Changeset 99

Timestamp:

12/11/06 06:23:07 (2 years ago)

Author:

kindlund

Message:

Still debugging registry/parser interactions.

Files:

• honeyclient/branches/bug/42/etc/honeyclient_log.conf (modified) (1 diff)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm (modified) (15 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm (modified) (22 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp (modified) (16 diffs)
• honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry.t (modified) (1 diff)
• honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry_parser.t (modified) (6 diffs)

honeyclient/branches/bug/42/etc/honeyclient_log.conf

@@ -60 +60 @@
-
-log4perl.rootLogger=DEBUG, Screen
+# Suppress Parser Debugging Messages
+log4perl.logger.HoneyClient.Agent.Integrity.Registry.Parser=INFO, Screen
-log4perl.appender.Screen=Log::Log4perl::Appender::Screen
-# If you want colorized logging to the screen, enable this line, instead.

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm

@@ -109 +109 @@
-use HoneyClient::Util::Config qw(getVar);
-
+# Include Registry Parsing Library
+use HoneyClient::Agent::Integrity::Registry::Parser;
+
-# Use Dumper Library
-use Data::Dumper;
@@ -248 +251 @@
-use Filesys::CygwinPaths qw(:all);
-
+# Make sure HoneyClient::Agent::Integrity::Registry::Parser loads
+BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry::Parser')
+        or diag("Can't load HoneyClient::Agent::Integrity::Registry::Parser package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('HoneyClient::Agent::Integrity::Registry::Parser');
+use HoneyClient::Agent::Integrity::Registry::Parser;
+
-=end testing
-
@@ -315 +324 @@
-
-    # Baseline File Collection
-handles, one file
+parsers, one parser
-    # (For internal use only.)
-file
+parser
-
-    # Checkpoint File Collection
-handles, one file
+parsers, one parser
-    # (For internal use only.)
-file
-
-handle
+parser
+
+parser
-    # and the hash value is the file name.
-    # (For internal use only.)
@@ -330 +339 @@
-
-    # A hashtable of current key info objects, where the hash key is the
-handle
+parser
-    # (For internal use only.)
-    _currentKeys => { },
@@ -336 +345 @@
-    # A hashtable of counters, where each counter keeps track of
-    # which entry was last read in from the current key.  The hash key
-handle
+parser
-    _currentEntryIndex => { },
-);
@@ -354 +363 @@
-    # Delete any temporary files created.
-#    foreach my $hive (@{$self->{hives_to_check}}) {
-file
+parser
-#        $LOG->debug("Deleting baseline of hive '" . $hive . "' in '" .
-#                    $self->{_filenames}->{$fh} . "'.");
@@ -375 +384 @@
-sub _snapshot {
-    # Extract arguments.
-file
-fh
+parser
+parser
-    my $fname = undef;
+    my $fname_tmp = undef;
-    foreach my $hive (@{$self->{hives_to_check}}) {
-        $fname = tmpnam(); 
+        $fname_tmp = tmpnam(); 
-        $LOG->debug("Storing snapshot of hive '" . $hive . "' into '" . $fname . "'.");
-
-
+
+
+
+
+
-            $LOG->fatal("Error: Unable to write '" . $hive . "' hive data to '" . $fname ."'.");
-            Carp::croak("Error: Unable to write '" . $hive . "' hive data to '" . $fname ."'.");
-        }
-
-$fh = new IO::File($fname, 'r');
-defined($fh
-read '" . $hive . "' hive data from '" . $fname
-read '" . $hive . "' hive data from '" . $fname
+# Delete the unconverted temporary file.
+unlink($fname_tmp
+unlink temporary file '" . $fname_tmp
+unlink temporary file '" . $fname_tmp
-        }
-
+        $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $fname);
+
-        # Preemptively unlink the file, to prevent any other process from mucking with it.
-
+
+
-#            $LOG->fatal("Error: Unable to unlink '" . $hive . "' hive data in '" . $fname ."'.");
-#            Carp::croak("Error: Unable to unlink '" . $hive . "' hive data in '" . $fname ."'.");
-#        }
-
-file_collection->{$hive} = $fh
-fh
+parser_collection->{$hive} = $parser
+parser
-    }
-}
-
-# Helper function, designed to read a single key from the specified
-# file descriptor.
-#
-# Inputs: HoneyClient::Agent::Integrity::Registry object,
-#         file descriptor to read the key from
-#
