⭐️ Add support for static analysis of Windows systems #4203
Conversation
Test Results3 054 tests +7 3 053 ✅ +7 1m 29s ⏱️ +10s Results for commit edcfb47. ± Comparison against base commit 324535f. This pull request removes 3 and adds 10 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
…ry files, located on a filesystem Signed-off-by: Preslav <preslav@mondoo.com>
preslavgerchev
force-pushed
the
preslav/windows-fs
branch
from
021f828 to
f4c1f13
Compare
preslavgerchev
force-pushed
the
preslav/windows-fs
branch
from
b724b53 to
8cc29e4
Compare
| // The subkey file is indicated by the filepath parameter. | ||
| // Only known registry files (see KnownRegistryFiles) can be loaded. | ||
| func (r *RegistryHandler) LoadSubkey(registryId, filepath string) error { | ||
| if runtime.GOOS != "windows" { |
There was a problem hiding this comment.
nit; why not define this function also inside the files registryhandler_unix.go and registryhandler_windows.go instead?
There was a problem hiding this comment.
It also has some additional logic besides making the syscall so I figured it best belongs to the struct which handles the syscalls too (and storing which registries are loaded)
| return err | ||
| } | ||
| ret, _, err := regLoadKey.Call(syscall.HKEY_LOCAL_MACHINE, uintptr(unsafe.Pointer(keyPtr)), uintptr(unsafe.Pointer(pathPtr))) | ||
| // the Microsoft docs indicate that the return value is 0 on success |
There was a problem hiding this comment.
this is funny, what is the err for then? 😂
There was a problem hiding this comment.
also, what if ret is 0 but err is nil?
Would the caller of LoadRegistrySubkey() be confused if it was a success of failure?
There was a problem hiding this comment.
The err is to be thrown when the ret is not 0. There's always an err, even on success, so we cannot rely on the usual err != nil check:
https://go.dev/src/syscall/dll_windows.go (see 151)
This PR adds support for identifying Windows disks, mounted on a given FS as assets.
providers/os/registry. This allows both the connections and the OS MQL resources to use the same code.providers/os/resources, the MQL resources now only referenceproviders/os/registryand use that.RegLoadKeyWandUnLoadRegKeyWsyscalls that help us mount static registry files as subkeys under HKLM in the registry.version,build,platform, and hostname for Windows filesystems