Skip to content

Commit 0ea2de0

Browse files
author
4n6ist
committed
v1.3.1
1 parent 2012707 commit 0ea2de0

15 files changed

+284
-68
lines changed

‎CDIR/CDIR.cpp

+217-43
Large diffs are not rendered by default.

‎CDIR/CDIR.rc

0 Bytes
Binary file not shown.

‎CDIR/CDIR.vcxproj

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?xml version="1.0" encoding="utf-8"?>
2-
<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
2+
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup Label="ProjectConfigurations">
44
<ProjectConfiguration Include="Debug|Win32">
55
<Configuration>Debug</Configuration>
@@ -23,33 +23,33 @@
2323
<Keyword>Win32Proj</Keyword>
2424
<RootNamespace>CDIR</RootNamespace>
2525
<ProjectName>cdir-collector</ProjectName>
26-
<WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
26+
<WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
2727
</PropertyGroup>
2828
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2929
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
3030
<ConfigurationType>Application</ConfigurationType>
3131
<UseDebugLibraries>true</UseDebugLibraries>
32-
<PlatformToolset>v140_xp</PlatformToolset>
32+
<PlatformToolset>v141</PlatformToolset>
3333
<CharacterSet>MultiByte</CharacterSet>
3434
<UseOfMfc>Static</UseOfMfc>
3535
</PropertyGroup>
3636
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
3737
<ConfigurationType>Application</ConfigurationType>
3838
<UseDebugLibraries>false</UseDebugLibraries>
39-
<PlatformToolset>v140</PlatformToolset>
39+
<PlatformToolset>v141</PlatformToolset>
4040
<WholeProgramOptimization>true</WholeProgramOptimization>
4141
<CharacterSet>MultiByte</CharacterSet>
4242
</PropertyGroup>
4343
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
4444
<ConfigurationType>Application</ConfigurationType>
4545
<UseDebugLibraries>true</UseDebugLibraries>
46-
<PlatformToolset>v140</PlatformToolset>
46+
<PlatformToolset>v141</PlatformToolset>
4747
<CharacterSet>MultiByte</CharacterSet>
4848
</PropertyGroup>
4949
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
5050
<ConfigurationType>Application</ConfigurationType>
5151
<UseDebugLibraries>false</UseDebugLibraries>
52-
<PlatformToolset>v140</PlatformToolset>
52+
<PlatformToolset>v141</PlatformToolset>
5353
<WholeProgramOptimization>true</WholeProgramOptimization>
5454
<CharacterSet>MultiByte</CharacterSet>
5555
</PropertyGroup>

‎CDIR/ConfigParser.cpp

+6-3
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,16 @@ ConfigParser::ConfigParser(string path)
2222
string key = l.substr(0, idx);
2323
string val = l.substr(idx+1);
2424

25-
// trim string
25+
// trim key string
2626
key = trim(key);
27-
val = trim(val);
27+
2828
if (CONFIGLIST.find(key) != CONFIGLIST.end()) {
2929
Value value;
3030
value.type = CONFIGLIST[key];
3131
switch (CONFIGLIST[key]) {
3232
case TYPE_BOOL:
3333
value.ptr = new bool;
34+
val = trim(val);
3435
*((bool*)value.ptr) = [=]() {
3536
if (_stricmp("true", val.c_str()) == 0) {
3637
return true;
@@ -56,11 +57,13 @@ ConfigParser::ConfigParser(string path)
5657
break;
5758
case TYPE_INT:
5859
value.ptr = new int;
60+
val = trim(val);
5961
*((int*)value.ptr) = atoi(val.c_str());
6062
break;
6163
case TYPE_STRING:
6264
value.ptr = new string;
63-
*((string*)value.ptr) = val;
65+
for (idx = 0; idx < val.size() && isspace(val[idx]); idx++);
66+
*((string*)value.ptr) = val.substr(idx);
6467
break;
6568
}
6669
m[key] = value;

‎CDIR/ConfigParser.h

+6-1
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,17 @@ struct c_ignorecase:std::binary_function<string, string, bool> {
3232
static map<string, TYPE_ID, c_ignorecase> CONFIGLIST = {
3333
{"MemoryDump", TYPE_BOOL},
3434
{"MFT", TYPE_BOOL},
35+
{"Secure", TYPE_BOOL},
3536
{"UsnJrnl", TYPE_BOOL},
3637
{"EventLog", TYPE_BOOL},
3738
{"Prefetch", TYPE_BOOL},
3839
{"Registry", TYPE_BOOL},
40+
{"WMI", TYPE_BOOL},
41+
{"SRUM", TYPE_BOOL },
42+
{"Web", TYPE_BOOL },
3943
{"Output", TYPE_STRING},
40-
{"Web", TYPE_BOOL},
44+
{"Target", TYPE_STRING},
45+
{"MemoryDumpCmdline", TYPE_STRING},
4146
{"host", TYPE_STRING},
4247
{"port", TYPE_INT},
4348
{"path", TYPE_STRING}

‎CDIR/cdir.ini

+8-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,16 @@
1-
;MemoryDump = false
1+
;MemoryDump = true
22
MFT = true
3+
Secure = true
34
UsnJrnl = true
45
EventLog = true
56
Prefetch = true
67
Registry = true
8+
WMI = true
9+
SRUM = true
710
Web = true
11+
;Target = G:\
12+
;MemoryDumpCmdline = DumpIt.exe /Q /N /T DMP /O RAM.dmp
13+
;MemoryDumpCmdline = RamCapture64.exe RAM.raw
14+
;MemoryDumpCmdline = MagnetRAMCapture.exe /accepteula /go .\RAM.raw
815
;Output = E:\
916
;Output = \\hostname\sharename\

‎CDIR/libressl-2.4.1-windows/x86/libcrypto-38.dll

1.31 MB
Binary file not shown.

‎CDIR/libressl-2.4.1-windows/x86/libssl-39.dll

291 KB
Binary file not shown.

‎CDIR/libressl-2.4.1-windows/x86/libtls-11.dll

54.6 KB
Binary file not shown.

‎CDIR/util.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -142,4 +142,4 @@ vector<pair<string, int>> findfiles(string filepath, bool error) {
142142
}
143143

144144
return paths;
145-
}
145+
}

‎CDIR/util.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ string dirname(string &, char delim = '\\');
1515
string msg(string jp, string en, WORD lang = GetUserDefaultLangID());
1616
string join(vector<string>, string);
1717
string hexdump(const unsigned char*, size_t);
18-
vector<pair<string, int>> findfiles(string, bool error=true);
18+
vector<pair<string, int>> findfiles(string, bool error=true);

‎NTFSParserDLL/NTFSParserDLL.vcxproj

+8-3
Original file line numberDiff line numberDiff line change
@@ -22,24 +22,25 @@
2222
<ProjectGuid>{5E42B778-F231-4797-B7FD-7D5BCA9738D0}</ProjectGuid>
2323
<Keyword>Win32Proj</Keyword>
2424
<RootNamespace>NTFSParserDLL</RootNamespace>
25+
<WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
2526
</PropertyGroup>
2627
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2728
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
2829
<ConfigurationType>DynamicLibrary</ConfigurationType>
2930
<UseDebugLibraries>true</UseDebugLibraries>
30-
<PlatformToolset>v140</PlatformToolset>
31+
<PlatformToolset>v141</PlatformToolset>
3132
<CharacterSet>NotSet</CharacterSet>
3233
</PropertyGroup>
3334
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
3435
<ConfigurationType>DynamicLibrary</ConfigurationType>
3536
<UseDebugLibraries>true</UseDebugLibraries>
36-
<PlatformToolset>v140</PlatformToolset>
37+
<PlatformToolset>v141</PlatformToolset>
3738
<CharacterSet>NotSet</CharacterSet>
3839
</PropertyGroup>
3940
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
4041
<ConfigurationType>DynamicLibrary</ConfigurationType>
4142
<UseDebugLibraries>false</UseDebugLibraries>
42-
<PlatformToolset>v140_xp</PlatformToolset>
43+
<PlatformToolset>v141</PlatformToolset>
4344
<WholeProgramOptimization>true</WholeProgramOptimization>
4445
<CharacterSet>NotSet</CharacterSet>
4546
</PropertyGroup>
@@ -74,6 +75,10 @@
7475
</PropertyGroup>
7576
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
7677
<LinkIncremental>false</LinkIncremental>
78+
<ExecutablePath>C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin;$(ExecutablePath)</ExecutablePath>
79+
<IncludePath>C:\Program Files\Microsoft SDKs\Windows\v7.1\Include;$(IncludePath)</IncludePath>
80+
<LibraryPath>C:\Program Files\Microsoft SDKs\Windows\v7.1\Lib;$(LibraryPath)</LibraryPath>
81+
<ExcludePath>C:\Program Files\Microsoft SDKs\Windows\v7.1\Include;$(ExcludePath)</ExcludePath>
7782
</PropertyGroup>
7883
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
7984
<LinkIncremental>false</LinkIncremental>

