File Info: | ||||||||||||
|
Root Entry: | ||||||||||||||||||||
|
Cache Metadata: | ||||||||||
|
Index Metadata: | ||||||
|
Thumb Image Analysis: | ||||||||||||||||||||||||
|
Orphan Catalog Entries:> |
__TNORPHAN__ |
Summary: | |
| Totals: | __COUNTSTATS__ |
| Extraction: | __TYPESTATS__ |
= 0): sys.stderr.write(" Warning: No ESEDB Image column %s available\n" % utils.ESEDB_ICOL_NAMES["TCID"][0]) self.table = None self.edbFile.close() self.edbFile = False return self.edbFile if (self.iCol["MIME"] == None and self.iCol["CTYPE"] == None and self.iCol["ITT"] == None): if (config.ARGS.verbose >= 0): sys.stderr.write(" Warning: No ESEDB Image columns %s available\n" % (utils.ESEDB_ICOL_NAMES["MIME"][0] + ", " + utils.ESEDB_ICOL_NAMES["CTYPE"][0] + ", or " + utils.ESEDB_ICOL_NAMES["ITT"][0])) self.table = None self.edbFile.close() self.edbFile = False return self.edbFile self.listRecords = [] if (config.ARGS.verbose > 1): sys.stderr.write(" Info: ESEDB Getting record count...\n") iRecCnt = self.table.get_number_of_records() if (config.ARGS.verbose > 1): sys.stderr.write(" Info: ESEDB Processing records...\n") strRecIPD = None strRecIU = None iRecAdded = 0 strRecOut = " Info: Record #: %d Added: %d\r" # Read all the records... for iRec in range(iRecCnt): record = self.table.get_record(iRec) if (record == None): break if (config.ARGS.verbose > 1 and (iRec + 1) % 1000 == 0): sys.stderr.write(strRecOut % (iRec + 1, iRecAdded)) sys.stderr.flush() # Test for ThumbnailCacheId exists... bstrRecTCID = record.get_value_data(self.iCol["TCID"]) if (bstrRecTCID == None): continue # Test for image type record... strMime = "" if (self.iCol["MIME"] != None): strMime = (record.get_value_data_as_string(self.iCol["MIME"]) or "") strCType = "" if (self.iCol["CTYPE"] != None): strCType = (record.get_value_data_as_string(self.iCol["CTYPE"]) or "") strITT = "" if (self.iCol["ITT"] != None): strITT = (record.get_value_data_as_string(self.iCol["ITT"]) or "") strImageTest = strMime + strCType + strITT if (not "image" in strImageTest): continue # # TEST Record Retrieval... # print("\nTCID: " + str( hexlify( bstrRecTCID ))[2:-1]) # for strKey in self.iColNames: # if (strKey == "TCID"): # continue # sys.stdout.write(strKey + ": ") # rawESEDB = self.processRecord(record, strKey) # print(rawESEDB) dictRecord = {} dictRecord["TCID"] = bstrRecTCID dictRecord["MIME"] = strMime dictRecord["CTYPE"] = strCType dictRecord["ITT"] = strITT for strKey in self.iColNames: if (strKey == "TCID" or strKey == "MIME" or strKey == "CTYPE" or strKey == "ITT"): continue dictRecord[strKey] = self.processRecord(record, strKey) self.listRecords.append(dictRecord) iRecAdded += 1 if (config.ARGS.verbose > 1): sys.stderr.write(strRecOut % (iRec + 1, iRecAdded)) sys.stderr.flush() if (config.ARGS.verbose > 1): sys.stderr.write(strRecOut % (iRec + 1, iRecAdded)) sys.stderr.write("\n") # # TEST: Print ESEDB Image Records... # for dictRecord in self.listRecords: # self.printInfo(False) # print() if (len(self.listRecords) == 0): self.listRecords = None if (config.ARGS.verbose >= 0): sys.stderr.write(" Warning: No ESEDB Image data available\n") self.table = None self.edbFile.close() self.edbFile = False return self.edbFile if (config.ARGS.verbose > 0): sys.stderr.write(" Info: ESEDB Image data loaded\n") self.table = None self.edbFile.close() self.edbFile = True # ...ESEDB records were loaded, see self.listRecords return self.edbFile def getStr(self, strKey): strESEDB = None if (self.dictRecord == None): return strESEDB dataESEDB = None iCol = self.iCol[strKey] if (iCol != None): cTest = self.iColNames[strKey][1] # Format the key's value for output... # 'x' - bstr == (Large) Binary Data # 's' - str == (Large) Text # 'i' - int == Integer (32/16/8)-bit (un)signed # 'b' - bool == Boolean or Boolean Flags (Integer) # 'f' - float == Floating Point (Double Precision) (64/32-bit) # 'd' - date == Binary Data converted to Formatted UTC Time if (cTest == 'x'): strESEDB = str( hexlify( self.dictRecord[strKey] ))[2:-1] # ...stript off start b' and end ' elif (cTest == 's'): strESEDB = self.dictRecord[strKey] elif (cTest == 'i'): strESEDB = format(self.dictRecord[strKey], "d") elif (cTest == 'b'): if (isinstance(self.dictRecord[strKey], bool)): strESEDB = format(self.dictRecord[strKey], "") else: # ..Integer strFmt = "08b" # ...setup flag format for 8 bit integer if (self.dictRecord[strKey] > 255): strFmt = "016b" # ...setup flag format for 16 bit integer format if (self.dictRecord[strKey] > 65535): strFmt = "032b" # ...setup flag format for 32 bit integer format if (self.dictRecord[strKey] > 4294967295): strFmt = "064b" # ...setup flag format for 64 bit integer format strESEDB = format(self.dictRecord[strKey], strFmt) elif (cTest == 'f'): strESEDB = format(self.dictRecord[strKey], "G") elif (cTest == 'd'): strESEDB = utils.getFormattedWinToPyTimeUTC(self.dictRecord[strKey]) return strESEDB def printInfo(self, bHead = True): strEnhance = " ESEDB Enhance:" # If there is no output... if (self.dictRecord == None): if bHead: print(strEnhance + " None") return # Otherwise, print... if bHead: print(strEnhance) if (config.ARGS.verbose > 0): for strKey in self.iColNames: strESEDB = self.getStr(strKey) if (strESEDB != None): print("%s%s" % (self.iColNames[strKey][2], strESEDB)) else: strESEDB = self.getStr("TCID") print("%s%s" % (self.iColNames["TCID"][2], strESEDB)) return def examineRecord(self, strCmd): strValidRecord = "Enter a valid record number" print("List Record") if (strCmd[2:] == ""): print(strValidRecord) else: # Store and modify verbosity... iVerboseOld = config.ARGS.verbose if (iVerboseOld < 1): config.ARGS.verbose = 1 try: iRec = int(strCmd[2:]) try: dictRecord = self.listRecords[iRec - 1] print("Record: %d" % iRec) self.printInfo(False) print() except: print(strValidRecord) except: print(strValidRecord) # Restore verbosity... config.ARGS.verbose = iVerboseOld return def examine(self): import re import readline funcInput = input def prompt(strMessage, strErrorMessage, isValid): # Prompt for input given a message and return that value after verifying the input. # # Keyword arguments: # strMessage -- the message to display when asking the user for the value # strErrorMessage -- the message to display when the value fails validation # isValid -- a function that returns True if the value given by the user is valid res = None while res is None: res = funcInput(str(strMessage)+' > ') if (not isValid(res)): print(str(strErrorMessage)) res = None return res strValidColumn = "Enter a valid column number" strRecordsFound = "Records Found: %d\n" strMessage = "ESEDB Explorer" strErrorMessage = "A valid command must be provided. Try 'h'." reIsValid = re.compile(r"^[ehlqs]$|^l .+$") isValid = lambda v : reIsValid.search(v) reIsValidSearch = re.compile(r"^[ehlq]$|^[clv] .