Changeset 521

Show
Ignore:
Timestamp:
06/17/07 17:21:39 (1 year ago)
Author:
kindlund
Message:

Merged DB branch into trunk.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/trunk/bin/StartManager.pl

    r409 r521  
    2525 
    2626my $driver = "IE"; 
    27 my $config = "/vm/master-vms/Agent.Master-19/winXPPro.cfg"; 
    28 my $maxrel = 5; 
     27my $config = "/vm/master-vms/Agent.Master-20/winXPPro.cfg"; 
     28my $maxrel = 10; 
    2929my $nexturl = ""; 
    3030my $urllist= ""; 

  • honeyclient/trunk/bin/TestRegistry.pl

    r131 r521  
    5151    } else { 
    5252        foreach my $change (@{$changes}) { 
    53             print $change->{'key'} . " (" . $change->{'status'} . ")\n"; 
     53            print $change->{'key_name'} . " (" . $change->{'status'} . ")\n"; 
    5454        } 
    5555    } 
    …… 
    6262    print "Detailed registry changes were written to: " . $file . "\n"; 
    6363} 
    64  

  • honeyclient/trunk/bin/run.sh

    r350 r521  
    22 
    33echo "Starting up Agent - (Hit CTRL-C multiple times to exit.)" 
     4 
     5# Remove all old /tmp/* entries. 
     6rm /tmp/* 
    47 
    58IP=$(/cygdrive/c/Program\ Files/VMware/VMware\ Tools/VMip.exe -get) 

  • honeyclient/trunk/etc/honeyclient.xml

    r432 r521  
    7272            <!-- TODO: Update this. --> 
    7373            <timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60"> 
    74                 30  
     74                20  
    7575            </timeout> 
    7676            <Browser> 
    …… 
    124124        </Driver> 
    125125        <perform_integrity_checks description="An integer, representing whether the Agent should perform any integrity checks. 1 enables, 0 disables." default="1"> 
    126             1  
     126            1 
    127127        </perform_integrity_checks> 
    128128        <!-- HoneyClient::Agent::Integrity Options --> 
    …… 
    205205                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 
    206206                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 
     207                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\MediaPlayer.*$</regex> 
     208                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia.*$</regex> 
    207209                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 
    208210                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex> 
    …… 
    244246                    <regex>^HKEY_USERS\\.+\\UNICODE Program Groups.*$</regex> 
    245247                    <regex>^HKEY_USERS\\S.+\\SessionInformation$</regex> 
     248                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex> 
    246249                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex> 
    247250                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International$</regex> 
    …… 
    250253                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 
    251254                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 
    252                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\MediaPlayer\\Preferences.*$</regex> 
     255                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\MediaPlayer.*$</regex> 
     256                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Multimedia.*$</regex> 
    253257                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 
    254258                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex> 
    …… 
    291295        </Integrity> 
    292296    </Agent> 
     297    <!-- HoneyClient::DB Options --> 
     298    <DB> 
     299        <enable description="Enables database operations. 1 enables, 0 disables." default="0"> 
     300            1 
     301        </enable> 
     302        <host description="The system providing the HoneyClient database.  If the database is installed on the same host system as the Manager, then localhost should be used." default="127.0.0.1"> 
     303            172.16.164.1 
     304        </host> 
     305        <dbname description="The name of the HoneyClient database." default="HoneyClient"> 
     306            HoneyClient 
     307        </dbname> 
     308        <user description="The username to use, when connecting to the HoneyClient database."> 
     309            honeyclient_user 
     310        </user> 
     311        <pass description="The password to use, when connecting to the HoneyClient database."> 
     312            honeyclient_password  
     313        </pass> 
     314        <port description="The default TCP port number used to communicate with the database." default="3306"> 
     315            3306 
     316        </port> 
     317    </DB> 
    293318    <Manager> 
    294319        <!-- TODO: Update this. --> 
    …… 
    396421            <!-- TODO: Update this. --> 
    397422            <fwprocess description="Name of external SOAP listener."> 
    398                 startFWListener.pl  
     423                startFWListener.pl 
    399424            </fwprocess> 
    400425            <!-- TODO: Update this. --> 
    …… 
    403428            </config_file> 
    404429        </FW> 
    405         <!-- HoneyClient::Manager::DB Options --> 
    406         <DB> 
    407             <!-- TODO: Update this. --> 
    408             <address description="eth0 interface static IP"> 
    409                 192.168.0.128 
    410             </address> 
    411             <!-- TODO: Update this. --> 
    412             <port description="Default FW port number" default="8083"> 
    413                 8089 
    414             </port> 
    415         </DB> 
    416430        <!-- HoneyClient::Manager::VM Options --> 
    417431        <VM> 

