retrieve_regmod_values.py 文件源码

def _worker_thread_loop(self):
        while self.go:
            try:
                try:
                    (x, regmod_path) = self.queue.get(timeout=0.5)
                except Queue.Empty:
                    continue

                # TODO -- could comment this out if you want CSV data to feed into something
                print "--> Attempting for %s" % regmod_path

                # Go Grab it if we think we have something!
                sensor_id = x.env.endpoint.SensorId
                hostname = x.env.endpoint.SensorHostName

                # TODO -- this could use some concurrency and work queues because we could wait a while for
                # each of these to get established and retrieve the value

                # Establish our CBLR session if necessary!
                lrh = self._create_lr_session_if_necessary(sensor_id)

                data = lrh.get_registry_value(regmod_path)

                print "%s,%s,%d,%s,%s,%s" % ( time.asctime(),
                                              hostname,
                                              sensor_id,
                                              x.header.process_path,
                                              regmod_path,
                                              data.get('value_data', "") if data else "<UNKNOWN>")

                # TODO -- could *do something* here, like if it is for autoruns keys then go check the signature status
                # of the binary at the path pointed to, and see who wrote it out, etc
            except:
                traceback.print_exc()