From 855768e1448e39012ea35964306f57586852f417 Mon Sep 17 00:00:00 2001 From: Alejandro Sirgo Rica Date: Tue, 10 Dec 2024 17:00:13 +0100 Subject: src: refactor windows hive code Remove usage of hivexget as a subprocess and use Python hivex to inspect the Windows Registry. Use registry path constants defined in src.utils.winreg Remove windows_is64bit() funcion as the code to identify the architecture relies on a broken Registry query. Fixing the query proved to be a challenge and the only implication is the removal of the string "64 bits" at the end of the listed Windows OS installed in each partition. Use utility function in src.utils.winreg to make the software inventory code more compact. Rewrite onliner in _fill_package_set function and parse the registry with a for loop. --- src/utils/probe.py | 65 ++++++++++++----------------------------------- src/utils/sw_inventory.py | 60 ++++++++++++++++++++++--------------------- 2 files changed, 47 insertions(+), 78 deletions(-) (limited to 'src') diff --git a/src/utils/probe.py b/src/utils/probe.py index ee9a08e..c8218f2 100644 --- a/src/utils/probe.py +++ b/src/utils/probe.py @@ -12,6 +12,7 @@ import platform import logging import sys +from src.utils.winreg import * from enum import Enum from subprocess import PIPE @@ -45,35 +46,23 @@ def getlinuxversion(osrelease): def getwindowsversion(winreghives): """ - Tries to obtain windows version information by - querying the SOFTWARE registry hive. Registry - hives path is a required parameter. - - Runs hivexget(1) to fetch ProductName and - ReleaseId. If something fails (hivexget is - not installed, or registry is not found) it - returns a generic "Microsoft Windows" string. + Try to obtain windows version information by querying the SOFTWARE registry + hive to fetch ProductName and ReleaseId. + Return a generic "Microsoft Windows" string if something fails. """ - # XXX: 3.6 friendly try: - proc_prodname = subprocess.run(['hivexget', - f'{winreghives}/SOFTWARE', - 'microsoft\windows nt\currentversion', - 'ProductName'], stdout=PIPE) - proc_releaseid = subprocess.run(['hivexget', - f'{winreghives}/SOFTWARE', - 'microsoft\windows nt\currentversion', - 'ReleaseId'], stdout=PIPE) - - prodname = proc_prodname.stdout.decode().replace('\n', '') - releaseid = proc_releaseid.stdout.decode().replace('\n', '') - bits = ' 64 bits' if windows_is64bit(winreghives) else '' - - if proc_prodname.returncode == 0 and proc_releaseid.returncode == 0: - return f'{prodname} {releaseid}{bits}' - except FileNotFoundError: # hivexget command not found - pass + hivepath = f'{winreghives}/SOFTWARE' + hive = hive_handler_open(hivepath, write = False) + root_node = hive.root() + version_node = get_node_child_from_path(hive, root_node, 'Microsoft/Windows NT/CurrentVersion') + + prodname = get_value_from_node(hive, version_node, 'ProductName') + releaseid = get_value_from_node(hive, version_node, 'ReleaseId') + + return f'{prodname} {releaseid}' + except (RuntimeError, OgError) as e: + logging.error(f'Hivex was not able to operate over {hivepath}. Reported: {e}') return 'Microsoft Windows' @@ -81,28 +70,6 @@ def interpreter_is64bit(): return sys.maxsize > 2**32 -def windows_is64bit(winreghives): - """ - Check for 64 bit Windows by means of retrieving the value of - ProgramW6432Dir. This key is set if Windows is running 64 bit. - - If set returns True. - If not set or hivexget exits with non-zero, returns False. - """ - try: - proc_hivexget = subprocess.run(['hivexget', - f'{winreghives}/SOFTWARE', - 'Microsoft\Windows\CurrentVersion', - 'ProgramW6432Dir'], stdout=PIPE) - stdout = proc_hivexget.stdout.decode().replace('\n', '') - - if proc_hivexget.returncode == 0 and stdout: - return True - except FileNotFoundError: # hivexget command not found - pass - return False - - def linux_is64bit(mountpoint): """ If /sbin/init is detected, check if compiled for 64-bit machine. @@ -174,7 +141,7 @@ def os_probe(mountpoint): Returns a string depending on the OS it detects. """ - winreghives = f'{mountpoint}/Windows/System32/config' + winreghives = f'{mountpoint}{WINDOWS_HIVES_PATH}' osrelease = f'{mountpoint}/etc/os-release' if os.path.exists(osrelease): diff --git a/src/utils/sw_inventory.py b/src/utils/sw_inventory.py index bcf9f09..ccb70fe 100644 --- a/src/utils/sw_inventory.py +++ b/src/utils/sw_inventory.py @@ -16,33 +16,39 @@ from collections import namedtuple import hivex from src.utils.probe import os_probe +from src.utils.winreg import * Package = namedtuple('Package', ['name', 'version']) Package.