-# Outputs: Returns undef on error, an empty hash reference if end
-#          of file is encountered, our outputs the following
-#          'info' hashtable:
-#
-#   {
-#       'key' => "theName",          # name of key (with HKEY_...)
-#       'status' => 'd' | 'n' | 'e', # d: deleted, n:new, e:existing
-#       'entries' => [ {             # entries added/changed/deleted
-#           'name' => "\"theName\"", # name of entry (maybe "@")
-#           'value' => "hex:...",    # value (undef if deleted)
-#           'oldValue' => "\"abc\"", # undef if unknown (maybe "new")
-#       } ],
-#   }
-#
-sub _readKey {
-    # Extract arguments.
-    my ($self, $fd) = @_;
-
-    my ($key, $stuff);
-
-    # Create a new info object to return.
-    my ($info) = {};
-    my ($startLine, $currentLine);
-
-    # Boolean to keep track of whether the first line has been read.
-    my ($firstLine) = 1;
-
-    # While the file descriptor has more lines to read...
-    while (<$fd>) {
-        # Strip off any carriage returns.
-        $_ =~ s/\r$//;
-
-        # Skip the beginning 'REGEDIT4' header.
-        next if (/^REGEDIT4\s*$/ && $firstLine);
-
-        # Terminate early, if the info object is already populated.
-        if (/^\s*$/) {
-            last if (%$info); # non empty key
-            next;
-        }
-
-        # If we've gotten this far, then we're not on the first line.
-        $firstLine = 0;
-
-        # Read in the new registry key directory name.
-        #if (/^\[(.*)](.*)/) {
-        if (/^\[(.*)]/) {
-
-            # Emit error, if we've already created an info object and were about
-            # to create a new one, before reaching a blank line.
-            if (%$info) {
-                $LOG->error("Error: (" . $. . ") - Registry keys not separated by blank line.");
-                Carp::carp("Error: (" . $. . ") - Registry keys not separated by blank line.");
-                return undef;
-            }
-
-            # Read in key name, along with any adjacent string.
-            #($key, $stuff) = ($1, $2);
-            $key = $1;
-
-            # Determine if the registry file we're reading has custom identifiers in the
-            # adjacent string, which would signify if the registry key is new, deleted, or
-            # already existed.
-            my ($status);
-            #if ($stuff =~ /^\s*$/) {
-            #   $status = 'e';
-            #} elsif ($stuff =~ /^\s*-\s*$/) {
-            #   $status = 'd';
-            #} elsif ($stuff =~ /^\s*\(new\)\s*$/) {
-            #   $status = 'n';
-            #} else {
-            #   $LOG->error("Error: (" . $. . ") - Unrecognized data after registry key: " . $stuff);
-            #   Carp::carp("Error: (" . $. . ") - Unrecognized data after registry key: " . $stuff);
-            #   return undef;
-            #}
-
-            # Construct the info object.
-            $info->{'key'}     = $key;
-            $info->{'status'}  = $status;
-            $info->{'entries'} = [];
-            next;
-        }
-
-        # If we've gotten this far, then we must have already read the key directory name and
-        # the new text must correspond to a key entry.
-        if (!%$info) {
-            $LOG->error("Error: (" . $. . ") - Entry found outside of registry key.");
-            Carp::carp("Error: (" . $. . ") - Entry found outside of registry key.");
-            return undef;
-        }
-
-        # Read in the contents of the key entry, span multiple lines
-        # as long as we have a continuation marker (\) at the end of 
-        # each line...
-        $startLine = $.;
-        #my $sofar = '';
-        while (1) {
-
-            #if (/^(([^"\\]|\\\\|\\")+|"([^"\\]|\\\\|\\")*")*/) {
-            #    $sofar .= $&;
-            #    last if $' eq '';
-            #    $_ = $';
-            #}
-
-            chomp; # Kill off excess newlines from $_.
-
-            # Check to see if we're on a line that continues.
-            if (/^.*[^\\]$/) {
-                last;
-            }
-
-            # Strip out continuation marker from $_.
-            $_ =~ s/\\$//;
-
-
-            # Kill off excess newlines.
-            chomp($currentLine = <$fd>);
