No OneTemporary
Actions

Size

24 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/trunk/datareporterengine.cpp b/trunk/datareporterengine.cpp
	index 0543710..0b8808e 100644
	--- a/trunk/datareporterengine.cpp
	+++ b/trunk/datareporterengine.cpp
	@@ -1,196 +1,203 @@
	/*******************************************************************************
	* fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu> *
	* *
	* Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor *
	* with special feautures useful during forensic analysis. *
	* *
	* This program is free software: you can redistribute it and/or modify it *
	* under the terms of the GNU General Public License as published by the Free *
	* Software Foundation, either version 3 of the License, or (at your option) *
	* any later version. *
	* *
	* This program is distributed in the hope that it will be useful, but WITHOUT *
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or *
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for *
	* more details. *
	* *
	* You should have received a copy of the GNU General Public License along with *
	* this program. If not, see <http://www.gnu.org/licenses/>. *
	*******************************************************************************/

	#include "datareporterengine.h"

	#include <QString>

	DataReporterEngine::DataReporterEngine(RegistryHive *p_hive) : QScriptEngine() {
	// Init vars
	this->p_registry_hive=p_hive;
	this->report_content="";

	// Add our types to engine
	qScriptRegisterMetaType<s_RegistryKeyValue>(this,
	this->RegistryKeyValueToScript,
	this->RegistryKeyValueFromScript);
	this->p_type_byte_array=new ByteArray(this);
	this->globalObject().setProperty("ByteArray",
	this->p_type_byte_array->constructor());

	// Add our functions
	// print
	QScriptValue func_print=this->newFunction(this->Print);
	this->globalObject().setProperty("print",func_print);
	// println
	QScriptValue func_println=this->newFunction(this->PrintLn);
	this->globalObject().setProperty("println",func_println);
	// GetRegistryKeyValue
	QScriptValue func_get_key_value=this->newFunction(this->GetRegistryKeyValue);
	func_get_key_value.setData(this->newQObject(this->p_registry_hive));
	this->globalObject().setProperty("GetRegistryKeyValue",func_get_key_value);
	+
	+ /*
	// RegistryKeyValueToString
	QScriptValue func_value_to_string=
	this->newFunction(this->RegistryKeyValueToString);
	this->globalObject().setProperty("RegistryKeyValueToString",
	func_value_to_string);
	// RegistryKeyTypeToString
	QScriptValue func_type_to_string=
	this->newFunction(this->RegistryKeyTypeToString);
	this->globalObject().setProperty("RegistryKeyTypeToString",
	func_type_to_string);
	+ */
	+
	+ // Add RegistryHive object
	+ QScriptValue obj_registry_hive=this->newQObject(this->p_registry_hive);
	+ this->globalObject().setProperty("RegistryHive",obj_registry_hive);
	}

	DataReporterEngine::~DataReporterEngine() {
	delete this->p_type_byte_array;
	}

	QScriptValue DataReporterEngine::Print(QScriptContext *context,
	QScriptEngine *engine)
	{
	int i;
	QString content;

	// Append all arguments to content
	for(i=0;i<context->argumentCount();++i) {
	if(i>0) content.append(" ");
	content.append(context->argument(i).toString());
	}

	//QScriptValue calleeData=context->callee().data();
	//DataReporterEngine *engine=
	// qobject_cast<DataReporterEngine*>(calleeData.toQObject());
	qobject_cast<DataReporterEngine*>(engine)->report_content.append(content);

	return engine->undefinedValue();
	}

	QScriptValue DataReporterEngine::PrintLn(QScriptContext *context,
	QScriptEngine *engine)
	{
	int i;
	QString content;

