private IEnumerable <string> GetValuesForKeyEntity(RegistryObject registryObject, IEnumerable <string> elements)
{
List <string> values = new List <string>();
foreach (string startElement in elements)
{
List <string> elementsOfKey = startElement.Split(new string[] { "\\" }, StringSplitOptions.RemoveEmptyEntries).ToList <string>();
string key = "";
if (elementsOfKey.Count() > 1)
{
elementsOfKey.Remove(elementsOfKey.First());
key = this.ConvertAStringWithSeparator(elementsOfKey, "\\");
}
IEnumerable <string> valuesToMatch = this.getSubKeys(registryObject.Hive, key);
if (valuesToMatch == null)
{
values.Add(startElement);
}
else
{
IEnumerable <string> valuesConcatenated = this.ConcatTheValuesOfKey(valuesToMatch, startElement);
values.AddRange(this.GetValuesForKeyEntity(registryObject, valuesConcatenated));
}
}
return(values);
}
private RegistryObject GetRegistryObject()
{
registry_object ovalRegistryObject = (registry_object)ProbeHelper.GetOvalComponentByOvalID(definitions, "oval:org.mitre.oval:obj:3000");
RegistryObject registry = RegistryObjectFactory.CreateRegistryObject(ovalRegistryObject);
return(registry);
}
private IEnumerable <ItemType> processOperationInRegistryObject(RegistryObject registryObject)
{
List <string> hives = new List <string>()
{
registryObject.Hive
};
RegistryItemTypeFactory itemTypeFactory = new RegistryItemTypeFactory();
List <ItemType> items = new List <ItemType>();
List <string> keys = new List <string>();
List <string> names = new List <string>();
try
{
var registryNameValue = registryObject.GetValueOfEntity("name");
keys.AddRange(this.processOperationInEntity(registry_object_ItemsChoices.key, registryObject));
var derivedRegistryObjects =
RegistryObjectFactory.CreateRegistryObjectsByCombinationOfEntitiesFrom(hives, keys, new string[] { registryNameValue }, registryObject);
if (registryObject.GetNameOperation() != OperationEnumeration.equals)
{
foreach (var newRegistryObject in derivedRegistryObjects)
{
if (!string.IsNullOrEmpty(registryNameValue))
{
names = this.processOperationInEntity(registry_object_ItemsChoices.name, newRegistryObject).ToList();
items.AddRange(itemTypeFactory.CreateRegistryItemTypesByCombinationOfEntitiesFrom(hives, new string[] { newRegistryObject.Key }, names, registryObject));
}
}
}
else
{
names.AddRange(this.processOperationInEntity(registry_object_ItemsChoices.name, registryObject));
items.AddRange(itemTypeFactory.CreateRegistryItemTypesByCombinationOfEntitiesFrom(hives, keys, names, registryObject));
}
}
catch (RegistryKeyNotFoundException)
{
items = itemTypeFactory.CreateRegistryItemTypesByCombinationOfEntitiesFrom(hives, null, null, registryObject).ToList();
}
catch (RegistryItemNotFoundException)
{
items = new List <ItemType>()
{
itemTypeFactory.CreateRegistryItem("", "", "", StatusEnumeration.doesnotexist)
};
}
catch (Exception ex)
{
registry_item registry = itemTypeFactory.CreateRegistryItem(registryObject.Hive, registryObject.Key, registryObject.Name, StatusEnumeration.error);
registry.message = MessageType.FromErrorString(ex.Message);
items = new List <ItemType>()
{
registry
};
}
return(items);
}
public static RegistryObject RegistryKeyToRegistryObject(RegistryKey registryKey)
{
RegistryObject regObj = null;
if (registryKey == null)
{
return(regObj);
}
try
{
regObj = new RegistryObject()
{
Key = registryKey.Name,
};
regObj.AddSubKeys(new List <string>(registryKey.GetSubKeyNames()));
foreach (RegistryAccessRule rule in registryKey.GetAccessControl().GetAccessRules(true, true, typeof(System.Security.Principal.SecurityIdentifier)))
{
string name = GetName(rule);
if (regObj.Permissions.ContainsKey(name))
{
regObj.Permissions[name].Add(rule.RegistryRights.ToString());
}
else
{
regObj.Permissions.Add(name, new List <string>()
{
rule.RegistryRights.ToString()
});
}
}
foreach (string valueName in registryKey.GetValueNames())
{
try
{