‎NTFSParserDLL/NTFS_FileRecord.h

+3-1
Original file line numberDiff line numberDiff line change
@@ -826,8 +826,10 @@ CNTFSVolume::CNTFSVolume(_TCHAR volume)
826826
Version = 0;
827827
ClearAttrRawCB();
828828

829-
if (!OpenVolume(volume))
829+
if (!OpenVolume(volume)) {
830+
fprintf(stderr, "Volume open error: %c\n", volume);
830831
return;
832+
}
831833

832834
// Verify NTFS volume version (must >= 3.0)
833835

‎README.md

+14-4
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,22 @@
55
cdir-collectorは初動対応時のデータ保全を支援するためのツールです。Windows PC上の以下のデータを取得することが可能です。
66

77
* メモリ
8-
* MFT
9-
* UsnJrnl
8+
* NTFS
9+
* $MFT
10+
* $SECURE:$SDS
11+
* $UsnJrnl:$J
1012
* プリフェッチ
1113
* イベントログ
1214
* レジストリ
13-
* Web(履歴、クッキー)
15+
* Amcache.hve
16+
* SAM, SECURITY, SOFTWARE, SYSTEM
17+
* NTUser.dat, UsrClass.dat
18+
* WMI
19+
* SRUM
20+
* Web
21+
* Default_History (Chrome)
22+
* default_cookies.sqlite, default_places.sqlite (Firefox)
23+
* WebCacheV01.dat (IE, Edge)
1424

1525
## ダウンロード
1626

@@ -20,7 +30,7 @@ https://github.com/CyberDefenseInstitute/CDIR/releases
2030

2131
## ビルド
2232

23-
ソースコードはVisual Studio 2015で読み込みビルドすることができます。cdir-collectorの構成ファイルは以下の通りです。
33+
ソースコードはVisual Studio 2017で読み込みビルドすることができます。cdir-collectorの構成ファイルは以下の通りです。
2434

2535
* cdir.ini
2636
* cdir-collector.exe

‎README_en.md

+14-4
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,22 @@
55
cdir-collector is a collection tool for first response. it collects the following data on Windows.
66

77
* RAM
8-
* MFT
9-
* UsnJrnl
8+
* NTFS
9+
* $MFT
10+
* $SECURE:$SDS
11+
* $UsnJrnl:$J
1012
* Prefetch
1113
* EventLog
1214
* Registry
13-
* Web(History, Cookie)
15+
* Amcache.hve
16+
* SAM, SECURITY, SOFTWARE, SYSTEM
17+
* NTUser.dat, UsrClass.dat
18+
* WMI
19+
* SRUM
20+
* Web
21+
* Default_History (Chrome)
22+
* default_cookies.sqlite, default_places.sqlite (Firefox)
23+
* WebCacheV01.dat (IE, Edge)
1424

1525
## Download
1626

@@ -20,7 +30,7 @@ https://github.com/CyberDefenseInstitute/CDIR/releases
2030

2131
## Build
2232

23-
If you want to customise and build binary from source code, try to use Visual Studio 2015.
33+
If you want to customise and build binary from source code, try to use Visual Studio 2017.
2434

2535
Component of cdir-collector:
2636
* cdir.ini

0 commit comments

Comments
 (0)