  • honeyclient/trunk/lib/HoneyClient/Agent.pm

    r411 r521  
    792792        # Initially set all driver objects to undef.  
    793793        my $driver = undef; 
     794 
     795        # Last resource used by driver. 
     796        my $lastResource = undef; 
    794797     
    795798        # Acquire lock on stored driver state. 
    …… 
    846849            foreach my $resource (keys %{$driver->next()->{resources}}) { 
    847850                $LOG->info("Driving To Resource: " . $resource); 
     851                $lastResource = $resource; 
    848852            } 
    849853 
    …… 
    882886        # TODO: Perform Integrity Check 
    883887        my $isCompromised = 0; 
     888        my $changes = undef; 
    884889        if (defined($integrity)) { 
    885890            # For now, we update a scalar called 'is_compromised' within 
    886891            # the $data->{$driverName}->{'status'} sub-hashtable. 
    887892            $LOG->info("Performing Integrity Checks."); 
    888             my $changes = $integrity->check(); 
     893            $changes = $integrity->check(); 
    889894            if (scalar(@{$changes->{registry}}) ||  
    890895                scalar(@{$changes->{filesystem}})) { 
    891896                $LOG->warn("Integrity Check: FAILED"); 
    892897                $isCompromised = 1; 
     898                $changes->{'last_resource'} = $lastResource; 
    893899            } else { 
    894900                $LOG->info("Integrity Check: PASSED"); 
    …… 
    900906 
    901907        # Update driver state one last time, before exiting. 
    902                  
    903908        # Acquire lock on stored driver state. 
    904909        $data = _lock(); 
    …… 
    911916        $data->{$driverName}->{'status'} = $driver->status(); 
    912917        $data->{$driverName}->{'status'}->{'is_compromised'} = $isCompromised; 
     918        $data->{$driverName}->{'status'}->{'fingerprint'} = $changes; 
    913919        $data->{$driverName}->{'status'}->{'is_running'} = 0; 
    914920        $data->{$driverName}->{'state'} = $driver; 

  • honeyclient/trunk/lib/HoneyClient/Agent/Driver.pm

    r411 r521  
    288288# 
    289289# use HoneyClient::Agent::Driver; 
    290 # my $driver = Driver->new(someVar => 'someValue'); 
     290# my $driver = HoneyClient::Agent::Driver->new(someVar => 'someValue'); 
    291291# 
    292292# What this function allows us to do, is programmatically, get or set 
    …… 
    375375my $driver = HoneyClient::Agent::Driver->new(test => 1); 
    376376is($driver->{test}, 1, "new(test => 1)") or diag("The new() call failed."); 
     377isa_ok($driver, 'HoneyClient::Agent::Driver', "new(test => 1)") or diag("The new() call failed."); 
    377378 
    378379=end testing 

  • honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Filesystem.pm

    r427 r521  
    6666  #     # Indicates if the filesystem entry was deleted, 
    6767  #     # added, or changed. 
    68   #     'status' => 'deleted' | 'added' | 'changed', 
     68  #     'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
     69  #     'name'  => 'C:\WINDOWS\SYSTEM32...', 
     70  #     'mtime' => 'YYYY-MM-DD HH:MM:SS', # new mtime for added/modified files; 
     71  #                                       # old mtime for deleted files 
    6972  # 
    70   #     # If the entry has been added/changed, then this  
    71   #     # hashtable contains the file/directory's new information. 
    72   #     'new' => { 
    73   #         'name'  => 'C:\WINDOWS\SYSTEM32...', 
    74   #         'size'  => 1263, # in bytes 
    75   #         'mtime' => 1178135092, # modification time, seconds since epoch 
    76   #     }, 
    77   # 
    78   #     # If the entry has been deleted/changed, then this 
    79   #     # hashtable contains the file/directory's old information. 
    80   #     'old' => { 
    81   #         'name'  => 'C:\WINDOWS\SYSTEM32...', 
    82   #         'size'  => 802, # in bytes 
    83   #         'mtime' => 1178135028, # modification time, seconds since epoch 
     73  #     # content will only exist for added/modified files 
     74  #     'content' => { 
     75  #         'size' => 1263,                                       # size of new content  
     76  #         'type' => 'application/octect-stream',                # type of new content 
     77  #         'md5'  => 'b1946ac92492d2347c6235b4d2611184',         # md5  of new content 
     78  #         'sha1' => 'f572d396fae9206628714fb2ce00f72e94f2258f', # sha1 of new content 
    8479  #     }, 
    8580  # }, ] 
    …… 
    124119# Include Logging Library 
    125120use Log::Log4perl qw(:easy); 
     121 
     122# Use DateTime Library 
     123use DateTime; 
     124 
     125# Use MD5 Library 
     126use Digest::MD5; 
     127 
     128# Use SHA Library 
     129use Digest::SHA; 
     130 
     131# Use File::Type Library 
     132use File::Type; 
     133 
     134# Use IO::File Library 
     135use IO::File; 
    126136 
    127137####################################################################### 
    …… 
    242252use HoneyClient::Agent::Integrity::Filesystem; 
    243253 
     254# Make sure DateTime loads. 
     255BEGIN { use_ok('DateTime') or diag("Can't load DateTime package.  Check to make sure the package library is correctly listed within the path."); } 
     256require_ok('DateTime'); 
     257use DateTime; 
     258 
     259# Make sure Digest::MD5 loads. 
     260BEGIN { use_ok('Digest::MD5') or diag("Can't load Digest::MD5 package.  Check to make sure the package library is correctly listed within the path."); } 
     261require_ok('Digest::MD5'); 
     262use Digest::MD5; 
     263 
     264# Make sure Digest::SHA loads. 
     265BEGIN { use_ok('Digest::SHA') or diag("Can't load Digest::SHA package.  Check to make sure the package library is correctly listed within the path."); } 
     266require_ok('Digest::SHA'); 
     267use Digest::SHA; 
     268 
     269# Make sure File::Type loads. 
     270BEGIN { use_ok('File::Type') or diag("Can't load File::Type package.  Check to make sure the package library is correctly listed within the path."); } 
     271require_ok('File::Type'); 
     272use File::Type; 
     273 
     274# Make sure IO::File loads. 
     275BEGIN { use_ok('IO::File') or diag("Can't load IO::File package.  Check to make sure the package library is correctly listed within the path."); } 
     276require_ok('IO::File'); 
     277use IO::File; 
     278 
    244279=end testing 
    245280 
    …… 
    249284# Global Configuration Variables                                      # 
    250285####################################################################### 
     286 
     287# TODO: Need to link these constants with DB code. 
     288# Filesystem Status Identifiers 
     289our $STATUS_DELETED  = 0; 
     290our $STATUS_ADDED    = 1; 
     291our $STATUS_MODIFIED = 2; 
     292 
     293# TODO: Need to link these constants with DB code. 
     294# Set hash value to this constant, if unable to compute.  
     295our $HASH_UNKNOWN    = 'UNKNOWN'; 
     296# Set type value to this constant, if unable to compute.  
     297our $TYPE_UNKNOWN    = 'UNKNOWN'; 
    251298 
    252299# The global logging object. 
    …… 
    432479# Input: Algorithm::Diff object 
    433480# Output: Array reference of hashtables 
     481# Notes: This function returns hashtables in the following 
     482# format: 
     483# 
     484#  $changes = [ { 
     485#      # Indicates if the filesystem entry was deleted, 