	// Append all arguments to content
	for(i=0;i<context->argumentCount();++i) {
	if(i>0) content.append(" ");
	content.append(context->argument(i).toString());
	}

	qobject_cast<DataReporterEngine*>(engine)->
	report_content.append(content).append("\n");

	return engine->undefinedValue();
	}

	/*
	* RegistryKeyValueToScript
	*/
	QScriptValue DataReporterEngine::RegistryKeyValueToScript(QScriptEngine *engine,
	const
	s_RegistryKeyValue
	&s)
	{
	QScriptValue obj=engine->newObject();
	obj.setProperty("type",s.type);
	obj.setProperty("length",s.length);
	ByteArray *p_byte_array=new ByteArray(engine);
	obj.setProperty("value",p_byte_array->newInstance(s.value));
	return obj;
	}

	/*
	* RegistryKeyValueFromScriptValue
	*/
	void DataReporterEngine::RegistryKeyValueFromScript(const QScriptValue &obj,
	s_RegistryKeyValue &s)
	{
	s.type=obj.property("type").toInt32();
	s.length=obj.property("length").toInt32();
	// TODO: Don't know if this works
	s.value=obj.property("value").toVariant().toByteArray();
	}

	QScriptValue DataReporterEngine::GetRegistryKeyValue(QScriptContext *context,
	QScriptEngine *engine)
	{
	QScriptValue calleeData;
	RegistryHive *p_hive;
	QByteArray key_value;
	int key_type=0;
	size_t key_length=0;
	s_RegistryKeyValue script_key_value;

	// This function needs two arguments, key path and key name
	if(context->argumentCount()!=2) return engine->undefinedValue();

	// Get calle data (Pointer to RegistryHive class)
	calleeData=context->callee().data();
	p_hive=qobject_cast<RegistryHive*>(calleeData.toQObject());

	// Get key value
	key_value=p_hive->GetKeyValue(context->argument(0).toString(),
	context->argument(1).toString(),
	&key_type,
	&key_length);
	if(p_hive->Error() \|\| key_length==-1) {
	// Get error message ro clear error state
	p_hive->GetErrorMsg();
	return engine->undefinedValue();
	}

	// Save key value to s_RegistryKeyValue struct
	script_key_value.type=key_type;
	script_key_value.length=key_length;
	script_key_value.value=key_value;

	return DataReporterEngine::RegistryKeyValueToScript(engine,script_key_value);
	}

	QScriptValue DataReporterEngine::RegistryKeyValueToString(
	QScriptContext *context,
	QScriptEngine *engine)
	{
	QByteArray key_value;
	QString ret="";

	// This function needs two arguments, key value and value type
	if(context->argumentCount()!=2) return engine->undefinedValue();

	// TODO: Does not work!!
	- //key_value=qscriptvalue_cast<QByteArray>(context->argument(0));
	- key_value=context->argument(0).toVariant().toByteArray();
	+ key_value=qscriptvalue_cast<QByteArray>(context->argument(0));
	+ //key_value=context->argument(0).toVariant().toByteArray();
	ret=RegistryHive::KeyValueToString(key_value,
	hive_t_REG_SZ /context->argument(1).toInteger()/);

	qDebug("Type: %u Sring: %c",
	context->argument(1).toInteger(),
	ret.toAscii().constData());

	return engine->newVariant(ret);
	}

	QScriptValue DataReporterEngine::RegistryKeyTypeToString(
	QScriptContext *context,
	QScriptEngine *engine)
	{
	// This function needs one arguments, key type
	if(context->argumentCount()!=2) return engine->undefinedValue();
	}
	diff --git a/trunk/registryhive.cpp b/trunk/registryhive.cpp
	index b50b46f..65b806c 100644
	--- a/trunk/registryhive.cpp
	+++ b/trunk/registryhive.cpp
	@@ -1,459 +1,459 @@
	/*******************************************************************************
	* fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu> *
	* *
	* Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor *
	* with special feautures useful during forensic analysis. *
	* *
	* This program is free software: you can redistribute it and/or modify it *
	* under the terms of the GNU General Public License as published by the Free *
	* Software Foundation, either version 3 of the License, or (at your option) *
	* any later version. *
	* *
	* This program is distributed in the hope that it will be useful, but WITHOUT *
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or *
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for *
	* more details. *
	* *
	* You should have received a copy of the GNU General Public License along with *
	* this program. If not, see <http://www.gnu.org/licenses/>. *
	*******************************************************************************/