-            $currentLine =~ s/\r$//;
-
-            # Sanity check.
-            if (!defined $currentLine) {
-                $LOG->error("Error: (" . $. . ") - Hit EOF while looking for matching registry entry quote or non-continuation line (started at line " . $startLine . ")");
-                Carp::carp("Error: (" . $. . ") - Hit EOF while looking for matching registry entry quote or non-continuation line (started at line " . $startLine . ")");
-                return undef;
-            }
-            #if ($_ eq "\\\n") {
-            #    $_ = '';
-                $currentLine =~ s/^\s*//;
-            #}
-            $_ .= $currentLine;
-        }
-        #$_ = $sofar;
-        if (
-/^(\@|\"([^\\"]|\\"|\\\\)+")(|=(|(|stringz:|ustringz:)"([^\\"]|\\"|\\\\)*"|dword:[\da-fA-F]+|hex(|\([0-9a-fA-F]+\)):[\da-fA-F,]*))(|\s+\((.+)\))\s*$/
-          )
-        {
-            push(@{$info->{'entries'}},
-                 {'name'     => $1,
-                  'value'    => $3 eq '' ? undef: $4,
-                  'oldValue' => $8 eq '' ? undef: $9,});
-            next;
-        }
-        $LOG->error("Error: (" . $. . ") - Unable to extract registry entry name/value pairs.");
-        Carp::carp("Error: (" . $. . ") - Unable to extract registry entry name/value pairs.");
-        return undef;
-    }
-    return $info;
-}
-
-# Helper function, designed to print any info object created by
-# the _readKey() function.
-#
-# Inputs: HoneyClient::Agent::Integrity::Registry object,
-#         file descriptor to print to,
-#         info object created by _readKey()
-# 
-# Outputs: None
-sub _printKey {
-    my ($self, $info) = @_;
-
-    return if !defined($info) || !%{$info};
-
-    print '[', $info->{'key'}, ']';
-#    print "\t(new)" if ($info->{'status'} eq 'n');
-#    print '-'       if ($info->{'status'} eq 'd');
-    print "\n";
-    my $f;
-    foreach $f (@{$info->{'entries'}}) {
-        print $f->{'name'};
-        print '=', $f->{'value'} if (defined $f->{'value'});
-        print "\t(", $f->{'oldValue'}, ')' if (defined $f->{'oldValue'});
-        print "\n";
-    }
-    print "\n";
-}
-
@@ -640 +475 @@
-# name, out of the specified file.
-#
-descripto
+parse
-#
-# Outputs: next registry key directory name; undef if no key directory names
-#          are left to read
-sub _nextKey {
-file
+parser
-
-    # Read the next key from the specified file.
-file} = $self->_readKey($file
+parser} = $parser->nextGroup(
-
-    # Check to make sure read was successful.
-file
+parser
-        $LOG->fatal("Error: Unable to read registry keys from '" .
-file
+parser
-        Carp::croak("Error: Unable to read registry keys from '" .
-file
+parser
-    }
-
-    # Encountered empty hash ref, thus we are at
-    # the end of the file.
-file
+parser
-        return undef;
-    }
@@ -666 +501 @@
-    # Key read was successful, reset the entry index
-    # for this file.
-file
+parser
-
-    # Return the corresponding key directory name.
-file
+parser
-}
-
@@ -675 +510 @@
-# the last key directory that was fetched by _nextKey().
-#
-descripto
+parse
-#
-# Outputs: next entry (name, value) pair; undef if no entries were found that
-#          correspond to the last key directory fetched by _nextKey()
-sub _nextVal {
-file
+parser
-
-    # Read the last key object read from the specified file.
-   = $self->{_currentKeys}->{$file
+= $self->{_currentKeys}->{$parser
-
-    # Get the latest entry index associated with the latest key.
-file
+parser
-
-    # If the index is past our array of known entries, then return undef.
@@ -694 +529 @@
-
-    # There is an entry to be read, so increment the entry index.
-file
+parser
-
-    # Return the corresponding entry (name, value) pair.
@@ -782 +617 @@
-
-    # Perform registry baselining.
-file
+parser
-
-    # Finally, return the blessed object.
@@ -848 +683 @@
-
-    # Checkpoint the registry.
-file
+parser
-
-    my ($from, $to);
@@ -871 +706 @@
-
-$LOG->info("Checking '" . $hive . "' hive...");
-file
-file
+parser
+parser
-
-    my $dellen = 99999;
@@ -888 +723 @@
-#$LOG->debug("FROM: ". Dumper($fromkey));
-#$LOG->debug("TO: " . Dumper($tokey));
-
+
+
+
-
-        # Figure out the length of the to key.

