def ReadTimesyncFile(buffer, ts_list):
try:
pos = 0
size = len(buffer)
while pos < size:
sig, header_size, unk1 = struct.unpack("<HHI", buffer[pos:pos + 8])
if sig != 0xBBB0:
logger.error(
"not the right signature for Timesync header, got 0x{:04X} instead of 0x{:04X}, pos was 0x{:08X}"
.format(sig, 0x0030BBB0, pos))
break
uuid = UUID(bytes=buffer[pos + 8:pos + 24])
ts_numer, ts_denom, t_stamp, tz, is_dst = struct.unpack(
"<IIqiI", buffer[pos + 24:pos + 48])
ts_header = resources.TimesyncHeader(sig, unk1, uuid, ts_numer,
ts_denom, t_stamp, tz, is_dst)
pos += header_size # 0x30 (48) by default
if header_size != 0x30:
logger.info(
"Timesync header was 0x{:X} bytes instead of 0x30(48) bytes!"
.format(size))
logger.debug("TIMEHEAD {} 0x{:016X} {} {}".format(
uuid, t_stamp, ReadAPFSTime(t_stamp), 'boot'))
#TODO - TEST search ts_list for existing, not seen so far
existing_ts = None
for ts in ts_list:
if ts.header.boot_uuid == uuid:
existing_ts = ts
break
if existing_ts:
ts_obj = existing_ts
else:
ts_obj = resources.Timesync(ts_header)
ts_list.append(ts_obj)
# Adding header timestamp as Ts type too with cont_time = 0
timesync_item = resources.TimesyncItem(0, 0, t_stamp, tz,
is_dst)
ts_obj.items.append(timesync_item)
while pos < size:
if buffer[pos:pos + 4] == b'Ts \x00':
ts_unknown, cont_time, t_stamp, bias, is_dst = struct.unpack(
"<IqqiI", buffer[pos + 4:pos + 32])
timesync_item = resources.TimesyncItem(
ts_unknown, cont_time, t_stamp, bias, is_dst)
ts_obj.items.append(timesync_item)
logger.debug("TIMESYNC {} 0x{:016X} {} {}".format(
uuid, t_stamp, ReadAPFSTime(t_stamp), ts_unknown))
else:
break # break this loop, parse as header
pos += 32
except Exception as ex:
logger.exception("Exception reading TimesyncFile")
def DebugPrintDsc(self):
logger.debug("DSC version={0:s} file={1:s}".format(
self._format_version, self._file.filename))
logger.debug("Range entry values")
for range_entry in self.range_entries:
logger.debug("{0:d} {1:d} {2:d} {3:d}".format(
range_entry[0], range_entry[1], range_entry[2], range_entry[3]))
logger.debug("Uuid entry values")
for uuid_entry in self.uuid_entries:
logger.debug("{0:d} {1:d} {2!s} {3:s} {3:s}".format(
uuid_entry[0], uuid_entry[1], uuid_entry[2], uuid_entry[3],
uuid_entry[4]))
def open(self, mode='rb'):
'''Opens a file for reading/writing, returns file pointer or None'''
try:
logger.debug('Trying to read {} file {}'.format(self.file_type, self.path))
self.file_pointer = open(self.path, mode)
return self.file_pointer
except Exception as ex:
if str(ex).find('No such file') == -1:
logger.exception('Failed to open file {}'.format(self.path))
else:
logger.error('Failed to open as file not found {}'.format(self.path))
self.file_not_found = True
self.is_valid = False
return None
def DecompressTraceV3(trace_file, out_file):
''' Creates an uncompressed version of the .traceV3 file.
Input parameters:
trace_file = file pointer to .traceV3 file (opened as 'rb')
out_file = file pointer to blank file (opened as 'wb')
Returns True/False
'''
try:
index = 0
tag = trace_file.read(4)
while tag:
begin_pos = trace_file.tell() - 4
trace_file.seek(begin_pos + 8)
struct_len = struct.unpack('<Q', trace_file.read(8))[0]
logger.debug("index={} pos=0x{:X} tag=0x{}".format(
index, begin_pos,
binascii.hexlify(tag)[::-1]))
trace_file.seek(begin_pos)
chunk_data_incl_header = trace_file.read(16 + struct_len)
if tag == b'\x00\x10\x00\x00': # header
out_file.write(chunk_data_incl_header
) # boot_uuid header, write to output directly
elif tag[0] == 0x0B:
out_file.write(chunk_data_incl_header
) # uncompressed, write to output directly
elif tag[0] == 0x0D:
uncompressed = DecompressChunkData(chunk_data_incl_header[16:],
struct_len)
out_file.write(chunk_data_incl_header[0:8]) # Same Header !
out_file.write(struct.pack('<Q',
len(uncompressed))) # New size
out_file.write(uncompressed)
else:
logger.error('Unknown chunk tag value encountered : {}'.format(
binascii.hexlify(tag)))
out_file.write(chunk_data_incl_header)
if struct_len % 8: # Go to QWORD boundary
struct_len += 8 - (struct_len % 8)
if out_file.tell() % 8: # Go to QWORD boundary on output
out_file.write(
b'\x00\x00\x00\x00\x00\x00\x00'[0:(8 -
out_file.tell() % 8)])
trace_file.seek(begin_pos + 16 + struct_len)
tag = trace_file.read(4)
index += 1
except (ValueError, lz4.block.LZ4BlockError) as ex:
logger.exception('')
return False
return True
def ReadTimesyncFolder(path, ts_list, vfs):
'''Reads files in the timesync folder specified by 'path' and populates ts_list
with timesync entries.
vfs = VirtualFileSystem object
'''
try:
entries = vfs.listdir(path)
for entry in sorted(entries): # sort the files by name, so continuous time will be sequential automatically
if entry.endswith(".timesync"):
file_path = vfs.path_join(path, entry)
logger.debug('Trying to read timesync file {}'.format(file_path))
f = vfs.get_virtual_file(file_path, 'TimeSync').open()
if f:
buffer = f.read() # should be a fairly small file!
ReadTimesyncFile(buffer, ts_list)
f.close()
else:
logger.error("In Timesync folder, found non-ts file {}".format(entry))
except Exception:
logger.exception('')