regObj.Values.Add(valueName, (registryKey.GetValue(valueName) == null) ? "" : (registryKey.GetValue(valueName).ToString()));
}
catch (Exception ex)
{
Log.Debug(ex, "Found an exception processing registry values.");
}
}
}
catch (System.ArgumentException e)
{
Log.Debug(e, "Exception parsing {0}", registryKey.Name);
}
catch (Exception e)
{
Log.Debug(e, "Couldn't process reg key {0}", registryKey.Name);
}
return(regObj);
}
public bool RegisterObject(RegistryObject obj)
{
if (!gameObjects.Contains(obj))
{
gameObjects.Add(obj);
return(true);
}
return(false);
}
public static string GetResourceType(string payload)
{
string ctdlType = "";
RegistryObject ro = new RegistryObject(payload);
ctdlType = ro.CtdlType;
//ctdlType = ctdlType.Replace( "ceterms:", "" );
return(ctdlType);
}
public static RegistryObject?RegistryKeyToRegistryObject(RegistryKey registryKey, RegistryView registryView)
{
if (registryKey == null)
{
return(null);
}
RegistryObject regObj = new RegistryObject(registryKey.Name, registryView);
try
{
regObj.AddSubKeys(registryKey.GetSubKeyNames());
}
catch (System.ArgumentException)
{
Log.Debug("Invalid Handle (ArgumentException) {0}", registryKey.Name);
}
catch (Exception e)
{
Log.Debug(e, "Couldn't process reg key {0}", registryKey.Name);
}
try
{
foreach (RegistryAccessRule?rule in registryKey.GetAccessControl().GetAccessRules(true, true, typeof(SecurityIdentifier)))
{
if (rule != null)
{
string name = AsaHelpers.SidToName(rule.IdentityReference);
if (regObj.Permissions.ContainsKey(name))
{
regObj.Permissions[name].Add(rule.RegistryRights.ToString());
}
else
{
regObj.Permissions.Add(name, new List <string>()
{
rule.RegistryRights.ToString()
});
}
}
}
}
catch (ArgumentException)
{
Log.Debug("Failed to get permissions (handle is invalid) for {0}", regObj.Key);
}
catch (Exception e)
{
Log.Debug(e, "Failed to get permissions for {0}", regObj.Key);
}
regObj.Values = RegistryObject.GetValues(registryKey);
return(regObj);
}
public RegistryObject CheckRegistryFromServer(string ProductKey, string CurrentCHash)
{
//non registered ise trial'a CHash'yu ekleyip trail object döner, daha önce trial ise tarihi kontrol edip trail ya da nonregistered döner, registered ise zaten registered object döner
//client'de local regObj ile karşılaştırılıp update'ler yapılacaktır.
KulCHashModel cHash = new KulCHashModel();
List <KulCHashModel> cHashList = new List <KulCHashModel>();
RegistryObject KulOnServer;// = new RegistryObject();
//ek. cHash daha önceden register oldu ise ama rg o ProductKey ile gelmediyse de registered bilgisini dönmek için
if (ProductKey == "RRRR-RRRR") //mevcut lisansı Trial iken update Licance'e bastıysa bu cHash'nun lisanslı tanımı var mı diye bakılır.
{
string tmpProductKey = GetProductKeyByCHash(CurrentCHash) ?? "";
if (tmpProductKey != "")
{
ProductKey = tmpProductKey;
}
}
//
KulOnServer = GetKulByProductKey(ProductKey);
if (KulOnServer == null) //ProductKey kullanıcılar tablosunda kayıtlı değilse
{
KulOnServer = new RegistryObject();
SetNonRegisteredOrTrial(ref KulOnServer, CurrentCHash);
}
else
{
if (KulOnServer.IsRegistrated == 2) //TRIAL
{
//CHash = GetCHashTrial(CurrentCHash);
//if (CHash.AddedAt.AddMonths(1) < DateTime.Now) KulOnServer.IsRegistrated = 0; //trial için cHash yoksa sp tarafında yaratılıyor...
SetNonRegisteredOrTrial(ref KulOnServer, CurrentCHash);
}
if (KulOnServer.IsRegistrated == 1) //Product key is Registered-CHash kontrolleri yapılacak
{
cHashList = GetCHashByProductKey(ProductKey);
if (cHashList.Where(x => x.cHashKey == CurrentCHash).FirstOrDefault() == null) //clientin gönderdiği CHash bu product key için listede yok-not registered
//gelen cHash registered olmadıysa=>product key'e bağlı cHash 5'den küçükse cHash ekle ve ret as registered değilse return not registered
{
if (cHashList.Count < 5) //5 CHash'ya kadar bu productKey ile kayıt yapılabilir. Bilgisayar değişikliği vs. gibi durumlar için.
