forked from log2timeline/plaso
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Migrated construct-based parsers to use dtfabric log2timeline#1893
- Loading branch information
1 parent
be6b6cf
commit 5d9418a
Showing
4 changed files
with
279 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,152 @@ | ||
# -*- coding: utf-8 -*- | ||
"""Shared functionality for dtFabric-based data format parsers.""" | ||
|
||
from __future__ import unicode_literals | ||
|
||
import os | ||
|
||
from dtfabric import errors as dtfabric_errors | ||
from dtfabric.runtime import data_maps as dtfabric_data_maps | ||
|
||
from plaso.lib import errors | ||
from plaso.parsers import interface | ||
|
||
|
||
class DataFormatParser(interface.FileObjectParser): | ||
"""Shared functionality for dtFabric-based data format parsers.""" | ||
|
||
def _ReadData(self, file_object, file_offset, data_size, description): | ||
"""Reads data. | ||
Args: | ||
file_object (file): a file-like object. | ||
file_offset (int): offset of the data relative from the start of | ||
the file-like object. | ||
data_size (int): size of the data. | ||
description (str): description of the data. | ||
Returns: | ||
bytes: byte stream containing the data. | ||
Raises: | ||
ParseError: if the structure cannot be read. | ||
ValueError: if file-like object or data type map are invalid. | ||
""" | ||
if not file_object: | ||
raise ValueError('Invalid file-like object.') | ||
|
||
file_object.seek(file_offset, os.SEEK_SET) | ||
|
||
read_error = '' | ||
|
||
try: | ||
data = file_object.read(data_size) | ||
|
||
if len(data) != data_size: | ||
read_error = 'missing data' | ||
|
||
except IOError as exception: | ||
read_error = '{0!s}'.format(exception) | ||
|
||
if read_error: | ||
raise errors.ParseError(( | ||
'Unable to read {0:s} data at offset: 0x{1:08x} with error: ' | ||
'{2:s}').format(description, file_offset, read_error)) | ||
|
||
return data | ||
|
||
def _ReadStructure( | ||
self, file_object, file_offset, data_size, data_type_map, description): | ||
"""Reads a structure. | ||
Args: | ||
file_object (file): a file-like object. | ||
file_offset (int): offset of the data relative from the start of | ||
the file-like object. | ||
data_size (int): data size of the structure. | ||
data_type_map (dtfabric.DataTypeMap): data type map of the structure. | ||
description (str): description of the structure. | ||
Returns: | ||
object: structure values object. | ||
Raises: | ||
ParseError: if the structure cannot be read. | ||
ValueError: if file-like object or data type map are invalid. | ||
""" | ||
data = self._ReadData(file_object, file_offset, data_size, description) | ||
|
||
return self._ReadStructureFromByteStream( | ||
data, file_offset, data_type_map, description) | ||
|
||
def _ReadStructureWithSizeHint( | ||
self, file_object, file_offset, data_type_map, description): | ||
"""Reads a structure using a size hint. | ||
Args: | ||
file_object (file): a file-like object. | ||
file_offset (int): offset of the data relative from the start of | ||
the file-like object. | ||
data_type_map (dtfabric.DataTypeMap): data type map of the structure. | ||
description (str): description of the structure. | ||
Returns: | ||
tuple[object, int]: structure values object and data size of | ||
the structure. | ||
Raises: | ||
ParseError: if the structure cannot be read. | ||
ValueError: if file-like object or data type map are invalid. | ||
""" | ||
context = None | ||
last_size_hint = 0 | ||
size_hint = data_type_map.GetSizeHint() | ||
|
||
while size_hint != last_size_hint: | ||
data = self._ReadData(file_object, file_offset, size_hint, description) | ||
|
||
try: | ||
context = dtfabric_data_maps.DataTypeMapContext() | ||
structure_values_object = self._ReadStructureFromByteStream( | ||
data, file_offset, data_type_map, description, context=context) | ||
return structure_values_object, size_hint | ||
|
||
except dtfabric_errors.ByteStreamTooSmallError: | ||
pass | ||
|
||
last_size_hint = size_hint | ||
size_hint = data_type_map.GetSizeHint(context=context) | ||
|
||
raise errors.ParseError('Unable to read {0:s}'.format(description)) | ||
|
||
def _ReadStructureFromByteStream( | ||
self, byte_stream, file_offset, data_type_map, description, context=None): | ||
"""Reads a structure from a byte stream. | ||
Args: | ||
byte_stream (bytes): byte stream. | ||
file_offset (int): offset of the data relative from the start of | ||
the file-like object. | ||
data_type_map (dtfabric.DataTypeMap): data type map of the structure. | ||
description (str): description of the structure. | ||
context (Optional[dtfabric.DataTypeMapContext]): data type map context. | ||
Returns: | ||
object: structure values object. | ||
Raises: | ||
ParseError: if the structure cannot be read. | ||
ValueError: if file-like object or data type map are invalid. | ||
""" | ||
if not byte_stream: | ||
raise ValueError('Invalid byte stream.') | ||
|
||
if not data_type_map: | ||
raise ValueError('Invalid data type map.') | ||
|
||
try: | ||
return data_type_map.MapByteStream(byte_stream, context=context) | ||
except dtfabric_errors.MappingError as exception: | ||
raise errors.ParseError(( | ||
'Unable to map {0:s} data at offset: 0x{1:08x} with error: ' | ||
'{2!s}').format(description, file_offset, exception)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
name: rp_log | ||
type: format | ||
description: Windows restore point log (rp.log) format | ||
urls: ["https://github.com/libyal/dtformats/blob/master/documentation/Restore%20point%20formats.asciidoc"] | ||
--- | ||
name: uint32 | ||
type: integer | ||
attributes: | ||
format: unsigned | ||
size: 4 | ||
units: bytes | ||
--- | ||
name: uint64 | ||
type: integer | ||
attributes: | ||
format: unsigned | ||
size: 8 | ||
units: bytes | ||
--- | ||
name: wchar16 | ||
type: character | ||
attributes: | ||
size: 2 | ||
units: bytes | ||
--- | ||
name: rp_log_file_header | ||
type: structure | ||
attributes: | ||
byte_order: little-endian | ||
members: | ||
- name: event_type | ||
data_type: uint32 | ||
- name: restore_point_type | ||
data_type: uint32 | ||
- name: sequence_number | ||
data_type: uint64 | ||
- name: description | ||
type: string | ||
encoding: utf-16-le | ||
element_data_type: wchar16 | ||
elements_terminator: "\x00\x00" | ||
--- | ||
name: rp_log_file_footer | ||
type: structure | ||
attributes: | ||
byte_order: little-endian | ||
members: | ||
- name: creation_time | ||
data_type: uint64 |