class POST_PROCESS(Script):
def __init__(self):
Script.__init__(self, "post_process")
self.tm = TaskManager()
def start(self, args):
mod = args["module"]
if mod:
self.tm.addPostProcess(str(mod))
return
def __init__(self): Script.__init__(self, "batch") self.tm = TaskManager() self.DEBUG = False self.VERBOSITY = 0 self.lp = LineParser(self.DEBUG, self.VERBOSITY -1) self.cm = ConfigManager.Get()
class BATCH(Script):
def __init__(self):
Script.__init__(self, "batch")
self.tm = TaskManager()
self.DEBUG = False
self.VERBOSITY = 0
self.lp = LineParser(self.DEBUG, self.VERBOSITY -1)
self.cm = ConfigManager.Get()
def start(self, args):
path = args["path"].value().path
print "executing batch script " + path
file = open(path)
for line in file.xreadlines():
if line[0] == "#":
print line[1:]
else:
cmds = self.lp.makeCommands(line)
for cmd in cmds:
exec_type = ["console"]
config = self.cm.configByName(cmd[0])
args = config.generate(cmd[1])
proc = self.tm.add(cmd[0], args, exec_type)
proc.event.wait()
file.close()
return
def __init__(self, parent):
super(QWidget, self).__init__()
EventHandler.__init__(self)
self.setupUi(self)
self.mainwindow = parent
self.getWindowGeometry()
self.name = self.windowTitle()
self.type = "filebrowser"
self.setObjectName(self.name)
self.vfs = vfs.vfs()
self.VFS = VFS.Get()
self.VFS.connection(self)
self.loader = loader.loader()
self.lmodules = self.loader.modules
self.taskmanager = TaskManager()
self.parent = parent
self.icon = None
self.createSubMenu()
self.createLayout()
self.addModel("/")
self.addNodeLinkTreeView()
self.addNodeView()
self.addOptionsView()
def __init__(self, IOout=None):
self.oldstdout = sys.__stdout__
self.oldstderr = sys.__stderr__
self.lparent = []
self.ioOut = IOout
self.tm = TaskManager()
self.loader = loader.loader()
sys.stdout = RedirectWrite(self, 'out')
sys.stderr = RedirectWrite(self, 'err')
self.write = sys.stdout.write
def __init__(self, selector, vnode):
QWidget.__init__(self)
EventHandler.__init__(self)
self.vnode = vnode
self.filesize = vnode.value().size()
self.tm = TaskManager()
self.selector = selector
self.setLayout(QVBoxLayout())
self.factor = 1
self.parsetime = 0
self.time = time.time()
self.starttime = time.time()
self.createStartOffset()
self.createButtons()
self.createStateInfo()
def __init__(self, parent):
super(QWidget, self).__init__()
EventHandler.__init__(self)
self.setupUi(self)
self.mainwindow = parent.parent.parent.parent
self.model = ListNodeModel(self)
self.name = self.windowTitle()
self.type = "filebrowser"
self.setObjectName(self.name)
self.vfs = vfs.vfs()
self.VFS = VFS.Get()
self.loader = loader.loader()
self.lmodules = self.loader.modules
self.taskmanager = TaskManager()
self.parent = parent
self.icon = None
self.createSubMenu()
self.createLayout()
def __init__(self):
Script.__init__(self, "carverui")
self.tm = TaskManager()
class CarverUi(Script):
def __init__(self):
Script.__init__(self, "carverui")
self.tm = TaskManager()
def start(self, args):
patterns = VList()
patterns.thisown = False
if args.has_key("start-offset"):
startoff = args["start-offset"].value()
else:
startoff = 0
if args.has_key("block-aligned"):
aligned = True
else:
aligned = False
for mimetype in filetypes.keys():
if mimetype in args:
vsubtypes = args[mimetype].value()