	#include "registryhive.h"

	#include <QStringList>

	#include <stdlib.h>

	/*
	* RegistryHive
	*/
	RegistryHive::RegistryHive(QObject *p_parent) : QObject(p_parent) {
	this->erro_msg="";
	this->is_error=false;
	this->hive_file="";
	this->p_hive=NULL;
	this->is_hive_open=false;
	}

	/*
	* ~RegistryHive
	*/
	RegistryHive::~RegistryHive() {
	if(this->is_hive_open) this->Close();
	}

	/*
	* Error
	*/
	bool RegistryHive::Error() {
	return this->is_error;
	}

	/*
	* GetErrorMsg
	*/
	QString RegistryHive::GetErrorMsg() {
	QString msg=this->erro_msg;
	this->erro_msg="";
	this->is_error=false;
	return msg;
	}

	/*
	* Open
	*/
	bool RegistryHive::Open(QString file, bool read_only) {
	if(this->is_hive_open) return false;

	// Open hive file
	this->p_hive=hivex_open(file.toAscii().constData(),
	read_only ? 0 : HIVEX_OPEN_WRITE);
	if(this->p_hive==NULL) return false;

	// Set local vars
	this->hive_file=file;
	this->is_hive_open=true;

	return true;
	}

	/*
	* Close
	*/
	bool RegistryHive::Close(bool commit_changes) {
	if(this->is_hive_open) {
	if(commit_changes) {
	// Commit changes before closing hive.
	// TODO: Maybe it would be more secure to commit changes to a new file and
	// then move it over the original one.
	hivex_commit(this->p_hive,NULL,0);
	}

	// As hivex_close will _ALWAYS_ free the handle, we don't need the following
	// values anymore
	this->hive_file="";
	this->is_hive_open=false;

	// Close hive
	if(hivex_close(this->p_hive)!=0) return false;
	}
	return true;
	}

	/*
	* GetNodes
	*/
	QMap<QString,int> RegistryHive::GetNodes(QString path) {
	hive_node_h parent_node;

	// Get handle to last node in path
	if(!this->GetNodeHandle(path,&parent_node)) return QMap<QString,int>();

	// Get and return nodes
	return this->GetNodesHelper(parent_node);
	}

	/*
	* GetNodes
	*/
	QMap<QString,int> RegistryHive::GetNodes(int parent_node) {
	if(parent_node==0) {
	this->SetError(tr("Invalid parent node handle specified!"));
	return QMap<QString,int>();
	}

	// Get and return nodes
	return this->GetNodesHelper(parent_node);
	}

	/*
	* GetKeys
	*/
	QMap<QString,int> RegistryHive::GetKeys(QString path) {
	hive_node_h parent_node;

	// Get handle to last node in path
	if(!this->GetNodeHandle(path,&parent_node)) return QMap<QString,int>();

	// Get and return keys
	return this->GetKeysHelper(parent_node);
	}

	/*
	* GetKeys
	*/
	QMap<QString,int> RegistryHive::GetKeys(int parent_node) {
	if(parent_node==0) {
	this->SetError(tr("Invalid parent node handle specified!"));
	return QMap<QString,int>();
	}

	// Get and return keys
	return this->GetKeysHelper(parent_node);
	}

	/*
	* GetKeyValue
	*/
	QByteArray RegistryHive::GetKeyValue(QString path,
	QString key,
	int *p_value_type,
	size_t *p_value_len)
	{
	hive_node_h parent_node;
	hive_value_h hive_key;

	// Get handle to last node in path
	if(!this->GetNodeHandle(path,&parent_node)) return QByteArray();

	// Get key handle
	hive_key=hivex_node_get_value(this->p_hive,
	parent_node,key.toAscii().constData());
	if(hive_key==0) {
	this->SetError(tr("Unable to get key handle!"));
	*p_value_len=-1;
	return QByteArray();
	}

	// Get and return key value
	return this->GetKeyValueHelper(hive_key,p_value_type,p_value_len);
	}

