공장장과 함께하는 디지털 포렌식 이야기

출처 : http://blog.paran.com/franc3sco/33307420


/* ChkRegLastChange 프로그램은 윈도우즈 레지스트리 value 및 data에 대한 생성 및 변경 시간 체크 프로그램입니다. 작성자 : 김태훈(kimfrancesco@gmail.com) 라이센스 : Freeware 첨언 : 용도에 맞게 제작된 작은 사이즈 프로그램입니다. */ #include <windows.h> #include <commctrl.h> #include <windowsx.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <winuser.h> #include <commdlg.h> #include "resource9.h" LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM); void RegEnum(HKEY *key, DWORD entry_count, char *string); DWORD GetAbsDayfromsystime(SYSTEMTIME st); HINSTANCE g_hInst; LPSTR lpszClass = "RegistryTimeCheck"; HWND g_hWndMain; #ifndef NMAXFILE #define NMAXFILE 512 #endif #ifndef TEXTMAXBUF #define TEXTMAXBUF 512 #endif HKEY HKEY_ENTRY[4] = { HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, HKEY_CURRENT_CONFIG }; DWORD start_time_value; DWORD end_time_value; int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpszCmdParam, int nCmdShow) { HWND hWnd; MSG Message; WNDCLASS WndClass; g_hInst = hInstance; WndClass.cbClsExtra = 0; WndClass.cbWndExtra = 0; WndClass.hbrBackground = (HBRUSH)(COLOR_BTNFACE + 1); WndClass.hCursor = LoadCursor(NULL, IDC_ARROW); WndClass.hIcon = LoadIcon(NULL, IDI_APPLICATION); WndClass.hInstance = hInstance; WndClass.lpfnWndProc = (WNDPROC)WndProc; WndClass.lpszClassName = lpszClass; WndClass.lpszMenuName = MAKEINTRESOURCE(IDR_MENU1); WndClass.style = CS_HREDRAW | CS_VREDRAW; RegisterClass(&WndClass); hWnd = CreateWindow(lpszClass, lpszClass, WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX | WS_CLIPCHILDREN, 100, 100, 550, 310, NULL, (HMENU)NULL, hInstance, NULL); ShowWindow(hWnd, nCmdShow); g_hWndMain = hWnd; while ( GetMessage(&Message, 0, 0, 0)) { TranslateMessage(&Message); DispatchMessage(&Message); } return Message.wParam; } // Child 윈도우 컨트롤 #define ID_LISTBOX 100 #define ID_EDIT 101 #define ID_BUTTON 102 HWND hList; HWND hButton; HWND hStatic; HWND hStatic2; HWND hEDtp; HWND hSDtp; HWND hState; HWND hsTime; HWND heTime; // 윈도우 메시지 처리 프로시저 함수 정의 LRESULT CALLBACK WndProc(HWND hWnd, UINT iMessage, WPARAM wParam, LPARAM lParam) { HKEY key; OPENFILENAME ofn; HANDLE fichier; int i_dummy; char psz_text[TEXTMAXBUF]; char entry_item[TEXTMAXBUF]; char szFileName[NMAXFILE] = ""; char start_time[255]; char end_time[255]; char str[MAX_PATH]; char sHourTimeString[4] = { 0 }; char eHourTimeString[4] = { 0 }; DWORD sHourTime = 0; DWORD eHourTime = 0; DWORD entry_count = 0; LVCOLUMN COL; LVITEM LI; switch (iMessage) { case WM_CREATE: //InitCommonControls(); INITCOMMONCONTROLSEX InitCtrlEx; InitCtrlEx.dwSize = sizeof(INITCOMMONCONTROLSEX); InitCtrlEx.dwICC = ICC_PROGRESS_CLASS | ICC_BAR_CLASSES | ICC_LISTVIEW_CLASSES | ICC_DATE_CLASSES; InitCommonControlsEx(&InitCtrlEx); hList = CreateWindow(WC_LISTVIEW, NULL, WS_CHILD | WS_VISIBLE | WS_BORDER | LVS_REPORT, 10, 50, 530, 200, hWnd, NULL, g_hInst, NULL); hSDtp = CreateWindow(DATETIMEPICK_CLASS, "기간_시작", WS_BORDER | WS_CHILD | WS_VISIBLE | DTS_SHORTDATEFORMAT, 30, 10, 100, 25, hWnd, NULL, g_hInst, NULL); hsTime = CreateWindow(DATETIMEPICK_CLASS, "기간_시작", WS_BORDER | WS_CHILD | WS_VISIBLE | DTS_TIMEFORMAT, 130, 10, 100, 25, hWnd, NULL, g_hInst, NULL); hStatic = CreateWindow("static","~", WS_CHILD | SS_CENTER | WS_VISIBLE, 240, 15, 10, 25, hWnd, (HMENU)-1, g_hInst, NULL); hEDtp = CreateWindow(DATETIMEPICK_CLASS, "기간_종료", WS_BORDER | WS_CHILD | WS_VISIBLE | DTS_SHORTDATEFORMAT, 260, 10, 100, 25, hWnd, NULL, g_hInst, NULL); heTime = CreateWindow(DATETIMEPICK_CLASS, "기간_시작", WS_BORDER | WS_CHILD | WS_VISIBLE | DTS_TIMEFORMAT, 360, 10, 100, 25, hWnd, NULL, g_hInst, NULL); hButton = CreateWindow("Button","Check", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON, 480, 10, 50, 25, hWnd, (HMENU)ID_BUTTON, g_hInst, NULL); //hStatic2=CreateWindow("static", NULL, WS_CHILD | WS_VISIBLE | SS_SIMPLE | SS_GRAYRECT, //10, 250, 530, 280, hWnd, NULL, g_hInst, NULL); hState = CreateStatusWindow(WS_CHILD | WS_VISIBLE, "Written by Kim, Tae Hoon(kimfrancesco@gmail.com) - registry 생성/변경 날짜 체크 툴", hWnd, 0); COL.mask = LVCF_FMT | LVCF_WIDTH | LVCF_TEXT | LVCF_SUBITEM; COL.fmt = LVCFMT_LEFT; COL.cx = 150; COL.pszText = "ROOT KEY"; COL.iSubItem = 0; SendMessage(hList, LVM_INSERTCOLUMN, 0, (LPARAM)&COL); COL.pszText = "SUB KEY"; COL.iSubItem = 1; SendMessage(hList, LVM_INSERTCOLUMN, 1, (LPARAM)&COL); COL.cx = 300; COL.pszText = "Time(Create/Modify)"; COL.iSubItem = 2; SendMessage(hList, LVM_INSERTCOLUMN, 2, (LPARAM)&COL); return 0; case WM_COMMAND: switch(LOWORD(wParam)) { case ID_BUTTON: SYSTEMTIME s_tm; SYSTEMTIME e_tm; SYSTEMTIME s_time; SYSTEMTIME e_time; DateTime_GetSystemtime(hSDtp, &s_tm); DateTime_GetSystemtime(hEDtp, &e_tm); DateTime_GetSystemtime(hsTime, &s_time); DateTime_GetSystemtime(heTime, &e_time); s_tm.wHour = 0; e_tm.wHour = 0; s_tm.wHour = s_time.wHour; e_tm.wHour = e_time.wHour; s_tm.wMinute = s_time.wMinute; e_tm.wMinute = e_time.wMinute; s_tm.wSecond = s_time.wSecond; e_tm.wSecond = e_time.wSecond; start_time_value = GetAbsDayfromsystime(s_tm); end_time_value = GetAbsDayfromsystime(e_tm); SendMessage(hList, LVM_DELETEALLITEMS, 0, (LPARAM)&LI); for (entry_count; entry_count<sizeof(HKEY_ENTRY)/sizeof(HKEY); entry_count++) { RegEnum(&HKEY_ENTRY[0], entry_count, ""); } break; case ID_FILE_SAVE40001: memset(&(ofn), 0, sizeof(ofn)); ofn.lStructSize = sizeof(ofn); ofn.hwndOwner = hWnd; ofn.lpstrFile = szFileName; ofn.nMaxFile = NMAXFILE; ofn.lpstrFilter = "Text (*.txt)\0*.txt\0"; ofn.lpstrTitle = "Save File As"; ofn.Flags = OFN_HIDEREADONLY; ofn.lpstrDefExt = "txt"; if ( GetSaveFileName( (LPOPENFILENAME) &ofn)) { fichier = CreateFile(ofn.lpstrFile, GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); if ( fichier != INVALID_HANDLE_VALUE ) { int idx, n; for ( idx = 0; idx < ListView_GetItemCount(hList); idx++ ) { memset(entry_item, 0, sizeof(entry_item)); for ( n = 0; n < 3; n++ ) { memset(psz_text, 0, sizeof(psz_text)); ListView_GetItemText(hList, idx, n, psz_text, TEXTMAXBUF); if ( n == 0 ) { lstrcpy(entry_item, psz_text); lstrcat(entry_item, "\t\t"); } else { lstrcat(entry_item, "\t"); lstrcat(entry_item, psz_text); } } lstrcat(entry_item,"\r\n"); WriteFile(fichier, entry_item, strlen(entry_item), (LPDWORD)&i_dummy, NULL); } FlushFileBuffers(fichier); CloseHandle(fichier); } } break; case ID_FILE_EXIT: DestroyWindow(hWnd); break; } return 0; case