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm

@@ -69 +69 @@
-
-  # Print each registry group found, until there are no more left.
-undef
-defined($registryGroup = $parser->nextGroup(
+$parser->nextGroup()
+scalar(keys(%{$registryGroup}
-      print Dumper($registryGroup);
+      $registryGroup = $parser->nextGroup();
-  }
-
@@ -113 +114 @@
-use IO::File;
-
+# Use Seek Library.
+use Fcntl qw(:seek);
+
-#######################################################################
-# Module Initialization                                               #
@@ -198 +202 @@
-require_ok('IO::File');
-use IO::File;
+
+# Make sure Fcntl loads
+BEGIN { use_ok('Fcntl')
+        or diag("Can't load Fcntl package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('Fcntl');
+use Fcntl qw(:seek);
-
-# Make sure HoneyClient::Agent::Integrity::Registry::Parser loads
@@ -344 +354 @@
-         'registry', 0,
-sub
-1
+2
-{
-            $LOG->debug("Reached end of input stream.");
-und
-undef
+empty hash r
+{ }
-        }
-    ],
@@ -354 +364 @@
-         'registry', 1,
-sub
-2
+3
-{
-            $LOG->debug("Reached end of input stream.");
-und
-undef
+empty hash r
+{ }
-        }
-    ],
@@ -364 +374 @@
-         'registry', 2,
-sub
-2
+3
-{
-            $LOG->debug("Reached end of input stream.");
-und
-undef
+empty hash r
+{ }
-        }
-    ],
@@ -386 +396 @@
-         'group', 2,
-sub
-4
+5
-{
-            my $ret = { };
@@ -405 +415 @@
-         'group', 1,
-sub
-5
+6
-{
-            my $ret = { };
@@ -430 +440 @@
-         'entry', 2,
-sub
-8
+9
-{
-            my $entry = {
@@ -445 +455 @@
-}
-
-29
+30
-
-
@@ -541 +551 @@
-}
-
+# Helper function, designed to index all groups, based upon beginning file
+# offsets.
+#
+# Inputs: parser
+# Outputs: None
+sub _index {
+    # Extract arguments.
+    my $self = shift;
+
+    $LOG->debug("Starting group index process.");
+
+    $self->YYData->{'group_index'} = [0, ];
+
+    my $registryGroup = $self->nextGroup();
+    while(scalar(keys(%{$registryGroup}))) {
+        $registryGroup = $self->nextGroup();
+        push (@{$self->YYData->{'group_index'}}, $self->YYData->{'input_pos'});
+    }
+
+    my $fh = $self->YYData->{'file_handle'};
+    seek($fh, 0, SEEK_SET);
+
+    undef $/;
+    $self->YYData->{DATA} = <$fh>;
+
+    # Strip all CRs.
+    $self->YYData->{DATA} =~ s/\r//g;
+    
+$self->YYData->{DATA} =~ m/\G.{73}/scg;
+   
+
+    # Reinitialize helper variables.
+    # Hashtable, to represent the latest, extracted group chunk.
+    $self->YYData->{'latest_group'} = { };
+
+    # Boolean, to indicate when we're parsing inside a group chunk.
+    $self->YYData->{'in_group'} = 0;
+
+    # Boolean, to indicate when we're parsing inside a value segment.
+    $self->YYData->{'in_value'} = 0;
+    
+    # Regexp offset, used to record where the parser is within
+    # the file.
+    $self->YYData->{'input_pos'} = 0;
+
+    # Initialize statistics.
+    # Total number of directories parsed.
+    $self->YYData->{'dir_count'} = 0;
+
+    # Total number of key/value pairs parsed.
+    $self->YYData->{'entry_count'} = 0;
+
+    $LOG->debug("Finished group index process.");
+
+    print Dumper($self->YYData->{'group_index'}) . "\n";
