|
3 | 3 |
|
4 | 4 | from artifacts import reader as artifacts_reader
|
5 | 5 | from artifacts import registry as artifacts_registry
|
6 |
| -from dfvfs.helpers import fake_file_system_builder |
7 | 6 | from dfvfs.helpers import file_system_searcher
|
8 |
| -from dfvfs.lib import definitions as dfvfs_definitions |
9 |
| -from dfvfs.path import factory as path_spec_factory |
10 |
| -from dfwinreg import registry as dfwinreg_registry |
11 |
| -from dfwinreg import registry_searcher |
12 | 7 |
|
13 |
| -from plaso.containers import artifacts |
14 |
| -from plaso.preprocessors import manager |
15 | 8 | from plaso.preprocessors import mediator
|
16 | 9 | from plaso.storage.fake import writer as fake_writer
|
17 | 10 |
|
@@ -65,81 +58,3 @@ def _RunPreprocessorPluginOnFileSystem(
|
65 | 58 | plugin.Collect(test_mediator, artifact_definition, searcher, file_system)
|
66 | 59 |
|
67 | 60 | return test_mediator
|
68 |
| - |
69 |
| - def _RunPreprocessorPluginOnWindowsRegistryValue( |
70 |
| - self, file_system, mount_point, storage_writer, plugin): |
71 |
| - """Runs a preprocessor plugin on a Windows Registry value. |
72 |
| -
|
73 |
| - Args: |
74 |
| - file_system (dfvfs.FileSystem): file system to be preprocessed. |
75 |
| - mount_point (dfvfs.PathSpec): mount point path specification that refers |
76 |
| - to the base location of the file system. |
77 |
| - storage_writer (StorageWriter): storage writer. |
78 |
| - plugin (ArtifactPreprocessorPlugin): preprocessor plugin. |
79 |
| -
|
80 |
| - Return: |
81 |
| - PreprocessMediator: preprocess mediator. |
82 |
| - """ |
83 |
| - artifact_definition = self._artifacts_registry.GetDefinitionByName( |
84 |
| - plugin.ARTIFACT_DEFINITION_NAME) |
85 |
| - self.assertIsNotNone(artifact_definition) |
86 |
| - |
87 |
| - environment_variable = artifacts.EnvironmentVariableArtifact( |
88 |
| - case_sensitive=False, name='SystemRoot', value='C:\\Windows') |
89 |
| - |
90 |
| - registry_file_reader = manager.FileSystemWinRegistryFileReader( |
91 |
| - file_system, mount_point, environment_variables=[environment_variable]) |
92 |
| - win_registry = dfwinreg_registry.WinRegistry( |
93 |
| - registry_file_reader=registry_file_reader) |
94 |
| - |
95 |
| - test_mediator = mediator.PreprocessMediator(storage_writer) |
96 |
| - |
97 |
| - searcher = registry_searcher.WinRegistrySearcher(win_registry) |
98 |
| - |
99 |
| - plugin.Collect(test_mediator, artifact_definition, searcher) |
100 |
| - |
101 |
| - return test_mediator |
102 |
| - |
103 |
| - def _RunPreprocessorPluginOnWindowsRegistryValueSoftware( |
104 |
| - self, storage_writer, plugin): |
105 |
| - """Runs a preprocessor plugin on a Windows Registry value in SOFTWARE. |
106 |
| -
|
107 |
| - Args: |
108 |
| - storage_writer (StorageWriter): storage writer. |
109 |
| - plugin (ArtifactPreprocessorPlugin): preprocessor plugin. |
110 |
| -
|
111 |
| - Return: |
112 |
| - PreprocessMediator: preprocess mediator. |
113 |
| - """ |
114 |
| - file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
115 |
| - test_file_path = self._GetTestFilePath(['SOFTWARE']) |
116 |
| - file_system_builder.AddFileReadData( |
117 |
| - '/Windows/System32/config/SOFTWARE', test_file_path) |
118 |
| - |
119 |
| - mount_point = path_spec_factory.Factory.NewPathSpec( |
120 |
| - dfvfs_definitions.TYPE_INDICATOR_FAKE, location='/') |
121 |
| - |
122 |
| - return self._RunPreprocessorPluginOnWindowsRegistryValue( |
123 |
| - file_system_builder.file_system, mount_point, storage_writer, plugin) |
124 |
| - |
125 |
| - def _RunPreprocessorPluginOnWindowsRegistryValueSystem( |
126 |
| - self, storage_writer, plugin): |
127 |
| - """Runs a preprocessor plugin on a Windows Registry value in SYSTEM. |
128 |
| -
|
129 |
| - Args: |
130 |
| - storage_writer (StorageWriter): storage writer. |
131 |
| - plugin (ArtifactPreprocessorPlugin): preprocessor plugin. |
132 |
| -
|
133 |
| - Return: |
134 |
| - PreprocessMediator: preprocess mediator. |
135 |
| - """ |
136 |
| - file_system_builder = fake_file_system_builder.FakeFileSystemBuilder() |
137 |
| - test_file_path = self._GetTestFilePath(['SYSTEM']) |
138 |
| - file_system_builder.AddFileReadData( |
139 |
| - '/Windows/System32/config/SYSTEM', test_file_path) |
140 |
| - |
141 |
| - mount_point = path_spec_factory.Factory.NewPathSpec( |
142 |
| - dfvfs_definitions.TYPE_INDICATOR_FAKE, location='/') |
143 |
| - |
144 |
| - return self._RunPreprocessorPluginOnWindowsRegistryValue( |
145 |
| - file_system_builder.file_system, mount_point, storage_writer, plugin) |
0 commit comments