for subtype in filetypes[mimetype].keys():
if subtype in vsubtypes:
pattern = VMap()
pattern.thisown = False
descr = filetypes[mimetype][subtype]
filetype = Variant(subtype, typeId.String)
filetype.thisown = False
for p in descr:
pattern["filetype"] = filetype
header = VMap()
header.thisown = False
val = Variant(p[0], typeId.String)
val.thisown = False
header["needle"] = val
val = Variant(len(p[0]), typeId.UInt32)
val.thisown = False
header["size"] = val
footer = VMap()
footer.thisown = False
val = Variant(p[1], typeId.String)
val.thisown = False
footer["needle"] = val
val = Variant(len(p[1]), typeId.UInt32)
val.thisown = False
footer["size"] = val
vheader = Variant(header)
vheader.thisown = False
pattern["header"] = vheader
vfooter = Variant(footer)
vfooter.thisown = False
pattern["footer"] = vfooter
pattern["window"] = Variant(int(p[2]), typeId.UInt32)
if aligned:
val = Variant(True, typeId.Bool)
val.thisown = False
pattern["aligned"] = val
else:
val = Variant(False, typeId.Bool)
val.thisown = False
pattern["aligned"] = val
patterns.append(pattern)
vpatterns = Variant(patterns)
vpatterns.thisown = False
margs = VMap()
margs.thisown = False
margs["patterns"] = vpatterns
margs["file"] = args["file"]
vstartoff = Variant(startoff, typeId.UInt64)
vstartoff.thisown = False
margs["start-offset"] = vstartoff
proc = self.tm.add("carver", margs, ["console"])
if proc:
proc.event.wait()
def c_display(self):
pass
def __init__(self): Script.__init__(self, "post_process") self.tm = TaskManager()
class SearchNodeBrowser(QWidget, EventHandler, Ui_NodeBrowser):
def __init__(self, parent):
super(QWidget, self).__init__()
EventHandler.__init__(self)
self.setupUi(self)
self.mainwindow = parent.parent.parent.parent
self.model = ListNodeModel(self)
self.name = self.windowTitle()
self.type = "filebrowser"
self.setObjectName(self.name)
self.vfs = vfs.vfs()
self.VFS = VFS.Get()
self.loader = loader.loader()
self.lmodules = self.loader.modules
self.taskmanager = TaskManager()
self.parent = parent
self.icon = None
self.createSubMenu()
self.createLayout()
def Event(self, e):
self.model.emit(SIGNAL("layoutAboutToBeChanged()"))
self.model.emit(SIGNAL("layoutChanged()"))
def getWindowGeometry(self):
self.winWidth = self.mainwindow.width()
def createLayout(self):
self.baseLayout = QVBoxLayout(self)
self.baseLayout.setMargin(0)
self.baseLayout.setSpacing(0)
self.browserLayout = QSplitter(self)
self.baseLayout.insertWidget(0, self.browserLayout)
self.baseLayout.setStretchFactor(self.browserLayout, 1)
def addNodeView(self):
self.addTableView()
self.addThumbsView()
def addTableView(self):
self.tableView = NodeTableView(self)
self.tableView.horizontalHeader().setStretchLastSection(True)
self.tableView.setColumnWidth(0, 200)
self.tableView.setSizePolicy(QSizePolicy(QSizePolicy.Maximum, QSizePolicy.Maximum))
self.browserLayout.addWidget(self.tableView)
self.browserLayout.setStretchFactor(self.browserLayout.indexOf(self.tableView), 1)
self.connect(self.tableView, SIGNAL("nodePressed"), self.nodePressed)
self.connect(self.tableView, SIGNAL("nodeClicked"), self.nodeClicked)
self.connect(self.tableView, SIGNAL("nodeDoubleClicked"), self.nodeDoubleClicked)
self.connect(self.tableView, SIGNAL(""), self.selectAttr)
def applyModule(self, modname, modtype, selected):
appMod = ApplyModule(self)