+}
+
-#######################################################################
-# Public Methods Implemented                                          #
@@ -551 +618 @@
-The following functions have been implemented by any Parser object.
-
-
+, index_groups => $perform_index
-
-=over 4
@@ -560 +627 @@
-I<Inputs>:
- B<$filename> is an required parameter, specifying the file to open for parsing.
+ B<$perform_index> is an optional parameter.  1 specifies that the parser should go
+ahead and scan the entire file, indexing the file offsets of where groups start and
+end.  Otherwise, this indexing process is not performed.
- 
-I<Output>: The instantiated Parser B<$object>, fully initialized.
@@ -605 +675 @@
-        Carp::croak("Error: Unable to read file '" . $args{'input_file'} . "'!\n");
-    }
+
+    # Save the file handle.
+    $parser->YYData->{'file_handle'} = $fh;
+
-    undef $/;
-    $parser->YYData->{DATA} = <$fh>;
@@ -625 +699 @@
-    $parser->YYData->{'input_pos'} = 0;
-
+    # Array to record where group boundaries occur.
+    $parser->YYData->{'group_index'} = [0, ];
+
-    # Initialize statistics.
-    # Total number of directories parsed.
@@ -631 +708 @@
-    # Total number of key/value pairs parsed.
-    $parser->YYData->{'entry_count'} = 0;
+
+    # Perform group indexing, if specified.
+    if ($argsExist && 
+        exists($args{'index_groups'}) && 
+        defined($args{'index_groups'}) &&
+        $args{'index_groups'}) {
+        $parser->_index();
+    }
-
-    # Return parser object.
@@ -659 +744 @@
-
-I<Output>: A hashtable reference if the next group was parsed successfully;
-
+
+
-
-=back
@@ -670 +756 @@
-
-# Create a generic Parser object, with test state data.
-
+, index_groups => 1
-
-# Verify Test Group #1
@@ -804 +890 @@
-# Verify Test Group #9
-$nextGroup = $parser->nextGroup();
-undef
+{ }
-
-=end testing
@@ -852 +938 @@
-my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file);
-
-
+
+
+
-}
-
@@ -897 +985 @@
-my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file);
-
-
+
+
+
-}
-
@@ -919 +1009 @@
-}
-
+=pod
+
+=head2 $object->getFileHandle()
+
+=over 4
+
+Returns the file handle associated with the current Parser B<$object>.
+
+I<Output>: Returns the file handle in use.
+
+=back
+
+=begin testing
+
+my ($handle);
+my $test_registry_file = $ENV{PWD} . "/" . getVar(name      => "registry_file",
+                                                  namespace => "HoneyClient::Agent::Integrity::Registry::Parser::Test");
+
+# Create a generic Parser object, with test state data.
+my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file);
+
+$handle = $parser->getFileHandle();
+
+isa_ok($handle, 'IO::File', "getFileHandle()") or diag("The getFileHandle() call failed.");
+
+=end testing
+
+=cut
+
+sub getFileHandle {
+    # Extract arguments.
+    my ($self, %args) = @_;
+
+    # Log resolved arguments.
+    # Make Dumper format more terse.
+    $Data::Dumper::Terse = 1;
+    $Data::Dumper::Indent = 0;
+    $LOG->debug(Dumper(\%args));
+
+    return $self->YYData->{'file_handle'}; 
+}
+
-#######################################################################
-# Additional Module Documentation                                     #

