<s> """<STR_LIT>""" <EOL> from grr . lib import artifact_utils <EOL> from grr . lib import parsers <EOL> from grr . lib . rdfvalues import client as rdf_client <EOL> from grr . lib . rdfvalues import paths as rdf_paths <EOL> from grr . lib . rdfvalues import standard as rdf_standard <EOL> from grr . path_detection import windows as path_detection_windows <EOL> class WindowsPersistenceMechanismsParser ( parsers . ArtifactFilesParser ) : <EOL> """<STR_LIT>""" <EOL> output_types = [ "<STR_LIT>" ] <EOL> supported_artifacts = [ "<STR_LIT>" ] <EOL> knowledgebase_dependencies = [ "<STR_LIT>" , "<STR_LIT>" ] <EOL> def _GetFilePaths ( self , path , pathtype , kb ) : <EOL> """<STR_LIT>""" <EOL> environ_vars = artifact_utils . GetWindowsEnvironmentVariablesMap ( kb ) <EOL> path_guesses = path_detection_windows . DetectExecutablePaths ( <EOL> [ path ] , environ_vars ) <EOL> if not path_guesses : <EOL> return [ ] <EOL> return [ rdf_paths . PathSpec ( path = path , pathtype = pathtype ) <EOL> for path in path_guesses ] <EOL> def Parse ( self , persistence , knowledge_base , download_pathtype ) : <EOL> """<STR_LIT>""" <EOL> pathspecs = [ ] <EOL> source_urn = None <EOL> if isinstance ( persistence , rdf_client . WindowsServiceInformation ) : <EOL> if persistence . HasField ( "<STR_LIT>" ) : <EOL> source_urn = persistence . registry_key <EOL> if persistence . HasField ( "<STR_LIT>" ) : <EOL> pathspecs . append ( persistence . binary . pathspec ) <EOL> elif persistence . HasField ( "<STR_LIT>" ) : <EOL> pathspecs = self . _GetFilePaths ( persistence . image_path , <EOL> download_pathtype , knowledge_base ) <EOL> if isinstance ( persistence , rdf_client . StatEntry ) and persistence . HasField ( <EOL> "<STR_LIT>" ) : <EOL> pathspecs = self . _GetFilePaths ( persistence . registry_data . string , <EOL> download_pathtype , knowledge_base ) <EOL> source_urn = persistence . aff4path <EOL> for pathspec in pathspecs : <EOL> yield rdf_standard . PersistenceFile ( pathspec = pathspec , <EOL> source_urn = source_urn ) </s>
