Condition logic prevents some valid artifacts from being collected on Windows 10
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
**Environment**
- How did you install GRR? Deb
- What GRR version are you running?: 3.4.5.1
- What operating system does the GRR server run on? Ubuntu 18.04
- What operating system does the affected GRR client run on, if applicable? [e.g. Windows 10]
**Describe the issue**
Some artifacts are unable to be collected on Windows 10 due to [CheckCondition](https://github.com/google/grr/blob/a16be8f4f60778268ac2ad60911adb5568afe0fd/grr/core/grr_response_core/lib/artifact_utils.py#L269) logic failing on the minor version. Windows 10 has major version `10` and minor version `0`. For the artifact `WindowsAMCacheHveFile` which has major: 6 and minor 2
GRR is unable to complete the flow because of the minor version mismatch.
Affected artifacts:
[Windows](https://github.com/ForensicArtifacts/artifacts/blob/main/data/windows.yaml):
- WindowsAMCacheHveFile [os_major_version >= 6 AND os_minor_version >= 1]
- WinAppXRT [os_major_version >= 6 AND os_minor_version >= 2]
- WindowsEnvironmentVariableAppxProcess [os_major_version >= 6 AND os_minor_version >= 2]
- WindowsRecentFileCacheBCF [os_major_version >= 6 AND os_minor_version >= 1]
- WindowsStartupInfo [os_major_version >= 6 AND os_minor_version >= 2]
[WMI](https://github.com/ForensicArtifacts/artifacts/blob/main/data/wmi.yaml):
- WMIDNSClientCache [os_major_version >= 6 AND os_minor_version >= 2]
- WMINetNeighbors [os_major_version >= 6 AND os_minor_version >= 2]
- WMINetTCPConnections [os_major_version >= 6 AND os_minor_version >= 2]
- WMINetUDPEndpoints [os_major_version >= 6 AND os_minor_version >= 2]
- WMIScheduledTasks [os_major_version >= 6 AND os_minor_version >= 2]
**Error logs**
N/A
**Additional context**
forensicArtifacts/artifacts/issues/274 is from the original issue back in 2018 and the author lists some suggestions like combining os_major and os_minor into os_version. There is also the possibility of removing the condition altogether. Thoughts?
Contributor guide
Research direction
Start with CheckCondition in grr/core/grr_response_core/lib/artifact_utils.py and compare its version logic with the affected artifact definitions in the linked Windows and WMI YAML files. Review forensicArtifacts/artifacts/issues/274 for the prior discussion and determine the intended condition semantics. Done means the listed Windows 10 artifacts can be collected without the minor-version mismatch.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100