v1.3.1

Author: 4n6ist

CDIR/CDIR.cpp

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>
@@ -23,33 +23,33 @@
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>CDIR</RootNamespace>
     <ProjectName>cdir-collector</ProjectName>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v140_xp</PlatformToolset>
+    <PlatformToolset>v141</PlatformToolset>
     <CharacterSet>MultiByte</CharacterSet>
     <UseOfMfc>Static</UseOfMfc>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v141</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v141</PlatformToolset>
     <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v140</PlatformToolset>
+    <PlatformToolset>v141</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>

CDIR/CDIR.rc

@@ -22,15 +22,16 @@ ConfigParser::ConfigParser(string path)
 				string key = l.substr(0, idx);
 				string val = l.substr(idx+1);
 
-				// trim string
+				// trim key string
 				key = trim(key);
-				val = trim(val);
+
 				if (CONFIGLIST.find(key) != CONFIGLIST.end()) {
 					Value value;
 					value.type = CONFIGLIST[key];
 					switch (CONFIGLIST[key]) {
 					case TYPE_BOOL:
 						value.ptr = new bool;
+						val = trim(val);
 						*((bool*)value.ptr) = [=]() {
 							if (_stricmp("true", val.c_str()) == 0) {
 								return true;
@@ -56,11 +57,13 @@ ConfigParser::ConfigParser(string path)
 						break;
 					case TYPE_INT:
 						value.ptr = new int;
+						val = trim(val);
 						*((int*)value.ptr) = atoi(val.c_str());
 						break;
 					case TYPE_STRING:
 						value.ptr = new string;
-						*((string*)value.ptr) = val;
+						for (idx = 0; idx < val.size() && isspace(val[idx]); idx++);
+						*((string*)value.ptr) = val.substr(idx);
 						break;
 					}
 					m[key] = value;

CDIR/CDIR.vcxproj

@@ -32,12 +32,17 @@ struct c_ignorecase:std::binary_function<string, string, bool> {
 static map<string, TYPE_ID, c_ignorecase> CONFIGLIST = {
 	{"MemoryDump", TYPE_BOOL},
 	{"MFT", TYPE_BOOL},
+	{"Secure", TYPE_BOOL},
 	{"UsnJrnl", TYPE_BOOL},
 	{"EventLog", TYPE_BOOL},
 	{"Prefetch", TYPE_BOOL},
 	{"Registry", TYPE_BOOL},
+	{"WMI", TYPE_BOOL},
+	{"SRUM", TYPE_BOOL },
+	{"Web", TYPE_BOOL },
 	{"Output", TYPE_STRING},
-	{"Web", TYPE_BOOL},
+	{"Target", TYPE_STRING},
+	{"MemoryDumpCmdline", TYPE_STRING},
 	{"host", TYPE_STRING},
 	{"port", TYPE_INT},
 	{"path", TYPE_STRING}

CDIR/ConfigParser.cpp

@@ -1,9 +1,16 @@
-;MemoryDump = false
+;MemoryDump = true
 MFT = true
+Secure = true
 UsnJrnl = true
 EventLog = true
 Prefetch = true
 Registry = true
+WMI = true
+SRUM = true
 Web = true
+;Target = G:\
+;MemoryDumpCmdline = DumpIt.exe /Q /N /T DMP /O RAM.dmp
+;MemoryDumpCmdline = RamCapture64.exe RAM.raw
+;MemoryDumpCmdline = MagnetRAMCapture.exe /accepteula /go .\RAM.raw
 ;Output = E:\
 ;Output = \\hostname\sharename\

CDIR/ConfigParser.h

@@ -142,4 +142,4 @@ vector<pair<string, int>> findfiles(string filepath, bool error) {
 	}
 
 	return paths;
-}
+}