Vormir Forensics

If you are on an offline computer without Volatility symbols, you can decode the 64-bit raw kernel integer directly in Python:

import datetime

def filetime_to_datetime(filetime_val):
    # Windows FILETIME is the number of 100-nanosecond ticks since Jan 1, 1601 UTC.
    # Unix epoch (Jan 1, 1970) starts at tick 116,444,736,000,000,000.
    WINDOWS_EPOCH_TICKS = 116444736000000000
    microseconds = (filetime_val - WINDOWS_EPOCH_TICKS) // 10
    epoch = datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
    return epoch + datetime.timedelta(microseconds=microseconds)

# Raw 64-bit value carved from KUSER_SHARED_DATA.SystemTime:
raw_ticks = 134267416630000000
converted_date = filetime_to_datetime(raw_ticks)

print("[+] Recovered Timestamp:", converted_date.strftime("%Y-%m-%d %H:%M:%S"))
# Output: 2026-10-08 05:07:43

import numpy as np
from PIL import Image

# ==============================================================================
# PART 1: CARVE BOTTOM-UP DIB SECTION FROM VAD DUMP
# ==============================================================================
vad_path = "vad_dump/pid.1204.vad.0x23840870000-0x23840af4fff.dmp"
with open(vad_path, "rb") as f:
    raw_bytes = f.read()

width = 1152       # Stride: 4608 bytes / 4 bytes per pixel (32bpp)
height = 573      # Total size 2,641,920 // 4608 bytes
expected_length = width * height * 4

# Interpret raw bytes as BGRA 32-bit pixel array
arr = np.frombuffer(raw_bytes[:expected_length], dtype=np.uint8).reshape((height, width, 4))

# Convert BGRA order to standard RGBA
rgba = arr[:, :, [2, 1, 0, 3]]

# Windows DIB bitmaps are stored bottom-up; flip vertically
upright_image = np.flipud(rgba)

img = Image.fromarray(upright_image, mode="RGBA")
img.save("recovered_mspaint_canvas.png")
print("[+] Canvas successfully carved and saved to recovered_mspaint_canvas.png")

# ==============================================================================
# PART 2: HUNT UNRENDERED TEXT BUFFER IN PROCESS HEAP MEMORY
# ==============================================================================
with open("soul.mem", "rb") as f:
    mem = f.read()

# Search for the partial hex needle in UTF-16LE encoding:
needle = "7061696e745f3".encode("utf-16le")
offset = mem.find(needle)

if offset != -1:
    print(f"[+] Found UTF-16 buffer match at memory offset: 0x{offset:08x}")
    start_offset = mem.rfind("4f5741".encode("utf-16le"), 0, offset)
    end_offset = mem.find(b"\x00\x00\x00", offset)
    
    full_hex_utf16 = mem[start_offset:end_offset].decode("utf-16le")
    flag = bytes.fromhex(full_hex_utf16).decode("ascii")
    print(f"[+] Verified Decoded Flag: {flag}")
    # Output: OWASP{soulstone_paint_52af}