search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
986 stars 221 forks source link

Parse BMC cache #1302

Open MariasStory opened 2 years ago

MariasStory commented 2 years ago

Hi team, Thanks again for the very cool tool it is. Please implement a BMC cache paser for remote desktop cache. The tool I am using: https://github.com/ANSSI-FR/bmc-tools The images are little squares from the remote desktop sessions. They can be reconstructed and give a valuable inside in the RDP related attacks.

lfcnassif commented 2 years ago

This could be very useful, thanks for pointing. I don't know French, but the license summary of above tool seems not compatible with ours:

Strong copyleft license made by three French public research organisations, CEA, CNRS, and Inria, compatible with AGPL-3.0, EUPL-1.1, and GPL-2.0, or later versions of those licenses.

But, integrating it as a plugin module loaded at runtime may possible...

patrickdalla commented 2 years ago

This seems very simple as the cache has only the tiles images to be extracted. I implemented a parser that works for BIN file in RDPTilesCache branch.

lfcnassif commented 2 years ago

Thank you @patrickdalla! But I would like you to help me finish works already started. Could you help the progress on #1341?

PS: Today I'm giving lectures all day.