ShimCacheDatabaseParser.cpp

/*
 * ShimCacheDatabaseParser - Forensics Tool (WinToolsSuite Serie 3 #22)
 * Parse AppCompatCache (Shimcache), détection malware persistant non-signé
 *
 * Fonctionnalités :
 * - Registry : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache
 * - Parse binaire : header (version Win7/8/10), entries array
 * - Extraction : path, size, last modified time, exec flag (si présent)
 * - Ordre chronologique insertion (LRU cache)
 * - Détection exécutables suspects : paths temp, downloads, ProgramData, non-signed
 * - Export CSV UTF-8 avec logging complet
 *
 * APIs : advapi32.lib, comctl32.lib
 * Auteur : WinToolsSuite
 * License : MIT
 */

#define _WIN32_WINNT 0x0601
#define UNICODE
#define _UNICODE
#define NOMINMAX

#include <windows.h>
#include <commctrl.h>
#include <commdlg.h>
#include <shlwapi.h>
#include <wintrust.h>
#include <softpub.h>
#include <vector>
#include <string>
#include <fstream>
#include <sstream>
#include <algorithm>
#include <memory>

#pragma comment(lib, "comctl32.lib")
#pragma comment(lib, "shlwapi.lib")
#pragma comment(lib, "advapi32.lib")
#pragma comment(lib, "wintrust.lib")
#pragma comment(linker,"\"/manifestdependency:type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"")

// Constantes UI
constexpr int WINDOW_WIDTH = 1500;
constexpr int WINDOW_HEIGHT = 750;
constexpr int MARGIN = 10;
constexpr int BUTTON_WIDTH = 180;
constexpr int BUTTON_HEIGHT = 30;

// IDs des contrôles
constexpr int IDC_LISTVIEW = 1001;
constexpr int IDC_BTN_PARSE = 1002;
constexpr int IDC_BTN_SORT = 1003;
constexpr int IDC_BTN_SEARCH = 1004;
constexpr int IDC_BTN_EXPORT = 1005;
constexpr int IDC_STATUS = 1006;
constexpr int IDC_EDIT_SEARCH = 1007;

// Signatures ShimCache
constexpr DWORD SHIMCACHE_MAGIC_NT52 = 0xBADC0FFE; // Windows XP/2003
constexpr DWORD SHIMCACHE_MAGIC_NT60 = 0xBADC0FEE; // Windows Vista/7
constexpr DWORD SHIMCACHE_MAGIC_NT61 = 0xBADC0FEE; // Windows 8/8.1
constexpr DWORD SHIMCACHE_MAGIC_NT62 = 0x00000034; // Windows 10

// Structure d'entrée ShimCache
struct ShimCacheEntry {
 std::wstring path;
 ULONGLONG fileSize;
 FILETIME lastModified;
 bool execFlag;
 DWORD insertOrder;
 bool suspicious;
 std::wstring notes;
};

// RAII pour clé registry
class RegKey {
 HKEY h;
public:
 explicit RegKey(HKEY handle) : h(handle) {}
 ~RegKey() { if (h) RegCloseKey(h); }
 operator HKEY() const { return h; }
 bool valid() const { return h != nullptr; }
};

// Classe principale
class ShimCacheDatabaseParser {
private:
 HWND hwndMain, hwndList, hwndStatus, hwndEditSearch;
 std::vector<ShimCacheEntry> entries;
 std::wofstream logFile;
 HANDLE hWorkerThread;
 volatile bool stopProcessing;

 void Log(const std::wstring& message) {
 if (logFile.is_open()) {
 SYSTEMTIME st;
 GetLocalTime(&st);
 wchar_t timeStr[64];
 swprintf_s(timeStr, L"[%02d/%02d/%04d %02d:%02d:%02d] ",
 st.wDay, st.wMonth, st.wYear, st.wHour, st.wMinute, st.wSecond);
 logFile << timeStr << message << std::endl;
 logFile.flush();
 }
 }

 void UpdateStatus(const std::wstring& text) {
 SetWindowTextW(hwndStatus, text.c_str());
 Log(text);
 }

 std::wstring FileTimeToString(FILETIME ft) {
 if (ft.dwLowDateTime == 0 && ft.dwHighDateTime == 0) {
 return L"N/A";
 }

