Skip to content

WAC 3.0.1

Choose a tag to compare

View all tags
@reygiss reygiss released this 30 Oct 17:43
· 247 commits to master since this release
3.0.1
cec240e

WAC 3.0.1 — fixes found by measuring 3.0.0 again

Fixes

  • Process modules read without PROCESS_ALL_ACCESS. The Toolhelp module snapshot opened each process itself with full access (0x1FFFFF), measured under Sysmon on 42 processes. Each process is now opened with PROCESS_QUERY_INFORMATION and PROCESS_VM_READ only (0x1410) and its modules read through psapi; protected processes refuse it as before. WAC32 uses psapi.dll, present since XP.
  • Local times of investigation.json in the suspect's time zone: the first operations and StartLocal (and ExtractionStart of the manifest) carried UTC labelled +00:00.
  • Not enough space said as such. The conversion checks the room for the working copy before rebuilding it (it reported "invalid data" on a full disk); the collection's estimate counts the deleted files' budget.
  • Only a server edition is said not validated by the test cycle; every client from XP SP1 to Windows 11 is.

Measured

Windows 11 full cycle: 553 checks, no failure; Vista (WAC32): process checks green. Comparison with KAPE and the EZ tools, trace measurement (registry read back offline) and every manual redone on 29 and 30 October 2026.

Files

WAC.exe (x64), WAC32.exe (x86, XP SP1 to 8), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

Assets 11
Loading