Skip to content

Commit 04cb911

Browse files
hashimoto62563hashimoto62563
committed
v.1.3.4
1 parent 72872a1 commit 04cb911

File tree

8 files changed

+104
-28
lines changed

8 files changed

+104
-28
lines changed

‎CDIR/CDIR.cpp

+59-18
Original file line numberDiff line numberDiff line change
@@ -749,11 +749,15 @@ int get_analysisdata(ostringstream *osslog = NULL) {
749749
Wow64DisableWow64FsRedirection(&oldval);
750750

751751
char findpath[MAX_PATH + 1];
752+
char filepath[MAX_PATH + 1];
752753
char srcpath[MAX_PATH + 1];
753754
char dstpath[MAX_PATH + 1];
754755

755-
if (param_mftdump == true) {
756+
if (param_mftdump || param_securedump || param_usndump) {
756757
mkdir("NTFS");
758+
}
759+
760+
if (param_mftdump == true) {
757761
// get MFT
758762
sprintf(srcpath, "%s\\$MFT", osvolume);
759763
sprintf(dstpath, "NTFS\\%c_$MFT", osvolume[0]);
@@ -867,20 +871,38 @@ int get_analysisdata(ostringstream *osslog = NULL) {
867871
// get prefetch files
868872
mkdir("Prefetch");
869873

870-
sprintf(findpath, "%s\\Prefetch\\*.pf", windir);
874+
sprintf(findpath, "%s\\Prefetch\\*", windir);
871875
auto files = findfiles(string(findpath));
872-
873876
bool flag = false;
874877
for (auto file : files) {
875-
sprintf(srcpath, "%s\\Prefetch\\%s", windir, file.first.c_str());
876-
sprintf(dstpath, "Prefetch\\%s", file.first.c_str());
877-
if (StealthGetFile(srcpath, dstpath, osslog, false)) {
878-
cerr << msg("取得失敗", "failed to save") << ": " << srcpath << endl;
878+
if ( file.first.substr(file.first.length() - 3) == ".pf" ) {
879+
sprintf(srcpath, "%s\\Prefetch\\%s", windir, file.first.c_str());
880+
sprintf(dstpath, "Prefetch\\%s", file.first.c_str());
881+
if (StealthGetFile(srcpath, dstpath, osslog, false)) {
882+
cerr << msg("取得失敗", "failed to save") << ": " << srcpath << endl;
883+
}
884+
else {
885+
flag = true;
886+
}
879887
}
880-
else {
881-
flag = true;
888+
// check if the file has ADS or not
889+
sprintf(filepath, "%s\\Prefetch\\%s", windir, file.first.c_str());
890+
auto strms = findstreams(filepath);
891+
if ( strms.size() > 0 ){
892+
for (auto strm : strms) {
893+
sprintf(srcpath, "%s\\Prefetch\\%s%s", windir, file.first.c_str(), strm.first.c_str());
894+
sprintf(dstpath, "Prefetch\\%s%s", file.first.c_str(), strm.first.c_str());
895+
if (StealthGetFile(srcpath, dstpath, osslog, false)) {
896+
cerr << msg("取得失敗", "failed to save") << ": " << srcpath << endl;
897+
}
898+
else {
899+
flag = true;
900+
}
901+
}
882902
}
903+
883904
}
905+
884906
if (flag) {
885907
cerr << msg("プリフェッチ 取得完了", "prefetch is saved") << endl;
886908
}
@@ -890,20 +912,38 @@ int get_analysisdata(ostringstream *osslog = NULL) {
890912

891913
// Windows.old
892914
if (PathIsDirectory(backupdir)) {
915+
893916
mkdir("Prefetch_old");
894-
895-
sprintf(findpath, "%s\\Prefetch\\*.pf", windir_old);
917+
sprintf(findpath, "%s\\Prefetch\\*", windir_old);
896918
auto files = findfiles(string(findpath));
897919

