google / google/grr

Split Registry key path and value name and optimize key path glob

Open
#426 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

As discussed with @grrrrrrrrr

We encountered an issue in how GRR handles Registry key paths and value name while running an artifact hunt for typelib files: https://github.com/ForensicArtifacts/artifacts/pull/197/files

The artifact definitions, defines a key path with 4x `\*` (similar behaviour can be reproduced with `**4`). When a GRR artifact collection is scheduled GRR returns:
- Registry keys and values matching 4 additional path segments, which includes the value name
- Does not include the default value of a Registry key with 4 additional path segments

Expected/Wanted behaviour:
- the default value of Registry keys with 4 additional path segments

I can use a work around for now: `**5` and do post result filtering.

I would ask to change GRR to:
- not treat the value name as a key path segment, since that leads to strange issues, and treat it as a separate value. This could also allow GRR to collect "class name" value for Registry keys at some point.
- find a solution to improve the performance of 4x `\*`without having to result to `**4` which has a different meaning, namely: keys matching up to 4 additional path segments instead of exactly 4 additional path segments.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.