Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.87k stars 480 forks source link

Remapping registry hives with zip_nocase #3691

Closed ruzzle closed 2 weeks ago

ruzzle commented 3 weeks ago

Following up on https://github.com/Velocidex/velociraptor/issues/3597 (with respect to Dissect Acquire collects), I am now able to remap the filesystem using remapping configuration, but remapping registry hives inside the collects still give me case sensitiveness issues

Given the following (partial) config

- type: mount
  description: Map the Collection-*/C/Windows/System32/Config/SYSTEM registry hive on HKEY_LOCAL_MACHINE\System (Prefixed at /)
  from:
    accessor: raw_reg
    prefix: |-
      {
        "Path": "/",
        "DelegateAccessor": "zip_nocase",
        "Delegate" : {
          "DelegateAccessor": "file",
          "DelegatePath": "/path/to/acquire-collect.zip",
          "Path": "fs/C:/Windows/System32/config/SYSTEM"
        }
      }
    path_type: registry
  "on":
    accessor: registry
    prefix: HKEY_LOCAL_MACHINE\System
    path_type: registry

This remapping works if the zip file "acquire-collect.zip" contains the file "fs/C:/Windows/System32/config/SYSTEM" but fails to work if the casing deviates ("fs/C:/windows/system32/config/system").

Does this has something to do with the fact that there is more delegation here?

About environment: I pulled the main branch, build velociraptor and test this using the artifact Windows.Registry.AppCompatCache and a sample collect made by Dissect acquire

scudette commented 3 weeks ago

This was actually a bug in the zip no case accessor fixed in #3693