def Parse(self, persistence, knowledge_base, download_pathtype):
"""Convert persistence collector output to downloadable rdfvalues."""
pathspecs = []
if isinstance(persistence, rdf_client.OSXServiceInformation):
if persistence.program:
pathspecs = rdf_paths.PathSpec(path=persistence.program,
pathtype=download_pathtype)
elif persistence.args:
pathspecs = rdf_paths.PathSpec(path=persistence.args[0],
pathtype=download_pathtype)
for pathspec in pathspecs:
yield rdf_standard.PersistenceFile(pathspec=pathspec)
def Parse(self, persistence, knowledge_base):
"""Convert persistence collector output to downloadable rdfvalues."""
pathspec = None
if isinstance(persistence, rdf_client.OSXServiceInformation):
if persistence.program:
pathspec = rdf_paths.PathSpec(
path=persistence.program,
pathtype=rdf_paths.PathSpec.PathType.UNSET)
elif persistence.args:
pathspec = rdf_paths.PathSpec(
path=persistence.args[0],
pathtype=rdf_paths.PathSpec.PathType.UNSET)
if pathspec is not None:
yield rdf_standard.PersistenceFile(pathspec=pathspec)
def ParseResponse(
self,
knowledge_base: rdf_client.KnowledgeBase,
response: rdfvalue.RDFValue,
) -> Iterator[rdf_standard.PersistenceFile]:
"""Convert persistence collector output to downloadable rdfvalues."""
pathspec = None
if isinstance(response, rdf_client.OSXServiceInformation):
if response.program:
pathspec = rdf_paths.PathSpec(
path=response.program, pathtype=rdf_paths.PathSpec.PathType.UNSET)
elif response.args:
pathspec = rdf_paths.PathSpec(
path=response.args[0], pathtype=rdf_paths.PathSpec.PathType.UNSET)
if pathspec is not None:
yield rdf_standard.PersistenceFile(pathspec=pathspec)
def Parse(self, persistence, knowledge_base):
"""Convert persistence collector output to downloadable rdfvalues."""
pathspecs = []
if isinstance(persistence, rdf_client.WindowsServiceInformation):
if persistence.HasField("binary"):
pathspecs.append(persistence.binary.pathspec)
elif persistence.HasField("image_path"):
pathspecs = self._GetFilePaths(persistence.image_path,
knowledge_base)
if isinstance(persistence, rdf_client_fs.StatEntry
) and persistence.HasField("registry_type"):
pathspecs = self._GetFilePaths(persistence.registry_data.string,
knowledge_base)
for pathspec in pathspecs:
yield rdf_standard.PersistenceFile(pathspec=pathspec)
