[213] | 1 | #!/usr/bin/env python3 |
---|
[197] | 2 | |
---|
| 3 | import sys |
---|
[213] | 4 | import gc |
---|
[215] | 5 | import time |
---|
[197] | 6 | import pyregfi |
---|
| 7 | |
---|
[213] | 8 | def usage(): |
---|
| 9 | sys.stderr.write("USAGE: pyregfi-smoketest.py hive1 [hive2 ...]\n") |
---|
[197] | 10 | |
---|
| 11 | |
---|
[215] | 12 | # helper function |
---|
| 13 | def getCurrentPath(key): |
---|
| 14 | if key == None: |
---|
| 15 | return '' |
---|
| 16 | path = [] |
---|
| 17 | p = key |
---|
| 18 | while p != None: |
---|
| 19 | path.append(p.name) |
---|
[218] | 20 | p = p.get_parent() |
---|
[215] | 21 | path.reverse() |
---|
| 22 | del path[0] |
---|
| 23 | |
---|
| 24 | return path |
---|
| 25 | |
---|
| 26 | |
---|
[213] | 27 | # Uses the HiveIterator to walk all keys |
---|
| 28 | # Gathers various (meaningless) statistics to exercise simple attribute access |
---|
| 29 | # and to hopefully smoke out any bugs that can be identified by changing stats |
---|
[216] | 30 | def iterTallyNames(hive): |
---|
[213] | 31 | key_count = 0 |
---|
| 32 | key_lens = 0 |
---|
| 33 | key_rawlens = 0 |
---|
| 34 | value_count = 0 |
---|
| 35 | value_lens = 0 |
---|
| 36 | value_rawlens = 0 |
---|
[197] | 37 | |
---|
[213] | 38 | for k in hive: |
---|
| 39 | key_count += 1 |
---|
| 40 | if k.name != None: |
---|
| 41 | key_lens += len(k.name) |
---|
| 42 | if k.name_raw != None: |
---|
| 43 | key_rawlens += len(k.name_raw) |
---|
[199] | 44 | |
---|
[213] | 45 | for v in k.values: |
---|
| 46 | value_count += 1 |
---|
| 47 | if v.name != None: |
---|
| 48 | value_lens += len(v.name) |
---|
| 49 | if v.name_raw != None: |
---|
| 50 | value_rawlens += len(v.name_raw) |
---|
[200] | 51 | |
---|
[214] | 52 | print(" Counts: keys=%d, values=%d" % (key_count, value_count)) |
---|
| 53 | print(" Total name length: keys=%d, values=%d" % (key_lens, value_lens)) |
---|
| 54 | print(" Total raw name lengths: keys=%d, values=%d" % (key_rawlens, value_rawlens)) |
---|
[200] | 55 | |
---|
[209] | 56 | |
---|
[215] | 57 | # For each key in the hive, this traverses the parent links up to the root, |
---|
| 58 | # recording the path as it goes, and then uses the subtree/descend method |
---|
| 59 | # to find the same key again, verifying it is the same. This test is currently |
---|
| 60 | # very slow because no key caching is used. |
---|
| 61 | def iterParentWalk(hive): |
---|
| 62 | i = 1 |
---|
| 63 | for k in hive: |
---|
| 64 | path = getCurrentPath(k) |
---|
| 65 | try: |
---|
| 66 | hive_iter = hive.subtree(path) |
---|
| 67 | if hive_iter.current_key() != k: |
---|
| 68 | print("WARNING: k != current_key for path '%s'." % path) |
---|
| 69 | else: |
---|
| 70 | i += 1 |
---|
| 71 | except Exception as e: |
---|
| 72 | print("WARNING: Could not decend to path '%s'.\nError:\n %s\n%s" % (path,e.args,e)) |
---|
| 73 | print(" Successfully tested paths on %d keys." % i) |
---|
[209] | 74 | |
---|
[215] | 75 | |
---|
[216] | 76 | # Uses the HiveIterator to walk all keys |
---|
| 77 | # Gathers various (meaningless) statistics about data/data_raw attributes |
---|
| 78 | def iterTallyData(hive): |
---|
| 79 | data_stat = 0.0 |
---|
| 80 | dataraw_stat = 0.0 |
---|
| 81 | |
---|
| 82 | for k in hive: |
---|
| 83 | for v in k.values: |
---|
[219] | 84 | d = v.fetch_data() |
---|
[216] | 85 | if d == None: |
---|
| 86 | data_stat += 0.1 |
---|
| 87 | elif hasattr(d, "__len__"): |
---|
| 88 | data_stat += len(d) |
---|
| 89 | else: |
---|
| 90 | data_stat += d/2.0**64 |
---|
| 91 | |
---|
[219] | 92 | d = v.fetch_raw_data() |
---|
[216] | 93 | if d == None: |
---|
| 94 | dataraw_stat += 0.1 |
---|
| 95 | else: |
---|
| 96 | dataraw_stat += len(d) |
---|
| 97 | |
---|
| 98 | print(" Data stat: %f" % data_stat) |
---|
| 99 | print(" Raw data stat: %f" % dataraw_stat) |
---|