	/*
	* GetKeyValue
	*/
	QByteArray RegistryHive::GetKeyValue(int hive_key,
	int *p_value_type,
	size_t *p_value_len)
	{
	if(hive_key==0) {
	this->SetError(tr("Invalid key handle specified!"));
	*p_value_type=-1;
	return QByteArray();
	}

	// Get and return key value
	return this->GetKeyValueHelper(hive_key,p_value_type,p_value_len);
	}

	/*
	* KeyValueToString
	*/
	-QString RegistryHive::KeyValueToString(QByteArray &value, int value_type) {
	+QString RegistryHive::KeyValueToString(QByteArray value, int value_type) {
	QString ret="";
	int i=0;

	#define ToHexStr() { \
	for(i=0;i<value.size();i++) { \
	ret.append(QString().sprintf("%02X ",(uint8_t)(value.constData()[i]))); \
	} \
	ret.chop(1); \
	}

	switch(value_type) {
	case hive_t_REG_NONE:
	// Just a key without a value, but to be certain...
	ToHexStr();
	break;
	case hive_t_REG_SZ:
	// A Windows string (encoding is unknown, but often UTF16-LE)
	// TODO: What happens if encoding is not UTF16-LE ??? Thx Billy!!!
	ret=value.size() ? QString().fromUtf16((ushort*)(value.constData())) : "";
	break;
	case hive_t_REG_EXPAND_SZ:
	// A Windows string that contains %env% (environment variable expansion)
	ret=value.size() ? QString().fromUtf16((ushort*)(value.constData())) : "";
	break;
	case hive_t_REG_BINARY:
	// A blob of binary
	ToHexStr();
	break;
	case hive_t_REG_DWORD:
	// DWORD (32 bit integer), little endian
	ret=QString().sprintf("0x%08X",(uint32_t)value.constData());
	//ret=QString().sprintf("0x%08X",value.toUInt());
	break;
	case hive_t_REG_DWORD_BIG_ENDIAN:
	// DWORD (32 bit integer), big endian
	ret=QString().sprintf("0x%08X",(uint32_t)value.constData());
	//ret=QString().sprintf("0x%08X",value.toUInt());
	break;
	case hive_t_REG_LINK:
	// Symbolic link to another part of the registry tree
	ToHexStr();
	break;
	case hive_t_REG_MULTI_SZ:
	// Multiple Windows strings.
	// See http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx
	ToHexStr();
	break;
	case hive_t_REG_RESOURCE_LIST:
	// Resource list
	ToHexStr();
	break;
	case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
	// Resource descriptor
	ToHexStr();
	break;
	case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
	// Resouce requirements list
	ToHexStr();
	break;
	case hive_t_REG_QWORD:
	// QWORD (64 bit integer). Usually little endian.
	ret=QString().sprintf("0x%016X",(uint64_t)value.constData());
	//ret=QString().sprintf("0x%08X",value.toULongLong());
	break;
	default:
	ToHexStr();
	}

	#undef ToHexStr

	return ret;
	}

	/*
	* KeyTypeToString
	*/
	QString RegistryHive::KeyTypeToString(int value_type) {
	QString ret="";

	switch(value_type) {
	case hive_t_REG_NONE:
	ret="REG_NONE";
	break;
	case hive_t_REG_SZ:
	ret="REG_SZ";
	break;
	case hive_t_REG_EXPAND_SZ:
	ret="REG_EXPAND_SZ";
	break;
	case hive_t_REG_BINARY:
	ret="REG_BINARY";
	break;
	case hive_t_REG_DWORD:
	ret="REG_DWORD";
	break;
	case hive_t_REG_DWORD_BIG_ENDIAN:
	ret="REG_DWORD_BIG_ENDIAN";
	break;
	case hive_t_REG_LINK:
	ret="REG_LINK";
	break;
	case hive_t_REG_MULTI_SZ:
	ret="REG_MULTI_SZ";
	break;
	case hive_t_REG_RESOURCE_LIST:
	ret="REG_RESOURCE_LIST";
	break;
	case hive_t_REG_FULL_RESOURCE_DESCRIPTOR:
	ret="REG_FULL_RESOURCE_DESC";
	break;
	case hive_t_REG_RESOURCE_REQUIREMENTS_LIST:
	ret="REG_RESOURCE_REQ_LIST";
	break;
	case hive_t_REG_QWORD:
	ret="REG_QWORD";
	break;
	default:
	ret=QString().sprintf("0x%08X",(uint32_t)value_type);
	}

