Advertisement
Guest User

Untitled

a guest
Jan 17th, 2020
77
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.28 KB | None | 0 0
  1. # Importeer de juiste bibliotheken om de registry te kunnen lezen
  2. import sys
  3. import winreg
  4. import tabulate
  5. import os.path as osp
  6. import logging
  7. import hashlib
  8.  
  9. logger = logging.getLogger('Registry Keys')
  10. logging.basicConfig(handlers=[logging.FileHandler('registry_keys.log', 'w', 'utf-8')], format='%(name)s: %(asctime)s %(levelname)s: %(message)s', datefmt='%d/%m/%Y %I:%M:%S %p', level=logging.DEBUG)
  11.  
  12. def choice_menu(geefHKEY, geefPad):
  13. # input vragen aan de gebruiker.
  14.  
  15. logger.info("Asked for input HKEY.")
  16. logger.info("Received input HKEY: " + geefHKEY)
  17. logger.info("Asked for input path, ")
  18. logger.info("Received input path: " + geefPad)
  19.  
  20.  
  21. # Wanneer er een enter wordt ingevoerd geeft het programma een fout melding
  22. if (geefPad == ""):
  23. print("Path not found, please enter a valid path choice. Try again.")
  24. sys.exit(1)
  25. if (geefHKEY == ""):
  26. print("HKEY not found, please enter a valid HKEY choice. Try again.")
  27. sys.exit(1)
  28.  
  29. #Leest de gegeven HKEY-input van de gebruiker uit.
  30. try:
  31. HKEYFound = False
  32. logging.info("Analyzing HKEY and path choice")
  33. if (geefHKEY == "HKEY_CLASSES_ROOT"):
  34. explorer = winreg.OpenKey(
  35. winreg.HKEY_CLASSES_ROOT, geefPad)
  36. HKEYFound = True
  37. elif (geefHKEY == "HKEY_CURRENT_USER"):
  38. explorer = winreg.OpenKey(
  39. winreg.HKEY_CURRENT_USER, geefPad)
  40. HKEYFound = True
  41. elif (geefHKEY == "HKEY_LOCAL_MACHINE"):
  42. explorer = winreg.OpenKey(
  43. winreg.HKEY_LOCAL_MACHINE, geefPad)
  44. HKEYFound = True
  45. elif (geefHKEY == "HKEY_USERS"):
  46. explorer = winreg.OpenKey(
  47. winreg.HKEY_USERS, geefPad)
  48. HKEYFound = True
  49. elif (geefHKEY == "HKEY_PERFORMANCE_DATA"):
  50. explorer = winreg.OpenKey(
  51. winreg.HKEY_PERFORMANCE_DATA, geefPad)
  52. HKEYFound = True
  53. elif (geefHKEY == "HKEY_CURRENT_CONFIG"):
  54. explorer = winreg.OpenKey(
  55. winreg.HKEY_CURRENT_CONFIG, geefPad)
  56. HKEYFound = True
  57. elif (geefHKEY == "HKEY_DYN_DATA"):
  58. explorer = winreg.OpenKey(
  59. winreg.HKEY_DYN_DATA, geefPad)
  60. HKEYFound = True
  61.  
  62. if (HKEYFound == False):
  63. print("HKEY not found, please enter a valid HKEY choice. Try again.")
  64. logging.info("HKEY not found")
  65. sys.exit(1)
  66. return
  67.  
  68. return explorer
  69.  
  70. except:
  71. print("Path not found, please enter a valid path choice. Try again.")
  72. logging.info("Path not found")
  73. sys.exit(1)
  74.  
  75.  
  76.  
  77.  
  78. def reg_reader(exp):
  79. registry = []
  80.  
  81. #Geeft bij 'Type' de bijbehoorende state naam aan.
  82. TYPE_STATE = {0: 'REG_NONE',
  83. 1: 'REG_SZ',
  84. 2: 'REG_EXPAND_SZ',
  85. 3: 'REG_BINARY',
  86. 4: 'REG_DWORD ',
  87. 5: 'REG_DWORD_BIG_ENDIAN',
  88. 6: 'REG_LINK',
  89. 7: 'REG_MULTI_SZ',
  90. 8: 'REG_RESOURCE_LIST',
  91. 9: 'REG_FULL_RESOURCE_DESCRIPTOR',
  92. 10: 'REG_RESOURCE_REQUIREMENTS_LIST',
  93. 11: 'REG_QWORD '}
  94.  
  95.  
