grr/server/grr_response_server/flows/general/registry.py
def ParseRunKeys(self, responses):
    """Get filenames from the RunKeys and download the files."""
    filenames = []
    if data_store.RelationalDBReadEnabled():
      client = data_store.REL_DB.ReadClientSnapshot(self.client_id)
      kb = client.knowledge_base
    else:
      client = aff4.FACTORY.Open(self.client_id, mode="r", token=self.token)
      kb = artifact.GetArtifactKnowledgeBase(client)

    for response in responses:
      runkey = response.registry_data.string

      environ_vars = artifact_utils.GetWindowsEnvironmentVariablesMap(kb)
      path_guesses = path_detection_windows.DetectExecutablePaths([runkey],
                                                                  environ_vars)

      if not path_guesses:
        self.Log("Couldn't guess path for %s", runkey)

      for path in path_guesses:
        filenames.append(
            rdf_paths.PathSpec(
                path=path, pathtype=rdf_paths.PathSpec.PathType.TSK))

    if filenames:
      self.CallFlow(
          transfer.MultiGetFile.__name__,
          pathspecs=filenames,
          next_state="Done")
Get filenames from the RunKeys and download the files.
Get filenames from the RunKeys and download the files.
Get filenames from the RunKeys and download the files .
def ParseRunKeys(self, responses):
    filenames = []
    if data_store.RelationalDBReadEnabled():
      client = data_store.REL_DB.ReadClientSnapshot(self.client_id)
      kb = client.knowledge_base
    else:
      client = aff4.FACTORY.Open(self.client_id, mode="r", token=self.token)
      kb = artifact.GetArtifactKnowledgeBase(client)
    for response in responses:
      runkey = response.registry_data.string
      environ_vars = artifact_utils.GetWindowsEnvironmentVariablesMap(kb)
      path_guesses = path_detection_windows.DetectExecutablePaths([runkey],
                                                                  environ_vars)
      if not path_guesses:
        self.Log("Couldn't guess path for %s", runkey)
      for path in path_guesses:
        filenames.append(
            rdf_paths.PathSpec(
                path=path, pathtype=rdf_paths.PathSpec.PathType.TSK))
    if filenames:
      self.CallFlow(
          transfer.MultiGetFile.__name__,
          pathspecs=filenames,
          next_state="Done")
def ParseRunKeys ( self , responses ) : filenames = [ ] if data_store . RelationalDBReadEnabled ( ) : client = data_store . REL_DB . ReadClientSnapshot ( self . client_id ) kb = client . knowledge_base else : client = aff4 . FACTORY . Open ( self . client_id , mode = "r" , token = self . token ) kb = artifact . GetArtifactKnowledgeBase ( client ) for response in responses : runkey = response . registry_data . string environ_vars = artifact_utils . GetWindowsEnvironmentVariablesMap ( kb ) path_guesses = path_detection_windows . DetectExecutablePaths ( [ runkey ] , environ_vars ) if not path_guesses : self . Log ( "Couldn't guess path for %s" , runkey ) for path in path_guesses : filenames . append ( rdf_paths . PathSpec ( path = path , pathtype = rdf_paths . PathSpec . PathType . TSK ) ) if filenames : self . CallFlow ( transfer . MultiGetFile . __name__ , pathspecs = filenames , next_state = "Done" )
Get filenames from the RunKeys and download the files.
Get filenames from the RunKeys and download the files .
"""Get filenames from the RunKeys and download the files."""
self
responses