     486#      # added, or changed. 
     487#      'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
     488# 
     489#      # If the entry has been added/changed, then this  
     490#      # hashtable contains the file/directory's new information. 
     491#      'new' => { 
     492#          'name'  => 'C:\WINDOWS\SYSTEM32...', 
     493#          'size'  => 1263, # in bytes 
     494#          'mtime' => 1178135092, # modification time, seconds since epoch 
     495#      }, 
     496# 
     497#      # If the entry has been deleted/changed, then this 
     498#      # hashtable contains the file/directory's old information. 
     499#      'old' => { 
     500#          'name'  => 'C:\WINDOWS\SYSTEM32...', 
     501#          'size'  => 802, # in bytes 
     502#          'mtime' => 1178135028, # modification time, seconds since epoch 
     503#      }, 
     504#  }, ] 
    434505sub _diff { 
    435506 
    …… 
    458529 
    459530                push (@{$ret}, { 
    460                     'status' => 'deleted', 
     531                    'status' => $STATUS_DELETED, 
    461532                    'old' => $_, 
    462533                }); 
    …… 
    471542 
    472543                push (@{$ret}, { 
    473                     'status' => 'added', 
     544                    'status' => $STATUS_ADDED, 
    474545                    'new' => $_, 
    475546                }); 
    …… 
    501572 
    502573                        push (@{$ret}, { 
    503                             'status' => 'changed', 
     574                            'status' => $STATUS_MODIFIED, 
    504575                            'old' => $old_entry, 
    505576                            'new' => $new_entry, 
    …… 
    515586 
    516587                        push (@{$ret}, { 
    517                             'status' => 'deleted', 
     588                            'status' => $STATUS_DELETED, 
    518589                            'old' => $old_entry, 
    519590                        }); 
    520591                        push (@{$ret}, { 
    521                             'status' => 'added', 
     592                            'status' => $STATUS_ADDED, 
    522593                            'new' => $new_entry, 
    523594                        }); 
    …… 
    543614 
    544615                        push (@{$ret}, { 
    545                             'status' => 'changed', 
     616                            'status' => $STATUS_MODIFIED, 
    546617                            'old' => $old_entry, 
    547618                            'new' => $new_entry, 
    …… 
    557628 
    558629                        push (@{$ret}, { 
    559                             'status' => 'deleted', 
     630                            'status' => $STATUS_DELETED, 
    560631                            'old' => $old_entry, 
    561632                        }); 
    …… 
    568639                            $LOG->debug("File Added - "   . Dumper($new_entry)); 
    569640                            push (@{$ret}, { 
    570                                 'status' => 'added', 
     641                                'status' => $STATUS_ADDED, 
    571642                                'new' => $new_entry, 
    572643                            }); 
    …… 
    584655                    $LOG->debug("File Added - "   . Dumper($new_entry)); 
    585656                    push (@{$ret}, { 
    586                         'status' => 'added', 
     657                        'status' => $STATUS_ADDED, 
    587658                        'new' => $new_entry, 
    588659                    }); 
    …… 
    604675                                                " - New - " . Dumper($new_entry)); 
    605676                        push (@{$ret}, { 
    606                             'status' => 'changed', 
     677                            'status' => $STATUS_MODIFIED, 
    607678                            'old' => $old_entry, 
    608679                            'new' => $new_entry, 
    …… 
    617688                        $LOG->debug("File Added - "   . Dumper($new_entry)); 
    618689                        push (@{$ret}, { 
    619                             'status' => 'added', 
     690                            'status' => $STATUS_ADDED, 
    620691                            'new' => $new_entry, 
    621692                        }); 
    …… 
    628699                            $LOG->debug("File Deleted - "   . Dumper($old_entry)); 
    629700                            push (@{$ret}, { 
    630                                 'status' => 'deleted', 
     701                                'status' => $STATUS_DELETED, 
    631702                                'old' => $old_entry, 