898920
bool flag = false;
921+
899922
for (auto file : files) {
900-
sprintf(srcpath, "%s\\Prefetch\\%s", windir_old, file.first.c_str());
901-
sprintf(dstpath, "Prefetch_old\\%s", file.first.c_str());
902-
if (StealthGetFile(srcpath, dstpath, osslog, false)) {
903-
cerr << msg("取得失敗", "failed to save") << ": " << srcpath << endl;
923+
if ( file.first.substr(file.first.length() - 3) == ".pf" ) {
924+
sprintf(srcpath, "%s\\Prefetch\\%s", windir_old, file.first.c_str());
925+
sprintf(dstpath, "Prefetch_old\\%s", file.first.c_str());
926+
if (StealthGetFile(srcpath, dstpath, osslog, false)) {
927+
cerr << msg("取得失敗", "failed to save") << ": " << srcpath << endl;
928+
}
929+
else {
930+
flag = true;
931+
}
904932
}
905-
else {
906-
flag = true;
933+
// check if the file has ADS or not
934+
sprintf(filepath, "%s\\Prefetch\\%s", windir_old, file.first.c_str());
935+
auto strms = findstreams(filepath);
936+
if (strms.size() > 0) {
937+
for (auto strm : strms) {
938+
sprintf(srcpath, "%s\\Prefetch\\%s%s", windir_old, file.first.c_str(), strm.first.c_str());
939+
sprintf(dstpath, "Prefetch_old\\%s%s", file.first.c_str(), strm.first.c_str());
940+
if (StealthGetFile(srcpath, dstpath, osslog, false)) {
941+
cerr << msg("取得失敗", "failed to save") << ": " << srcpath << endl;
942+
}
943+
else {
944+
flag = true;
945+
}
946+
}
907947
}
908948
}
909949
if (flag) {
@@ -1173,7 +1213,7 @@ int main(int argc, char **argv)
11731213

11741214
// chack proces name
11751215
procname = basename(string(argv[0]));
1176-
cout << msg("CDIR Collector v1.3.3 - 初動対応用データ収集ツール", "CDIR Collector v1.3.3 - Data Acquisition Tool for First Response") << endl;
1216+
cout << msg("CDIR Collector v1.3.4 - 初動対応用データ収集ツール", "CDIR Collector v1.3.4 - Data Acquisition Tool for First Response") << endl;
11771217
cout << msg("Cyber Defense Institute, Inc.\n", "Cyber Defense Institute, Inc.\n") << endl;
11781218

11791219
// set curdir -> exedir
@@ -1299,6 +1339,7 @@ int main(int argc, char **argv)
12991339
strncpy(usrvolume, (CASTVAL(string, config->getValue("Target"))).c_str(), 2);
13001340
strncpy(sysdir, (CASTVAL(string, config->getValue("Target"))).c_str(), 2);
13011341
strncpy(windir, (CASTVAL(string, config->getValue("Target"))).c_str(), 2);
1342+
strncpy(backupdir, (CASTVAL(string, config->getValue("Target"))).c_str(), 2);
13021343
cerr << "Target: " << osvolume << endl;
13031344
}
13041345

‎CDIR/CDIR.rc

-2.62 KB
Binary file not shown.

‎CDIR/CDIR.vcxproj

+4-4
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
<Keyword>Win32Proj</Keyword>
2424
<RootNamespace>CDIR</RootNamespace>
2525
<ProjectName>cdir-collector</ProjectName>
26-
<WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
2727
</PropertyGroup>
2828
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2929
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -36,20 +36,20 @@
3636
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
3737
<ConfigurationType>Application</ConfigurationType>
3838
<UseDebugLibraries>false</UseDebugLibraries>
39-
<PlatformToolset>v141</PlatformToolset>
39+
<PlatformToolset>v142</PlatformToolset>
4040
<WholeProgramOptimization>true</WholeProgramOptimization>
4141
<CharacterSet>MultiByte</CharacterSet>
4242
</PropertyGroup>
4343
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
4444
<ConfigurationType>Application</ConfigurationType>
4545
<UseDebugLibraries>true</UseDebugLibraries>
46-
<PlatformToolset>v141</PlatformToolset>
46+
<PlatformToolset>v142</PlatformToolset>
4747
<CharacterSet>MultiByte</CharacterSet>
4848
</PropertyGroup>
4949
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
5050
<ConfigurationType>Application</ConfigurationType>
5151
<UseDebugLibraries>false</UseDebugLibraries>
52-
<PlatformToolset>v141</PlatformToolset>
52+
<PlatformToolset>v142</PlatformToolset>
5353
<WholeProgramOptimization>true</WholeProgramOptimization>
5454
<CharacterSet>MultiByte</CharacterSet>
5555
</PropertyGroup>

‎CDIR/util.cpp

+34
Original file line numberDiff line numberDiff line change
@@ -143,3 +143,37 @@ vector<pair<string, int>> findfiles(string filepath, bool error) {
143143

144144
return paths;
145145
}
146+
147+
vector<pair<string, int>> findstreams(const char* cfilepath, bool error) {
148+
149+
vector<pair<string, int>> paths;
150+
WIN32_FIND_STREAM_DATA streamData;
151+
HANDLE hfind;
152+
153+
154+
size_t ret;
155+
wchar_t wfilepath[MAX_PATH + 1];
156+
157+
mbstowcs_s(&ret, wfilepath, size_t(MAX_PATH + 1), cfilepath, _TRUNCATE);
158+
hfind = FindFirstStreamW(wfilepath, FindStreamInfoStandard, &streamData, 0);
159+
160+
if (hfind != INVALID_HANDLE_VALUE) {
161+
do {
162+
char ads[ MAX_PATH + 1 ];
163+
//WideCharToMultiByte(CP_ACP, 0, streamData.cStreamName, -1, mtxt, MAX_PATH, NULL, NULL);
164+
wcstombs_s(&ret, ads, size_t(MAX_PATH + 1), streamData.cStreamName, _TRUNCATE);
165+
166+
if ( strcmp( ads, "::$DATA" ) != 0) {
167+
// trim last ":$DATA"
168+
string ads_str = string(ads).substr(0, string(ads).length() - 6);
169+
paths.push_back(pair<string, int>( ads_str, 0 ) );
170+
}
171+
} while (FindNextStreamW(hfind, &streamData));
172+
if (!FindClose(hfind)) {
173+
_perror("FindClose");
174+
}
175+
176+
}
177+
178+
return paths;
179+
}

‎CDIR/util.h

+1
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,4 @@ string msg(string jp, string en, WORD lang = GetUserDefaultLangID());
1616
string join(vector<string>, string);
1717
string hexdump(const unsigned char*, size_t);
1818
vector<pair<string, int>> findfiles(string, bool error=true);
19+
vector<pair<string, int>> findstreams(const char* cfilepath, bool error = true);

‎NTFSParserDLL/NTFSParserDLL.vcxproj

+4-4
Original file line numberDiff line numberDiff line change
@@ -22,25 +22,25 @@
2222
<ProjectGuid>{5E42B778-F231-4797-B7FD-7D5BCA9738D0}</ProjectGuid>
2323
<Keyword>Win32Proj</Keyword>
2424
<RootNamespace>NTFSParserDLL</RootNamespace>
25-
<WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
25+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
2626
</PropertyGroup>
2727
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2828
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
2929
<ConfigurationType>DynamicLibrary</ConfigurationType>
3030
<UseDebugLibraries>true</UseDebugLibraries>
31-
<PlatformToolset>v141</PlatformToolset>
31+
<PlatformToolset>v142</PlatformToolset>
3232
<CharacterSet>NotSet</CharacterSet>
3333
</PropertyGroup>
3434
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
3535
<ConfigurationType>DynamicLibrary</ConfigurationType>
3636
<UseDebugLibraries>true</UseDebugLibraries>
37-
<PlatformToolset>v141</PlatformToolset>
37+
<PlatformToolset>v142</PlatformToolset>
3838
<CharacterSet>NotSet</CharacterSet>
3939
</PropertyGroup>
4040
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
4141
<ConfigurationType>DynamicLibrary</ConfigurationType>
4242
<UseDebugLibraries>false</UseDebugLibraries>
43-
<PlatformToolset>v141</PlatformToolset>
43+
<PlatformToolset>v142</PlatformToolset>
4444
<WholeProgramOptimization>true</WholeProgramOptimization>
4545
<CharacterSet>NotSet</CharacterSet>
4646
</PropertyGroup>

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ https://github.com/CyberDefenseInstitute/CDIR/releases
3131

3232
## ビルド
3333

34-
ソースコードはVisual Studio 2017で読み込みビルドすることができます。cdir-collectorの構成ファイルは以下の通りです。
34+
ソースコードはVisual Studio 2019で読み込みビルドすることができます。cdir-collectorの構成ファイルは以下の通りです。
3535

3636
* cdir.ini
3737
* cdir-collector.exe

‎README_en.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ https://github.com/CyberDefenseInstitute/CDIR/releases
3131

3232
## Build
3333

34-
If you want to customise and build binary from source code, try to use Visual Studio 2017.
34+
If you want to customise and build binary from source code, try to use Visual Studio 2019.
3535

3636
Component of cdir-collector:
3737
* cdir.ini

0 commit comments

Comments
 (0)