{
AddThisCHash(CurrentCHash, ProductKey);
KulOnServer.cHashKey = CurrentCHash;
}
else //
{
SetNonRegisteredOrTrial(ref KulOnServer, CurrentCHash);
}
}
}
} //else
KulOnServer.cHashKey = CurrentCHash;
return(KulOnServer);
}
void solveByType(JToken json, string codePath, OrderedDictionary <string, string> searchReplace)
{
List <string> propertiesToRemove = new List <string>();
Dictionary <string, JToken> propertiesToAdd = new Dictionary <string, JToken>();
if (json is JObject)
{
foreach (var entry in (json as JObject))
{
if (entry.Key.EndsWith("byType", System.StringComparison.OrdinalIgnoreCase))
{
foreach (var byTypeProperty in entry.Value.ToObject <OrderedDictionary <string, JToken> >())
{
if (WildcardUtil.Match(byTypeProperty.Key, codePath))
{
JToken typedToken = byTypeProperty.Value;
solveByType(typedToken, codePath, searchReplace);
propertiesToAdd.Add(entry.Key.Substring(0, entry.Key.Length - "byType".Length), typedToken);
break;
}
}
propertiesToRemove.Add(entry.Key);
}
}
foreach (var property in propertiesToRemove)
{
(json as JObject).Remove(property);
}
foreach (var property in propertiesToAdd)
{
(json as JObject)[property.Key] = property.Value;
}
foreach (var entry in (json as JObject))
{
solveByType(entry.Value, codePath, searchReplace);
}
}
else if (json.Type == JTokenType.String)
{
string value = (string)(json as JValue).Value;
if (value.Contains("{"))
{
(json as JValue).Value = RegistryObject.FillPlaceHolder(value, searchReplace);
}
}
else if (json is JArray)
{
foreach (var child in (json as JArray))
{
solveByType(child, codePath, searchReplace);
}
}
}
public static RegistryObject RegistryKeyToRegistryObject(RegistryKey registryKey)
{
RegistryObject regObj = null;
try
{
regObj = new RegistryObject()
{
Subkeys = new List <string>(registryKey.GetSubKeyNames()),
Key = registryKey.Name,
Values = new Dictionary <string, string>(),
Permissions = new Dictionary <string, string>()
};
foreach (RegistryAccessRule rule in registryKey.GetAccessControl().GetAccessRules(true, true, typeof(System.Security.Principal.SecurityIdentifier)))
{
string name = rule.IdentityReference.Value;
try
{
name = rule.IdentityReference.Translate(typeof(NTAccount)).Value;
}
catch (IdentityNotMappedException)
{
// This is fine. Some SIDs don't map to NT Accounts.
}
regObj.Permissions.Add(name, rule.RegistryRights.ToString());
}
foreach (string valueName in registryKey.GetValueNames())
{
try
{
if (registryKey.GetValue(valueName) == null)
{
}
regObj.Values.Add(valueName, (registryKey.GetValue(valueName) == null) ? "" : (registryKey.GetValue(valueName).ToString()));
}
catch (Exception ex)
{
Log.Debug(ex, "Found an exception processing registry values.");
}
}
}
catch (System.ArgumentException e)
{
Logger.VerboseException(e);
}
catch (Exception e)
{
Log.Debug(e, "Couldn't process reg key {0}", registryKey.Name);
}
return(regObj);
}
private IEnumerable <RegistryObject> ProcessVariables(RegistryObject registry)
{
var hiveValues = this.ProcessEntityVariables(registry, registry_object_ItemsChoices.hive.ToString()).Distinct();
var keyValues = this.ProcessEntityVariables(registry, registry_object_ItemsChoices.key.ToString()).Distinct();
var nameValues = this.ProcessEntityVariables(registry, registry_object_ItemsChoices.name.ToString()).Distinct();
return(RegistryObjectFactory
.CreateRegistryObjectsByCombinationOfEntitiesFrom(
hiveValues, keyValues, nameValues, registry));
}
private IEnumerable<RegistryObject> ProcessVariables(RegistryObject registry)
{
var hiveValues = this.ProcessEntityVariables(registry, registry_object_ItemsChoices.hive.ToString()).Distinct();
var keyValues = this.ProcessEntityVariables(registry, registry_object_ItemsChoices.key.ToString()).Distinct();
var nameValues = this.ProcessEntityVariables(registry, registry_object_ItemsChoices.name.ToString()).Distinct();
return RegistryObjectFactory
.CreateRegistryObjectsByCombinationOfEntitiesFrom(
hiveValues, keyValues, nameValues,registry);
}
private IEnumerable <string> getKeyValues(RegistryObject registryObject)
{
string hive = registryObject.Hive;
string key = registryObject.Key;
string name = registryObject.Name;
Dictionary <string, object> searchEntityParameters = this.getEntityParamsForSearchValues(hive, key, name);
return(this.systemDataSource.GetValues(searchEntityParameters));
}
private IEnumerable<ItemType> processOperationInRegistryObject(RegistryObject registryObject)
{
List<string> hives = new List<string>() { registryObject.Hive };
RegistryItemTypeFactory itemTypeFactory = new RegistryItemTypeFactory();
List<ItemType> items = new List<ItemType>();
List<string> keys = new List<string>();
List<string> names = new List<string>();
try
{
var registryNameValue = registryObject.GetValueOfEntity("name");
keys.AddRange(this.processOperationInEntity(registry_object_ItemsChoices.key, registryObject));
var derivedRegistryObjects =
RegistryObjectFactory.CreateRegistryObjectsByCombinationOfEntitiesFrom(hives, keys, new string[] { registryNameValue }, registryObject);
if (registryObject.GetNameOperation() != OperationEnumeration.equals)
{
foreach (var newRegistryObject in derivedRegistryObjects)
{
if (!string.IsNullOrEmpty(registryNameValue))
{
names = this.processOperationInEntity(registry_object_ItemsChoices.name, newRegistryObject).ToList();
items.AddRange(itemTypeFactory.CreateRegistryItemTypesByCombinationOfEntitiesFrom(hives, new string[] { newRegistryObject.Key }, names, registryObject));
}
}
}
else
{
names.AddRange(this.processOperationInEntity(registry_object_ItemsChoices.name, registryObject));
items.AddRange(itemTypeFactory.CreateRegistryItemTypesByCombinationOfEntitiesFrom(hives, keys, names, registryObject));
}
}
catch (RegistryKeyNotFoundException)
{
items = itemTypeFactory.CreateRegistryItemTypesByCombinationOfEntitiesFrom(hives, null, null, registryObject).ToList();
}
catch (RegistryItemNotFoundException)
{
items = new List<ItemType>() { itemTypeFactory.CreateRegistryItem("", "", "", StatusEnumeration.doesnotexist) };
}
catch (Exception ex)
{
registry_item registry = itemTypeFactory.CreateRegistryItem(registryObject.Hive, registryObject.Key, registryObject.Name, StatusEnumeration.error);
registry.message = MessageType.FromErrorString(ex.Message);
items = new List<ItemType>() { registry };
}
return items;
}
public void Should_be_access_variable_information_from_the_registry_object_by_the_registry_wrapper()
{
oval_definitions definitions = ProbeHelper.GetFakeOvalDefinitions("definitionsWithConstantVariable.xml");
registry_object ovalRegistryObject = (registry_object)ProbeHelper.GetOvalComponentByOvalID(definitions, "oval:org.mitre.oval:obj:3000");
Assert.IsNotNull(ovalRegistryObject, "the oval registry object is not exists in the fakeDefinitions");
RegistryObject registry = RegistryObjectFactory.CreateRegistryObject(ovalRegistryObject);
Assert.AreEqual(registry.Hive, "HKEY_LOCAL_MACHINE", "the hive value is not expected");
Assert.AreEqual(registry.Key, "", "the key value is not expected");
Assert.AreEqual(registry.Name, "CurrentVersion", "the hive value is not expected");
Assert.AreEqual("oval:org.mitre.oval:var:3000", registry.GetVariableId(registry_object_ItemsChoices.key.ToString()), "the variableId from key is not expected");
Assert.AreEqual("", registry.GetVariableId(registry_object_ItemsChoices.name.ToString()), "the variableId from from name is not expected");
}
public void Should_be_access_information_from_the_registry_object_by_the_registry_wrapper()
{
oval_definitions definitions = ProbeHelper.GetFakeOvalDefinitions("definitionsSimple.xml");
registry_object ovalRegistryObject = (registry_object)ProbeHelper.GetOvalComponentByOvalID(definitions, "oval:org.mitre.oval:obj:4000");
Assert.IsNotNull(ovalRegistryObject, "the oval registry object is not exists in the fakeDefinitions");
RegistryObject registry = RegistryObjectFactory.CreateRegistryObject(ovalRegistryObject);
Assert.AreEqual(registry.Hive, "HKEY_LOCAL_MACHINE", "the hive value is not expected");
Assert.AreEqual(registry.Key, @"Software\Microsoft\Windows NT\CSDBuild", "the key value is not expected");
Assert.AreEqual(registry.Name, "^D.*", "the hive value is not expected");
Assert.AreEqual(OperationEnumeration.patternmatch, registry.GetNameOperation(), "the operation from from name is not expected");
Assert.AreEqual(OperationEnumeration.equals, registry.GetKeyOperation(), "the operation from from key is not expected");
}
private IEnumerable<string> ProcessEntityVariables(RegistryObject registry,string entityName)
{
var values = new List<string>();
var variableId = registry.GetVariableId(entityName);
var variableValues = variables.GetVariableValueForVariableId(variableId);
if ((variableValues != null) && (variableValues.Count() > 0))
foreach (VariableValue variableValue in variableValues)
values.AddRange(variableValue.values);
else
if ((registry.GetEntity(entityName) == null) || (string.IsNullOrEmpty(registry.GetEntity(entityName).var_ref)))
values.Add(registry.GetValueOfEntity(entityName));
return values;
}
public HttpResponseMessage CheckRegistryFromServer()
{
try
{
string CurrentCHash = Request.Headers.GetValues("CurrentCHash").FirstOrDefault();
string ProductKey = Request.Headers.GetValues("ProductKey").FirstOrDefault();
Kuls kuls = new Kuls();
RegistryObject retRegistryObject = new RegistryObject();
retRegistryObject = kuls.CheckRegistryFromServer(ProductKey, CurrentCHash);
return(Request.CreateResponse(HttpStatusCode.OK, retRegistryObject));
}
catch (Exception Ex)
{
return(Request.CreateResponse(HttpStatusCode.ServiceUnavailable, Ex.Message));
}
}
private void SetNonRegisteredOrTrial(ref RegistryObject KulOnServer, string CurrentCHash)
{
//ProductKey = "RRRR-RRRR" ve IsRegistrated = 0 ise trial versiyon expire olmuş demektir.