    632703                            }); 
    …… 
    644715                    $LOG->debug("File Deleted - "   . Dumper($old_entry)); 
    645716                    push (@{$ret}, { 
    646                         'status' => 'deleted', 
     717                        'status' => $STATUS_DELETED, 
    647718                        'old' => $old_entry, 
    648719                    }); 
    …… 
    659730# 
    660731# Input: Array reference of hashtables  
    661 # Output: Array reference of hashtables (filtered)  
     732# Output: Array reference of hashtables (filtered) 
     733# Notes: This function expects and returns hashtables in the following 
     734# format: 
     735# 
     736#  $changes = [ { 
     737#      # Indicates if the filesystem entry was deleted, 
     738#      # added, or changed. 
     739#      'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
     740# 
     741#      # If the entry has been added/changed, then this  
     742#      # hashtable contains the file/directory's new information. 
     743#      'new' => { 
     744#          'name'  => 'C:\WINDOWS\SYSTEM32...', 
     745#          'size'  => 1263, # in bytes 
     746#          'mtime' => 1178135092, # modification time, seconds since epoch 
     747#      }, 
     748# 
     749#      # If the entry has been deleted/changed, then this 
     750#      # hashtable contains the file/directory's old information. 
     751#      'old' => { 
     752#          'name'  => 'C:\WINDOWS\SYSTEM32...', 
     753#          'size'  => 802, # in bytes 
     754#          'mtime' => 1178135028, # modification time, seconds since epoch 
     755#      }, 
     756#  }, ] 
    662757sub _filter { 
    663758    my ($self, $changes) = @_; 
    …… 
    668763        # Extract the file name from each entry. 
    669764        my $name = undef; 
    670         if (($_->{status} eq 'added') or ($_->{status} eq 'changed')) { 
     765        if (($_->{status} == $STATUS_ADDED) or ($_->{status} == $STATUS_MODIFIED)) { 
    671766            $name = $_->{'new'}->{name}; 
    672767        } else { 
    …… 
    705800 
    706801            # Sanity check. 
    707             if ((($prev_entry->{status} eq 'changed') || 
    708                  ($curr_entry->{status} eq 'changed')) || 
    709                 (($prev_entry->{status} eq 'added') && 
    710                  ($curr_entry->{status} eq 'added')) || 
    711                 (($prev_entry->{status} eq 'deleted') && 
    712                  ($curr_entry->{status} eq 'deleted'))) { 
     802            if ((($prev_entry->{status} == $STATUS_MODIFIED) || 
     803                 ($curr_entry->{status} == $STATUS_MODIFIED)) || 
     804                (($prev_entry->{status} == $STATUS_ADDED) && 
     805                 ($curr_entry->{status} == $STATUS_ADDED)) || 
     806                (($prev_entry->{status} == $STATUS_DELETED) && 
     807                 ($curr_entry->{status} == $STATUS_DELETED))) { 
    713808                $LOG->error("Duplicate filesystem change entries were found. " . 
    714809                            "Previous Entry - " . Dumper($prev_entry) . " - ". 
    …… 
    720815            # If the previous entry was added and the current 
    721816            # was deleted. 
    722             if (($prev_entry->{status} eq 'added') && 
    723                 ($curr_entry->{status} eq 'deleted')) { 
    724                 $prev_entry->{status} = 'changed'; 
     817            if (($prev_entry->{status} == $STATUS_ADDED) && 
     818                ($curr_entry->{status} == $STATUS_DELETED)) { 
     819                $prev_entry->{status} = $STATUS_MODIFIED; 
    725820                $prev_entry->{old} = $curr_entry->{old}; 
    726821 
    …… 
    728823            # current was added. 
    729824            } else { 
    730                 $prev_entry->{status} = 'changed'; 
     825                $prev_entry->{status} = $STATUS_MODIFIED; 
    731826                $prev_entry->{'new'} = $curr_entry->{'new'}; 
    732827            } 
    …… 
    741836    } 
    742837    return $ret; 
     838} 
     839 
     840# A helper function, designed to manipulate the array of changes into  
     841# a format that is expected by the check() function -- collecting 
     842# more forensic data about each change along the way. 
     843# 
     844# Input: Array reference of hashtables  
     845# Output: Array reference of hashtables (manipulated) 
     846# Notes: This function expects hashtables in the following 
     847# format: 
     848# 
     849#  $inputChanges = [ { 
     850#      # Indicates if the filesystem entry was deleted, 
     851#      # added, or changed. 