	return ret;
	}

	/*
	* SetError
	*/
	void RegistryHive::SetError(QString msg) {
	this->erro_msg=msg;
	this->is_error=true;
	}

	/*
	* GetNodeHandle
	*/
	bool RegistryHive::GetNodeHandle(QString &path, hive_node_h *p_node) {
	QStringList nodes;
	int i=0;

	// Get root node handle
	*p_node=hivex_root(this->p_hive);
	if(*p_node==0) {
	this->SetError(tr("Unable to get root node!"));
	return false;
	}

	if(path!="\\") {
	// If we aren't listing the root node, we have to get a handle to the
	// last node in the path. Split path into nodes
	nodes=path.split('\\',QString::SkipEmptyParts);

	// Iterate to the correct parent node
	for(i=0;i<nodes.count();i++) {
	*p_node=hivex_node_get_child(this->p_hive,
	*p_node,
	nodes.value(i).toAscii().constData());
	if(*p_node==0) {
	this->SetError(tr("Unable to find node '%1'!").arg(nodes.value(i)));
	return false;
	}
	}
	}

	return true;
	}

	/*
	* GetNodesHelper
	*/
	QMap<QString,int> RegistryHive::GetNodesHelper(hive_node_h parent_node) {
	QMap<QString,int> keys;
	char *p_name;
	int i=0;

	// Get child nodes
	hive_node_h *child_nodes=hivex_node_children(this->p_hive,parent_node);
	if(child_nodes==NULL) {
	this->SetError(
	tr("Unable to enumerate child nodes!"));
	return QMap<QString,int>();
	}

	// Build result
	keys.clear();
	i=0;
	while(child_nodes[i]) {
	p_name=hivex_node_name(this->p_hive,child_nodes[i]);
	if(p_name==NULL) {
	this->SetError(tr("Unable to get node name!"));
	free(child_nodes);
	return QMap<QString,int>();
	}
	keys.insert(QString(p_name),(int)child_nodes[i]);
	free(p_name);
	i++;
	}
	free(child_nodes);

	return keys;
	}

	/*
	* GetKeysHelper
	*/
	QMap<QString,int> RegistryHive::GetKeysHelper(hive_node_h parent_node) {
	QMap<QString,int> keys;
	char *p_name;
	int i=0;

	// Get child keys
	hive_value_h *p_keys=hivex_node_values(this->p_hive,parent_node);
	if(p_keys==NULL) {
	this->SetError(
	tr("Unable to enumerate child keys!"));
	return QMap<QString,int>();
	}

	// Build result list
	keys.clear();
	i=0;
	while(p_keys[i]) {
	p_name=hivex_value_key(this->p_hive,p_keys[i]);
	if(p_name==NULL) {
	this->SetError(tr("Unable to get key name!"));
	return QMap<QString,int>();
	}
	keys.insert(QString(p_name),p_keys[i]);
	free(p_name);
	i++;
	}
	free(p_keys);

	return keys;
	}

	QByteArray RegistryHive::GetKeyValueHelper(hive_value_h hive_key,
	int *p_value_type,
	size_t *p_value_len)
	{
	QByteArray key_value;
	char *p_key_value;

	p_key_value=hivex_value_value(this->p_hive,
	hive_key,
	(hive_type*)p_value_type,
	p_value_len);
	if(p_key_value==NULL) {
	this->SetError(tr("Unable to get key value!"));
	*p_value_type=-1;
	return QByteArray();
	}

