Skip to content

Conversation

@william-billaud
Copy link
Contributor

Add support for the %ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr.db file. This file contains information related to the Background Intelligent Transfer Service.

  • Structure comprehension base on https://github.com/ANSSI-FR/bits_parser + RE on qmgr.dll
  • Do not handle the older (pre windows 10) format, maybe for later, but as Win10 is more than 10 year old, I don't thinks it's a priority.
  • Do not make carving, as already existing tool (but it may be interesting, as the data format use a lot of known guid).
  • Modify the UserRecordDescriptorExtension : no longer override field with None value. In this case its allows to keep the user_id value even if user is not found by the UserRecordDescriptorExtension
  • PowerShell script used to generate test data is included in the test file.

Some reference :

closes #1475

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add a Background Intelligent Transfer Service database parser

1 participant