ShimCache 应用兼容缓存解析

面向 Windows ShimCache / Application Compatibility Cache 取证，指导使用 Eric Zimmerman 的 AppCompatCacheParser 从 SYSTEM 注册表 Hive 或当前系统中提取兼容性缓存记录。可解析不同 ControlSet，输出程序完整路径、文件最后修改时间、缓存位置、执行标志及重复项信息，并支持时间排序和脏 Hive 场景。适合在恶意程序、入侵排查和终端取证中快速筛查曾出现过的可执行文件，并与 Prefetch、Amcache、事件日志等痕迹交叉验证程序存在及可能执行情况。

在 AI 中使用此 Skill将本页链接复制给 AI，即可让 AI 获取完整 Skill 内容并按此执行

安全提示： 本站 Skill 均经 ChatGPT 最新模型扫描，未发现恶意脚本及危险指令、未检出已知恶意行为特征，但不保证绝对安全，使用即表示接受此风险

Skill 文件

版本 20260318 · 76609998e1113888e80cb28c594c01bf

SKILL.md

---
name: appcompatcacheparser
version: 1.0.0
description: Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
metadata:
  tool-name: AppCompatCacheParser
  tool-vendor: Eric Zimmerman
---

# AppCompatCacheParser Skill

AppCompatCacheParser is Eric Zimmerman's command-line tool for parsing the Windows Application Compatibility Cache (ShimCache) from the SYSTEM registry hive. It extracts execution metadata including file paths, last modified timestamps, and execution flags. Forensic interpretation of ShimCache data (execution timeline analysis, program existence verification, etc.) belongs in a separate analysis skill.

## Command Syntax

```
AppCompatCacheParser.exe --csv <dir> [-f <file>] [other options]
```

Single-letter options use a single dash (`-`). Multi-character options use double dashes (`--`).

## Input

| Flag | Description |
|------|-------------|
| `-f` | Full path to SYSTEM hive file to process. If not specified, the live Registry is used. |

## Output Formats

| Flag | Description |
|------|-------------|
| `--csv` | Directory to write CSV output. Required. |
| `--csvf` | Custom filename for CSV output (overrides default) |

It's recommended to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

## Options

| Flag | Description | Default |
|------|-------------|---------|
| `--c` | ControlSet to parse. Default extracts all control sets. | all |
| `-t` | Sort last modified timestamps in descending order | FALSE |
| `--dt` | Custom date/time format string | `yyyy-MM-dd HH:mm:ss` |
| `--nl` | Ignore transaction log files for dirty hives | FALSE |
| `--debug` | Show debug information | FALSE |
| `--trace` | Show trace information | FALSE |

## Common Output Fields (CSV)

Output columns depend on tool version.

| Column | Description |
|--------|-------------|
| **ControlSet** | ControlSet the entry was extracted from |
| **CacheEntryPosition** | Position of the entry in the cache (execution order indicator) |
| **Path** | Full path to the executable |
| **LastModifiedTimeUTC** | Last modified timestamp of the file (UTC) |
| **Executed** | Execution flag (when available; not reliable on all OS versions) |
| **Duplicate** | Whether this entry is a duplicate across control sets |
| **SourceFile** | Path to the source SYSTEM hive file |

## Workflow Examples

### Parse a SYSTEM hive to CSV

```
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output"
```

### Parse with custom output filename

```
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --csvf ShimCache_parsed.csv
```

### Parse a specific ControlSet

```
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --c 1
```

### Parse with descending timestamp sort

```
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" -t
```

### Parse the live system Registry

```
AppCompatCacheParser.exe --csv "C:\Cases\Output"
```

### Parse dirty hive without transaction logs

```
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --nl
```