     852#      'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
     853# 
     854#      # If the entry has been added/changed, then this  
     855#      # hashtable contains the file/directory's new information. 
     856#      'new' => { 
     857#          'name'  => 'C:\WINDOWS\SYSTEM32...', 
     858#          'size'  => 1263, # in bytes 
     859#          'mtime' => 1178135092, # modification time, seconds since epoch 
     860#      }, 
     861# 
     862#      # If the entry has been deleted/changed, then this 
     863#      # hashtable contains the file/directory's old information. 
     864#      'old' => { 
     865#          'name'  => 'C:\WINDOWS\SYSTEM32...', 
     866#          'size'  => 802, # in bytes 
     867#          'mtime' => 1178135028, # modification time, seconds since epoch 
     868#      }, 
     869#  }, ] 
     870# 
     871# And outputs hashtables in the following format: 
     872#  
     873#  $outputChanges = [ { 
     874#      # Indicates if the filesystem entry was deleted, 
     875#      # added, or changed. 
     876#      'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
     877#      'name'  => 'C:\WINDOWS\SYSTEM32...', 
     878#      'mtime' => 'YYYY-MM-DD HH:MM:SS', # new mtime for added/modified files; 
     879#                                        # old mtime for deleted files 
     880# 
     881#      # content will only exist for added/modified files 
     882#      'content' => { 
     883#          'size' => 1263,                                       # size of new content  
     884#          'type' => 'application/octet-stream',                 # type of new content 
     885#          'md5'  => 'b1946ac92492d2347c6235b4d2611184',         # md5  of new content 
     886#          'sha1' => 'f572d396fae9206628714fb2ce00f72e94f2258f', # sha1 of new content 
     887#      }, 
     888#  }, ] 
     889# 
     890sub _prepare { 
     891    my ($self, $changes) = @_; 
     892    my $ret = []; 
     893 
     894    $LOG->debug("Preparing changes."); 
     895 
     896    my $md5_ctx  = Digest::MD5->new(); 
     897    my $sha1_ctx = Digest::SHA->new("1"); 
     898    my $type_ctx = File::Type->new(); 
     899 
     900    foreach my $entry (@{$changes}) { 
     901        # Construct a new entry in the new format. 
     902        my $newEntry = { 
     903            'status' => $entry->{'status'}, 
     904        }; 
     905 
     906        # Figure out which type of entry it is. 
     907        if ($entry->{'status'} == $STATUS_DELETED) { 
     908            # Convert Filename 
     909            $newEntry->{'name'}  = _convertFilename($entry->{'old'}->{'name'}); 
     910            $newEntry->{'mtime'} = _convertTime($entry->{'old'}->{'mtime'}); 
     911     
     912            $LOG->debug("Filename: " . $newEntry->{'name'}); 
     913        } else { 
     914            $newEntry->{'name'}  = $entry->{'new'}->{'name'}; 
     915            $newEntry->{'mtime'} = _convertTime($entry->{'new'}->{'mtime'}); 
     916 
     917            $LOG->debug("Filename: " . $newEntry->{'name'}); 
     918 
     919            # Create a new file handle. 
     920            my $fh = IO::File->new($newEntry->{'name'}, "r"); 
     921            my $md5  = $HASH_UNKNOWN; 
     922            my $sha1 = $HASH_UNKNOWN; 
     923            my $type = $TYPE_UNKNOWN; 
     924 
     925            # Check to make sure the new/changed file exists. 
     926            if (defined($fh)) { 
     927                # If the entry is a directory. 
     928                if (-d $fh) { 
     929                    $type = "directory"; 
     930                    undef $fh; 
     931 
     932                    # XXX: We currently skip all entries that 
     933                    # only correspond to directories. 
     934                    # This is a known limitation. 
     935                    next; 
     936 
     937                # If the entry is a file. 
     938                } else { 
     939                    # Compute MD5 Checksum. 
     940                    $md5_ctx->addfile($fh); 
     941                    $md5 = $md5_ctx->hexdigest(); 
     942 
     943                    # Rewind file handle. 
     944                    seek($fh, 0, 0); 
     945 
     946                    # Compute SHA1 Checksum. 
     947                    $sha1_ctx->addfile($fh); 
     948                    $sha1 = $sha1_ctx->hexdigest(); 
     949 
     950                    # Close the file handle. 
     951                    undef $fh; 
     952 
     953                    # Compute File Type. 
     954                    $type = $type_ctx->mime_type($newEntry->{'name'}); 
     955               } 
     956            } 
     957             
