385    $retval = $self->checkFileSystem(); 
    410386 
    411387    return $retval; 
    412  
    413  
    414 } 
     388} 
     389 
     390# TODO: Comment this. 
     391sub serialize { 
     392    my $self = shift; 
     393 
     394    if (defined($self->{'_registry'})) { 
     395        $self->{'_registry'}->closeFiles(); 
     396    } 
     397 
     398    return nfreeze($self); 
     399} 
     400 
    415401################################################################################ 
    416402 
    …… 
    479465    $g_hack = $self->{file_list}; 
    480466    $g_ex_hash = (); 
     467    my $file; 
    481468     
    482469    my @checkdirs = $self->_get_directories_to_check(); 
    …… 
    494481    } 
    495482 
    496     foreach my $file (@{$self->{file_exclude_array}}){ 
     483    $/ = "\n"; 
     484    foreach $file (@{$self->{file_exclude_array}}){ 
    497485        chomp $file; 
    498486        if(-f $file){ 
    …… 
    501489                                # because you can't get to that in _found() 
    502490        } 
    503         else { if(-d  $file){ 
    504                 find (\&_recursive_exclude, $file); 
    505             } 
    506             else{ 
    507                 #XXX: Does this case matter(exist?) for pipes for instance? 
    508                 print "A file that isn't a file or directory (or just general problem, or the file just isn't there) was found with file: $file\n"; 
    509             } 
     491        elsif(-d $file){ 
     492            print "excluding $file\n"; 
     493            $g_ex_hash->{$file} = 1;    #used in lieu of the $self->file_exclude_hash 
     494            #find (\&_recursive_exclude, $file); 
     495        } 
     496        else{ 
     497            #XXX: Does this case matter(exist?) for pipes for instance? 
     498            print "A file that isn't a file or directory (or just general problem, or the file just isn't there) was found with file: $file\n"; 
    510499        } 
    511500    } 
    512501 
    513502    print "Finding Files in initFileSystem...Be Patient.\n"; 
    514     foreach my $checkdir(@checkdirs) { 
     503    foreach my $checkdir (@checkdirs) { 
    515504        find (\&_found, "$checkdir");   #this will populate @{$self->{file_list}} 
    516505    } 
    …… 
    518507    $self->{file_list} = $g_hack; 
    519508    $self->{file_exclude_hash} = $g_ex_hash; 
    520 ###   print "file_exclude_hash in init\n" . Dumper($self->{file_exclude_hash}) . "\n"; 
     509##    print "file_exclude_hash in init\n" . Dumper($self->{file_exclude_hash}) . "\n"; 
    521510 
    522511    print "Hashing Files in initFileSystem...Be Patient\n"; 
    523512    open CLEANFILE, ">$self->{clean_file}" or die "Cannot open $self->{clean_file}: $!\n"; 
    524     foreach my $file (@{$self->{file_list}}) { 
     513    foreach $file (@{$self->{file_list}}) { 
    525514#       print "hashing $file\n"; 
    526515        if(open HASHFILE, "$file") { 
    …… 
    603592sub checkFileSystem { 
    604593 
    605 my $self = shift;   #Object 
    606 %{$self->{clean_file_hash}} = (); 
    607 %{$self->{changed_file_hash}} = (); 
    608 my %current_file_hash = (); 
    609 my %new_file_hash = (); 
    610 my %del_file_hash = (); 
    611 my @checkdirs; 
    612 my $standalone_test = 0; 
     594    my $self = shift;   #Object 
     595    %{$self->{clean_file_hash}} = (); 
     596    %{$self->{changed_file_hash}} = (); 
     597    my %current_file_hash = (); 
     598    my %new_file_hash = (); 
     599    my %del_file_hash = (); 
     600    my @checkdirs; 
     601    my $standalone_test = 0; 
     602    my $file; 
     603    my $key; 
    613604 
    614605### print "file_exclude_hash in check\n" . Dumper($self->{file_exclude_hash}) . "\n"; 
    …… 
    620611    #open file to create hash of values for clean files 
    621612    open CLEANFILE, "$self->{clean_file}" or die "Cannot open $self->{clean_file}: $!\n"; 
     613    $/ = "\n"; 
    622614    while(<CLEANFILE>) { 
    623615        my $line = $_; 
    …… 
    656648        } 
    657649     
    658         foreach my $file (@{$self->{file_exclude_array}}){ 
     650        $/ = "\n"; 
     651        foreach $file (@{$self->{file_exclude_array}}){ 
    659652            chomp $file; 
    660653            if(-f $file){ 
    …… 
    686679    #also detects new files 
    687680    print "Hashing Files in checkFileSystem...Be Patient\n"; 
    688     foreach my $file (@{$self->{file_list}}) { 
    689       if(open HASHFILE, "$file") { 
     681    foreach $file (@{$self->{file_list}}) { 
     682      if(open HASHFILE, "$file") { 
    690683            my $md5ctx = Digest::MD5->new(); 
    691684            # If this call fails, an exception will be generated. 
    …… 
    704697 
    705698    #check for deleted files 
    706     foreach my $key (keys %{$self->{clean_file_hash}}) { 
     699    foreach $key (keys %{$self->{clean_file_hash}}) { 
    707700        if(!($current_file_hash{$key})) { 
    708701            $del_file_hash{$key} = $self->{clean_file_hash}->{$key}; 
    …… 
    716709 
    717710        print CHANGES "Files deleted:\n"; 
    718         foreach my $key (sort keys %del_file_hash) { 
     711        foreach $key (sort keys %del_file_hash) { 
    719712            print CHANGES "$key\n"; 
    720713        } 
    721714        print CHANGES "\n\n"; 
    722715        print CHANGES "Files added:\n";