[wpkg-users] [OT?] Nested for on a cmd script...

Marco Gaiarin gaio at sv.lnf.it
Mon Feb 9 11:19:10 CET 2015


Mandi! Stefan Pendl
  In chel di` si favelave...

> could you post some example lines of the rules, so we could see what
> can be used to filter?

Attached my curreent script and rules file. Clearly, you have to
decomment the last line in srp.paths. ;-)


> May be using FINDSTR instead of FIND could be an option, since
> FINDSTR uses regular expression syntax by default.

Seems not a 'find' trouble, at least using '%%' now.


> I would also use a sample batch file with only the parsing to start
> with and add pieces until I get a syntax that works for the final
> batch file.

As you can see, mu batch script is just very simple...


> May be it will be time to change to Javascript to succeed, instead
> of using batch commands.

I can also keep using 'REG_EXPAND_SZ' for every rule, i think can only
add some little overhead... i'm only curious. ;-)

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''                    http://www.sv.lnf.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
    http://www.lanostrafamiglia.it/25/index.php/component/k2/item/123
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
-------------- next part --------------
@ECHO OFF
::
::  Script per l'applicazione registry-based delle Software Restriction Policies.
::  Copyright (C) 2015  Marco Gaiarin (gaio at linux.it)
::
::  This program is free software; you can redistribute it and/or
::  modify it under the terms of the GNU General Public License
::  as published by the Free Software Foundation; either version 2
::  of the License, or (at your option) any later version.
::
::  This program is distributed in the hope that it will be useful,
::  but WITHOUT ANY WARRANTY; without even the implied warranty of
::  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
::  GNU General Public License for more details.
::
::  You should have received a copy of the GNU General Public License
::  along with this program; if not, write to the Free Software
::  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
::  USA.
::
:: CHANGELOG
:: (Tue Feb  3 16:40:04 CET 2015)
::   + prima versione
:: (Wed Feb  4 12:13:12 CET 2015)
::   + Elimino il calcolo del tipo di chiave, metto tutto a REG_EXPAND_SZ
::   + aggiungo le redirezioni a NUL, evito le limitazioni del buffer di cscript

:: Devo definire 'EnableDelayedExpansion' per poter gestire la complessita delle variabili nei for.
::
Setlocal EnableDelayedExpansion

:: Il parametro passato in cmdline indica se devo operare in modo black (tutto negato a parte whitelist)
:: o white (tutto permesso a parte blacklist).
:: Se non specificato, è white.
::
if "%1" == "black" (
	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "DefaultLevel" /t REG_DWORD /d "0" >nul 2>nul
) else (
	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "DefaultLevel" /t REG_DWORD /d "262144" >nul 2>nul
)

:: Sistemo gli altri parametri comuni. In particolare le policy sono disabilitate per Administrator.
::
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "TransparentEnabled" /t REG_DWORD /d "1" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "PolicyScope" /t REG_DWORD /d "1" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "AuthenticodeEnabled" /t REG_DWORD /d "0" >nul 2>nul
:: Standard, meno i LNK (link) che non si capisce che ci faccino qui dentro...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "ExecutableTypes" /t REG_MULTI_SZ /d "WSC\0VB\0URL\0SHS\0SCR\0REG\0PIF\0PCD\0OCX\0MST\0MSP\0MSI\0MSC\0MDE\0MDB\0ISP\0INS\0INF\0HTA\0HLP\0EXE\0CRT\0CPL\0COM\0CMD\0CHM\0BAT\0BAS\0ADP\0ADE" >nul 2>nul

:: Il timestamp delle regole, è fisso, ed è un timestamp di oggi.
::
set ts=130674430620013217

:: Ciclo tra le regole custom, prima generali e poi specifiche.
::
for /F "eol=; tokens=1,*" %%l in ( %WPKGROOT%\packages\srp.paths %WPKGROOT%\packages\srp\%COMPUTERNAME%.paths ) do (

	:: primo campo: il livello.
	set level=262144
	if "%%l" == "black" (
		set level=0
	)

	:: secondo campo: il path
	set pathrule=%%m

	:: faccio qualcosa solo se ho un path... salto le righe nulle o malformate.
	if "!pathrule!" neq "" (

		:: Calcolo il tipo. NON FUNZIONA.
		set type=REG_SZ
		echo !pathrule! | find "%%" >nul 2>nul && set type=REG_EXPAND_SZ

		:: Genero un UUID e inserisco la voce, devo farlo all'interno del for per evitare le delayed expansion.
		for /F "tokens=1" %%u in ( '%WPKGROOT%\tools\Uuidgen.Exe' ) do (
			reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "ItemData" /t "!type!" /d "!pathrule!" >nul 2>nul
			reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "LastModified" /t "REG_QWORD" /d "%ts%" >nul 2>nul
			reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "SaferFlags" /t "REG_DWORD" /d "0" >nul 2>nul
			reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "Description" /t "REG_SZ" /d "" >nul 2>nul
		)
	)
)

:: Esco
::
exit 0
-------------- next part --------------
; Elenco di regole di Software Restriction Policy.
; Il primo campo è la tipologia (black o white), segue la regola.

; Queste sono le regole standard, che è sempre bene avere.
; In generale le regole di WHITELIST è bene che non facciano riferimento a variabili d'ambiente
; perchè ovviamente possono essere abusate.
; Meglio usare le 'registry path rules'.
;
white %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
white %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%
white %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%

; Alcune regole di blacklist. Qui le variabili ovviamente hanno più senso. ;-)
;
black %AppData%
black %LocalAppData%
black %TEMP%

; Posso anche usare path assoluti, ma meglio usare sempre perlomeno %SystemDrive%...
;
;black c:\prova


More information about the wpkg-users mailing list