     958            # Populate the content, accordingly. 
     959            $newEntry->{'content'} = { 
     960                'size' => $entry->{'new'}->{'size'}, 
     961                'type' => $type, 
     962                'md5'  => $md5, 
     963                'sha1' => $sha1, 
     964            }; 
     965 
     966            # Convert Filename 
     967            $newEntry->{'name'}  = _convertFilename($newEntry->{'name'}); 
     968        } 
     969 
     970        # Finally, push it onto our return array. 
     971        push (@{$ret}, $newEntry); 
     972    } 
     973    return $ret; 
     974} 
     975 
     976# Helper function, designed to convert seconds since epoch to 
     977# an ISO 8601 date time format. 
     978# 
     979# Input: epoch 
     980# Output: iso8601 date/time 
     981sub _convertTime { 
     982    my $dt = DateTime->from_epoch(epoch => shift); 
     983    return $dt->ymd('-') . " " . $dt->hms(':'); 
     984} 
     985 
     986# Helper function, designed to convert Cygwin filename paths to 
     987# a Windows format, where the output is always lowercase. 
     988# 
     989# Input: cygwin filename path 
     990# Output: absolute windows filename path 
     991sub _convertFilename { 
     992    return lc(fullwin32path(shift)); 
    743993} 
    744994 
    …… 
    8381088} 
    8391089 
    840 ################################################################################ 
    841  
    8421090=pod 
    8431091 
    844 =head2 $object->check() 
     1092=head2 $object->check(no_prepare => $no_prepare) 
    8451093 
    8461094=over 4 
    …… 
    8481096Checks the filesystem for various changes, based upon 
    8491097the filesystem baseline, when the new() method was invoked. 
     1098 
     1099I<Inputs>: 
     1100 B<$no_prepare> is an optional parameter, specifying the output 
     1101format of the changes found. 
    8501102 
    8511103I<Output>: 
    …… 
    8531105hashtable has the following format: 
    8541106 
     1107  If $no_prepare == 1, then the format will be: 
     1108 
    8551109  $changes = [ { 
    8561110      # Indicates if the filesystem entry was deleted, 
    8571111      # added, or changed. 
    858       'status' => 'deleted' | 'added' | 'changed', 
     1112      'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
    8591113 
    8601114      # If the entry has been added/changed, then this  
    …… 
    8751129  }, ] 
    8761130 
     1131  Otherwise, the format will be: 
     1132 
     1133  $changes = [ { 
     1134      # Indicates if the filesystem entry was deleted, 
     1135      # added, or changed. 
     1136      'status' => $STATUS_DELETED | $STATUS_ADDED | $STATUS_MODIFIED, 
     1137      'name'  => 'C:\WINDOWS\SYSTEM32...', 
     1138      'mtime' => 'YYYY-MM-DD HH:MM:SS', # new mtime for added/modified files; 
     1139                                        # old mtime for deleted files 
     1140 
     1141      # content will only exist for added/modified files 
     1142      'content' => { 
     1143          'size' => 1263,                                       # size of new content  
     1144          'type' => 'application/octet-stream',                 # type of new content 
     1145          'md5'  => 'b1946ac92492d2347c6235b4d2611184',         # md5  of new content 
     1146          'sha1' => 'f572d396fae9206628714fb2ce00f72e94f2258f', # sha1 of new content 
     1147      }, 
     1148  }, ] 
     1149 
    8771150I<Notes>: 
     1151 If $no_prepare != 1 or $no_prepare == undef, then the outputted changes will B<NEVER> refer to 
     1152any directories.  All the changes will correspond to individual files. 
    8781153 
    8791154=back 
    …… 
    9311206close ADD_FILE; 
    9321207 
     1208my $md5_ctx = Digest::MD5->new(); 
     1209my $sha1_ctx = Digest::SHA->new("1"); 
     1210my $type_ctx = File::Type->new(); 
     1211 
     1212my $add_fh = IO::File->new($add_file, "r"); 
     1213$md5_ctx->addfile($add_fh); 
     1214my $add_file_md5 = $md5_ctx->hexdigest(); 
     1215seek($add_fh, 0, 0); 
     1216$sha1_ctx->addfile($add_fh); 
     1217my $add_file_sha1 = $sha1_ctx->hexdigest(); 
     1218undef $add_fh; 
     1219my $add_file_type = $type_ctx->mime_type($add_file); 
     1220 
    9331221@file_attr = stat($add_file); 
    9341222my $add_file_size  = $file_attr[7]; 
    …… 
    9401228close CHANGE_FILE; 
    9411229 
     1230my $change_fh = IO::File->new($change_file, "r"); 
     1231$md5_ctx->addfile($change_fh); 
     1232my $change_file_md5 = $md5_ctx->hexdigest(); 
     1233seek($change_fh, 0, 0); 
     1234$sha1_ctx->addfile($change_fh); 
     1235my $change_file_sha1 = $sha1_ctx->hexdigest(); 
     1236undef $change_fh; 
