google / google/grr

CSV export of registry keys does not properly export registry values

Open
#582 1 comment 0 reactions 1 assignee Claimed by @mbushkov View on GitHub
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

GRR uses the stat.registry_data to contain value content (unlike files). When exporting this in the CSV export, binary data appears to be terminated at the first null, and also the data is exported unescaped (so for example the CSV contains weird chars instead of data).

This makes it hard to export registry values because these are not exported in their own files (e.g. like files are). I guess it is always possible to roll your own export script but I suppose the point of the CSV export is not to.

Specifically in this case we are trying to export AppCompatCache which is ~200kb per value.

I am not sure what would be the best way to export binary data into CSV though - it is possibly not ideal to dump potentially MBs into the CSV file. Maybe binary values should be exported as their own files as well?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.