Add SYSTEMTIME Support to BinConvert

EricZimmerman · Aug 23, 2024 · 3dfef0c · 3dfef0c
1 parent a855605
commit 3dfef0c
Show file tree

Hide file tree

Showing 2 changed files with 52 additions and 2 deletions.
diff --git a/RECmd/Program.cs b/RECmd/Program.cs
@@ -2334,7 +2334,31 @@ private static BatchCsvOut BuildBatchCsvOut(RegistryKey regKey, Key key, string
                             rebOut.ValueData = regVal.ValueData;
                         }
 
-                        break;
+                         break;
+                    case Key.BinConvert.Systemtime:
+                        try
+                        {
+                            int index = 0;
+                            int int16_1 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, index);
+                            int int16_2 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 2 + index);
+                            int int16_3 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 4 + index);
+                            int int16_4 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 6 + index);
+                            int int16_5 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 8 + index);
+                            int int16_6 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 10 + index);
+                            int int16_7 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 12 + index);
+                            int int16_8 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 14 + index);
+
+                            var st = new DateTimeOffset(new DateTime(int16_1, int16_2, int16_4, int16_5, int16_6, int16_7, int16_8, DateTimeKind.Utc)).ToUniversalTime().ToString();
+                            rebOut.ValueData = st;
+
+                        }
+                        catch (Exception)
+                        {
+                            Log.Warning("Error converting to SYSTEMTIME. Using bytes instead!");
+                            rebOut.ValueData = regVal.ValueData;
+                        }
+
+						break;
                     default:
                         rebOut.ValueData = regVal.ValueData;
                         break;
@@ -2374,6 +2398,31 @@ private static BatchCsvOut BuildBatchCsvOut(RegistryKey regKey, Key key, string
                         Log.Warning("Error converting to FILETIME. Using bytes instead!");
                         rebOut.ValueData = regVal.ValueData;
                     }
+
+                   break;
+
+                case Key.BinConvert.Systemtime:
+                    try
+                    {
+                        int index = 0;
+                        int int16_1 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, index);
+                        int int16_2 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 2 + index);
+                        int int16_3 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 4 + index);
+                        int int16_4 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 6 + index);
+                        int int16_5 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 8 + index);
+                        int int16_6 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 10 + index);
+                        int int16_7 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 12 + index);
+                        int int16_8 = (int)BitConverter.ToInt16(regVal.ValueDataRaw, 14 + index);
+
+                        var st = new DateTimeOffset(new DateTime(int16_1, int16_2, int16_4, int16_5, int16_6, int16_7, int16_8, DateTimeKind.Utc)).ToUniversalTime().ToString();
+                        rebOut.ValueData = st;
+
+                    }
+                    catch (Exception)
+                    {
+                        Log.Warning("Error converting to SYSTEMTIME. Using bytes instead!");
+                        rebOut.ValueData = regVal.ValueData;
+                    }
 
                     break;
             }

diff --git a/RECmd/ReBatch.cs b/RECmd/ReBatch.cs
@@ -29,7 +29,8 @@ public enum BinConvert
         Filetime = 1,
         [Description("IPv4 address")] Ip = 2,
         [Description("DWord to Epoch")] Epoch = 3,
-        [Description("Binary to SID")] Sid = 4
+        [Description("Binary to SID")] Sid = 4,
+        [Description("128 bit Windows SYSTEMTIME")] Systemtime = 5
     }
 
     public enum HiveType_