oceans2alaska
610a3bb447
- Add privacy projection (core/privacy.py), private report storage, bounded
process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
"Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
39 lines
2.3 KiB
PowerShell
39 lines
2.3 KiB
PowerShell
function Read-SamsaraSoftwareEntries {
|
|
param($Result, $Uninstall, [string]$View)
|
|
foreach ($name in $Uninstall.GetSubKeyNames()) {
|
|
$entry = $null
|
|
try {
|
|
$entry = $Uninstall.OpenSubKey($name, $false)
|
|
if ($null -eq $entry) { throw 'Software entry not readable.' }
|
|
$display = [string]$entry.GetValue('DisplayName', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
|
|
if ($display) {
|
|
$version = [string]$entry.GetValue('DisplayVersion', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
|
|
if ($version -match '^(\d{1,5}(?:\.\d{1,5}){0,3})(?![\d.])') { $version = $Matches[1] } else { $version = 'Not collected' }
|
|
$Result.data += [pscustomobject]@{ name = Get-SamsaraPublicName 'products' $display ($Result.data.Count + 1)
|
|
version = $version; registry_view = $View }
|
|
}
|
|
} catch { Add-SamsaraError $Result $_ 'Machine software entry' }
|
|
finally { if ($entry) { $entry.Dispose() } }
|
|
}
|
|
}
|
|
|
|
function Get-SamsaraSoftware {
|
|
param($Result)
|
|
# Explicit registry views avoid 32-bit redirection and require no installer queries.
|
|
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64, [Microsoft.Win32.RegistryView]::Registry32)) {
|
|
Invoke-SamsaraRead $Result ('Machine software registry ' + [string]$view) {
|
|
$hive = $null; $uninstall = $null
|
|
try {
|
|
$hive = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $view)
|
|
$uninstall = $hive.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', $false)
|
|
if ($null -eq $uninstall) { return }
|
|
Read-SamsaraSoftwareEntries $Result $uninstall ([string]$view)
|
|
} finally {
|
|
if ($uninstall) { $uninstall.Dispose() }
|
|
if ($hive) { $hive.Dispose() }
|
|
}
|
|
}
|
|
}
|
|
$Result.limitations += 'Machine uninstall registrations in both registry views only. Per-user, portable, container and unregistered software may be absent. Publisher, installation date, uninstall commands and environment expansion are omitted. No installer consistency checks are triggered.'
|
|
}
|