__str__ = lambda pkg: f'{pkg.name} {pkg.version}' -WINDOWS_HIVES_PATH = '/Windows/System32/config' -WINDOWS_HIVES_SOFTWARE = f'{WINDOWS_HIVES_PATH}/SOFTWARE' DPKG_STATUS_PATH = '/var/lib/dpkg/status' OSRELEASE_PATH = '/etc/os-release' -def _fill_package_set(h, key, pkg_set): +def _fill_package_set(hive, key, pkg_set): """ Fill the package set looking for entries at the current registry node childs. Any valid node child must have "DisplayVersion" or "DisplayName" keys. """ - childs = h.node_children(key) - valid_childs = [h.node_get_child(key, h.node_name(child)) - for child in childs - for value in h.node_values(child) if h.value_key(value) == 'DisplayVersion'] + childs = hive.node_children(key) + valid_childs = [] + for child in childs: + child_name = hive.node_name(child) + values = hive.node_values(child) + + for value in values: + if hive.value_key(value) == 'DisplayVersion': + valid_child = hive.node_get_child(key, child_name) + valid_childs.append(valid_child) + for ch in valid_childs: try: - name = h.value_string(h.node_get_value(ch, 'DisplayName')) - value = h.node_get_value(ch, 'DisplayVersion') - version = h.value_string(value) + name = hive.value_string(hive.node_get_value(ch, 'DisplayName')) + value = hive.node_get_value(ch, 'DisplayVersion') + version = hive.value_string(value) pkg = Package(name, version) pkg_set.add(pkg) except RuntimeError: @@ -50,22 +56,19 @@ def _fill_package_set(h, key, pkg_set): pass -def _fill_package_set_1(h, pkg_set): +def _fill_package_set_1(hive, pkg_set): """ Looks for entries in registry path /Microsoft/Windows/CurrentVersion/Uninstall Fills the given set with Package instances for each program found. """ - key = h.root() - key = h.node_get_child(key, 'Microsoft') - key = h.node_get_child(key, 'Windows') - key = h.node_get_child(key, 'CurrentVersion') - key = h.node_get_child(key, 'Uninstall') - _fill_package_set(h, key, pkg_set) + root_node = hive.root() + key = get_node_child_from_path(hive, root_node, 'Microsoft/Windows/CurrentVersion/Uninstall') + _fill_package_set(hive, key, pkg_set) -def _fill_package_set_2(h, pkg_set): +def _fill_package_set_32_bit_compat(hive, pkg_set): """ Looks for entries in registry path /Wow6432Node/Microsoft/Windows/CurrentVersion/Uninstall @@ -73,23 +76,22 @@ def _fill_package_set_2(h, pkg_set): Fills the given set with Package instances for each program found. """ - key = h.root() - key = h.node_get_child(key, 'Wow6432Node') - key = h.node_get_child(key, 'Microsoft') - key = h.node_get_child(key, 'Windows') - key = h.node_get_child(key, 'CurrentVersion') - key = h.node_get_child(key, 'Uninstall') - _fill_package_set(h, key, pkg_set) + root_node = hive.root() + key = get_node_child_from_path(hive, root_node, 'Wow6432Node/Windows/CurrentVersion/Uninstall') + _fill_package_set(hive, key, pkg_set) def _get_package_set_windows(hivepath): packages = set() try: - h = hivex.Hivex(hivepath) + h = hive_handler_open(hivepath, write = False) _fill_package_set_1(h, packages) - _fill_package_set_2(h, packages) - except RuntimeError as e: + except (RuntimeError, OgError) as e: logging.error(f'Hivex was not able to operate over {hivepath}. Reported: {e}') + try: + _fill_package_set_32_bit_compat(h, packages) + except (RuntimeError, OgError) as e: + pass return packages @@ -119,7 +121,7 @@ def _get_package_set_dpkg(dpkg_status_path): def get_package_set(mountpoint): dpkg_status_path = f'{mountpoint}{DPKG_STATUS_PATH}' - softwarehive = f'{mountpoint}{WINDOWS_HIVES_SOFTWARE}' + softwarehive = f'{mountpoint}{WINDOWS_HIVE_SOFTWARE}' if os.path.exists(softwarehive): pkgset = _get_package_set_windows(softwarehive) elif os.path.exists(dpkg_status_path): -- cgit v1.2.3-18-g5258