WM_SIZE: //MoveWindow(hEdit, 10, 10, LOWORD(lParam) - 130, 25, TRUE); //MoveWindow(hButton, LOWORD(lParam) - 110, 10, 100, 25, TRUE); //MoveWindow(hList, 10, 50, LOWORD(lParam)-20, HIWORD(lParam)-80, TRUE); //MoveWindow(hStatic, 10, HIWORD(lParam)-30, LOWORD(lParam)-20, 25, TRUE); SendMessage(hState, WM_SIZE, wParam, lParam); return 0; // case WM_MOVE: // SetStatusText(hWnd); case WM_DESTROY: PostQuitMessage(0); return 0; } return (DefWindowProc(hWnd, iMessage, wParam, lParam)); } void RegEnum(HKEY *PHKEY_ENTRY, DWORD entry_count, char *str) { char lpSubKey[MAX_PATH]; char lpValue[MAX_PATH]; char key_path[4096]; DWORD i; LONG Result; DWORD Size; FILETIME FileTime; FILETIME LC_FileTime; SYSTEMTIME SysTime; HKEY key; char path_buffer[4096]={0}; DWORD crmd_time_value = 0; LVITEM LI; DWORD item_index = 0; char crmd_time[32] = { 0 }; char root_key[32] = { 0 }; if ( RegOpenKeyEx((HKEY)PHKEY_ENTRY[entry_count], str, 0, KEY_ALL_ACCESS, &key) != ERROR_SUCCESS) return ; LI.mask = LVIF_TEXT; LI.state = 0; LI.stateMask = 0; switch( (DWORD)PHKEY_ENTRY[entry_count]) { case (DWORD)HKEY_CURRENT_USER: strncpy(root_key, "HKEY_CURRENT_USER", sizeof(root_key)); break; case (DWORD)HKEY_LOCAL_MACHINE: strncpy(root_key, "HKEY_LOCAL_MACHINE", sizeof(root_key)); break; case (DWORD)HKEY_USERS: strncpy(root_key, "HKEY_USERS", sizeof(root_key)); break; case (DWORD)HKEY_CURRENT_CONFIG: strncpy(root_key, "HKEY_CURRENT_CONFIG", sizeof(root_key)); break; } // 서브키의 목록의 조사해 리스트 박스에 채워 넣는다. Result=ERROR_SUCCESS; for (i=0;Result==ERROR_SUCCESS;i++) { Size=MAX_PATH; Result=RegEnumKeyEx(key,i,lpSubKey,&Size,NULL,NULL,NULL,&FileTime); if (Result==ERROR_SUCCESS) { if ( ! strcmp(str, "") ) { wsprintf(path_buffer, "%s",lpSubKey); }else { wsprintf(path_buffer, "%s\\%s", str, (char *)lpSubKey); } wsprintf(key_path,"%s\\%s", root_key, path_buffer); // 진행 상황 출력 SendMessage(hState, SB_SETTEXT, 0, (LPARAM)key_path); FileTimeToLocalFileTime(&FileTime, &LC_FileTime); FileTimeToSystemTime(&LC_FileTime,&SysTime); crmd_time_value = GetAbsDayfromsystime(SysTime); if ( crmd_time_value >= start_time_value && crmd_time_value <= end_time_value) { wsprintf(crmd_time,"%d-%d-%d:%d-%d-%d",SysTime.wYear, SysTime.wMonth, SysTime.wDay,SysTime.wHour, SysTime.wMinute, SysTime.wSecond); for ( item_index = 0; item_index < 3; item_index ++ ) { LI.iSubItem = item_index; if ( ! item_index ) { LI.iItem = 0; LI.pszText =root_key; SendMessage(hList, LVM_INSERTITEM, 0, (LPARAM)&LI); } if ( item_index == 1 ) { LI.pszText = path_buffer; SendMessage(hList, LVM_SETITEM, 0, (LPARAM)&LI); } if ( item_index == 2 ) { LI.pszText = crmd_time; SendMessage(hList, LVM_SETITEM, 0, (LPARAM)&LI); } } } RegEnum(PHKEY_ENTRY, entry_count, path_buffer); } } RegCloseKey(key); } DWORD GetAbsDayfromsystime(SYSTEMTIME st) { INT64 i64; FILETIME fst; char debug_msg[16] = {0 }; st.wMilliseconds=st.wDayOfWeek=0; SystemTimeToFileTime(&st,&fst); i64=(((INT64)fst.dwHighDateTime) << 32) + fst.dwLowDateTime; i64 = i64 / 10000000 - (INT64)144000 * 86400; return (DWORD)i64; }

보안컨설턴트이신 김태훈 님의 작품

EnCase의 Registry Scan이나 Timeline Analysis로도 가능하지만...

소스까지 공개해주시다니 넘넘 감사합니다.

출처 : http://blog.paran.com/franc3sco/33307420