	// Feed QByteArray and free p_key_value
	key_value=QByteArray(p_key_value,*p_value_len);
	free(p_key_value);

	return key_value;
	}
	diff --git a/trunk/registryhive.h b/trunk/registryhive.h
	index dde94a5..9230c1a 100644
	--- a/trunk/registryhive.h
	+++ b/trunk/registryhive.h
	@@ -1,73 +1,74 @@
	/*******************************************************************************
	* fred Copyright (c) 2011 by Gillen Daniel <gillen.dan@pinguin.lu> *
	* *
	* Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor *
	* with special feautures useful during forensic analysis. *
	* *
	* This program is free software: you can redistribute it and/or modify it *
	* under the terms of the GNU General Public License as published by the Free *
	* Software Foundation, either version 3 of the License, or (at your option) *
	* any later version. *
	* *
	* This program is distributed in the hope that it will be useful, but WITHOUT *
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or *
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for *
	* more details. *
	* *
	* You should have received a copy of the GNU General Public License along with *
	* this program. If not, see <http://www.gnu.org/licenses/>. *
	*******************************************************************************/

	#ifndef REGISTRYHIVE_H
	#define REGISTRYHIVE_H

	#include <QObject>
	#include <QMap>

	#include <hivex.h>

	class RegistryHive : public QObject {
	Q_OBJECT

	public:
	explicit RegistryHive(QObject *p_parent=0);
	~RegistryHive();

	bool Error();
	QString GetErrorMsg();

	bool Open(QString file, bool read_only=true);
	bool Close(bool commit_changes=false);

	QMap<QString,int> GetNodes(QString path="\\");
	QMap<QString,int> GetNodes(int parent_node=0);
	QMap<QString,int> GetKeys(QString path="\\");
	QMap<QString,int> GetKeys(int parent_node=0);
	QByteArray GetKeyValue(QString path,
	QString key,
	int *p_value_type,
	size_t *p_value_len);
	QByteArray GetKeyValue(int hive_key,
	int *p_value_type,
	size_t *p_value_len);
	- static QString KeyValueToString(QByteArray &value, int value_type);
	- static QString KeyTypeToString(int value_type);
	+ Q_INVOKABLE static QString KeyValueToString(QByteArray value,
	+ int value_type);
	+ Q_INVOKABLE static QString KeyTypeToString(int value_type);

	private:
	QString erro_msg;
	bool is_error;
	QString hive_file;
	hive_h *p_hive;
	bool is_hive_open;

	void SetError(QString msg);
	bool GetNodeHandle(QString &path, hive_node_h *p_node);
	QMap<QString,int> GetNodesHelper(hive_node_h parent_node);
	QMap<QString,int> GetKeysHelper(hive_node_h parent_node);
	QByteArray GetKeyValueHelper(hive_value_h hive_key,
	int *p_value_type,
	size_t *p_value_len);

	};

	#endif // REGISTRYHIVE_H
	diff --git a/trunk/report_templates/SOFTWARE_WindowsVersion.js b/trunk/report_templates/SOFTWARE_WindowsVersion.js
	index 5c7d44d..503f80c 100644
	--- a/trunk/report_templates/SOFTWARE_WindowsVersion.js
	+++ b/trunk/report_templates/SOFTWARE_WindowsVersion.js
	@@ -1,19 +1,18 @@
	println("<html>");
	println(" <head><title>Windows version info</title></head>");
	println(" <body>");
	println(" <h2>Windows version info</h2>");
	println(" <p>");

	var val=GetRegistryKeyValue("\\Microsoft\\Windows NT\\CurrentVersion","ProductName");

	print("ProductVersion: ");
	-var str_value=RegistryKeyValueToString(val.value,val.type);
	-println(str_value);
	+println(RegistryHive.KeyValueToString(val.value,1));

	println(" </p>");
	println("</html>");

	//for(var i=0;i<(val.length-1);i+=2) {
	// print(String.fromCharCode(val.value[i]));
	//}

File Metadata

Mime Type: text/x-diff
Expires: Tue, Dec 24, 3:13 AM (1 d, 8 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1177000
Default Alt Text: (24 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions