EricZimmerman / EricZimmerman/Issues

AmcacheParser ignores "old format" entries if "new format" entries are found

Open
#203 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
14
Forks
3
PR merge metrics
No merged PRs in 30d

Description

Hello.

Here is the output of your tool:
```
AmcacheParser version 1.5.1.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/AmcacheParser

Command line: -f Amcache.hve --csv .

Warning: Administrator privileges not found!

Error parsing ProgramsEntry at {11517B7C-E79D-4e20-961B-75A811715ADD}\Root\InventoryApplication\0000f3a1ae240ab0d68d8f4673f7bc63c42c00000904. Error: Строка не распознана как действительное значение DateTime.

[...]

C:\Users\MS\Desktop\amcache\Amcache.hve is in new format!

Total file entries found: 486
Total device containers found: 141
Total device PnPs found: 105
Total drive binaries found: 284
Total driver packages found: 16

Found 18 unassociated file entry

Results saved to: .

Total parsing time: 1,323 seconds

```

Here is a key that isn't parsed by your tool:
```
Key path: Root\File\dd31621c-4f8f-11e4-9f49-806e6f6e6963\1000004513b
Last written timestamp (UTC): 2020-07-29 16:59:41.147582
Access bits: 0
Owner SID: S-1-5-32-544

[...]

Value name: 15
Value type: REG_SZ
Data size: 112
Data (decoded):
c:\program files (x86)\opera\69.0.3686.77\installer.exe^@

[...]

---

```

("^@" marks the null byte.)

So, the Amcache hive contains entries having both the new and old formats. Those using the old format aren't parsed (e.g., the path quoted above is missing in the CSV files).

Unfortunately, I can't share the hive file.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.