Phase 2 — Generic SOFTWARE/SYSTEM/SAM hive value extraction (CFReDS gap G-001)

[Juwon1405]

Source

This issue was opened as a result of CFReDS Hacking Case integration (case-08) — see examples/case-studies/case-08-cfreds-hacking-case/README.md for full context.

Gap

dart-mcp v0.5.3 has read-only adapters for AmCache, ShimCache, and ShellBags, but lacks a generic registry hive value extraction primitive. This blocks 4 of 10 sampled CFReDS findings:

• F-CFR-001 (registered owner — SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner)
• F-CFR-004 (network cards — SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards)
• F-CFR-007 (logon stats — SAM\Domains\Users\Names)
• F-CFR-010 (last shutdown time — SYSTEM\CurrentControlSet001\Control\Windows\ShutdownTime)

Proposed primitive

@register_tool
def parse_registry_hive(
    hive_path: str,         # required: relative path within DART_EVIDENCE_ROOT
    key: str,                # required: registry key path (forward or backslash separated)
    value_name: str = None,  # optional: specific value name; if None, dump all values under key
) -> dict:
    """Extract registry hive values via python-registry (already in deps).
    
    Read-only — no hive modification. Path canonicalization through
    _safe_resolve() like all other primitives.
    """

Acceptance criteria

• parse_registry_hive registered in dart_mcp (positive surface)
• tests/test_mcp_bypass.py confirms it's not in the negative surface
• Path canonicalization tested (cannot escape DART_EVIDENCE_ROOT)
• tests/test_mcp_surface.py updated (60 → 61)
• CHANGELOG entry
• case-08 ground-truth findings F-CFR-001/004/007/010 flip to directly_detectable_v054 = true
• Re-measure CFReDS recall — strict 0.10 → ~0.50, lenient 0.40 → ~0.80

Implementation estimate

1-2 weeks. python-registry is already in dart_mcp deps for AmCache/ShimCache work.

Cross-references

• case-08 README — gap G-001
• ground-truth.json — phase_2_gap_analysis.G-001