appMod.openApplyModule(modname, modtype, selected)
def selectAttr(self):
pass
def addThumbsView(self):
self.thumbsView = NodeThumbsView(self)
self.thumbsView.setModel(self.model)
self.thumbsView.setSizePolicy(QSizePolicy(QSizePolicy.Maximum, QSizePolicy.Maximum))
self.browserLayout.addWidget(self.thumbsView)
self.browserLayout.setStretchFactor(self.browserLayout.indexOf(self.thumbsView), 1)
self.connect(self.thumbsView, SIGNAL("nodePressed"), self.nodePressed)
self.connect(self.thumbsView, SIGNAL("nodeClicked"), self.nodeClicked)
self.connect(self.thumbsView, SIGNAL("nodeDoubleClicked"), self.nodeDoubleClicked)
def currentProxyModel(self):
if self.thumbsView.isVisible():
return self.thumbsView.model()
elif self.tableView.isVisible():
return self.tableView.model()
def currentModel(self):
return self.tableView.model()
def currentView(self):
return self.tableView
def currentNodes(self):
indexList = self.currentView().selectionModel().selectedRows()
nodeList = []
for index in indexList:
if index.isValid():
nodeList.append(self.VFS.getNodeFromPointer(index.internalId()))
return nodeList
def currentNode(self):
index = self.currentView().selectionModel().currentIndex()
if index.isValid():
return self.VFS.getNodeFromPointer(index.internalId())
def nodePressed(self, key, node, index = None):
if key in [Qt.Key_Up, Qt.Key_Down, Qt.Key_PageUp, Qt.Key_PageDown]:
self.parent.xtd_attr.fill(node)
self.mainwindow.emit(SIGNAL("previewUpdate"), node)
def nodeClicked(self, mouseButton, node, index = None):
if mouseButton == Qt.LeftButton:
self.mainwindow.emit(SIGNAL("previewUpdate"), node)
if mouseButton == Qt.RightButton:
self.menuRelevant = MenuRelevant(self, self, node)
if node.hasChildren() or node.isDir():
self.actionOpen_in_new_tab.setEnabled(True)
else:
self.actionOpen_in_new_tab.setEnabled(False)
self.submenuFile.popup(QCursor.pos())
self.submenuFile.show()
self.parent.xtd_attr.fill(node)
def nodeTreeDoubleClicked(self, mouseButton, node, index = None):
if node == None:
return
if self.currentView().enterInDirectory:
if node.hasChildren() or node.isDir():
self.currentModel().setRootPath(node)
def nodeDoubleClicked(self, mouseButton, node, index = None):
if node == None:
return
if self.currentView().enterInDirectory:
if node.hasChildren() or node.isDir():
self.openAsNewTab()
else:
self.openDefault(node)
else:
self.openDefault(node)
def sizeChanged(self, string):
if self.nodeViewBox.thumbSize.currentIndex() == 0:
self.thumbsView.setIconGridSize(64, 64)
elif self.nodeViewBox.thumbSize.currentIndex() == 1:
self.thumbsView.setIconGridSize(96, 96)
elif self.nodeViewBox.thumbSize.currentIndex() == 2:
self.thumbsView.setIconGridSize(128, 128)
def openDefault(self, node = None):
if not node:
node = self.currentNode()
if not node:
return
mods = node.compatibleModules()
mods.reverse()
if len(mods):
for mod in mods:
if "Viewers" in self.lmodules[mod].tags:
break
try:
priority = modulePriority[mod]
except KeyError:
modulePriority[mod] = 0
priority = 0
if not priority:
mbox = QMessageBox(QMessageBox.Question, self.tr("Apply module"), self.tr("Do you want to apply module ") + str(mod) + self.tr(" on this node ?"), QMessageBox.Yes | QMessageBox.No, self)
mbox.addButton(self.tr("Always"), QMessageBox.AcceptRole)
reply = mbox.exec_()
if reply == QMessageBox.No:
return
