Split Registry key path and value name and optimize key path glob
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
As discussed with @grrrrrrrrr
We encountered an issue in how GRR handles Registry key paths and value name while running an artifact hunt for typelib files: https://github.com/ForensicArtifacts/artifacts/pull/197/files
The artifact definitions, defines a key path with 4x `\*` (similar behaviour can be reproduced with `**4`). When a GRR artifact collection is scheduled GRR returns:
- Registry keys and values matching 4 additional path segments, which includes the value name
- Does not include the default value of a Registry key with 4 additional path segments
Expected/Wanted behaviour:
- the default value of Registry keys with 4 additional path segments
I can use a work around for now: `**5` and do post result filtering.
I would ask to change GRR to:
- not treat the value name as a key path segment, since that leads to strange issues, and treat it as a separate value. This could also allow GRR to collect "class name" value for Registry keys at some point.
- find a solution to improve the performance of 4x `\*`without having to result to `**4` which has a different meaning, namely: keys matching up to 4 additional path segments instead of exactly 4 additional path segments.
Contributor guide
Assessment
This issue has not been assessed yet.