#!/usr/bin/env?python
#?ShimCacheParser.py
#
#?Andrew?Davis?andrew.davis@mandiant.com
#?Copyright?2012?Mandiant
#
#?Mandiant?licenses?this?file?to?you?under?the?Apache?License?Version
#?2.0?（the?“License“）;?you?may?not?use?this?file?except?in?compliance?with?the
#?License.??You?may?obtain?a?copy?of?the?License?at:
#
#????????http://www.apache.org/licenses/LICENSE-2.0
#
#?Unless?required?by?applicable?law?or?agreed?to?in?writing?software
#?distributed?under?the?License?is?distributed?on?an?“AS?IS“?BASIS
#?WITHOUT?WARRANTIES?OR?CONDITIONS?OF?ANY?KIND?either?express?or
#?implied.??See?the?License?for?the?specific?language?governing
#?permissions?and?limitations?under?the?License.
#
#?Identifies?and?parses?Application?Compatibility?Shim?Cache?entries?for?forensic?data.

import?sys
import?struct
import?zipfile
import?argparse
import?binascii
import?datetime
import?codecs
import?cStringIO?as?sio
import?xml.etree.cElementTree?as?et
from?os?import?path
from?csv?import?writer

#?Values?used?by?Windows?5.2?and?6.0?（Server?2003?through?Vista/Server?2008）
CACHE_MAGIC_NT5_2?=?0xbadc0ffe
CACHE_HEADER_SIZE_NT5_2?=?0x8
NT5_2_ENTRY_SIZE32?=?0x18
NT5_2_ENTRY_SIZE64?=?0x20

#?Values?used?by?Windows?6.1?（Win7?and?Server?2008?R2）
CACHE_MAGIC_NT6_1?=?0xbadc0fee
CACHE_HEADER_SIZE_NT6_1?=?0x80
NT6_1_ENTRY_SIZE32?=?0x20
NT6_1_ENTRY_SIZE64?=?0x30
CSRSS_FLAG?=?0x2

#?Values?used?by?Windows?5.1?（WinXP?32-bit）
WINXP_MAGIC32?=?0xdeadbeef
WINXP_HEADER_SIZE32?=?0x190
WINXP_ENTRY_SIZE32?=?0x228
MAX_PATH?=?520

#?Values?used?by?Windows?8
WIN8_STATS_SIZE?=?0x80
WIN8_MAGIC?=?‘00ts‘

#?Magic?value?used?by?Windows?8.1
WIN81_MAGIC?=?‘10ts‘

#?Values?used?by?Windows?10
WIN10_STATS_SIZE?=?0x30
WIN10_CREATORS_STATS_SIZE?=?0x34
WIN10_MAGIC?=?‘10ts‘
CACHE_HEADER_SIZE_NT6_4?=?0x30
CACHE_MAGIC_NT6_4?=?0x30

bad_entry_data?=?‘N/A‘
g_verbose?=?False
g_usebom?=?False
output_header??=?[“Last?Modified“?“Last?Update“?“Path“?“File?Size“?“Exec?Flag“]

#?Date?Formats
DATE_MDY?=?“%m/%d/%y?%H:%M:%S“
DATE_ISO?=?“%Y-%m-%d?%H:%M:%S“
g_timeformat?=?DATE_ISO

#?Shim?Cache?format?used?by?Windows?5.2?and?6.0?（Server?2003?through?Vista/Server?2008）
class?CacheEntryNt5（object）:

????def?__init__（self?is32bit?data=None）:

????????self.is32bit?=?is32bit
????????if?data?!=?None:
????????????self.update（data）

????def?update（self?data）:

????????if?self.is32bit:
????????????entry?=?struct.unpack（‘<2H?3L?2L‘?data）
????????else:
????????????entry?=?struct.unpack（‘<2H?4x?Q?2L?2L‘?data）
????????self.wLength?=?entry[0]
????????self.wMaximumLength?=??entry[1]
????????self.Offset?=?entry[2]
????????self.dwLowDateTime?=?entry[3]
????????self.dwHighDateTime?=?entry[4]
????????self.dwFileSizeLow?=?entry[5]
????????self.dwFileSizeHigh?=?entry[6]

????def?size（self）:

????????if?self.is32bit:
????????????return?NT5_2_ENTRY_SIZE32
????????else:
????????????return?NT5_2_ENTRY_SIZE64

#?Shim?Cache?format?used?by?

?屬性????????????大小?????日期????時(shí)間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)MUICacheViewv1.01_xiazai.com\
?????文件???????14339??2010-01-05?16:06??注冊(cè)表取證工具\(yùn)MUICacheViewv1.01_xiazai.com\MUICacheView.chm
?????文件???????30208??2010-01-05?15:49??注冊(cè)表取證工具\(yùn)MUICacheViewv1.01_xiazai.com\MUICacheView.exe
?????文件?????????219??2016-06-01?17:03??注冊(cè)表取證工具\(yùn)MUICacheViewv1.01_xiazai.com\找軟件.htm
?????文件????????2202??2016-06-01?17:03??注冊(cè)表取證工具\(yùn)MUICacheViewv1.01_xiazai.com\軟件說(shuō)明.htm
?????文件???????37563??2018-08-28?11:41??注冊(cè)表取證工具\(yùn)MUICacheViewv1.01_xiazai.com.zip
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\
?????文件???????11357??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\LICENSE
?????文件????????3001??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\README
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\Registry\
?????文件???????11357??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\Registry\LICENSE
?????文件????????9282??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\Registry\Registry.py
?????文件???????43208??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\Registry\RegistryParse.py
?????文件?????????795??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\Registry\__init__.py
?????文件???????36866??2017-08-14?09:11??注冊(cè)表取證工具\(yùn)ShimCacheParser-master\ShimCacheParser-master\ShimCacheParser.py
?????文件???????29859??2018-08-28?11:46??注冊(cè)表取證工具\(yùn)ShimCacheParser-master.zip
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)userassistview\
?????文件???????13755??2010-12-29?19:20??注冊(cè)表取證工具\(yùn)userassistview\UserAssistView.chm
?????文件???????31232??2010-12-29?19:17??注冊(cè)表取證工具\(yùn)userassistview\UserAssistView.exe
?????文件????????3786??2010-12-29?19:20??注冊(cè)表取證工具\(yùn)userassistview\readme.txt
?????文件???????35140??2018-08-28?11:47??注冊(cè)表取證工具\(yùn)userassistview.zip
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)winprefetchview\
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\
?????目錄???????????0??2020-01-07?12:05??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\x64\
?????文件???????15550??2014-12-14?18:22??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\x64\WinPrefetchView.chm
?????文件??????110688??2014-12-14?18:22??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\x64\WinPrefetchView.exe
?????文件????????1644??2010-01-07?05:35??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\x64\WinPrefetchView_lng.ini
?????文件????????7692??2014-12-14?18:22??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\x64\readme.txt
?????文件?????????109??2015-05-05?17:01??注冊(cè)表取證工具\(yùn)winprefetchview\winprefetchview\x64\東坡下載.url
............此處省略9個(gè)文件信息