 SYSTEMTIME st;
 if (FileTimeToSystemTime(&ft, &st)) {
 wchar_t buf[128];
 swprintf_s(buf, L"%02d/%02d/%04d %02d:%02d:%02d",
 st.wDay, st.wMonth, st.wYear, st.wHour, st.wMinute, st.wSecond);
 return buf;
 }
 return L"Invalide";
 }

 std::wstring FormatFileSize(ULONGLONG size) {
 const wchar_t* units[] = { L"B", L"KB", L"MB", L"GB" };
 int unitIndex = 0;
 double dSize = static_cast<double>(size);

 while (dSize >= 1024.0 && unitIndex < 3) {
 dSize /= 1024.0;
 unitIndex++;
 }

 wchar_t buf[64];
 swprintf_s(buf, L"%.2f %s", dSize, units[unitIndex]);
 return buf;
 }

 bool IsSuspiciousPath(const std::wstring& path, std::wstring& reason) {
 std::wstring lowerPath = path;
 std::transform(lowerPath.begin(), lowerPath.end(), lowerPath.begin(), ::towlower);

 // Chemins suspects
 if (lowerPath.find(L"\\temp\\") != std::wstring::npos ||
 lowerPath.find(L"\\tmp\\") != std::wstring::npos) {
 reason = L"Répertoire TEMP";
 return true;
 }

 if (lowerPath.find(L"\\downloads\\") != std::wstring::npos) {
 reason = L"Répertoire Downloads";
 return true;
 }

 if (lowerPath.find(L"\\appdata\\local\\temp") != std::wstring::npos) {
 reason = L"AppData Local Temp";
 return true;
 }

 if (lowerPath.find(L"\\programdata\\") != std::wstring::npos) {
 reason = L"ProgramData (rare)";
 return true;
 }

 if (lowerPath.find(L"\\users\\public\\") != std::wstring::npos) {
 reason = L"Users Public";
 return true;
 }

 // Extensions suspectes
 if (lowerPath.find(L".tmp.exe") != std::wstring::npos ||
 lowerPath.find(L".temp.exe") != std::wstring::npos) {
 reason = L"Extension suspecte";
 return true;
 }

 // Noms suspects
 std::wstring filename = PathFindFileNameW(path.c_str());
 std::transform(filename.begin(), filename.end(), filename.begin(), ::towlower);

 if (filename == L"svchost.exe" && lowerPath.find(L"\\system32\\") == std::wstring::npos) {
 reason = L"svchost.exe hors System32";
 return true;
 }

 if (filename == L"csrss.exe" && lowerPath.find(L"\\system32\\") == std::wstring::npos) {
 reason = L"csrss.exe hors System32";
 return true;
 }

 return false;
 }

 bool ParseShimCacheWin10(const BYTE* data, DWORD dataSize) {
 // Windows 10 format (le plus récent)
 if (dataSize < 48) return false;

 DWORD magic = *reinterpret_cast<const DWORD*>(data);
 if (magic != 0x34 && magic != 0x30) { // 0x34 ou 0x30 selon version
 return false;
 }

 // Header : 4 bytes magic + 4 bytes unknown + 4 bytes entry count + ...
 DWORD entryCount = *reinterpret_cast<const DWORD*>(data + 4);
 if (entryCount == 0 || entryCount > 10000) {
 entryCount = 512; // Fallback : limite raisonnable
 }

 size_t offset = 48; // Après le header (48 bytes pour Win10)
 DWORD order = 0;

 while (offset + 12 < dataSize && order < entryCount && !stopProcessing) {
 ShimCacheEntry entry;

 // Path length (2 bytes)
 if (offset + 2 > dataSize) break;
 WORD pathLen = *reinterpret_cast<const WORD*>(data + offset);
 offset += 2;

 if (pathLen == 0 || pathLen > 2048) break;

 // Path (Unicode)
 if (offset + pathLen > dataSize) break;
 entry.path = std::wstring(reinterpret_cast<const wchar_t*>(data + offset), pathLen / 2);
 offset += pathLen;

 // Alignement sur 4 bytes
 if (offset % 4 != 0) {
 offset += 4 - (offset % 4);
 }

 // Last Modified Time (8 bytes)
 if (offset + 8 > dataSize) break;
 entry.lastModified = *reinterpret_cast<const FILETIME*>(data + offset);
 offset += 8;

