Tags

Tags give the ability to mark specific points in history as being important

  • 2.1.0

    8e578c87 · Bump the script version to 2.1 · 
    2.1.0 - hardening, validated on a clean Windows VM

Improvements on the 2.0 rewrite rather than a new architecture: same structure,
with the supply chain pinned and the failure modes made visible. First release
provisioned end to end on real Windows and checked by verify-baseline.ps1
rather than parse-checked and assumed.

Supply chain, previously unpinned:
  - hosted payloads moved from AWS S3 to Cloudflare R2 and SHA-256 pinned;
    a mismatch is fatal and deletes the partial file
  - Zimmerman (26 archives) and GitHub (7 tools) mirrored content-addressed,
    so an edge cache cannot serve stale bytes under a reused name
  - RegRipper and the Sigma helper pinned to commits instead of branch HEAD
  - Windows ISOs moved off the public tools/ prefix

New:
  - 13 independently re-runnable steps; -Only, -Skip, -Include
  - verify-baseline.ps1, run automatically at the end of provisioning
  - quiet installer output with a per-package summary
  - -SkipUpdateCheck, -ShowToolOutput

Defects fixed, most predating this work:
  - Get-ZimmermanTools.zip fetched from a URL returning 404
  - api.github.com rate limit: 5 calls per provision against 60/hour per IP, so
    one public IP supported 12 provisions an hour and failed as a mid-run crash.
    Provision-time GitHub API calls are now zero
  - Chocolatey exit codes never checked, hiding jumplistview (wrong id) and
    regripper (2.8 from a dead blog, shadowed on PATH anyway)
  - ShadowExplorer could never install: its package hardcodes an http:// URL
    whose redirect hangs
  - eleven Zimmerman archives ship a wrapping folder, leaving EvtxECmd, RECmd,
    SQLECmd and iisGeolocate off PATH -- true under the upstream bootstrapper too
  - .ps1 files must be pure ASCII: PowerShell 5.1 reads BOM-less files as CP1252,
    so an em-dash became an unterminated string on the target while parsing
    cleanly under pwsh
  - Expand-3rdPartyZip -Flatten was not idempotent, so no step could be re-run
  - dark mode and the wallpaper did not survive an RDP reconnect
  - LICENSE was MIT body text under an ALL RIGHTS RESERVED line, on a public
    remote; replaced with a proprietary notice
  - a desktop shortcut running `irm https://... | iex` on every new account

Known gaps: WinHex removed but still taught in 13 curriculum files; Chocolatey
runs with --ignore-checksums; x-ways and the Chocolatey feed remain unpinned.
    Unverified

  • 2.0.0

    25f93788 · finalizing rewrite · 
    Complete rewrite. Builds better user profiles.

  • 1.0.0

    409e823d · fixing URL · 
    Original powershell deployment script