def testExistingFileStat(self): bash_stat = { "st_ctime": rdfvalue.RDFDatetimeSeconds(1299502221), "st_rdev": 0, "st_mtime": rdfvalue.RDFDatetimeSeconds(1284154642), "st_blocks": 16, "st_nlink": 1, "st_gid": 0, "st_blksize": 4096, "pathspec": rdf_paths.PathSpec( path="/bin/bash", pathtype="OS", path_options="CASE_LITERAL"), "st_dev": 51713, "st_size": 4874, "st_ino": 1026148, "st_uid": 0, "st_mode": rdf_client.StatMode(33261), "st_atime": rdfvalue.RDFDatetimeSeconds(1299502220) } bash_path = os.path.join("/", self.client_name, "fs/os/c/bin/bash") self.assertItemsEqual(self.passthrough.getattr(bash_path), bash_stat)
def testStatEntryToExportedRegistryKeyConverter(self): stat = rdfvalue.StatEntry( aff4path=rdfvalue.RDFURN( "aff4:/C.0000000000000000/registry/HKEY_USERS/S-1-5-20/Software/" "Microsoft/Windows/CurrentVersion/Run/Sidebar"), st_mode=32768, st_size=51, st_mtime=1247546054, registry_type=rdfvalue.StatEntry.RegistryType.REG_EXPAND_SZ, pathspec=rdfvalue.PathSpec( path="/HKEY_USERS/S-1-5-20/Software/Microsoft/Windows/" "CurrentVersion/Run/Sidebar", pathtype=rdfvalue.PathSpec.PathType.REGISTRY), registry_data=rdfvalue.DataBlob(string="Sidebar.exe")) converter = export.StatEntryToExportedRegistryKeyConverter() results = list(converter.Convert(rdfvalue.ExportedMetadata(), stat, token=self.token)) self.assertEqual(len(results), 1) self.assertEqual(results[0].urn, rdfvalue.RDFURN( "aff4:/C.0000000000000000/registry/HKEY_USERS/S-1-5-20/Software/" "Microsoft/Windows/CurrentVersion/Run/Sidebar")) self.assertEqual(results[0].last_modified, rdfvalue.RDFDatetimeSeconds(1247546054)) self.assertEqual(results[0].type, rdfvalue.StatEntry.RegistryType.REG_EXPAND_SZ) self.assertEqual(results[0].data, "Sidebar.exe")
def SetupTestTimeline(self): self.client_id = self.SetupClient(0) fixture_test_lib.ClientFixture(self.client_id, token=self.token) # Choose some directory with pathspec in the ClientFixture. self.folder_path = "fs/os/Users/中国新闻网新闻中/Shared" self.file_path = self.folder_path + "/a.txt" file_urn = self.client_id.Add(self.file_path) for i in range(0, 5): with test_lib.FakeTime(i): with aff4.FACTORY.Create( file_urn, aff4_grr.VFSFile, mode="w", token=self.token) as fd: stats = rdf_client.StatEntry( st_mtime=rdfvalue.RDFDatetimeSeconds().Now()) fd.Set(fd.Schema.STAT, stats)