Comments on: Update: UserAssist Tool Version 2.4.3

By: Didier Stevens

Didier Stevens — Fri, 16 Oct 2009 11:00:32 +0000

It’s simple. The registry key has changed and the binary data format has changed in Windows 7 (and Windows Server 2008 R2).
What’s more, after I reversed the format of an early version of Windows 7 beta, Steve Riley from Microsoft told me that this format would change in next releases.
That’s why I only started last month with the analysis of the new format. I’ve a working beta version of my tool.

By: Hemn Baker

Hemn Baker — Thu, 15 Oct 2009 22:05:52 +0000

I am very interested to why it does not work currently with windows 7? what windows 7 have/n’t that makes it not work with it in a forensic point of view?

By: Didier Stevens

Didier Stevens — Thu, 13 Aug 2009 21:15:24 +0000

@Irongeek

that woulkd be cool, will keep you posted

By: Didier Stevens

Didier Stevens — Thu, 13 Aug 2009 21:14:39 +0000

Yes, it’s back to ROT-13 in the RTM I saw, but the binary data has changed.

By: Irongeek

Irongeek — Thu, 13 Aug 2009 14:10:39 +0000

I’d love to know when a version comes out that supports Win 7. I’m thinking of doing a video, or at least a text article that links to it.

By: H. Carvey

H. Carvey — Thu, 13 Aug 2009 11:08:02 +0000

Didier,

Does this mean that the “encryption” is NOT, in fact, going to fall back to ROT-13, the way previously discussed?