Java - Revision history

Joachim Metz: /* External Links */

2013-05-06T11:37:35Z

‎External Links

Joachim Metz: /* Java WebStart Cache */

2013-05-06T10:35:34Z

‎Java WebStart Cache

Joachim Metz: /* Java WebStart Cache */

2013-03-19T19:17:16Z

‎Java WebStart Cache

Joachim Metz: /* External Links */

2013-02-25T21:26:02Z

‎External Links

Joachim Metz at 19:14, 25 January 2013

2013-01-25T19:14:19Z

Joachim Metz: /* IDX file format */

2013-01-24T20:19:13Z

‎IDX file format

Joachim Metz: /* IDX file format */

2013-01-24T20:18:37Z

‎IDX file format

Joachim Metz at 20:02, 24 January 2013

2013-01-24T20:02:36Z

Joachim Metz: /* IDX file format */

2013-01-23T07:20:56Z

‎IDX file format

Joachim Metz: /* External Links */

2013-01-23T06:44:42Z

‎External Links

@@ Line 340: / Line 340: @@
 == External Links ==
 * [http://sploited.blogspot.ch/2012/08/java-forensics-using-tln-timelines.html Java Forensics using TLN Timelines]
 * [http://journeyintoir.blogspot.com/2011/02/almost-cooked-up-some-java.html Almost Cooked UP Some Java]

@@ Line 32: / Line 32: @@
 <pre>
 C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\
 </pre>

@@ Line 4: / Line 4: @@
 As of Java version 6 the Java WebStart Cache can be found in the following locations.
-On Linux
+On Linux for user accounts:
 <pre>
 /home/$USER/.java/deployment/cache/
 </pre>
-On MacOS-X
+On MacOS-X for user accounts:
 <pre>
 /Users/$USER/Library/Caches/Java/cache/
 </pre>
-On Windows XP
+On Windows XP  for user accounts:
 <pre>
 C:\Documents and Settings\%USERNAME%\Application Data\Sun\Java\Deployment\cache\
 </pre>
-On Windows Vista and later
+On Windows Vista and later for user accounts:
 <pre>
 C:\Users\%USERNAME%\AppData\LocalLow\Sun\Java\Deployment\cache\
 </pre>

@@ Line 329: / Line 329: @@
 * [http://journeyintoir.blogspot.com/2011/11/finding-initial-infection-vector.html Finding Initial Infection Vector]
 * [https://github.com/woanware/javaidx/blob/master/Documents/Java.IDX.Format.pdf Java IDX Format Specification], by [[Mark Woan]], January 2013
 === Java source code ===

@@ Line 188: / Line 188: @@
 |}
-The values present in the header are dependent on the version. The definition above is based on version 603 an intended as an example check the [https://github.com/woanware/javaidx/blob/master/Documents/Java.IDX.Format.pdf Java IDX Format Specification] for more current information.
+The values present in the header are dependent on the version. The definition above is based on version 603 and intended as an example check the [https://github.com/woanware/javaidx/blob/master/Documents/Java.IDX.Format.pdf Java IDX Format Specification] for more current information.
 To convert a timestamp in e.g. Python

@@ Line 282: / Line 282: @@
 | 4
+|
-| Number of value pairs
+| Number of header value pairs
 |-
 | ...
 | ...
+|
-| Array of value pairs
+| Array of header value pairs
 |}