| 100 | |
---|
| 101 | |
---|
[217] | 102 | recurseKey_stat = 0.0 |
---|
| 103 | recurseValue_stat = 0.0 |
---|
| 104 | def checkValues(key): |
---|
| 105 | global recurseKey_stat |
---|
| 106 | global recurseValue_stat |
---|
| 107 | recurseKey_stat += (key.mtime.low^key.mtime.high - key.max_bytes_subkeyname) * key.flags |
---|
| 108 | for v in key.values: |
---|
| 109 | recurseValue_stat += (v.data_off - v.data_size) / (1.0 + v.flags) + v.data_in_offset |
---|
| 110 | value = key.values[v.name] |
---|
| 111 | if v != value: |
---|
| 112 | print("WARNING: iterator value '%s' does not match dictionary value '%s'." |
---|
| 113 | % (v.name, value.name)) |
---|
[216] | 114 | |
---|
[217] | 115 | def recurseTree(cur, operation): |
---|
| 116 | for k in cur.subkeys: |
---|
| 117 | key = cur.subkeys[k.name] |
---|
| 118 | if k != key: |
---|
| 119 | print("WARNING: iterator subkey '%s' does not match dictionary subkey '%s'." |
---|
| 120 | % (k.name, key.name)) |
---|
| 121 | del key |
---|
| 122 | operation(k) |
---|
| 123 | recurseTree(k, operation) |
---|
| 124 | |
---|
| 125 | # Retrieves all keys by recursion, rather than the iterator, and validates |
---|
| 126 | # list dictionary access. Also builds nonsensical statistics as an excuse |
---|
| 127 | # to access various base structure attributes. |
---|
| 128 | def recurseKeyTally(hive): |
---|
[218] | 129 | checkValues(hive.root) |
---|
| 130 | recurseTree(hive.root, checkValues) |
---|
[217] | 131 | print(" Key stat: %f" % recurseKey_stat) |
---|
| 132 | print(" Value stat: %f" % recurseValue_stat) |
---|
| 133 | |
---|
| 134 | |
---|
[219] | 135 | # Iterates hive gathering stats about security and classname records |
---|
| 136 | def iterFetchRelated(hive): |
---|
| 137 | security_stat = 0.0 |
---|
| 138 | classname_stat = 0.0 |
---|
| 139 | modified_stat = 0.0 |
---|
| 140 | |
---|
| 141 | for k in hive: |
---|
| 142 | cn = k.fetch_classname() |
---|
| 143 | if cn == None: |
---|
| 144 | classname_stat += 0.000001 |
---|
| 145 | elif type(cn) == bytearray: |
---|
| 146 | classname_stat += len(cn)/2**32 |
---|
| 147 | else: |
---|
| 148 | classname_stat += len(cn) |
---|
| 149 | |
---|
| 150 | modified_stat += k.modified |
---|
| 151 | |
---|
| 152 | print(" Security stat: %f" % security_stat) |
---|
| 153 | print(" Classname stat: %f" % classname_stat) |
---|
| 154 | print(" Modified stat: %f" % modified_stat) |
---|
| 155 | |
---|
[213] | 156 | if len(sys.argv) < 2: |
---|
| 157 | usage() |
---|
| 158 | sys.exit(1) |
---|
[209] | 159 | |
---|
[215] | 160 | |
---|
[219] | 161 | #tests = [("iterTallyNames",iterTallyNames),("iterParentWalk",iterParentWalk),("iterTallyData",iterTallyData),("recurseKeyTally",recurseKeyTally),("iterFetchRelated",iterFetchRelated),] |
---|
| 162 | tests = [("iterFetchRelated",iterFetchRelated),] |
---|
[215] | 163 | |
---|
[213] | 164 | files = [] |
---|
| 165 | for f in sys.argv[1:]: |
---|
| 166 | files.append((f, open(f,"r+b"))) |
---|
| 167 | |
---|
| 168 | |
---|
[215] | 169 | start_time = time.time() |
---|
[213] | 170 | for hname,fh in files: |
---|
| 171 | hive = pyregfi.Hive(fh) |
---|
| 172 | for tname,t in tests: |
---|
[215] | 173 | teststart = time.time() |
---|
[213] | 174 | tstr = "'%s' on '%s'" % (tname,hname) |
---|
| 175 | print("##BEGIN %s:" % tstr) |
---|
| 176 | t(hive) |
---|
[215] | 177 | print("##END %s; runtime=%f; messages:" % (tstr, time.time() - teststart)) |
---|
[213] | 178 | print(pyregfi.GetLogMessages()) |
---|
| 179 | print |
---|
[215] | 180 | sys.stdout.flush() |
---|
[213] | 181 | |
---|
[215] | 182 | hive = None |
---|
[213] | 183 | files = None |
---|
| 184 | tests = None |
---|
| 185 | gc.collect() |
---|
[215] | 186 | print("### Tests Completed, runtime: %f ###" % (time.time() - start_time)) |
---|
[214] | 187 | #print(gc.garbage) |
---|