Skip to content

Commit ddf042c

Browse files
author
4n6ist
committed
v1.2.1
1 parent 8952a9f commit ddf042c

8 files changed

+82
-21
lines changed

‎CDIR/CDIR.cpp

+34-10
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
#pragma comment(lib, "libcrypto-38.lib")
4242

4343
#define CHUNKSIZE 262144
44+
#define BLOCKSIZE 4096
4445

4546
using namespace std;
4647

@@ -264,7 +265,10 @@ int StealthGetFile(char *filepath, char *outpath, ostringstream *osslog = NULL,
264265
offset = skipclusters * file->volume->GetClusterSize();
265266
}
266267

267-
if (!WriteWrapper::isLocal() && !(SparseSkip && strcmp(filepath, "C:\\$Extend\\$UsnJrnl:$J") == 0)) { // if using WebDAV and reading file except UsnJrnl
268+
char journalpath[MAX_PATH + 1];
269+
sprintf(journalpath, "%s\\$Extend\\$UsnJrnl:$J", osvolume);
270+
271+
if (!WriteWrapper::isLocal() && !(SparseSkip && strcmp(filepath, journalpath) == 0)) { // if using WebDAV and reading file except UsnJrnl
268272
if (wfile.sendheader()) {
269273
fprintf(stderr, "failed to send header.\n");
270274
return -1;
@@ -276,7 +280,7 @@ int StealthGetFile(char *filepath, char *outpath, ostringstream *osslog = NULL,
276280
int ret;
277281

278282
if ((ret = StealthReadFile(file, buf, CHUNKSIZE, offset, &bytesread, &bytesleft, filesize)) != 0) {
279-
if(SparseSkip && strcmp(filepath, "C:\\$Extend\\$UsnJrnl:$J") == 0){
283+
if(SparseSkip && strcmp(filepath, journalpath) == 0){
280284
filesize -= offset;
281285
skipclusters = 0;
282286
file->data = (CAttrBase*)file->fileRecord->FindNextStream("$J", atrnum);
@@ -304,7 +308,7 @@ int StealthGetFile(char *filepath, char *outpath, ostringstream *osslog = NULL,
304308
bytesleft = 1; // To continue loop
305309
continue;
306310
}
307-
else if (offset < filesize) {
311+
else if (ret == 4 && offset < filesize) {
308312
filesize -= offset;
309313
file->data = (CAttrBase*)file->fileRecord->FindNextStream(0,atrnum);
310314
if (file->data == NULL) {
@@ -317,6 +321,12 @@ int StealthGetFile(char *filepath, char *outpath, ostringstream *osslog = NULL,
317321
bytesleft = 1; // To continue loop
318322
continue;
319323
}
324+
else if (ret == 3) {
325+
int adjustsize = CHUNKSIZE;
326+
adjustsize -= BLOCKSIZE;
327+
while (StealthReadFile(file, buf, adjustsize, offset, &bytesread, &bytesleft, filesize) == 3)
328+
adjustsize -= BLOCKSIZE;
329+
}
320330
else{
321331
_perror("Error reading file");
322332
printf("filename: %s, offset: %lld\n", filepath, offset);
@@ -345,7 +355,10 @@ int StealthGetFile(char *filepath, char *outpath, ostringstream *osslog = NULL,
345355
}
346356
}
347357
// osfile.write((char*)buf, bytesread);
348-
wfile.write((char*)buf, bytesread);
358+
if (wfile.write((char*)buf, bytesread) < 0) {
359+
fprintf(stderr, "failed to write file.\n");
360+
return -1;
361+
}
349362
offset += bytesread;
350363
} while (bytesleft > 0 && offset < filesize);
351364

@@ -356,7 +369,9 @@ int StealthGetFile(char *filepath, char *outpath, ostringstream *osslog = NULL,
356369
StealthCloseFile(file);
357370

358371
if (WriteWrapper::isLocal()) {
359-
CopyFileTime(filepath, outpath);
372+
if (CopyFileTime(filepath, outpath)) {
373+
fprintf(stderr, "failed to copy filetime: %s\n", filepath);
374+
}
360375
}
361376

362377
if (osslog) {
@@ -562,6 +577,12 @@ int get_analysisdata(ostringstream *osslog = NULL) {
562577
cerr << msg("ジャーナル 取得失敗", "failed to save journal") << endl;
563578
}
564579
}
580+
else {
581+
cerr << msg("ジャーナル 取得完了", "journal is saved") << endl;
582+
}
583+
}
584+
else {
585+
cerr << msg("ジャーナル 取得完了", "journal is saved") << endl;
565586
}
566587
}
567588

