Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2 Features for kape targets #888

Open
SolitudePy opened this issue Nov 24, 2023 · 10 comments
Open

2 Features for kape targets #888

SolitudePy opened this issue Nov 24, 2023 · 10 comments
Labels
enhancement New feature or request

Comments

@SolitudePy
Copy link
Contributor

SolitudePy commented Nov 24, 2023

KAPE version
latest

Is your feature request related to a problem? Please describe.
WhatsApp.tkape for example

Describe the solution you'd like
Feature 1)
Path variable in the tkape files should have a wildcard option to match a directory, Example:
C:\Program Files\*SomeApp*

Feature 2)
SaveAsFileName variable in the tkape files should have a %destinationFileName% parameter similar to the mkape parameters so the target filename can be altered, Example:
SaveAsFileName: %destinationFileName%.jpg

Describe alternatives you've considered
Would like to know of any.

Additional context
An example can be seen in the PR #887:

Feature 1)
WhatsApp.tkape could be better addressed with using the following path instead:
C:\Users%user%\AppData\Local\Packages\*WhatsAppDesktop*\LocalCache\Roaming\WhatsApp\Cache

Feature 2)
WhatsApp_Media.tkape could be better addressed renaming the target files with a .jpg extension to make them readable:
Path: C:\Users%user%\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\profilePictures
SaveAsFileName: %destinationFileName%.jpg

@SolitudePy SolitudePy added the enhancement New feature or request label Nov 24, 2023
@EricZimmerman
Copy link
Owner

One should already be fully supported. I don't know that I'm a fan of two

@SolitudePy
Copy link
Contributor Author

1 is not supported from my testing

@EricZimmerman
Copy link
Owner

Hmm. I know wild cards in between separators works

@SolitudePy
Copy link
Contributor Author

SolitudePy commented Nov 24, 2023

Well wildcard C:\Program Files\*\ will catch any folder under Program Files but if you want to match a folder by name it would be more efficient such as C:\Program Files\*SomeApp*

@AndrewRathbun
Copy link
Sponsor Collaborator

I just tested the TeamViewer Target and it worked as expected.

image

Specifically, this part:

    -
        Name: TeamViewer Application Logs
        Category: ApplicationLogs
        Path: C:\Program Files*\TeamViewer\
        FileMask: 'TeamViewer*_Logfile*'
        Comment: "Includes TeamViewer<version>_Logfile.log and TeamViewer<version>_Logfile_OLD.log"

NOTE: I had to copy the file found in Program Files, add a few characters (so KAPE didn't SHA1 dedupe) and place it in C:\Program Files (x86)\TeamViewer for this test scenario. The Program Files* wildcard worked as expected, as did the wildcards in the FileMask.

I even went futher and added another slightly different file with a different file name to test the double wildcard in the FileMask and it worked.

image

I then went ANOTHER step further and modified the Target to this:

    -
        Name: TeamViewer Application Logs
        Category: ApplicationLogs
        Path: C:\Program Files*\*eamViewe*\
        FileMask: 'TeamViewer*_Logfile*'
        Comment: "Includes TeamViewer<version>_Logfile.log and TeamViewer<version>_Logfile_OLD.log"

and it worked!

image

@SolitudePy
Copy link
Contributor Author

interesting @AndrewRathbun, I tried the TeamViewerLogs target on my machine and it didnt find anything under Program Files(x86) even though it exists. I tried running the following command:
.\kape.exe --tsource C: --tdest C:\Temp\KapeTarget --tflush --target TeamViewerLogs --debug
and this is the resulted output:

Found 4 targets. Expanding targets to file list...
Processing target: TeamViewer Connection Logs (v2)
Expanding directory: C:\Program Files*\TeamViewer\
Files found: 0
Processing target: TeamViewer Application Logs (v2)
Expanding directory: C:\Program Files*\TeamViewer\
Files found: 0
Processing target: TeamViewer Application User Logs (v2)
Expanding directory: C:\Users\%user%\AppData\Roaming\TeamViewer\

As you can see they do exist:
image

I tested it with kape 1.3.0.2 on Windows 11.

@EricZimmerman
Copy link
Owner

Enable --debug and see what it shows

@SolitudePy
Copy link
Contributor Author

@EricZimmerman I have already done that and put the output in the comment above.
by the way, kape fails to recognize the correct OS(I'm using Windows 11 and it says Windows 10)

@EricZimmerman
Copy link
Owner

EricZimmerman commented Nov 24, 2023 via email

@AndrewRathbun
Copy link
Sponsor Collaborator

@EricZimmerman I have already done that and put the output in the comment above.
by the way, kape fails to recognize the correct OS(I'm using Windows 11 and it says Windows 10)

I did my testing with that same version of KAPE and Windows 🤷‍♂️. To be fair, the Windows Registry shows references to 10 even on 11 systems. Not sure why but it is what it is. I don't think that's a KAPE issue as KAPE is very likely just parsing what Windows is recording.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants