Skip to content

v1.0.0: Fix CSV report header bug: register all fields before writing rows

Latest
Latest

Choose a tag to compare

View all tags
@dbezicsec dbezicsec released this 28 Oct 00:40
· 1 commit to main since this release
v1.0.0
39c3a27

First public release of sidr-patch, a fork of strozfriedberg/sidr (base commit 5bde8e8, Apache License 2.0).

Fixes for Windows 11 24H2/25H2/26H2 databases

Stock SIDR 0.9.2 fails to read Windows.db on newer Windows 11 builds. This release fixes three issues:

  1. no such collation sequence: UNICODE_en-US on custom Windows Search collations. A case-insensitive stand-in is now registered for any collation SQLite asks for.
  2. A panic on storage-type-12 (date/number) values that are not exactly 8 bytes. These are now decoded without panicking, with unexpected-length values written as hex.
  3. Storage-type-12 values stored as native SQLite integers were previously read as their decimal text instead of being decoded. They are now read as integers first, then decoded normally.

CSV header fix (not 24H2/25H2-specific, present in stock SIDR 0.9.2)

The CSV header used to be fixed to whatever properties the first processed record had. A property that only showed up on a later record, like System.Search.AutoSummary or System.FileOwner, was silently missing from the header and written as an unlabelled, column-misaligned trailing value instead. Every field a report's rows can contain is now registered before any row is written, so the header always covers everything. On the bundled sample .edb, the File Report header went from 7 columns to 11, with no change in row count.

The File, Internet History and Activity History reports carry the same per-row data as stock SIDR 0.9.2 on databases stock SIDR can already read, but column layout is no longer byte-identical because of the fix above.

New: --history option

Recovers older, removed and deleted property values from a Windows.db's write-ahead log and unused database pages, writing an extra Recovered_Values_Report. Full details and column semantics are in README-PATCH.txt.

Assets

  • sidr_patch.exe: Windows x86_64 build
  • SHA256SUMS.txt: checksum for the exe above

Full technical write-up: CHANGES-PATCH.md. Full diff against upstream: sidr-patch.patch.

Assets 4
Loading