 // File Size (4 bytes) - optionnel selon version
 if (offset + 4 <= dataSize) {
 entry.fileSize = *reinterpret_cast<const DWORD*>(data + offset);
 offset += 4;
 } else {
 entry.fileSize = 0;
 }

 entry.execFlag = false; // Win10 n'a plus l'exec flag
 entry.insertOrder = order++;

 // Détection de suspicion
 std::wstring reason;
 entry.suspicious = IsSuspiciousPath(entry.path, reason);
 entry.notes = reason;

 entries.push_back(entry);
 }

 return order > 0;
 }

 bool ParseShimCacheWin7(const BYTE* data, DWORD dataSize) {
 // Windows 7/8 format
 if (dataSize < 128) return false;

 DWORD magic = *reinterpret_cast<const DWORD*>(data);
 if (magic != 0xBADC0FEE) {
 return false;
 }

 // Header : 128 bytes
 DWORD entryCount = *reinterpret_cast<const DWORD*>(data + 4);
 if (entryCount == 0 || entryCount > 10000) {
 entryCount = 512;
 }

 size_t offset = 128;
 DWORD order = 0;

 while (offset + 32 < dataSize && order < entryCount && !stopProcessing) {
 ShimCacheEntry entry;

 // Path length (2 bytes)
 if (offset + 2 > dataSize) break;
 WORD pathLen = *reinterpret_cast<const WORD*>(data + offset);
 offset += 2;

 // Max path length (2 bytes)
 offset += 2;

 // Path offset (4 bytes) - pointeur relatif
 DWORD pathOffset = *reinterpret_cast<const DWORD*>(data + offset);
 offset += 4;

 // Last Modified Time (8 bytes)
 if (offset + 8 > dataSize) break;
 entry.lastModified = *reinterpret_cast<const FILETIME*>(data + offset);
 offset += 8;

 // Exec flag (4 bytes)
 DWORD execFlags = *reinterpret_cast<const DWORD*>(data + offset);
 entry.execFlag = (execFlags & 0x02) != 0;
 offset += 4;

 // File size (4 bytes)
 if (offset + 4 <= dataSize) {
 entry.fileSize = *reinterpret_cast<const DWORD*>(data + offset);
 offset += 4;
 } else {
 entry.fileSize = 0;
 }

 // Last update time (8 bytes) - skip
 offset += 8;

 // Récupération du path
 if (pathOffset > 0 && pathOffset < dataSize && pathLen > 0 && pathLen < 2048) {
 if (pathOffset + pathLen <= dataSize) {
 entry.path = std::wstring(reinterpret_cast<const wchar_t*>(data + pathOffset), pathLen / 2);
 }
 }

 if (entry.path.empty()) {
 entry.path = L"<Path invalide>";
 }

 entry.insertOrder = order++;

 // Détection suspicion
 std::wstring reason;
 entry.suspicious = IsSuspiciousPath(entry.path, reason);
 entry.notes = reason;

 entries.push_back(entry);
 }

 return order > 0;
 }

 bool ParseShimCache() {
 entries.clear();

 // Ouvrir la clé registry
 HKEY hKey = nullptr;
 LONG result = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
 L"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache",
 0, KEY_READ, &hKey);

 if (result != ERROR_SUCCESS) {
 UpdateStatus(L"Erreur : Impossible d'ouvrir la clé AppCompatCache (admin requis)");
 return false;
 }

 RegKey key(hKey);

 // Lire la valeur AppCompatCache
 DWORD dataSize = 0;
 result = RegQueryValueExW(hKey, L"AppCompatCache", nullptr, nullptr, nullptr, &dataSize);

 if (result != ERROR_SUCCESS || dataSize == 0) {
 UpdateStatus(L"Erreur : Valeur AppCompatCache introuvable ou vide");
 return false;
 }

 std::vector<BYTE> data(dataSize);
 result = RegQueryValueExW(hKey, L"AppCompatCache", nullptr, nullptr, data.data(), &dataSize);

 if (result != ERROR_SUCCESS) {
 UpdateStatus(L"Erreur : Impossible de lire AppCompatCache");
 return false;
 }

 Log(L"AppCompatCache lu : " + std::to_wstring(dataSize) + L" bytes");

 // Détecter la version et parser
 if (dataSize >= 4) {
 DWORD magic = *reinterpret_cast<DWORD*>(data.data());

 bool success = false;

 // Tenter Win10 format d'abord
 if (magic == 0x34 || magic == 0x30) {
 UpdateStatus(L"Format détecté : Windows 10/11");
 success = ParseShimCacheWin10(data.data(), dataSize);
 }
 // Puis Win7/8 format
 else if (magic == 0xBADC0FEE) {
 UpdateStatus(L"Format détecté : Windows 7/8/8.1");
 success = ParseShimCacheWin7(data.data(), dataSize);
 }
 // Fallback : tenter Win10 format
 else {
 UpdateStatus(L"Format inconnu, tentative parsing Windows 10...");
 success = ParseShimCacheWin10(data.data(), dataSize);
 }

 if (success) {
 UpdateStatus(L"Parsing réussi : " + std::to_wstring(entries.size()) + L" entrées trouvées");
 return true;
 }
 }

 UpdateStatus(L"Erreur : Format ShimCache non reconnu");
 return false;
 }

 void PopulateListView() {
 ListView_DeleteAllItems(hwndList);

 for (size_t i = 0; i < entries.size(); i++) {
 LVITEMW lvi = {};
 lvi.mask = LVIF_TEXT;
 lvi.iItem = static_cast<int>(i);

 wchar_t buf[32];

 swprintf_s(buf, L"%u", entries[i].insertOrder);
 lvi.iSubItem = 0;
 lvi.pszText = buf;
 ListView_InsertItem(hwndList, &lvi);

 ListView_SetItemText(hwndList, i, 1, const_cast<LPWSTR>(entries[i].path.c_str()));

 std::wstring sizeStr = FormatFileSize(entries[i].fileSize);
 ListView_SetItemText(hwndList, i, 2, const_cast<LPWSTR>(sizeStr.c_str()));

 std::wstring modStr = FileTimeToString(entries[i].lastModified);
 ListView_SetItemText(hwndList, i, 3, const_cast<LPWSTR>(modStr.c_str()));

 ListView_SetItemText(hwndList, i, 4, entries[i].execFlag ? L"Oui" : L"Non");
 ListView_SetItemText(hwndList, i, 5, entries[i].suspicious ? L"SUSPECT" : L"OK");
 ListView_SetItemText(hwndList, i, 6, const_cast<LPWSTR>(entries[i].notes.c_str()));
 }
 }

 static DWORD WINAPI ParseThreadProc(LPVOID param) {
 auto* pThis = static_cast<ShimCacheDatabaseParser*>(param);

 pThis->UpdateStatus(L"Parsing ShimCache en cours...");

 if (pThis->ParseShimCache()) {
 PostMessage(pThis->hwndMain, WM_USER + 1, 0, 0);
 } else {
 pThis->UpdateStatus(L"Échec du parsing ShimCache");
 }

 return 0;
 }

 void OnParse() {
 stopProcessing = false;
 hWorkerThread = CreateThread(nullptr, 0, ParseThreadProc, this, 0, nullptr);

 if (hWorkerThread) {
 EnableWindow(GetDlgItem(hwndMain, IDC_BTN_PARSE), FALSE);
 }
 }

 void OnSort() {
 if (entries.empty()) {
 MessageBoxW(hwndMain, L"Aucune donnée à trier", L"Information", MB_ICONINFORMATION);
 return;
 }

 // Trier par lastModified (plus récent en premier)
 std::sort(entries.begin(), entries.end(), [](const ShimCacheEntry& a, const ShimCacheEntry& b) {
 ULARGE_INTEGER ua, ub;
 ua.LowPart = a.lastModified.dwLowDateTime;
 ua.HighPart = a.lastModified.dwHighDateTime;
 ub.LowPart = b.lastModified.dwLowDateTime;
 ub.HighPart = b.lastModified.dwHighDateTime;
 return ua.QuadPart > ub.QuadPart;
 });

 PopulateListView();
 UpdateStatus(L"Trié par date (plus récent en premier)");
 Log(L"Tri chronologique effectué");
 }

 void OnSearch() {
 if (entries.empty()) {
 MessageBoxW(hwndMain, L"Parsez d'abord le ShimCache", L"Information", MB_ICONINFORMATION);
 return;
 }

 wchar_t searchText[256] = {};
 GetWindowTextW(hwndEditSearch, searchText, 256);

 if (wcslen(searchText) == 0) {
 MessageBoxW(hwndMain, L"Entrez un terme de recherche", L"Information", MB_ICONINFORMATION);
 return;
 }

 std::wstring search = searchText;
 std::transform(search.begin(), search.end(), search.begin(), ::towlower);

 // Rechercher et sélectionner la première occurrence
 for (int i = 0; i < ListView_GetItemCount(hwndList); i++) {
 wchar_t path[2048];
 ListView_GetItemText(hwndList, i, 1, path, 2048);

 std::wstring itemPath = path;
 std::transform(itemPath.begin(), itemPath.end(), itemPath.begin(), ::towlower);

 if (itemPath.find(search) != std::wstring::npos) {
 ListView_SetItemState(hwndList, i, LVIS_SELECTED | LVIS_FOCUSED, LVIS_SELECTED | LVIS_FOCUSED);
 ListView_EnsureVisible(hwndList, i, FALSE);
 UpdateStatus(L"Trouvé à la ligne " + std::to_wstring(i + 1));
 return;
 }
 }

 UpdateStatus(L"Aucun résultat trouvé pour : " + std::wstring(searchText));
 }

 void OnExport() {
 if (entries.empty()) {
 MessageBoxW(hwndMain, L"Aucune donnée à exporter", L"Information", MB_ICONINFORMATION);
 return;
 }

 OPENFILENAMEW ofn = {};
 wchar_t fileName[MAX_PATH] = L"shimcache_analysis.csv";

 ofn.lStructSize = sizeof(OPENFILENAMEW);
 ofn.hwndOwner = hwndMain;
 ofn.lpstrFilter = L"CSV Files (*.csv)\0*.csv\0All Files (*.*)\0*.*\0";
 ofn.lpstrFile = fileName;
 ofn.nMaxFile = MAX_PATH;
 ofn.lpstrTitle = L"Exporter ShimCache";
 ofn.Flags = OFN_OVERWRITEPROMPT;
 ofn.lpstrDefExt = L"csv";

 if (GetSaveFileNameW(&ofn)) {
 std::wofstream csv(fileName, std::ios::binary);
 if (!csv.is_open()) {
 MessageBoxW(hwndMain, L"Impossible de créer le fichier CSV", L"Erreur", MB_ICONERROR);
 return;
 }

 // BOM UTF-8
 unsigned char bom[] = { 0xEF, 0xBB, 0xBF };
 csv.write(reinterpret_cast<wchar_t*>(bom), sizeof(bom) / sizeof(wchar_t));

 csv << L"Ordre,CheminExec,Taille,LastModified,ExecFlag,Suspect,Notes\n";

 for (const auto& entry : entries) {
 csv << entry.insertOrder << L",\""
 << entry.path << L"\",\""
 << FormatFileSize(entry.fileSize) << L"\",\""
 << FileTimeToString(entry.lastModified) << L"\",\""
 << (entry.execFlag ? L"Oui" : L"Non") << L"\",\""
 << (entry.suspicious ? L"SUSPECT" : L"OK") << L"\",\""
 << entry.notes << L"\"\n";
 }

 csv.close();
 UpdateStatus(L"Export réussi : " + std::wstring(fileName));
 Log(L"Export CSV : " + std::wstring(fileName));
 MessageBoxW(hwndMain, L"Export CSV réussi !", L"Succès", MB_ICONINFORMATION);
 }
 }

 void CreateControls(HWND hwnd) {
 // Champ de recherche
 CreateWindowW(L"STATIC", L"Rechercher :", WS_CHILD | WS_VISIBLE,
 MARGIN, MARGIN + 5, 100, 20, hwnd, nullptr, nullptr, nullptr);

 hwndEditSearch = CreateWindowExW(WS_EX_CLIENTEDGE, L"EDIT", L"",
 WS_CHILD | WS_VISIBLE | ES_AUTOHSCROLL,
 110, MARGIN, 350, 22, hwnd, (HMENU)IDC_EDIT_SEARCH, nullptr, nullptr);