KulCHashModel kc = new KulCHashModel();
kc = GetCHashTrial(CurrentCHash); //trial'de de yoksa cHash'yu ekleyip trial data dönecek
KulOnServer.IsRegistrated = 2;
if (kc.AddedAt.AddMonths(1) < DateTime.Now)
{
KulOnServer.IsRegistrated = 0; //
}
KulOnServer.DataRegistrationDurationInMonth = 1;
//KulOnServer.HaveDropAuth = 1;
//KulOnServer.HaveTrends = 1;
KulOnServer.ProductKey = "RRRR-RRRR";
KulOnServer.RegistratedDate = kc.AddedAt;//yeni eklediyse şimdiki zaman Trial expire olduysa olmuştur, olmadıysa da olmamış tarihi döner
KulOnServer.DataRegistratedDate = kc.AddedAt;
}
public bool IsSuitableFor(Entity entity)
{
NeolithicContentConfig config = nltConfig.FirstOrDefault();
if (config == null)
{
return(false);
}
for (int i = 0; i < config.Foodfor.Length; i++)
{
if (RegistryObject.WildCardMatch(config.Foodfor[i], entity.Code))
{
return(true);
}
}
return(false);
}
// Token: 0x0600143D RID: 5181 RVA: 0x00074C88 File Offset: 0x00072E88
internal static void CheckAndLogInvalidConfigurationSetting(RegistryObject instance)
{
if (instance == null)
{
return;
}
if (!instance.IsValid)
{
StringBuilder stringBuilder = new StringBuilder();
foreach (ValidationError validationError in instance.Validate())
{
stringBuilder.AppendLine(string.Format("{0}: {1}", validationError.PropertyName, validationError.Description));
}
string text = (instance.Identity != null) ? instance.Identity.ToString() : string.Empty;
PushNotificationsCrimsonEvents.InvalidConfiguration.Log <string, StringBuilder>(text, stringBuilder);
ExTraceGlobals.PushNotificationAssistantTracer.TraceWarning <string, StringBuilder>(0L, "Invalid configuration settings were detected for '{0}':\n{1}", text, stringBuilder);
}
}
private string processEqualsOperations(registry_object_ItemsChoices entity, RegistryObject registryObject, bool isKey)
{
string hive = registryObject.Hive;
string key = registryObject.Key;
Dictionary <string, string> parameters = RegistryHelper.GetInputParametersForWmiEnumValuesMethod(hive, key);
if (isKey)
{
Dictionary <string, object> result = this.wmiDataProvider.InvokeMethod("EnumKey", parameters);
if ((uint)result["ReturnValue"] == 2)
{
throw new RegistryKeyNotFoundException(String.Format("The key {0} does not exist", key));
}
return(key);
}
else
{
return(registryObject.GetValueOfEntity(entity.ToString()));
}
}
public string AddElement(RegistryObject Element, string Id = null)
{
if (Id == null)
{
Id = GetId();
}
Element.my_id = Id;
if (!this.Data.Contains(Id))
{
this.Data.Add(Id, Element);
}
if (Element.parent_object_id != null)
{
if (this.Data.Contains(Element.parent_object_id))
{
(GetElement(Element.parent_object_id)).inner_objects.Add(Id);
}
}
return(Id);
}
public static string[] GetCreativeTabs(AssetLocation code, Dictionary <string, string[]> CreativeInventory, OrderedDictionary <string, string> searchReplace)
{
List <string> tabs = new List <string>();
foreach (var val in CreativeInventory)
{
for (int i = 0; i < val.Value.Length; i++)
{
string blockCode = RegistryObject.FillPlaceHolder(val.Value[i], searchReplace);
if (WildcardUtil.Match(blockCode, code.Path))
//if (WildCardMatch(blockCode, code.Path))
{
string tabCode = val.Key;
tabs.Add(tabCode);
}
}
}
return(tabs.ToArray());
}
/// <summary>
/// Fills in placeholders in the composite texture (called by the VSGameContent mod during item loading)
/// </summary>
/// <param name="searchReplace"></param>
public void FillPlaceHolders(Dictionary <string, string> searchReplace)
{
foreach (CompositeTexture tex in Client.Textures.Values)
{
tex.FillPlaceHolders(searchReplace);
}
Client.Shape?.FillPlaceHolders(searchReplace);
foreach (var val in searchReplace)
{
Attributes?.FillPlaceHolder(val.Key, val.Value);
}
if (Drops != null)
{
for (int i = 0; i < Drops.Length; i++)
{
Drops[i].Code = RegistryObject.FillPlaceHolder(Drops[i].Code, searchReplace);
}
}
}
public static RegistryObject RegistryKeyToRegistryObject(RegistryKey registryKey)
{
RegistryObject regObj = null;
try
{
regObj = new RegistryObject()
{
Subkeys = new List <string>(registryKey.GetSubKeyNames()),
Key = registryKey.Name,
Permissions = registryKey.GetAccessControl().GetSecurityDescriptorSddlForm(System.Security.AccessControl.AccessControlSections.All),
Values = new Dictionary <string, string>()
};
foreach (string valueName in registryKey.GetValueNames())
{
try
{
if (registryKey.GetValue(valueName) == null)