@@ -771,7 +792,7 @@ int main(int argc, char **argv)
771792

772793
// chack proces name
773794
procname = basename(string(argv[0]));
774-
cout << msg("CDIR Collector v1.2 - 初動対応用データ収集ツール", "CDIR Collector v1.2 - Data Acquisition Tool for First Response") << endl;
795+
cout << msg("CDIR Collector v1.2.1 - 初動対応用データ収集ツール", "CDIR Collector v1.2.1 - Data Acquisition Tool for First Response") << endl;
775796
cout << msg("Cyber Defense Institute, Inc.\n", "Cyber Defense Institute, Inc.\n") << endl;
776797

777798
// getting config
@@ -831,7 +852,7 @@ int main(int argc, char **argv)
831852
_perror("localtime");
832853
__exit(EXIT_FAILURE);
833854
}
834-
if (!strftime(timestamp, sizeof(timestamp), "%Y%m%d%H%M%S", t) || !strftime(t_beg, sizeof(t_beg), "%Y %m/%d %H:%M:%S", t)) {
855+
if (!strftime(timestamp, sizeof(timestamp), "%Y%m%d%H%M%S", t) || !strftime(t_beg, sizeof(t_beg), "%Y/%m/%d %H:%M:%S", t)) {
835856
_perror("strftime");
836857
__exit(EXIT_FAILURE);
837858
}
@@ -888,7 +909,8 @@ int main(int argc, char **argv)
888909
_perror("GetCurrentDirectory");
889910
__exit(EXIT_FAILURE);
890911
}
891-
cerr << msg("保存先: ", "Output Directory: ") << outdir << endl;
912+
if (WriteWrapper::isLocal())
913+
cerr << msg("保存先: ", "Output Directory: ") << outdir << endl;
892914

893915
// start logging
894916
ostringstream ossinfo, osslog;
@@ -974,7 +996,7 @@ int main(int argc, char **argv)
974996
_perror("localtime");
975997
__exit(EXIT_FAILURE);
976998
}
977-
if (!strftime(t_end, sizeof(t_end), "%Y %m/%d %H:%M:%S", t)) {
999+
if (!strftime(t_end, sizeof(t_end), "%Y/%m/%d %H:%M:%S", t)) {
9781000
_perror("strftime");
9791001
__exit(EXIT_FAILURE);
9801002
}
@@ -1022,7 +1044,9 @@ int main(int argc, char **argv)
10221044

10231045
string log_str = ossinfo.str();
10241046
WriteWrapper log("collector-log.txt", log_str.size());
1025-
log.sendfile(log_str.c_str());
1047+
if (log.sendfile(log_str.c_str())) {
1048+
fprintf(stderr, "failed to save log");
1049+
}
10261050
log.close();
10271051
__exit(EXIT_SUCCESS);
10281052
}

‎CDIR/CDIR.rc

0 Bytes
Binary file not shown.

‎CDIR/WriteWrapper.cpp

+31-8
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ WriteWrapper::WriteWrapper(char *_filename, ULONGLONG _filesize, bool isDirector
6969
string header = "CONNECT " + address + ":443" + " HTTP/1.1" + "\r\n"
7070
+ "Host: " + address + ":443\r\n"
7171
+ "\r\n";
72-
if (write(header.c_str(), header.length()) != 0) {
72+
if (write(header.c_str(), header.length()) > 0) {
7373
readuntil("\r\n\r\n");
7474
}
7575
}
@@ -101,6 +101,10 @@ WriteWrapper::WriteWrapper(char *_filename, ULONGLONG _filesize, bool isDirector
101101
}
102102
else {
103103
osfile.open(filename, ios::out | ios::binary | ios::app);
104+
if (osfile.fail() && !isDirectory) {
105+
fprintf(stderr, "failed to open %s\n", filename);
106+
return;
107+
}
104108
}
105109
}
106110

@@ -249,7 +253,7 @@ string WriteWrapper::urlencode(string s) {
249253
void WriteWrapper::mkdir(string dirname) {
250254
string header = "MKCOL " + join({uriroot, curdir, WriteWrapper::urlencode(dirname)}, "/") + "/" + " HTTP/1.1" + "\r\n"
251255
+ "Host: " + address + ":" + to_string(port) + "\r\n\r\n";
252-
if (write(header.c_str(), header.length()) == 0) {
256+
if (write(header.c_str(), header.length()) <= 0) {
253257
cerr << "write failed" << endl;
254258
}
255259
}
@@ -263,15 +267,21 @@ void WriteWrapper::chdir(string dirname) {
263267
}
264268
}
265269