  96. # Waardes in de lijst van de registry keys
  97. try:
  98. i = 0
  99. while 1:
  100. name, data, type = winreg.EnumValue(exp, i)
  101. i += 1
  102.  
  103. #Tabelontwerp creeëren
  104. name = str(name)
  105. type = str(TYPE_STATE.get(type))
  106. data = str(data)
  107.  
  108. registry.append({
  109. 'Name': name, 'Type': type, 'Data': data,
  110. })
  111.  
  112. logging.info("Append values to registry list.")
  113.  
  114. except WindowsError:
  115. print
  116.  
  117.  
  118. return registry
  119.  
  120.  
  121.  
  122. def filter_reg(registry, filterVraag, filterNaam, filterType):
  123. ongefilterdLijst = registry
  124. filterLijst = []
  125.  
  126.  
  127. logging.info("input for filter the registry: " + filterVraag)
  128.  
  129. if(filterVraag.upper() == "N"):
  130. return ongefilterdLijst
  131. elif(filterVraag == "Y"):
  132. logging.info("input to filter on name: " + filterNaam)
  133. logging.info("input to filter on type: " + filterType)
  134.  
  135. if(filterNaam + filterType == ""):
  136. return ongefilterdLijst
  137. else:
  138. if(filterNaam != ""):
  139. for key in ongefilterdLijst:
  140. if key in filterLijst:
  141. continue
  142. elif(key['Name'] == filterNaam):
  143. filterLijst.append(key)
  144. logging.info("Registry key list is filtered on name.")
  145. if(filterLijst == []):
  146. print("Name not found in list of registry keys \n")
  147. logging.info("Name not found in the registry keys list.")
  148.  
  149. if (filterType != ""):
  150. for key in ongefilterdLijst:
  151. if key in filterLijst:
  152. continue
  153. elif (key['Type'] == filterType):
  154. filterLijst.append(key)
  155. logging.info("Registry key list is filtered on type.")
  156. if (filterLijst == []):
  157. print("Type not found in list of registry keys \n")
  158. logging.info("Type not found in the registry keys list.")
  159.  
  160. return filterLijst
  161.  
  162. else:
  163. print("The input you gave did not correspond Y or N.")
  164. logging.info("The input did not correspond with Y or N.")
  165. sys.exit(1)
  166.  
  167.  
  168.  
  169. def save_keys(finalList):
  170. #print tabel naar scherm
  171. header = finalList[0].keys()
  172. rows = [x.values() for x in finalList]
  173. tableregkey = tabulate.tabulate(rows, header, tablefmt='rst')
  174. logging.info("Create table of registry keys.")
  175. print(tableregkey)
  176. logging.info("Printed table of registry keys.")
  177.  
  178. #schrijf de tabel met uitkomsten naar een .txt bestand.
  179. if osp.isfile("RegistryKeys.txt"):
  180. f = open('RegistryKeys.txt', 'w')
  181. else:
  182. f = open('RegistryKeys.txt', 'x')
  183. logging.info("Save list of registry keys.")
  184.  
  185. f.write(tableregkey)
  186. logger.info('writing results to file.')
  187.  
  188. f.close()
  189. logger.info('close txt file.')
  190.  
  191. #hashing
  192. hasher = hashlib.md5()
  193. with open('RegistryKeys.txt', 'rb') as afile:
  194. buf = afile.read()
  195. hasher.update(buf)
  196. hash1 = 'RegistryKeys.txt MD5 Hashwaarde: ' + hasher.hexdigest()
  197. logger.debug('Generating MD5 hash: ' + hasher.hexdigest())
  198.  
  199. hashersha = hashlib.sha256()
  200. with open('RegistryKeys.txt', 'rb') as afile:
  201. buf = afile.read()
  202. hashersha.update(buf)
  203. hash2 = 'RegistryKeys.txt SHA256 Hashwaarde: ' + hashersha.hexdigest()
  204. logger.debug('Generating SHA256 hash: ' + hashersha.hexdigest())
  205.  
  206. f = open('hashfile.txt', 'a', encoding="utf-8")
  207. logger.info('open file: hashfile.txt')
  208. f.write(hash1 + '\n' + hash2 + '\n')
  209. logger.info('writing md5 hash to file')
  210. f.close()
  211. logger.info('close file: hashfile.txt')
  212.  
  213.  
  214.  
  215.  
  216.  
  217. def main(geefHKEY, geefPad, filterVraag, filterNaam, filterType):
  218. save_keys(filter_reg(reg_reader(choice_menu(geefHKEY, geefPad)), filterVraag, filterNaam, filterType))
  219.  
  220. if __name__ == '__main__':
  221. main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement