admin/SpecterOps-Nemesis
1
0
Fork 0
mirror of https://github.com/SpecterOps/Nemesis synced 2026-06-08 12:36:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added helper method to bof_reg_collect_parser

Browse Source 
-Added helper method to bof_reg_collect_parser
This commit is contained in:
HarmJ0y
2023-08-30 16:14:13 -07:00
parent 53d1fce05b
commit 5f765fa9ca
1 changed files with 24 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/enrichment/enrichment/tasks/raw_data_tag/bof_reg_collect_parser.py
+24 -9
View File
@@ -16,26 +16,32 @@ REG_FULL_RESOURCE_DESCRIPTOR = 9
REG_RESOURCE_REQUIREMENTS_LIST = 10
REG_QWORD = 11
def read_unsigned_int(data: bytes) -> Tuple[int, bytes]:
(ret,), data = struct.unpack('>I', data[:4]), data[4:]
return ret, data
def read_unsigned_long(data: bytes) -> Tuple[int, bytes]:
(ret,), data = struct.unpack('<L', data[:4]), data[4:]
return ret, data
def read_unsigned_long_be(data: bytes) -> Tuple[int, bytes]:
(ret,), data = struct.unpack('>L', data[:4]), data[4:]
return ret, data
def read_unsigned_long_long(data: bytes) -> Tuple[int, bytes]:
(ret,), data = struct.unpack('<Q', data[:8]), data[8:]
return ret, data
def read_fixed_string(data: bytes, length: int) -> Tuple[bytes, bytes]:
(ret,) = struct.unpack(f'>{length}s', data[:length])
return ret, data[length:]
def read_string(data: bytes) -> Tuple[bytes, int, bytes]:
size, data = read_unsigned_int(data)
if size == 0:
@@ -43,6 +49,7 @@ def read_string(data: bytes) -> Tuple[bytes, int, bytes]:
ret, data = read_fixed_string(data, size)
return ret, size, data
class RegKey(NamedTuple):
type_: int
path: str
@@ -52,6 +59,7 @@ class RegKey(NamedTuple):
value: Union[bytes, int, List[bytes]]
value_size: int
def read_key(data: bytes) -> Tuple[RegKey, bytes]:
type_, data = read_unsigned_int(data)
path, path_size, data = read_string(data)
@@ -90,14 +98,8 @@ def read_key(data: bytes) -> Tuple[RegKey, bytes]:
return RegKey(type_, path, path_size, key, key_size, value, value_length), data
if __name__ == '__main__':
if len(sys.argv) != 3:
print('Usage: python nemesis_reg_parser.py <input file> <output file>')
sys.exit(1)
input_path = sys.argv[1]
output_path = sys.argv[2]
def parse_serialized_reg_data(input_path: str) -> List[Tuple[RegKey, bytes]]:
with open(input_path, 'rb') as f:
data = f.read()
arr = []
@@ -106,5 +108,18 @@ if __name__ == '__main__':
for i in range(arr_size):
reg_key, data = read_key(data)
arr.append(reg_key._asdict())
with open(output_path, 'w') as f:
json.dump(arr, f)
return arr
if __name__ == '__main__':
if len(sys.argv) != 3:
print('Usage: python nemesis_reg_parser.py <input file> <output file>')
sys.exit(1)
input_path = sys.argv[1]
output_path = sys.argv[2]
parsed_data = parse_serialized_reg_data(input_path)
with open(output_path, 'w') as f:
json.dump(parsed_data, f)