*$") isValidSearch = lambda v : reIsValidSearch.search(v) while (True): strCmd = prompt(strMessage, strErrorMessage, isValid) if (strCmd == "h"): # Help print("Help") print("Available Commands:") print(" h - this help") print(" l - list all stored ESEDB data") print(" l record - list the specified ESEDB record verbose") print(" s - search stored ESEDB data") print(" e - exit (quit) ESEDB Explorer") print(" q - exit (quit) ESEDB Explorer") elif (strCmd == "l"): # List print("List") iCount = 0 for dictRecord in self.listRecords: iCount += 1 print("Record: %d" % iCount) self.printInfo(False) print() print(strRecordsFound % iCount) elif (strCmd[:2] == "l "): # List Record self.examineRecord(strCmd) elif (strCmd == "s"): # Search strColKey = None iCol = None strRegEx = None while (True): strSearchMsg = "All Columns" if (strColKey == None) else ("Column %d (%s)" % (iCol, strColKey)) strCmd = prompt(strMessage + ": Search " + strSearchMsg, strErrorMessage, isValidSearch) if (strCmd == "h"): # Help print("Help") print("Available Commands:") print(" h - this help") print(" l - list all searchable columns") print(" l record - list the specified ESEDB record verbose") print(" c column - select specified column number (blank for all)") print(" v regex - search for value matching regex in selected column") print(" e - exit (quit) Search") print(" q - exit (quit) Search") elif (strCmd == "l"): # List print("List") for strKey in self.iCol: print("% 4d : %6s %s" % (self.iCol[strKey], strKey, self.iColNames[strKey][0])) elif (strCmd[:2] == "l "): # List Record self.examineRecord(strCmd) elif (strCmd[:2] == "c "): # Column Selection print("Column Selection") if (strCmd[2:] == ""): strColKey = None iCol = None else: try: iColNew = int(strCmd[2:]) try: strColKey = list(self.iCol.keys())[list(self.iCol.values()).index(iColNew)] iCol = iColNew except: print("Enter a valid column number") except: print("Enter a valid column number") elif (strCmd[:2] == "v "): # Value RegEx print("Searching columns in records...") iCount = 0 if (strCmd[2:] == ""): strRegEx = None else: strRegEx = strCmd[2:] reObj = re.compile(strRegEx) isFound = lambda v : reObj.search(v) if (v != None) else False iRec = 0 for dictRecord in self.listRecords: iRec += 1 bFound = False if (strColKey == None): for strKey in dictRecord: if isFound(self.getStr(strKey)): bFound = True break elif isFound(self.getStr(strColKey)): bFound = True if (bFound): iCount += 1 print("Record: %d" % iRec) self.printInfo(False) print() print(strRecordsFound % iCount) elif (strCmd == "e" or strCmd == "q"): # Exit/Quit break else: print(strErrorMessage) elif (strCmd == "e" or strCmd == "q"): # Exit/Quit break else: print(strErrorMessage) del readline del re return def search(self, strTCID): self.dictRecord = None if (self.listRecords == None or strTCID == None): return False strConvertTCID = strTCID if (len(strTCID)%2 == 1): strConvertTCID = "0" + strTCID try: bstrTCID = unhexlify(strConvertTCID) except: if (config.ARGS.verbose >= 0): sys.stderr.write(" Warning: Cannot unhex given Thumbnail Cache ID (%s) for compare\n" % strConvertTCID) return False for dictRecord in self.listRecords: # # TEST TCID Compare... # print(str(hexlify(bstrTCID))[2:-1] + " <> " + str(hexlify(dictRecord["BTCID"]))[2:-1]) if (bstrTCID == dictRecord["TCID"]): self.dictRecord = dictRecord break if (self.dictRecord == None): return False return True def isLoaded(self): if (isinstance(self.edbFile, bool)): return self.edbFile else: # ...file object... return False # ...in the process of loading Vinetto-0.9.13/src/vinetto/lib/ 0000775 0000000 0000000 00000000000 15017576257 0016300 5 ustar 00root root 0000000 0000000 Vinetto-0.9.13/src/vinetto/lib/__init__.py 0000664 0000000 0000000 00000000000 15017576257 0020377 0 ustar 00root root 0000000 0000000 Vinetto-0.9.13/src/vinetto/lib/pyesedb.so 0000775 0000000 0000000 00011737630 15017576257 0020323 0 ustar 00root root 0000000 0000000 ELF > @ ' @ 8 @ &