elif reply == QMessageBox.AcceptRole:
modulePriority[mod] = 1
if self.lmodules[mod]:
conf = self.lmodules[mod].conf
arguments = conf.arguments()
marg = {}
for argument in arguments:
if argument.type() == typeId.Node:
marg[argument.name()] = node
args = conf.generate(marg)
self.taskmanager.add(mod, args, ["thread", "gui"])
return
else:
errnodes = ""
if node.size():
conf = self.lmodules["hexadecimal"].conf
try:
arg = conf.generate({"file": node})
self.taskmanager.add("hexadecimal", arg, ["thread", "gui"])
except RuntimeError:
errnodes += node.absolute() + "\n"
else:
errnodes += node.absolute() + "\n"
if len(errnodes):
msg = QMessageBox(self)
msg.setWindowTitle(self.tr("Empty files"))
msg.setText(self.tr("the following nodes could not be opened with Hex viewer because they are either empty or folders\n"))
msg.setIcon(QMessageBox.Warning)
msg.setDetailedText(errnodes)
msg.setStandardButtons(QMessageBox.Ok)
ret = msg.exec_()
def createSubMenu(self):
self.extractor = Extractor(self.parent)
self.connect(self.extractor, SIGNAL("filled"), self.launchExtract)
self.submenuFile = QMenu()
self.submenuFile.addAction(self.actionOpen)
self.connect(self.actionOpen, SIGNAL("triggered()"), self.openDefault)
self.submenuFile.addAction(self.actionOpen_in_new_tab)
self.connect(self.actionOpen_in_new_tab, SIGNAL("triggered()"), self.openAsNewTab)
self.submenuRelevant = self.submenuFile.addMenu(self.actionRelevant_module.icon(), self.actionRelevant_module.text())
self.menu = {}
self.menuModule = self.submenuFile.addMenu(self.actionOpen_with.icon(), self.actionOpen_with.text())
self.menuTags = MenuTags(self, self.parent.parent.parent.parent, self.currentNodes)
self.submenuFile.addSeparator()
self.submenuFile.addAction(self.actionHex_viewer)
self.connect(self.actionHex_viewer, SIGNAL("triggered()"), self.launchHexedit)
self.submenuFile.addAction(self.actionExtract)
self.connect(self.actionExtract, SIGNAL("triggered()"), self.extractNodes)
self.submenuFile.addSeparator()
def openAsNewTab(self):
node = self.currentNode()
self.parent.parent.parent.parent.addNodeBrowser(node)
def launchHexedit(self):
nodes = self.currentNodes()
conf = self.loader.get_conf("hexadecimal")
errnodes = ""
for node in nodes:
if node.size():
try:
arg = conf.generate({"file": node})
self.taskmanager.add("hexadecimal", arg, ["thread", "gui"])
except RuntimeError:
errnodes += node.absolute() + "\n"
else:
errnodes += node.absolute() + "\n"
if len(errnodes):
msg = QMessageBox(self)
msg.setWindowTitle(self.tr("Empty files"))
msg.setText(self.tr("the following nodes could not be opened with Hex viewer because they are either empty or folders\n"))
msg.setIcon(QMessageBox.Warning)
msg.setDetailedText(errnodes)
msg.setStandardButtons(QMessageBox.Ok)
ret = msg.exec_()
def extractNodes(self):
self.extractor.launch(self.currentNodes())
def launchExtract(self):
res = self.extractor.getArgs()
args = {}
args["files"] = res["nodes"]
args["syspath"] = str(res["path"])
args["recursive"] = res["recurse"]
conf = self.loader.get_conf("extract")
try:
margs = conf.generate(args)
self.taskmanager.add("extract", margs, ["thread", "gui"])
except RuntimeError:
pass
def changeEvent(self, event):
""" Search for a language change event
This event have to call retranslateUi to change interface language on
the fly.