{
}
regObj.Values.Add(valueName, (registryKey.GetValue(valueName) == null) ? "" : (registryKey.GetValue(valueName).ToString()));
}
catch (Exception ex)
{
Log.Debug(ex, "Found an exception processing registry values.");
}
}
}
catch (System.ArgumentException e)
{
Logger.VerboseException(e);
}
catch (Exception e)
{
Log.Debug(e, "Couldn't process reg key {0}", registryKey.Name);
}
return(regObj);
}
private IEnumerable <string> ProcessEntityVariables(RegistryObject registry, string entityName)
{
var values = new List <string>();
var variableId = registry.GetVariableId(entityName);
var variableValues = variables.GetVariableValueForVariableId(variableId);
if ((variableValues != null) && (variableValues.Count() > 0))
{
foreach (VariableValue variableValue in variableValues)
{
values.AddRange(variableValue.values);
}
}
else
if ((registry.GetEntity(entityName) == null) || (string.IsNullOrEmpty(registry.GetEntity(entityName).var_ref)))
{
values.Add(registry.GetValueOfEntity(entityName));
}
return(values);
}
private static float SafetyCalculation(PlanetEconomy PE, EconomyRegistry ER)
{
string planet_economy_id = PE.my_id;
float res = 0;
for (int i = 0; i < ER.Fractions_Num; ++i)
{
if (ER.AttackRewards[i].Contains(planet_economy_id))
{
res += (float)ER.AttackRewards[i][planet_economy_id];
}
}
string system_id = (string)ER.SystemOfPlanet[planet_economy_id];
for (int i = 0; i < ER.Fractions_Num; ++i)
{
if (ER.DefenceRewards[i].Contains(system_id))
{
if (ER.Relationships[i][PE.fraction_id] == (int)EconomyRegistry.Relation.Alliance)
{
res += (float)ER.DefenceRewards[i][system_id];
}
else if (ER.Relationships[i][PE.fraction_id] == (int)EconomyRegistry.Relation.Enemy)
{
res -= (float)ER.DefenceRewards[i][system_id];
}
}
}
Registry R = Registry.getInstance();
List <string> innerobjects = R.GetElement(system_id).inner_objects;
foreach (string s in innerobjects)
{
RegistryObject RO = R.GetElement(s);
//if (RO is Ship)
res += SpaceshipInfluence(RO, PE.fraction_id, ER);
}
return(res);
}
public void Write(RegistryObject obj)
{
try
{
string hashSeed = String.Format("{0}{1}", obj.Key, JsonConvert.SerializeObject(obj));
using (var cmd = new SqliteCommand(SQL_INSERT, DatabaseManager.Connection, DatabaseManager.Transaction))
{
cmd.Parameters.AddWithValue("@run_id", this.runId);
cmd.Parameters.AddWithValue("@row_key", CryptoHelpers.CreateHash(hashSeed));
cmd.Parameters.AddWithValue("@key", obj.Key);
cmd.Parameters.AddWithValue("@value", JsonConvert.SerializeObject(obj.Values));
cmd.Parameters.AddWithValue("@subkeys", JsonConvert.SerializeObject(obj.Subkeys));
cmd.Parameters.AddWithValue("@permissions", obj.Permissions);
cmd.Parameters.AddWithValue("@serialized", JsonConvert.SerializeObject(obj));
try
{
cmd.ExecuteNonQuery();
}
catch (Exception e)
{
Log.Debug(e.GetType() + "thrown in registry collector");
Telemetry.TrackTrace(Microsoft.ApplicationInsights.DataContracts.SeverityLevel.Error, e);
}
}
}
catch (Exception)
{
Log.Debug("Had trouble writing {0}", obj.Key);
}
customCrawlHandler?.Invoke(obj);
}
private IEnumerable<string> getKeyValues(RegistryObject registryObject)
{
string hive = registryObject.Hive;
string key = registryObject.Key;
string name = registryObject.Name;
Dictionary<string, object> searchEntityParameters = this.getEntityParamsForSearchValues(hive, key, name);
return this.systemDataSource.GetValues(searchEntityParameters);
}
public static bool WildCardMatch(this RegistryObject obj, string a) => obj.WildCardMatch(new AssetLocation(a));
public static RegistryObject RegistryKeyToRegistryObject(RegistryKey registryKey)
{
RegistryObject regObj = null;
if (registryKey == null)
{
return(regObj);
}
regObj = new RegistryObject()
{
Key = registryKey.Name,
};
try
{
regObj.AddSubKeys(registryKey.GetSubKeyNames());
}
catch (System.ArgumentException)
{
Log.Debug("Invalid Handle (ArgumentException) {0}", registryKey.Name);
}
catch (Exception e)
{
Log.Debug(e, "Couldn't process reg key {0}", registryKey.Name);
}
try
{
foreach (RegistryAccessRule rule in registryKey.GetAccessControl().GetAccessRules(true, true, typeof(System.Security.Principal.SecurityIdentifier)))
{
string name = rule.IdentityReference.Value;
try
{
name = rule.IdentityReference.Translate(typeof(NTAccount)).Value;
}
catch (IdentityNotMappedException)
{
// This is fine. Some SIDs don't map to NT Accounts.
