Daily Blog #595: Solution Saturday 1/12/19
Hello Reader,
I had two great submissions this week and one of them surprised me because it was from my own fellow g-c'er Matt Seyer. Matt won this weeks competition because he took one step farther in his testing to show not only what the new tables in the Server 2019 SRUM database meant, he also showed where to go in the registry to get the answer.
The Winning Answer:
Matt Seyer (@forensic_matt)
I had two great submissions this week and one of them surprised me because it was from my own fellow g-c'er Matt Seyer. Matt won this weeks competition because he took one step farther in his testing to show not only what the new tables in the Server 2019 SRUM database meant, he also showed where to go in the registry to get the answer.
The Winning Answer:
Matt Seyer (@forensic_matt)
Sunday Funday Submission
The Challenge
Server 2019 got SRUM, what if any differences are there between SRUM on Windows 10 and SRUM on Server 2019?
Methodology
Compare the SRUM database schemas of a Windows 10 system and Server 2019. The most obvious differences should appear in the database schemas. Because the SRUM database uses the Extensible Storage Engine (ESE) format, we should work directly with the ESE database itself and not use tools that interpret its data into a different format (many tools will convert the ESE to SQLite). Because SRUM uses Extensions that are recorded in the SOFTWARE hive, the SOFTWARE hive should also be checked for differences.
Windows Versions Used
The following versions were used for generating the data in this research.
Server 2019 Version: Windows Server 2019 Standard (Desktop Experience)
Windows 10 Version: Windows 10 Enterprise
Table Differences
The following table schemas are resolved with a script (srum_schema.py) that uses pyesedb and yarp to resolve SRUM data. pyesedb allows us to work with the ESE format and yarp allows us to work with Registry and take transaction logs into account.
Base Tables
After reviewing SRUM’s base set of tables (tables not in the extensions), they appear to remain the same across Windows 10 and Server 2019.
Windows 10
|
Server 2019 Desktop Experience
|
Status
|
---------------------------------------
Table: MSysObjects
---------------------------------------
ObjidTable -> INTEGER_32BIT_SIGNED
Type -> INTEGER_16BIT_SIGNED
Id -> INTEGER_32BIT_SIGNED
ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED
SpaceUsage -> INTEGER_32BIT_SIGNED
Flags -> INTEGER_32BIT_SIGNED
PagesOrLocale -> INTEGER_32BIT_SIGNED
RootFlag -> BOOLEAN
RecordOffset -> INTEGER_16BIT_SIGNED
LCMapFlags -> INTEGER_32BIT_SIGNED
KeyMost -> INTEGER_16BIT_UNSIGNED
LVChunkMax -> INTEGER_32BIT_SIGNED
Name -> TEXT
Stats -> BINARY_DATA
TemplateTable -> TEXT
DefaultValue -> BINARY_DATA
KeyFldIDs -> BINARY_DATA
VarSegMac -> BINARY_DATA
ConditionalColumns -> BINARY_DATA
TupleLimits -> BINARY_DATA
Version -> BINARY_DATA
SortID -> BINARY_DATA
CallbackData -> LARGE_BINARY_DATA
CallbackDependencies -> LARGE_BINARY_DATA
SeparateLV -> LARGE_BINARY_DATA
SpaceHints -> LARGE_BINARY_DATA
SpaceDeferredLVHints -> LARGE_BINARY_DATA
LocaleName -> LARGE_BINARY_DATA
|
---------------------------------------
Table: MSysObjects
---------------------------------------
ObjidTable -> INTEGER_32BIT_SIGNED
Type -> INTEGER_16BIT_SIGNED
Id -> INTEGER_32BIT_SIGNED
ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED
SpaceUsage -> INTEGER_32BIT_SIGNED
Flags -> INTEGER_32BIT_SIGNED
PagesOrLocale -> INTEGER_32BIT_SIGNED
RootFlag -> BOOLEAN
RecordOffset -> INTEGER_16BIT_SIGNED
LCMapFlags -> INTEGER_32BIT_SIGNED
KeyMost -> INTEGER_16BIT_UNSIGNED
LVChunkMax -> INTEGER_32BIT_SIGNED
Name -> TEXT
Stats -> BINARY_DATA
TemplateTable -> TEXT
DefaultValue -> BINARY_DATA
KeyFldIDs -> BINARY_DATA
VarSegMac -> BINARY_DATA
ConditionalColumns -> BINARY_DATA
TupleLimits -> BINARY_DATA
Version -> BINARY_DATA
SortID -> BINARY_DATA
CallbackData -> LARGE_BINARY_DATA
CallbackDependencies -> LARGE_BINARY_DATA
SeparateLV -> LARGE_BINARY_DATA
SpaceHints -> LARGE_BINARY_DATA
SpaceDeferredLVHints -> LARGE_BINARY_DATA
LocaleName -> LARGE_BINARY_DATA
|
Both table schemas match.
|
---------------------------------------
Table: MSysObjectsShadow
---------------------------------------
ObjidTable -> INTEGER_32BIT_SIGNED
Type -> INTEGER_16BIT_SIGNED
Id -> INTEGER_32BIT_SIGNED
ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED
SpaceUsage -> INTEGER_32BIT_SIGNED
Flags -> INTEGER_32BIT_SIGNED
PagesOrLocale -> INTEGER_32BIT_SIGNED
RootFlag -> BOOLEAN
RecordOffset -> INTEGER_16BIT_SIGNED
LCMapFlags -> INTEGER_32BIT_SIGNED
KeyMost -> INTEGER_16BIT_UNSIGNED
LVChunkMax -> INTEGER_32BIT_SIGNED
Name -> TEXT
Stats -> BINARY_DATA
TemplateTable -> TEXT
DefaultValue -> BINARY_DATA
KeyFldIDs -> BINARY_DATA
VarSegMac -> BINARY_DATA
ConditionalColumns -> BINARY_DATA
TupleLimits -> BINARY_DATA
Version -> BINARY_DATA
SortID -> BINARY_DATA
CallbackData -> LARGE_BINARY_DATA
CallbackDependencies -> LARGE_BINARY_DATA
SeparateLV -> LARGE_BINARY_DATA
SpaceHints -> LARGE_BINARY_DATA
SpaceDeferredLVHints -> LARGE_BINARY_DATA
LocaleName -> LARGE_BINARY_DATA
|
---------------------------------------
Table: MSysObjectsShadow
---------------------------------------
ObjidTable -> INTEGER_32BIT_SIGNED
Type -> INTEGER_16BIT_SIGNED
Id -> INTEGER_32BIT_SIGNED
ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED
SpaceUsage -> INTEGER_32BIT_SIGNED
Flags -> INTEGER_32BIT_SIGNED
PagesOrLocale -> INTEGER_32BIT_SIGNED
RootFlag -> BOOLEAN
RecordOffset -> INTEGER_16BIT_SIGNED
LCMapFlags -> INTEGER_32BIT_SIGNED
KeyMost -> INTEGER_16BIT_UNSIGNED
LVChunkMax -> INTEGER_32BIT_SIGNED
Name -> TEXT
Stats -> BINARY_DATA
TemplateTable -> TEXT
DefaultValue -> BINARY_DATA
KeyFldIDs -> BINARY_DATA
VarSegMac -> BINARY_DATA
ConditionalColumns -> BINARY_DATA
TupleLimits -> BINARY_DATA
Version -> BINARY_DATA
SortID -> BINARY_DATA
CallbackData -> LARGE_BINARY_DATA
CallbackDependencies -> LARGE_BINARY_DATA
SeparateLV -> LARGE_BINARY_DATA
SpaceHints -> LARGE_BINARY_DATA
SpaceDeferredLVHints -> LARGE_BINARY_DATA
LocaleName -> LARGE_BINARY_DATA
|
Both table schemas match.
|
---------------------------------------
Table: MSysObjids
---------------------------------------
objid -> INTEGER_32BIT_SIGNED
objidTable -> INTEGER_32BIT_SIGNED
type -> INTEGER_16BIT_SIGNED
|
---------------------------------------
Table: MSysObjids
---------------------------------------
objid -> INTEGER_32BIT_SIGNED
objidTable -> INTEGER_32BIT_SIGNED
type -> INTEGER_16BIT_SIGNED
|
Both table schemas match.
|
---------------------------------------
Table: MSysLocales
---------------------------------------
Type -> INTEGER_8BIT_UNSIGNED
iValue -> INTEGER_32BIT_SIGNED
Key -> BINARY_DATA
|
---------------------------------------
Table: MSysLocales
---------------------------------------
Type -> INTEGER_8BIT_UNSIGNED
iValue -> INTEGER_32BIT_SIGNED
Key -> BINARY_DATA
|
Both table schemas match.
|
---------------------------------------
Table: SruDbIdMapTable
---------------------------------------
IdType -> INTEGER_8BIT_UNSIGNED
IdIndex -> INTEGER_32BIT_SIGNED
IdBlob -> LARGE_BINARY_DATA
|
---------------------------------------
Table: SruDbIdMapTable
---------------------------------------
IdType -> INTEGER_8BIT_UNSIGNED
IdIndex -> INTEGER_32BIT_SIGNED
IdBlob -> LARGE_BINARY_DATA
|
Both table schemas match.
|
---------------------------------------
Table: SruDbCheckpointTable
---------------------------------------
ProviderId -> GUID
CheckpointId -> INTEGER_32BIT_SIGNED
NextIncId -> INTEGER_32BIT_SIGNED
SeqNumber -> BINARY_DATA
RecordSet -> LARGE_BINARY_DATA
|
---------------------------------------
Table: SruDbCheckpointTable
---------------------------------------
ProviderId -> GUID
CheckpointId -> INTEGER_32BIT_SIGNED
NextIncId -> INTEGER_32BIT_SIGNED
SeqNumber -> BINARY_DATA
RecordSet -> LARGE_BINARY_DATA
|
Both table schemas match.
|
Extended Tables
The differences between Windows 10 and Server 2019 start appearing when looking at the “Extension” tables. See the section Resolving Extended GUIDs for more information on registered Extensions and their enumeration. It would appear that DLLs register the Extension and thus it is expected to see differences of these tables between systems depending on services or application that exist. That being said, let’s look at some common tables.
Resolving Extended GUIDs
As with Windows 10, Server 2019 maintains the SRUM extended GUIDs and format under the SOFTWARE registry key `Microsoft\Windows NT\CurrentVersion\SRUM\Extensions`. This key has multiple sub-keys which are the GUIDs. For each GUID key, the default value is the descriptor of the GUID. See below for example:
Daily Blog #595: Solution Saturday 1/12/19
Reviewed by David Cowen
on
January 12, 2019
Rating:
No comments: