GithubHelp home page GithubHelp logo

pjrinaldi / wombatregistry Goto Github PK

View Code? Open in Web Editor NEW
4.0 3.0 0.0 7.78 MB

Stand Alone Version of the Registry Viewer found in Wombat Forensics

License: GNU General Public License v2.0

C++ 96.13% C 2.02% QMake 0.02% Makefile 1.82%
forensics forensics-tools windows-registry cpp gui linux fox-toolkit

wombatregistry's People

Contributors

pjrinaldi avatar

Stargazers

 avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

wombatregistry's Issues

OpenSavePidlMRU mostly parsed correctly

still a few issues where the 0x8000 and 0x2000 show up more than once, so the wrong info gets read, but closer for v0.6 and i'll continue to research and see if there is a way to parse the artifact properly. i think it has something to do with a ms shellitem.

static linking

current static linking install command doesn't wrap libregf.a into the executable, i need to modify it according to wombathasher code to actually get it built in.

opensavepidlmru

need to look at other examples and see if there is a common thread to pull the file name out.

Reporting item end line

The end line is too long, it isn't the width of the 1st row of text, it's the length of all the text across all the rows and it is too long.

need to fix this so the length is the correct length after the hex display, which should be a standard size based on the hex display.

Other Registry Formats

Add parsing for registries from Win3.1, 95, and any other registry format not covered by libregf

Fixes

Need to update status message when a non compatible file is opened, also need to add the proper gui features to the buttons as well as the tiptext to get it working.

Toolbar or Menubar

Need to add a toolbar, i'm not big on menu bars. this will provide teh reporting/tagging buttons that i need.

Decouple Code

Implement the pieces which were in wombatforensics and decouple the other parts so the code will work independently. I'm still leaving the registry viewer in wombatforensics, but this will enable me to use a registry viewer on linux.

Fix Removal

Need to fix the remove tags code which needs to loop backwards so that entries aren't missed. Might not be an issue since the tag remover would remove a specific tag and not necessarily all tags. I'll have to check and see. if it needs to be fixed, i'll need to fix this in other code such as mailviewer and sqlite tool, etc.

wombat registry release crashes where debug doesn't

wombatregistry release will crash when the debug version doesn't. not sure why and it's kind of annoying to have to double debug 2 versions of a program, so i'm playing around with fox toolkit and seeing how that will work rather than qt5.

Command line arguments issue

loading a registry file from the command line doesn't seem to full launch everything correctly, need to look at the code and ensure nothing is missing from the open button vs the command line.

previous openhive directory

Should implement the openhive to open in the directory it was in previously.

if(prevopendir.isEmpty())
prevdir = QDir::homePath())

once hivefilepath is set, also set prevopendir

Content Column

For parsed value content, i should add a column to the value table and pre-populate it with the parsed content, this way you don't have to click on the value to see it's content.

Reporting Export

Need to implement report export functionality and the html code to generate teh report.

More Content Sections

I also need to provide more parsed text for more key/values...

Will use the real world work of what I've been tagging lately for user data and system info, software info, and usb device info as a guide of how I would like the information parsed and displayed.

Empty Entry when no value exists

I either need an empty value when none exists, or I need a way to tag the folders, but I think the entry method is the better way to go.

UTF-8 hex is different

The value utf-8 content is different between the actual displayed code and the code as it is in the html report...

have to figure out why??

Reporting Enhancement

I'm not exactly happy with the reporting generation output.

I think there has to be a better way to generate the layout of the report. When I gen a report and try to add it into an overall analysis results html report, it doesn't blend in well.

I may need the standalone report as one method and then a add-in report which arranges the key/values tagged differently for another report method

Need a Close button

Need a way to close a selected registry file so i don't have to exit the program if i don't want to edit multiple registries at the same time.

Allow TimeZone Change

Need to add timezone button/settings to the toolbar or maybe when you publish report...

TimeZoneInformation & Select

Not properly displaying values for timezoneinformation and select keys from the \SOFTWARE\ControlSet001\Control\TimeZoneInformation and \SOFTWARE\Select

html contents links

link tags work until i click to open a tagged item. then the links open the last page...

need to figure this out..

tagging issue

When i tag one value in the ntuser/console, and then switch keys and go back to that key, all values below it get tagged...

I need to look at the restore tag code and fix whatever issue exists, it could be a found issue or contains, etc...
will have to debug.

2+ registry files at same time

Currently, the code allows 2 registry files to be added at once, but eventually the display of values get's all screwed up between them. either need to implement 1 at a time, or figure out what is going wrong with multiple files and fix accordingly. If i had to guess, the issue would be the filename of the last loaded wipes out the file name of the original, so the keys/values can't be dynamically loaded anymore.

Quick idea to resolve is to store the filepath's in an array and then use that to get the right filename to load the correct key/value pairs.
have to ensure the treewidget matches with the filepath array.

Report Generation

Need to move report generation from the viewer to the main code, otherwise you have to preview the report before you can publish the report, which is silly. I fixed this in the mailviewer, so i can look there if i forget how to fix it.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.