Tool Updated: Regmon and Filemon Log Duplicate Remover

2008-01-05T13:18:35Z

Listed in categories: Filemon Extensions, Regmon Extensions

Most recent version:
1.0

Most recent release date:
November 11, 2002

Description:
Designed to remove duplicate entries (at a designated filtering level) in Regmon and Filemon logs so it becomes humanly possible to scan large multi-thousand line logs for unique occurrences of a registry or file path being accessed.

The application parses the "Path" string of each entry and cuts it off at a subdirectory (\) level set by the user (Filter Level). A CRC32 value is then calculated on the remaining string. Any further occurrences of the same CRC32 value are considered "duplicates" and are discarded.

The string the CRC32 value is calculated on is actually a combination of the Process, plus the filtered Path string, and optionally the Request (CreateKey, OpenKey, QueryValueEx, etc.). Entries with one or more CLSID {} values can be handled separately so unique values are preserved irregardless of the Filter Level chosen.

Of course only the first occurrence is kept and is really only the "root" of the Path entry (unless you choose a Filter Level setting of 0), but by selecting a series of Filter Level settings you can choose the degree of detail you want to reveal.

Full MASM source is included.

Collaborative RCE Tool Library - Filemon Extensions (including sub-categories)

Tool Updated: Regmon and Filemon Log Duplicate Remover