     1237my $change_file_type = $type_ctx->mime_type($change_file); 
     1238 
    9421239@file_attr = stat($change_file); 
    9431240my $change_file_size2  = $file_attr[7]; 
    …… 
    9451242 
    9461243### Perform check. 
    947 my $foundChanges = $filesystem->check(); 
     1244my $foundChanges = $filesystem->check(no_prepare => 1); 
    9481245 
    9491246# Uncomment these lines, if you want to see more 
    …… 
    9561253my $expectedChanges = [ 
    9571254  { 
    958     'status' => 'changed', 
     1255    'status' => $HoneyClient::Agent::Integrity::Filesystem::STATUS_MODIFIED, 
    9591256    'new' => { 
    9601257        'name'  => $change_file, 
    …… 
    9691266  }, 
    9701267  { 
    971     'status' => 'added', 
     1268    'status' => $HoneyClient::Agent::Integrity::Filesystem::STATUS_ADDED, 
    9721269    'new' => { 
    9731270        'name'  => $add_file, 
    …… 
    9771274  }, 
    9781275  { 
    979     'status' => 'deleted', 
     1276    'status' => $HoneyClient::Agent::Integrity::Filesystem::STATUS_DELETED, 
    9801277    'old' => { 
    9811278        'name'  => $delete_file, 
    …… 
    9861283]; 
    9871284 
    988 is_deeply($foundChanges, $expectedChanges, "check(monitored_directories => [ $monitor_dir ], ignored_entries => [ $monitor_dir ])") or diag("The check() call failed."); 
     1285is_deeply($foundChanges, $expectedChanges, "check(no_prepare => 1)") or diag("The check() call failed."); 
     1286 
     1287### Perform check. 
     1288$foundChanges = $filesystem->check(); 
     1289 
     1290# Uncomment these lines, if you want to see more 
     1291# detailed information about the changes found. 
     1292#$Data::Dumper::Terse = 0; 
     1293#$Data::Dumper::Indent = 1; 
     1294#diag(Dumper($foundChanges)); 
     1295 
     1296### Verify changes. 
     1297$expectedChanges = [ 
     1298  { 
     1299    'status' => $HoneyClient::Agent::Integrity::Filesystem::STATUS_MODIFIED, 
     1300    'name'  => HoneyClient::Agent::Integrity::Filesystem::_convertFilename($change_file), 
     1301    'mtime' => HoneyClient::Agent::Integrity::Filesystem::_convertTime($change_file_mtime2), 
     1302    'content' => { 
     1303        'size'  => $change_file_size2, 
     1304        'type'  => $change_file_type, 
     1305        'sha1'  => $change_file_sha1, 
     1306        'md5'   => $change_file_md5, 
     1307    }, 
     1308  }, 
     1309  { 
     1310    'status' => $HoneyClient::Agent::Integrity::Filesystem::STATUS_ADDED, 
     1311    'name'  => HoneyClient::Agent::Integrity::Filesystem::_convertFilename($add_file), 
     1312    'mtime' => HoneyClient::Agent::Integrity::Filesystem::_convertTime($add_file_mtime), 
     1313    'content' => { 
     1314        'size'  => $add_file_size, 
     1315        'type'  => $add_file_type, 
     1316        'sha1'  => $add_file_sha1, 
     1317        'md5'   => $add_file_md5, 
     1318    }, 
     1319  }, 
     1320  { 
     1321    'status' => $HoneyClient::Agent::Integrity::Filesystem::STATUS_DELETED, 
     1322    'name'  => HoneyClient::Agent::Integrity::Filesystem::_convertFilename($delete_file), 
     1323    'mtime' => HoneyClient::Agent::Integrity::Filesystem::_convertTime($delete_file_mtime), 
     1324  }, 
     1325]; 
     1326 
     1327is_deeply($foundChanges, $expectedChanges, "check()") or diag("The check() call failed."); 
    9891328 
    9901329### Clean up test data. 
    …… 
    10151354    }); 
    10161355 
     1356    # Sanity checks; check if any args were specified. 
     1357    my $argsExist = scalar(%args); 
     1358 
    10171359    # Analyze the filesystem. 
    10181360    $LOG->info("Analyzing filesystem."); 
    …… 
    10241366                                                    $file_analysis, 
    10251367                                                    { keyGen => \&_toString })); 
    1026     # Return filtered results. 
     1368    # Filter results. 
    10271369    $changes = $self->_filter($changes); 
    10281370    if (scalar(@{$changes})) { 
    …… 
    10311373        $LOG->info("No filesystem changes found."); 
    10321374    } 
     1375 
     1376    # Prepare results, if not directed otherwise. 
     1377    if (!$argsExist ||  
     1378        !exists($args{'no_prepare'}) ||  
     1379        !defined($args{'no_prepare'}) || 
     1380        !$args{'no_prepare'}) { 
     1381        $changes = $self->_prepare($changes); 
     1382    } 
     1383 
     1384    # Return formatted results. 
    10331385    return $changes; 
    10341386} 
    …… 
    10591411 
    10601412=back 
     1413 
     1414This library also only monitors B<FILE> changes.  Thus, if malware 
     1415manipulates B<EMPTY DIRECTORIES> on the system, then this library will 
     1416B<NOT&