"""
if event.type() == QEvent.LanguageChange:
self.retranslateUi(self)
self.menuModule.setTitle(self.actionOpen_with.text())
self.submenuRelevant.setTitle(self.actionRelevant_module.text())
self.model.translation()
else:
QWidget.changeEvent(self, event)
class CarvingProcess(QWidget, EventHandler):
def __init__(self, selector, vnode):
QWidget.__init__(self)
EventHandler.__init__(self)
self.vnode = vnode
self.filesize = vnode.value().size()
self.tm = TaskManager()
self.selector = selector
self.setLayout(QVBoxLayout())
self.factor = 1
self.parsetime = 0
self.time = time.time()
self.starttime = time.time()
self.createStartOffset()
self.createButtons()
self.createStateInfo()
def createStartOffset(self):
self.offsetLayout = QHBoxLayout()
self.offsetSpinBox = QFFSpinBox(self)
self.offsetSpinBox.setMinimum(0)
self.offsetSpinBox.setMaximum(self.filesize)
self.offsetLabel = QLabel("start offset:")
self.offsetLayout.addWidget(self.offsetLabel)
self.offsetLayout.addWidget(self.offsetSpinBox)
self.layout().addLayout(self.offsetLayout)
def createButtons(self):
self.startButton = QPushButton("Start")
self.stopButton = QPushButton("Stop")
self.stopButton.setEnabled(False)
self.connect(self.stopButton, SIGNAL("clicked()"), self.stopCarving)
self.connect(self.startButton, SIGNAL("clicked()"), self.startCarving)
self.connect(self, SIGNAL("ended"), self.carvingEnded)
self.buttonLayout = QHBoxLayout()
self.buttonLayout.addWidget(self.startButton)
self.buttonLayout.addWidget(self.stopButton)
self.layout().addLayout(self.buttonLayout)
def createStateInfo(self):
self.stateLayout = QVBoxLayout()
self.overallLayout = QHBoxLayout()
self.currentLabel = QLabel("Overall progress :")
self.currentProgress = QProgressBar()
self.overallLayout.addWidget(self.currentLabel)
self.overallLayout.addWidget(self.currentProgress)
self.stateLayout.addLayout(self.overallLayout)
self.elapsedLabel = QLabel("elapsed time: 00d00h00m00s")
self.stateLayout.addWidget(self.elapsedLabel)
self.estimatedLabel = QLabel("estimated time: 00d00h00m00s")
self.stateLayout.addWidget(self.estimatedLabel)
self.totalLabel = QLabel("total headers found: 0")
self.stateLayout.addWidget(self.totalLabel)
self.stateLayout.setEnabled(False)
self.layout().addLayout(self.stateLayout)
def createContext(self, selected):
lpatterns = VList()
lpatterns.thisown = False
for filetype in selected.iterkeys():
patterns = selected[filetype][0]
aligned = selected[filetype][1]
for pattern in patterns:
vpattern = VMap()
vpattern.thisown = False
vfiletype = Variant(filetype, typeId.String)
vfiletype.thisown = False
vpattern["filetype"] = vfiletype
header = VMap()
header.thisown = False
val = Variant(pattern[0], typeId.String)
val.thisown = False
header["needle"] = val
val = Variant(len(pattern[0]), typeId.UInt32)
val.thisown = False
header["size"] = val
footer = VMap()
footer.thisown = False
val = Variant(pattern[1], typeId.String)
val.thisown = False
footer["needle"] = val
val = Variant(len(pattern[1]), typeId.UInt32)
val.thisown = False
footer["size"] = val
vheader = Variant(header)
vheader.thisown = False
vpattern["header"] = vheader
vfooter = Variant(footer)
vfooter.thisown = False
vpattern["footer"] = vfooter
vwindow = Variant(int(pattern[2]), typeId.UInt32)
vwindow.thisown = False
vpattern["window"] = vwindow
val = Variant(aligned, typeId.Bool)
val.thisown = False
vpattern["aligned"] = val
lpatterns.append(vpattern)
vpatterns = Variant(lpatterns)
vpatterns.thisown = False
