Closed pdutton-vc closed 1 month ago
Thanks for the initial triage and the sample files. I'll try and have a look at this later in the week.
Forgot to link the issue but this should be fixed in 21ab8c6dcb2a870be69cb40dc3e0c27f859fb46a, and I have bundled that up into release 2.9.2
. Looks like Chainsaw was assuming that field would always be present when in fact it is not,
Shim cache analysis of data from a Windows 11 or Windows Server 2022 machine fails with an error message (see below). The machines in question are clean, new, updated virtual machines. The same analysis works fine on Windows 10, Windows Server 2016, and Windows Server 2019.
The same error is seen when chainsaw is run from on the machine being analyzed, on a different Windows machine, or when from a mac. The same behavior is seen with or without --tspair. The tests were performed using the sample patterns from https://github.com/WithSecureLabs/chainsaw/blob/master/analysis/shimcache_patterns.txt. Reproducible with latest 2.9.1-2 build from https://github.com/WithSecureLabs/chainsaw/releases/download/v2.9.1-2/chainsaw_all_platforms+rules.zip.
---
Example Run:
.\chainsaw\chainsaw_x86_64-pc-windows-msvc.exe --version chainsaw 2.9.1
.\chainsaw\chainsaw_x86_64-pc-windows-msvc.exe analyse shimcache --regexfile .\shimcache_patterns.txt --amcache .\amcache.hve --tspair .\system.hve
Attaching zipped up amcache and system files: hives.zip