 // Boutons
 int btnY = MARGIN;
 CreateWindowW(L"BUTTON", L"Parser Shimcache", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
 470, btnY, BUTTON_WIDTH, BUTTON_HEIGHT, hwnd, (HMENU)IDC_BTN_PARSE, nullptr, nullptr);

 CreateWindowW(L"BUTTON", L"Trier Chronologique", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
 470 + BUTTON_WIDTH + 10, btnY, BUTTON_WIDTH, BUTTON_HEIGHT, hwnd,
 (HMENU)IDC_BTN_SORT, nullptr, nullptr);

 CreateWindowW(L"BUTTON", L"Rechercher Path", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
 470 + (BUTTON_WIDTH + 10) * 2, btnY, BUTTON_WIDTH, BUTTON_HEIGHT, hwnd,
 (HMENU)IDC_BTN_SEARCH, nullptr, nullptr);

 CreateWindowW(L"BUTTON", L"Exporter CSV", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
 470 + (BUTTON_WIDTH + 10) * 3, btnY, BUTTON_WIDTH, BUTTON_HEIGHT, hwnd,
 (HMENU)IDC_BTN_EXPORT, nullptr, nullptr);

 // ListView
 hwndList = CreateWindowExW(WS_EX_CLIENTEDGE, WC_LISTVIEWW, L"",
 WS_CHILD | WS_VISIBLE | LVS_REPORT | LVS_SINGLESEL,
 MARGIN, btnY + BUTTON_HEIGHT + 10,
 WINDOW_WIDTH - MARGIN * 2 - 20,
 WINDOW_HEIGHT - btnY - BUTTON_HEIGHT - 80,
 hwnd, (HMENU)IDC_LISTVIEW, nullptr, nullptr);

 ListView_SetExtendedListViewStyle(hwndList, LVS_EX_FULLROWSELECT | LVS_EX_GRIDLINES | LVS_EX_DOUBLEBUFFER);

 // Colonnes
 LVCOLUMNW lvc = {};
 lvc.mask = LVCF_TEXT | LVCF_WIDTH;

 lvc.cx = 70; lvc.pszText = const_cast<LPWSTR>(L"Ordre");
 ListView_InsertColumn(hwndList, 0, &lvc);

 lvc.cx = 600; lvc.pszText = const_cast<LPWSTR>(L"Chemin Exécutable");
 ListView_InsertColumn(hwndList, 1, &lvc);

 lvc.cx = 100; lvc.pszText = const_cast<LPWSTR>(L"Taille");
 ListView_InsertColumn(hwndList, 2, &lvc);

 lvc.cx = 150; lvc.pszText = const_cast<LPWSTR>(L"Last Modified");
 ListView_InsertColumn(hwndList, 3, &lvc);

 lvc.cx = 80; lvc.pszText = const_cast<LPWSTR>(L"Exec Flag");
 ListView_InsertColumn(hwndList, 4, &lvc);

 lvc.cx = 100; lvc.pszText = const_cast<LPWSTR>(L"Suspect");
 ListView_InsertColumn(hwndList, 5, &lvc);

 lvc.cx = 250; lvc.pszText = const_cast<LPWSTR>(L"Notes");
 ListView_InsertColumn(hwndList, 6, &lvc);

 // Status bar
 hwndStatus = CreateWindowExW(0, L"STATIC",
 L"Prêt - Cliquez sur 'Parser Shimcache' (nécessite droits admin)",
 WS_CHILD | WS_VISIBLE | SS_SUNKEN | SS_LEFT,
 0, WINDOW_HEIGHT - 50, WINDOW_WIDTH - 20, 25,
 hwnd, (HMENU)IDC_STATUS, nullptr, nullptr);
 }

 static LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
 ShimCacheDatabaseParser* pThis = nullptr;

 if (uMsg == WM_NCCREATE) {
 CREATESTRUCT* pCreate = reinterpret_cast<CREATESTRUCT*>(lParam);
 pThis = static_cast<ShimCacheDatabaseParser*>(pCreate->lpCreateParams);
 SetWindowLongPtr(hwnd, GWLP_USERDATA, reinterpret_cast<LONG_PTR>(pThis));
 pThis->hwndMain = hwnd;
 } else {
 pThis = reinterpret_cast<ShimCacheDatabaseParser*>(GetWindowLongPtr(hwnd, GWLP_USERDATA));
 }