@@ Line 188: / Line 188: @@
 |}
-The values present in the header are likely to be dependent on the version.
+The values present in the header are dependent on the version. The definition above is based on version 603 an intended as an example check the [https://github.com/woanware/javaidx/blob/master/Documents/Java.IDX.Format.pdf Java IDX Format Specification] for more actual information.
 The definition above is based on version 603.
-−
 To convert a timestamp in e.g. Python
@@ Line 212: / Line 210: @@
 |-
 | 128
-| 4
+| 2
+| 00 00
 | Original URL string size
 |-
@@ Line 234: / Line 237: @@
 |-
 | ...
-| 4
+| 2
+| 00 00
 | IP string size
 |-
@@ Line 292: / Line 300: @@
 | 2
+|
-| Value description string size
+| Header value identifier string size
 |-
 | 2
 | size
+|
-| Value description string
+| Header value identifier string
 |-
 | ...
 | 2
+|
-| Value string size
+| Header value string size
 |-
 | ...
 | size
+|
-| Value string
+| Header value string
 |}
-Analysis of *.idx files have revealed a number of interesting findings.  One is that specific offsets appear to be based on the version or "magic number" of the *.idx file.  For example, for files with the second DWORD of the binary contents of the file (thought to be the "magic number") of 0x5a02, the URL from which the data was retrieved starts at offset 0x20, and is an ASCII string terminated by "\x00\x00".
+For the example above the size of the URL string can be found at offset 130 (0x82). The first 4 string values to extract from this data are prefaced with their lengths (or sizes) as 16-bit big-endian values. E.g. to retrieve the original URL string, read the WORD at offset 0x82, and translate it as a big-endian value (e.g. using Perl, <i>unpack("n",$data)</i>). Beginning at offset 0x84, the string is 57 (0x39) bytes long. At the end of that string, the next WORD is the length of the third string, also in big-endian format.
-−
-For a magic number of 0x5d02, the size of the URL string can be found at offset 0x80. The first two string values to extract from this data are prefaced with their lengths in 4-byte DWORDs, stored in big endian order.  To get the first string, read the DWORD at offset 0x80, and translate it as a big endian value (in Perl, use <i>unpack("N",$data)</i>).  Beginning at offset 0x84, the string is <i>length</i> characters long.  At the end of that string, the next DWORD is the length of the second string, also in big endian format.
-Once you've completed reading the initial strings, there is a DWORD value which can be interpreted as a <i>type</i> value, of sorts, and the remaining data (i.e., strings following the apparent <i>type</i> value) appears to follow a fairly regular pattern.  The <i>type</i> value appears to represent the number of string pairs in the remaining data.  Each string is prefaced by a WORD (2-byte) value, in big endian format, which tells us how long each string is...using this information, it is a fairly straightforward process to parse through the information and collect the strings, and pair them up.
+Once you've completed reading the initial 4 strings, there is a DWORD value which can be interpreted as the number of header values, followed by the individual header value definitions. Each header value definition consists of an identifier and a value string. Both strings are prefaced by a 16-bit big-endian (2-byte) value, containing the length of the string.
-In many cases, the <i>type</i> values of 2 include an HTTP Response code of 302; the values of  6, 7, and 8 (values that have been observed so far) include a response of 200, as well as additional data (including time stamps), and the *.idx files themselves appear to contain certificate (and perhaps other) information.
+In many cases, the first header value contains the HTTP Response code of 302. Other header values (that have been observed so far) include a response of 200, as well as additional data (including time stamps), and the *.idx files themselves appear to contain certificate (and perhaps other) information.
 == External Links ==

@@ Line 85: / Line 85: @@
 | 8
 | 00 00 01 1f 81 29 fe b8
-| Last modification date (POSIX timestamp in milli seconds)
+| Last modification date (Number of milli seconds since Jan 1, 1970 00:00:00)
 |-
 | 21
 | 8
+|
-| expiration date (POSIX timestamp in milli seconds) 0 if not expires?
+| expiration date (Number of milli seconds since Jan 1, 1970 00:00:00) 0 if not expires?
 |-
 | 29
 | 8
 | 00 00 01 2b 24 4a cb dd
-| Validation timestamp (POSIX timestamp in milli seconds)
+| Validation timestamp (Number of milli seconds since Jan 1, 1970 00:00:00)
 |-
 | 37
@@ Line 125: / Line 125: @@
 | 8
 | 00 00 01 2b 24 4a a4 cd
-| Blacklist validation time (POSIX timestamp in milli seconds)
+| Blacklist validation time (Number of milli seconds since Jan 1, 1970 00:00:00)
 |-
 | 62
 | 8
 | 00 00 01 2e 45 83 f4 18
-| Certificate expiration date (POSIX timestamp in milli seconds)
+| Certificate expiration date (Number of milli seconds since Jan 1, 1970 00:00:00)
 |-
 | 70
@@ Line 175: / Line 175: @@
 | 8
 | 00 00 01 2b 24 4a a4 cd
-| Trusted libraries validation time (POSIX timestamp in milli seconds)
+| Trusted libraries validation time (Number of milli seconds since Jan 1, 1970 00:00:00)
 |-
 | 98