266-
void WriteWrapper::sendfile(const char *data) {
270+
int WriteWrapper::sendfile(const char *data) {
271+
if (data == NULL) {
272+
fprintf(stderr, "data must not be NULL\n");
273+
return -1;
274+
}
267275
if(!isLocal())
268276
if (sendheader()) {
269277
fprintf(stderr, "failed to send header.\n");
270-
return;
278+
return -1;
271279
}
272-
if (write(data, filesize) == 0) {
280+
if (write(data, filesize) <= 0) {
273281
cerr << "write failed" << endl;
282+
return -1;
274283
}
284+
return 0;
275285
}
276286

277287
int WriteWrapper::sendheader(ULONGLONG size) {
@@ -285,7 +295,7 @@ int WriteWrapper::sendheader(ULONGLONG size) {
285295
+ "Host: " + address + ":" + to_string(port) + "\r\n"
286296
+ "Content-Length: " + to_string(filesize) + "\r\n"
287297
+ "\r\n";
288-
if (write(header.c_str(), header.length())) {
298+
if (write(header.c_str(), header.length()) > 0) {
289299
isHeaderSent = true;
290300
return 0;
291301
}
@@ -300,6 +310,9 @@ int WriteWrapper::sendheader(ULONGLONG size) {
300310
/// <param name="size">書き込むサイズ</param>
301311
/// <returns>失敗すると-1が返る</returns>
302312
long long WriteWrapper::write(const char *buf, long long size) {
313+
if (buf == NULL) {
314+
return -1;
315+
}
303316
if (status == STATUS_REMOTE) {
304317
long long sent = 0;
305318
int r;
@@ -330,6 +343,9 @@ long long WriteWrapper::write(const char *buf, long long size) {
330343
}
331344

332345
long long WriteWrapper::read(char *buf, long long size) {
346+
if (buf == NULL) {
347+
return -1;
348+
}
333349
if (status == STATUS_REMOTE) {
334350
long long recieved = 0;
335351
int r;
@@ -384,10 +400,17 @@ string WriteWrapper::readuntil(string delim) {
384400

385401
void WriteWrapper::close() {
386402
if (status == STATUS_REMOTE) {
387-
closesocket(sock);
388-
WSACleanup();
403+
if (closesocket(sock)) {
404+
_perror("closesocket");
405+
}
406+
if (WSACleanup()) {
407+
_perror("WSACleanup");
408+
}
389409
}
390410
else {
391411
osfile.close();
412+
if (osfile.is_open()) {
413+
fprintf(stderr, "close failed\n");
414+
}
392415
}
393416
}

‎CDIR/WriteWrapper.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ class WriteWrapper
4949
string urlencode(string);
5050
void mkdir(string);
5151
static void chdir(string);
52-
void sendfile(const char *);
52+
int sendfile(const char *);
5353
int sendheader(ULONGLONG = 0);
5454
long long write(const char *, long long);
5555
long long read(char *, long long);

‎CDIR/util.cpp

+9-1
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,19 @@ void _perror(char *msg) {
2828
cerr << "FormatMessage failed" << endl;
2929
}
3030
else {
31-
cerr << msg << ": " << buf << endl;
31+
if (msg)
32+
cerr << msg << ": ";
33+
cerr << buf << endl;
3234
}
3335
}
3436

3537
void mkdir(char *dirname, bool error) {
3638
WriteWrapper dir("", 0, true);
3739

40+
if (dirname == NULL) {
41+
fprintf(stderr, "dirname must not be NULL\n");
42+
return;
43+
}
3844
string dirname_s = string(dirname);
3945

4046
size_t pos;
@@ -100,6 +106,8 @@ string join(vector<string> vs, string delim) {
100106
}
101107

102108
string hexdump(const unsigned char *s, size_t size) {
109+
if (s == NULL)
110+
return "";
103111
ostringstream res;
104112
for (size_t i = 0; i < size; i++) {
105113
res << setw(2) << setfill('0') << hex << (unsigned int)s[i];

‎NTFSParserDLL/NTFSParserDLL.cpp

+5-1
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,11 @@ extern "C" DWORD __declspec(dllexport) StealthReadFile(FileInfo_t* fileInfo, BYT
169169
*dataRemaining = fullDataLength - len - offset;
170170
return 0; //Success
171171
}
172-
return 3;
172+
else if (fileInfo->data->ReadData(offset, buffer, 1, &len))
173+
{
174+
return 3;
175+
}
176+
return 4;
173177
}
174178
return 2;
175179
}

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ cdir-collectorは初動対応時のデータ保全を支援するためのツー
1010
* プリフェッチ
1111
* イベントログ
1212
* レジストリ
13+
* Web(履歴、クッキー)
1314

1415
## ダウンロード
1516

‎README_en.md

+1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ cdir-collector is a collection tool for first response. it collects the followin
1010
* Prefetch
1111
* EventLog
1212
* Registry
13+
* Web(History, Cookie)
1314

1415
## Download
1516

0 commit comments

Comments
 (0)