 if (pThis) {
 switch (uMsg) {
 case WM_CREATE:
 pThis->CreateControls(hwnd);
 return 0;

 case WM_COMMAND:
 switch (LOWORD(wParam)) {
 case IDC_BTN_PARSE: pThis->OnParse(); break;
 case IDC_BTN_SORT: pThis->OnSort(); break;
 case IDC_BTN_SEARCH: pThis->OnSearch(); break;
 case IDC_BTN_EXPORT: pThis->OnExport(); break;
 }
 return 0;

 case WM_USER + 1: // Parsing terminé
 pThis->PopulateListView();
 EnableWindow(GetDlgItem(hwnd, IDC_BTN_PARSE), TRUE);
 if (pThis->hWorkerThread) {
 CloseHandle(pThis->hWorkerThread);
 pThis->hWorkerThread = nullptr;
 }
 return 0;

 case WM_DESTROY:
 pThis->stopProcessing = true;
 if (pThis->hWorkerThread) {
 WaitForSingleObject(pThis->hWorkerThread, 2000);
 CloseHandle(pThis->hWorkerThread);
 }
 PostQuitMessage(0);
 return 0;
 }
 }

 return DefWindowProcW(hwnd, uMsg, wParam, lParam);
 }

public:
 ShimCacheDatabaseParser() : hwndMain(nullptr), hwndList(nullptr), hwndStatus(nullptr),
 hwndEditSearch(nullptr), hWorkerThread(nullptr), stopProcessing(false) {
 wchar_t logPath[MAX_PATH];
 GetModuleFileNameW(nullptr, logPath, MAX_PATH);
 PathRemoveFileSpecW(logPath);
 PathAppendW(logPath, L"ShimCacheDatabaseParser.log");

 logFile.open(logPath, std::ios::app);
 logFile.imbue(std::locale(std::locale(), new std::codecvt_utf8<wchar_t>));
 Log(L"=== ShimCacheDatabaseParser démarré ===");
 }

 ~ShimCacheDatabaseParser() {
 Log(L"=== ShimCacheDatabaseParser terminé ===");
 if (logFile.is_open()) {
 logFile.close();
 }
 }

 int Run(HINSTANCE hInstance, int nCmdShow) {
 WNDCLASSEXW wc = {};
 wc.cbSize = sizeof(WNDCLASSEXW);
 wc.style = CS_HREDRAW | CS_VREDRAW;
 wc.lpfnWndProc = WindowProc;
 wc.hInstance = hInstance;
 wc.hCursor = LoadCursor(nullptr, IDC_ARROW);
 wc.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
 wc.lpszClassName = L"ShimCacheParserClass";
 wc.hIcon = LoadIcon(nullptr, IDI_APPLICATION);
 wc.hIconSm = LoadIcon(nullptr, IDI_APPLICATION);

 if (!RegisterClassExW(&wc)) {
 MessageBoxW(nullptr, L"Échec de l'enregistrement de la classe", L"Erreur", MB_ICONERROR);
 return 1;
 }

 hwndMain = CreateWindowExW(0, L"ShimCacheParserClass",
 L"ShimCache Database Parser - WinToolsSuite Forensics",
 WS_OVERLAPPEDWINDOW,
 CW_USEDEFAULT, CW_USEDEFAULT, WINDOW_WIDTH, WINDOW_HEIGHT,
 nullptr, nullptr, hInstance, this);

 if (!hwndMain) {
 MessageBoxW(nullptr, L"Échec de la création de la fenêtre", L"Erreur", MB_ICONERROR);
 return 1;
 }

 ShowWindow(hwndMain, nCmdShow);
 UpdateWindow(hwndMain);

 MSG msg = {};
 while (GetMessage(&msg, nullptr, 0, 0)) {
 TranslateMessage(&msg);
 DispatchMessage(&msg);
 }

 return static_cast<int>(msg.wParam);
 }
};

int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE, LPWSTR, int nCmdShow) {
 INITCOMMONCONTROLSEX icc = {};
 icc.dwSize = sizeof(icc);
 icc.dwICC = ICC_LISTVIEW_CLASSES;
 InitCommonControlsEx(&icc);

 ShimCacheDatabaseParser app;
 return app.Run(hInstance, nCmdShow);
}