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp

@@ -52 +52 @@
-
-  # Print each registry group found, until there are no more left.
-undef
-defined($registryGroup = $parser->nextGroup(
+$parser->nextGroup()
+scalar(keys(%{$registryGroup}
-      print Dumper($registryGroup);
+      $registryGroup = $parser->nextGroup();
-  }
-
@@ -96 +97 @@
-use IO::File;
-
+# Use Seek Library.
+use Fcntl qw(:seek);
+
-#######################################################################
-# Module Initialization                                               #
@@ -182 +186 @@
-use IO::File;
-
+# Make sure Fcntl loads
+BEGIN { use_ok('Fcntl')
+        or diag("Can't load Fcntl package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('Fcntl');
+use Fcntl qw(:seek);
+
-# Make sure HoneyClient::Agent::Integrity::Registry::Parser loads
-BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry::Parser')
@@ -218 +228 @@
-               {
-            $LOG->debug("Reached end of input stream.");
-und
-undef
+empty hash r
+{ }
-        }
-    |   groups {
-            $LOG->debug("Reached end of input stream.");
-und
-undef
+empty hash r
+{ }
-        }
-    |   HEADER groups {
-            $LOG->debug("Reached end of input stream.");
-und
-undef
+empty hash r
+{ }
-        }
-;
@@ -386 +396 @@
-}
-
+# Helper function, designed to index all groups, based upon beginning file
+# offsets.
+#
+# Inputs: parser
+# Outputs: None
+sub _index {
+    # Extract arguments.
+    my $self = shift;
+
+    $LOG->debug("Starting group index process.");
+
+    $self->YYData->{'group_index'} = [0, ];
+
+    my $registryGroup = $self->nextGroup();
+    while(scalar(keys(%{$registryGroup}))) {
+        $registryGroup = $self->nextGroup();
+        push (@{$self->YYData->{'group_index'}}, $self->YYData->{'input_pos'});
+    }
+
+    my $fh = $self->YYData->{'file_handle'};
+    seek($fh, 0, SEEK_SET);
+
+    undef $/;
+    $self->YYData->{DATA} = <$fh>;
+
+    # Strip all CRs.
+    $self->YYData->{DATA} =~ s/\r//g;
+    
+$self->YYData->{DATA} =~ m/\G.{73}/scg;
+   
+
+    # Reinitialize helper variables.
+    # Hashtable, to represent the latest, extracted group chunk.
+    $self->YYData->{'latest_group'} = { };
+
+    # Boolean, to indicate when we're parsing inside a group chunk.
+    $self->YYData->{'in_group'} = 0;
+
+    # Boolean, to indicate when we're parsing inside a value segment.
+    $self->YYData->{'in_value'} = 0;
+    
+    # Regexp offset, used to record where the parser is within
+    # the file.
+    $self->YYData->{'input_pos'} = 0;
+
+    # Initialize statistics.
+    # Total number of directories parsed.
+    $self->YYData->{'dir_count'} = 0;
+
+    # Total number of key/value pairs parsed.
+    $self->YYData->{'entry_count'} = 0;
+
+    $LOG->debug("Finished group index process.");
+
+    print Dumper($self->YYData->{'group_index'}) . "\n";
+}
+
-#######################################################################
-# Public Methods Implemented                                          #
@@ -396 +463 @@
-The following functions have been implemented by any Parser object.
-
-
+, index_groups => $perform_index
-
-=over 4
@@ -405 +472 @@
-I<Inputs>:
- B<$filename> is an required parameter, specifying the file to open for parsing.
+ B<$perform_index> is an optional parameter.  1 specifies that the parser should go
+ahead and scan the entire file, indexing the file offsets of where groups start and
+end.  Otherwise, this indexing process is not performed.