}
if (regObj.Permissions.ContainsKey(name))
{
regObj.Permissions[name].Add(rule.RegistryRights.ToString());
}
else
{
regObj.Permissions.Add(name, new List <string>()
{
rule.RegistryRights.ToString()
});
}
}
}
catch (ArgumentException)
{
Log.Debug("Failed to get permissions (handle is invalid) for {0}", regObj.Key);
}
catch (Exception e)
{
Log.Debug(e, "Failed to get permissions for {0}", regObj.Key);
}
foreach (string valueName in registryKey.GetValueNames())
{
try
{
regObj.Values.Add(valueName, (registryKey.GetValue(valueName) == null) ? "" : (registryKey.GetValue(valueName).ToString()));
}
catch (Exception ex)
{
Log.Debug(ex, "Found an exception processing registry values of {0}.", registryKey.Name);
}
}
return(regObj);
}
public static IEnumerable <RegistryObject> WalkHive(RegistryHive Hive)
{
// Data structure to hold names of subfolders to be
// examined for files.
Stack <RegistryKey> keys = new Stack <RegistryKey>();
//if (!System.IO.Directory.Exists(root))
//{
// throw new ArgumentException("Unable to find [" + root + "]");
//}
RegistryKey BaseKey = RegistryKey.OpenBaseKey(Hive, RegistryView.Default);
keys.Push(BaseKey);
while (keys.Count > 0)
{
RegistryKey currentKey = keys.Pop();
if (currentKey == null)
{
continue;
}
if (Filter.IsFiltered(Helpers.RuntimeString(), "Scan", "Registry", "Key", currentKey.Name))
{
continue;
}
// First push all the new subkeys onto our stack.
foreach (string key in currentKey.GetSubKeyNames())
{
try
{
var next = currentKey.OpenSubKey(key, false);
keys.Push(next);
}
// These are expected as we are running as administrator, not System.
catch (System.Security.SecurityException e)
{
Log.Debug(e.GetType() + " " + e.Message + " " + currentKey.Name);
}
// There seem to be some keys which are listed as existing by the APIs but don't actually exist.
// Unclear if these are just super transient keys or what the other cause might be.
// Since this isn't use actionable, also just supress these to the debug stream.