return vpatterns
def startCarving(self):
selected = self.selector.selectedItems()
patterns = self.createContext(selected)
args = VMap()
args.thisown = False
args["patterns"] = patterns
args["file"] = self.vnode
startoff = Variant(self.offsetSpinBox.value(), typeId.UInt64)
startoff.thisown = False
args["start-offset"] = startoff
factor = round(float(self.filesize) / 2147483647)
self.startButton.setEnabled(False)
self.stopButton.setEnabled(True)
self.stopButton.setDown(False)
if factor == 0:
factor = 1
proc = self.tm.add("carver", args, ["gui", "thread"])
if proc:
self.doJob(self.filesize, factor, self.offsetSpinBox.value())
self.stateLayout.setEnabled(True)
self.connection(proc.inst)
proc.inst.connection(self)
#self.connect(self, SIGNAL("stateInfo(QString)"), self.setStateInfo)
def carvingEnded(self, res):
#results = str(res).split("\n")
#print results
#for item in results:
# begidx = item.find(":")
# self.res.add_const(str(item[:begidx]), str(item[begidx+1:] + "\n"))
self.startButton.setEnabled(True)
self.stopButton.setEnabled(False)
self.stateLayout.setEnabled(False)
def stopCarving(self):
self.killJob()
self.stopButton.setDown(True)
def strtime(self, day, hour, min, sec):
day = str(day)
hour = str(hour)
min = str(min)
sec = str(sec)
res = "0" * (2-len(day)) + day + "d" + "0" * (2-len(hour)) + hour + "h" + "0" * (2-len(min)) + min + "m" + "0" * (2-len(sec)) + sec + "s"
return res
def timesec2str(self, timesec):
day = hour = min = sec = 0
if timesec > 3600 * 24:
day = timesec / (3600 * 24)
timesec = timesec % (3600 * 24)
if timesec > 3600:
hour = timesec / 3600
timesec = timesec % 3600
if timesec > 60:
min = timesec / 60
timesec = timesec % 60
sec = timesec
res = self.strtime(int(day), int(hour), int(min), int(sec))
return res
def Event(self, e):
if e.type == Carver.Position:
self.emit(SIGNAL("updatePosition"), e)
elif e.type == Carver.Matches:
self.emit(SIGNAL("updateMatches"), e)
elif e.type == Carver.EndOfProcessing:
self.emit(SIGNAL("ended"), "")
def updatePosition(self, e):
ref = time.time() - self.time
self.time = time.time()
if not str(ref).startswith("0.0"):
ref *= self.parsetime
res = self.timesec2str(ref)
self.estimatedLabel.setText("estimated time: " + res)
res = self.timesec2str(time.time() - self.starttime)
self.elapsedLabel.setText("elapsed time: " + res)
i = int(e.value.value() / self.factor)
if i > 2147483647:
i = 2147483647
self.emit(SIGNAL("valueChanged(int)"), i)
info = self.currentProgress.text() + " - " + self.totalLabel.text()
self.emit(SIGNAL("stateInfo(QString)"), info)
def updateMatches(self, e):
self.totalLabel.setText("total headers found: " + str(e.value))
def doJob(self, filesize, factor, start):
self.factor = factor
self.parsetime = filesize / (10*1204*1024)
self.elapsedLabel.setText("elapsed time: 00d00h00m00s")
self.estimatedLabel.setText("estimated time: 00d00h00m00s")
self.totalLabel.setText("total headers found: 0")
maxrange = int(filesize / self.factor)
if maxrange > 2147483647:
maxrange = 2147483647
self.currentProgress.setRange(0, maxrange)
self.currentProgress.setValue(0)
self.connect(self, SIGNAL("valueChanged(int)"), self.currentProgress.setValue)
self.time = time.time()
self.starttime = time.time()
self.connect(self, SIGNAL("updateMatches"), self.updateMatches)
self.connect(self, SIGNAL("updatePosition"), self.updatePosition)
def killJob(self):
e = event()
e.thisown = False
e.value = None
e.type = Carver.Stop
self.notify(e)