Tuesday, June 12, 2012

TypedURLsTime RegRipper Plugin

I mentioned in a previous post that a RegRipper plugin (or something similar) would need to be written in order to easily correlate the contents of the TypedURLs subkey with the TypedURLsTime subkey that is present in Windows 8.  Being that I haven't had the opportunity to do a whole lot with Perl or write a RegRipper plugin, I figured this would be a good learning experience for me and another way to contribute a bit to the community.  Harlan's Windows Registry Analysis book does a nice job explaining the process of creating a RegRipper plugin, so I decided to start there.

The book mentions the fact that you can create plugins while writing very little code by copying the functionality from other existing plugins. After all, why spend time rewriting something that's already been put out there (although an argument could be made for the sake of learning)? With that in mind, I thought about the different plugins that I'd executed in the past and what they did.  The typedurls plugin would obviously take care of parsing the TypedURLs subkey for me; I only needed to find code that would parse the TypedURLsTime value data containing the FILETIME structures.  The first plugin that came to mind is also one of my favorites: the userassist2 plugin.

So to create the TypedURLsTime plugin, I started simply by copying the code that parses the contents of the UserAssist key and adding that to the parsing code for the TypedURLs key.  I then went in and removed some unnecessary portions, such as the part decoding the ROT-13 values existing in the UserAssist key.  I was left with code that would parse both of the subkeys I'm interested in; I just needed to correlate the results to make the output easier to read.  There is an abundance of material out there to help you get started with Perl.  Learn.perl.org is a nice way to learn the basics; you can also go out and buy one of the many books that exist on the subject (Learning Perl on Win32 Systems was recommended to me).  After reading though a bit of the basics (comparing values, looping, hashes, etc.), I put together the rest of the plugin to correlate the results and display them appropriately.  I added a couple of variables, but the vast majority of the code and the actual work was completed using functionality from two previously written plugins.  That's it.  In very little time and roughly 10 lines of code, I'd put something together that can be used to extract and make use of the information from the TypedURLsTime subkey or simply add in as part of a plugin file for future use.

This obviously required very little coding, but that's part of the point.  I was surprised at how easy it was and the limited amount of Perl knowledge that's required to create a working RegRipper plugin.  That's not to say that other plugins wouldn't require much more coding and a deeper knowledge of Perl, but this is an example of how easy it can be. So the next time you think about writing a RegRipper plugin or realize that one would be helpful, think about what you're trying to pull from the registry. What is the format of the data you're trying to parse?  Are there existing plugins that perform some or all of the required functionality, except applied to a different key?  You might find that nearly everything you need is already out there and available, you just need to piece it together.

If you're interested in viewing or testing the typedurlstime plugin, it's included as part of the updated RegRipper plugins archive available from the RegRipper wordpress site (or more precisely, the RR supplemental plugins google code page).  I also went ahead and modified the reporting format to allow for outputting in TLN format, which is available with the typedurlstime_tln plugin (included in the download).  The output of the typedurlstime plugin could easily be modified to report in csv format as well.

6 comments:

  1. Jason,

    Thanks for sharing your plugin. Anyone that has spent time developing any tool or plugin or script or any addon to a program knows that it is time consuming labor and appreciated.

    Brett

    ReplyDelete
  2. Jason,

    When I wrote up my own plugin, I found that the LastWrite time of the key corresponded to the data stored in the url1 value...did you find something similar?

    Some variations of the plugin would be to correlate the date from this key with the corresponding values in the TypedURLs key, etc.

    ReplyDelete
  3. Oh, another thing I wanted to mention...I started with the typedurls.pl plugin when I wrote my version of the plugin. In the first iteration, the output looked as follows:

    Software\Microsoft\Internet Explorer\TypedURLsTime
    LastWrite Time Wed Oct 5 15:38:26 2011 (UTC)
    url1 -> 1317829106
    url2 -> 1317829097
    url3 -> 1317829087
    url4 -> 0

    I thought I would hold on to that, as it would make it easy to display the data in a timeline, via the TLN format, but for initial analysis purposes, I went with:

    TypedURLsTime
    Software\Microsoft\Internet Explorer\TypedURLsTime
    LastWrite Time Wed Oct 5 15:38:26 2011 (UTC)
    url1 -> Wed Oct 5 15:38:26 2011 Z
    url2 -> Wed Oct 5 15:38:17 2011 Z
    url3 -> Wed Oct 5 15:38:07 2011 Z
    url4 -> 0

    ReplyDelete
  4. Harlan,

    I also found that the LastWrite time of the key corresponded to the data in the url1 value, which is exactly what you would expect when thinking about how the values are added to the key. Additionally, I found that the LastWrite time of TypedURLs corresponded to the LastWrite time of TypedURLsTime, which again makes perfect sense. I originally had a line in the plugin requiring this to be the case, but decided that it was too restrictive so I removed it.

    "Some variations of the plugin would be to correlate the date from this key with the corresponding values in the TypedURLs key, etc."
    That's actually exactly what this plugin does. I didn't think there was a whole lot of value in the information from the TypedURLsTime key itself (other than knowing that computer activity was occurring at that time) without correlating it with the values in TypedURLs. This way, you can see the URL from each value in the TypedURLs key and the corresponding time value from the TypedURLsTime key.

    ReplyDelete
  5. I didn't think there was a whole lot of value in the information from the TypedURLsTime key itself (other than knowing that computer activity was occurring at that time) without correlating it with the values in TypedURLs.

    Agreed. I updated my plugin.

    ReplyDelete
  6. Thank you for sharing your work, especially for the detailed explanation you made.

    ReplyDelete