- 
-I<Output>: The instantiated Parser B<$object>, fully initialized.
@@ -450 +520 @@
-        Carp::croak("Error: Unable to read file '" . $args{'input_file'} . "'!\n");
-    }
+
+    # Save the file handle.
+    $parser->YYData->{'file_handle'} = $fh;
+
-    undef $/;
-    $parser->YYData->{DATA} = <$fh>;
@@ -470 +544 @@
-    $parser->YYData->{'input_pos'} = 0;
-
+    # Array to record where group boundaries occur.
+    $parser->YYData->{'group_index'} = [0, ];
+
-    # Initialize statistics.
-    # Total number of directories parsed.
@@ -476 +553 @@
-    # Total number of key/value pairs parsed.
-    $parser->YYData->{'entry_count'} = 0;
+
+    # Perform group indexing, if specified.
+    if ($argsExist && 
+        exists($args{'index_groups'}) && 
+        defined($args{'index_groups'}) &&
+        $args{'index_groups'}) {
+        $parser->_index();
+    }
-
-    # Return parser object.
@@ -504 +589 @@
-
-I<Output>: A hashtable reference if the next group was parsed successfully;
-
+
+
-
-=back
@@ -515 +601 @@
-
-# Create a generic Parser object, with test state data.
-
+, index_groups => 1
-
-# Verify Test Group #1
@@ -649 +735 @@
-# Verify Test Group #9
-$nextGroup = $parser->nextGroup();
-undef
+{ }
-
-=end testing
@@ -697 +783 @@
-my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file);
-
-
+
+
+
-}
-
@@ -742 +830 @@
-my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file);
-
-
+
+
+
-}
-
@@ -764 +854 @@
-}
-
+=pod
+
+=head2 $object->getFileHandle()
+
+=over 4
+
+Returns the file handle associated with the current Parser B<$object>.
+
+I<Output>: Returns the file handle in use.
+
+=back
+
+=begin testing
+
+my ($handle);
+my $test_registry_file = $ENV{PWD} . "/" . getVar(name      => "registry_file",
+                                                  namespace => "HoneyClient::Agent::Integrity::Registry::Parser::Test");
+
+# Create a generic Parser object, with test state data.
+my $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file => $test_registry_file);
+
+$handle = $parser->getFileHandle();
+
+isa_ok($handle, 'IO::File', "getFileHandle()") or diag("The getFileHandle() call failed.");
+
+=end testing
+
+=cut
+
+sub getFileHandle {
+    # Extract arguments.
+    my ($self, %args) = @_;
+
+    # Log resolved arguments.
+    # Make Dumper format more terse.
+    $Data::Dumper::Terse = 1;
+    $Data::Dumper::Indent = 0;
+    $LOG->debug(Dumper(\%args));
+
+    return $self->YYData->{'file_handle'}; 
+}
+
-#######################################################################
-# Additional Module Documentation                                     #

honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry.t

@@ -87 +87 @@
-require_ok('Filesys::CygwinPaths');
-use Filesys::CygwinPaths qw(:all);
+
+# Make sure HoneyClient::Agent::Integrity::Registry::Parser loads
+BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry::Parser')
+        or diag("Can't load HoneyClient::Agent::Integrity::Registry::Parser package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('HoneyClient::Agent::Integrity::Registry::Parser');
+use HoneyClient::Agent::Integrity::Registry::Parser;
-}
-

honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry_parser.t

@@ -55 +55 @@
-use IO::File;
-
+# Make sure Fcntl loads
+BEGIN { use_ok('Fcntl')
+        or diag("Can't load Fcntl package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('Fcntl');
+use Fcntl qw(:seek);
+
-# Make sure HoneyClient::Agen