catch (System.IO.IOException e)
{
Log.Debug(e.GetType() + " " + e.Message + " " + currentKey.Name);
}
catch (Exception e)
{
Log.Information(e.GetType() + " " + e.Message + " " + currentKey.Name);
Telemetry.TrackTrace(Microsoft.ApplicationInsights.DataContracts.SeverityLevel.Error, e);
}
}
RegistryObject regObj = null;
try
{
regObj = new RegistryObject(currentKey);
}
catch (Exception) { Log.Debug("I'm blue"); }
if (regObj != null)
{
yield return(regObj);
}
}
}
private IEnumerable<string> GetValuesForKeyEntity(RegistryObject registryObject, IEnumerable<string> elements)
{
List<string> values = new List<string>();
foreach (string startElement in elements)
{
List<string> elementsOfKey = startElement.Split(new string[] { "\\" }, StringSplitOptions.RemoveEmptyEntries).ToList<string>();
string key = "";
if (elementsOfKey.Count() > 1)
{
elementsOfKey.Remove(elementsOfKey.First());
key = this.ConvertAStringWithSeparator(elementsOfKey, "\\");
}
IEnumerable<string> valuesToMatch = this.getSubKeys(registryObject.Hive, key);
if (valuesToMatch == null)
{
values.Add(startElement);
}
else
{
IEnumerable<string> valuesConcatenated = this.ConcatTheValuesOfKey(valuesToMatch, startElement);
values.AddRange(this.GetValuesForKeyEntity(registryObject, valuesConcatenated));
}
}
return values;
}
private IEnumerable<string> GetValuesToMatchForOperationsDifferentsOfPatternMatch(bool isKeyEntity, RegistryObject registryObject)
{
if (isKeyEntity)
{
return GetValuesForKeyEntity(registryObject, new List<string>() { registryObject.Hive });
}
else
{
return this.getKeyValues(registryObject);
}
}
private string processEqualsOperations(registry_object_ItemsChoices entity, RegistryObject registryObject, bool isKey)
{
string hive = registryObject.Hive;
string key = registryObject.Key;
Dictionary<string, string> parameters = RegistryHelper.GetInputParametersForWmiEnumValuesMethod(hive, key);
if (isKey)
{
Dictionary<string, object> result = this.wmiDataProvider.InvokeMethod("EnumKey", parameters);
if ((uint)result["ReturnValue"] == 2)
throw new RegistryKeyNotFoundException(String.Format("The key {0} does not exist", key));
return key;
}
else
{
return registryObject.GetValueOfEntity(entity.ToString());
}
}
private IEnumerable<string> processOperationInEntity(registry_object_ItemsChoices entity, RegistryObject registryObject)
{
string entityValue = registryObject.GetValueOfEntity(entity.ToString());
OperationEnumeration entityOperation = registryObject.GetOperationOfEntity(entity.ToString());
bool isKeyEntity = (entity == registry_object_ItemsChoices.key);
if (operatorHelper.IsEqualsOperation(entityOperation))
{
return new List<string>() { this.processEqualsOperations(entity, registryObject, isKeyEntity) };
}
else
{
return this.EvaluateOperation(entityOperation, entityValue, registryObject, isKeyEntity);
}
}
protected static void solveByType(JToken json, string codePath, OrderedDictionary <string, string> searchReplace)
{
if (json is JObject jsonObj)
{
List <string> propertiesToRemove = null;
Dictionary <string, JToken> propertiesToAdd = null;
foreach (var entry in jsonObj)
{
if (entry.Key.EndsWith("byType", StringComparison.OrdinalIgnoreCase))
{
string trueKey = entry.Key.Substring(0, entry.Key.Length - 6); // 6 is the length of "byType"
var jobj = entry.Value as JObject;
foreach (var byTypeProperty in jobj)
{
if (WildcardUtil.Match(byTypeProperty.Key, codePath))
{
JToken typedToken = byTypeProperty.Value; // Unnecessary to solveByType specifically on this new token's contents as we will be doing a solveByType on all the tokens in the jsonObj anyhow, after adding the propertiesToAdd
if (propertiesToAdd == null)
{
propertiesToAdd = new Dictionary <string, JToken>();
}
propertiesToAdd.Add(trueKey, typedToken);
break; // Replaces for first matched key only
}
}
if (propertiesToRemove == null)
{
propertiesToRemove = new List <string>();
}
propertiesToRemove.Add(entry.Key);
}
}
if (propertiesToRemove != null)
{
foreach (var property in propertiesToRemove)
{
jsonObj.Remove(property);
}
if (propertiesToAdd != null)
{
foreach (var property in propertiesToAdd)
{
if (jsonObj[property.Key] is JObject jobject)
{
jobject.Merge(property.Value);
}
else
{
jsonObj[property.Key] = property.Value;
}
}
}
}
foreach (var entry in jsonObj)
{
solveByType(entry.Value, codePath, searchReplace);
}
}
else if (json.Type == JTokenType.String)
{
string value = (string)(json as JValue).Value;
if (value.Contains("{"))
{
(json as JValue).Value = RegistryObject.FillPlaceHolder(value, searchReplace);
}
}
else if (json is JArray jarray)
{
foreach (var child in jarray)
{
solveByType(child, codePath, searchReplace);
}
}
}
private IEnumerable<string> EvaluateOperation(OperationEnumeration operation, string entityValue, RegistryObject registryObject, bool isKeyEntity)
{
IEnumerable<string> valuesToMatch = null;
if (operatorHelper.IsRegularExpression(operation))
{
if (isKeyEntity)
valuesToMatch = this.getSubKeysRecursive(registryObject.Hive, registryObject.Key);
else
{
registryObject.ClearNameEntity();
valuesToMatch = this.getKeyValues(registryObject);
}
return new MultiLevelPatternMatchOperation(FamilyEnumeration.windows).applyPatternMatch(entityValue, valuesToMatch);
}
else
{
valuesToMatch = this.GetValuesToMatchForOperationsDifferentsOfPatternMatch(isKeyEntity, registryObject);
return NonPatternMatchOperationEvaluator.
EvaluateOperationsDifferentsOfPatternMatch(operation, entityValue, valuesToMatch);
}
}
