Class: RemoteRegistry

Inherits:
Object
  • Object
show all
Defined in:
lib/metadata/util/win32/remote-registry.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(fs, xml_class = MiqXml, reg_path = nil) ⇒ RemoteRegistry

Returns a new instance of RemoteRegistry.



13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 13

def initialize(fs, xml_class = MiqXml, reg_path = nil)
  @fileHnd = nil
  @HKLM_element = nil
  @loadedHives = []

  # Legacy check - xml_class use to be use_hash flag
  xml_class = XmlHash::Document if xml_class == true
  xml_class = MiqXml if xml_class == false

  # Create XML document
  @xml = xml_class.createDoc(:registry)
  @HKLM_element = @xml.root.add_element("HKEY_LOCAL_MACHINE")

  if fs.kind_of?(MiqFS)
    @fs = fs
    if reg_path.nil?
      path = Win32::SystemPath.registryPath(@fs) + "/"
      @RegPath = path.gsub(/^"/, "").gsub(/"$/, "")
    else
      @RegPath = reg_path
    end
  else
    @RegPath = fs
  end

  @fileLoadTime = nil
  @fileParseTime = nil

  @digitalProductKeys = []
end

Instance Attribute Details

#digitalProductKeys ⇒ Object (readonly)

Returns the value of attribute digitalProductKeys.



11
12
13
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 11

def digitalProductKeys
  @digitalProductKeys
end

#fileLoadTime ⇒ Object (readonly)

Returns the value of attribute fileLoadTime.



11
12
13
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 11

def fileLoadTime
  @fileLoadTime
end

#fileParseTime ⇒ Object (readonly)

Returns the value of attribute fileParseTime.



11
12
13
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 11

def fileParseTime
  @fileParseTime
end

#loadedHives ⇒ Object (readonly)

Return a list of loaded hives so the user can check if there hive is already available in the xml structure



142
143
144
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 142

def loadedHives
  @loadedHives
end

Instance Method Details

#close ⇒ Object 



44
45
46
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 44

def close
  @xml = nil
end

#loadBootHive(_filter = nil) ⇒ Object

Vista stores boot information in a registry hive in /boot/BCD



86
87
88
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 86

def loadBootHive(_filter = nil)
  loadHive("BCD", nil, "/boot")
end

#loadCurrentUser(filters = nil) ⇒ Object 



104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 104

def loadCurrentUser(filters = nil)
  xml = @xml
  users = []
  hkcu = loadHive("software", [{:key => "Microsoft/Windows NT/CurrentVersion/ProfileList", :value => ['ProfileImagePath']}])
  hkcu.root.each_recursive do |v|
    # Only process user accounts, not local system service accounts (like S-1-5-18)
    if v.name == :value && v.parent.attributes[:keyname].length > 8
      ntuser = File.join(v.text.tr('\\', '/'), 'ntuser.dat')
      users << {:path => ntuser, :mtime => @fs.fileMtime(ntuser).to_i} if @fs.fileExists?(ntuser)
    end
  end

  unless users.empty?
    # Sort so most recently updated is first
    users.sort! { |a, b| b[:mtime] <=> a[:mtime] }
    xmlNode = @xml.root.add_element("HKEY_CURRENT_USER")
    path, name = File.dirname(users.first[:path]), File.basename(users.first[:path])
    xml = process_hive(path, name, xmlNode, filters)
  end

  xml
end

#loadHive(name, filters = nil, path = @RegPath) ⇒ Object 



90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 90

def loadHive(name, filters = nil, path = @RegPath)
  xml = @xml
  unless @loadedHives.include?(name.downcase)
    if name.downcase == "default"
      xmlNode = @xml.root.add_element("HKEY_USERS").add_element("_DEFAULT")
    else
      xmlNode = @HKLM_element.add_element(name.upcase)
    end
    xml = process_hive(path, name, xmlNode, filters)
    @loadedHives.push(name.downcase)
  end
  xml
end

#loadSAMHive(filter = nil) ⇒ Object 



81
82
83
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 81

def loadSAMHive(filter = nil)
  loadHive("SAM", filter)
end

#loadSecurityHive(filter = nil) ⇒ Object 



77
78
79
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 77

def loadSecurityHive(filter = nil)
  loadHive("security", filter)
end

#loadSoftwareHive(filter = nil) ⇒ Object 



69
70
71
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 69

def loadSoftwareHive(filter = nil)
  loadHive("software", filter)
end

#loadSystemHive(filter = nil) ⇒ Object 



73
74
75
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 73

def loadSystemHive(filter = nil)
  loadHive("system", filter)
end

#open(key, subkey) ⇒ Object 



58
59
60
61
62
63
64
65
66
67
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 58

def open(key, subkey)
  paths = subkey.tr("\\", "/").split("/")
  if key == HKEY_LOCAL_MACHINE
    # $log.debug "Loading hive: #{paths[0].downcase}"
    loadHive(paths[0].downcase, nil)
    paths.insert(0, key)
    # $log.debug "Search paths: #{paths} #{paths.length}"
    return MIQRexml.findRegElementInt(paths, @xml.root)
  end
end

#process_hive(path, name, xmlNode, filters) ⇒ Object 



127
128
129
130
131
132
133
134
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 127

def process_hive(path, name, xmlNode, filters)
  defaultHive = MSRegHive.new(path, name.downcase, xmlNode, @fs, filters)
  defaultHive.parseHives
  @fileLoadTime, @fileParseTime = defaultHive.fileLoadTime, defaultHive.fileParseTime
  @digitalProductKeys = defaultHive.digitalProductKeys
  $log.debug "Hive parsing complete in [#{@fileLoadTime + @fileParseTime}] seconds"
  defaultHive.xmlNode
end

#processRegistryAll ⇒ Object 



48
49
50
51
52
53
54
55
56
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 48

def processRegistryAll
  # Load Major hives
  loadSoftwareHive
  loadSystemHive
  loadDefaultHive
  loadSecurityHive
  loadSAMHive
  @xml
end

#toXML ⇒ Object 



136
137
138
 
# File 'lib/metadata/util/win32/remote-registry.rb', line 136

def toXML
  @xml
end