Ejemplo n.º 1
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.type = self.get_uint_le(0)
        self.length = self.get_uint_le(0x4)
        self.non_resident_flag = self.get_ubyte(0x08)  # 0 - resident, 1 - not
        self.length_of_name = self.get_ubyte(0x09)  # Used only for ADS
        self.offset_to_name = self.get_ushort_le(0x0A)  # Used only for ADS

        # (Compressed, Encrypted, Sparse)
        self.flags = self.get_ushort_le(0x0C)
        self.identifier = self.get_ushort_le(0x0E)

        if (self.non_resident_flag):
            # Attribute is Non-Resident
            self.lowest_vcn = self.get_ulonglong_le(0x10)
            self.highest_vcn = self.get_ulonglong_le(0x18)
            self.data_run_offset = self.get_ushort_le(0x20)
            self.comp_unit_size = self.get_ushort_le(0x22)
            # 4 byte 0x00 padding @ 0x24
            self.alloc_size = self.get_ulonglong_le(0x28)
            self.real_size = self.get_ulonglong_le(0x30)
            self.data_size = self.get_ulonglong_le(0x38)

            if (self.length_of_name > 0):
                self.attr_name = self.get_chunk(
                    0x40, 2 * self.length_of_name).decode('utf-16')
                # print self.attr_name.decode('utf-16')
        else:
            # Attribute is Resident
            self.attr_length = self.get_uint_le(0x10)
            self.attr_offset = self.get_ushort_le(0x14)
            self.indexed = self.get_ubyte(0x16)
            if (self.length_of_name > 0):
                self.attr_name = self.get_chunk(
                    0x18, 2 * self.length_of_name).decode('utf-16')
Ejemplo n.º 2
0
    def __init__(self,
                 data=None,
                 offset=None,
                 length=None,
                 filename=None,
                 index=None):
        RawStruct.__init__(self,
                           data=data,
                           filename=filename,
                           offset=offset,
                           length=length)

        self.index = index
        self.attributes = []
        self.fname_str = ""

        self.header = MFT_RECORD_HEADER(
            self.get_string(0, 4),  # signature
            self.get_ushort_le(4),  # upd_seq_array_offset
            self.get_ushort_le(6),  # upd_seq_array_size
            self.get_ulonglong_le(8),  # logfile_seq_number
            self.get_ushort_le(16),  # seq_number
            self.get_ushort_le(18),  # hard_link_count
            self.get_ushort_le(20),  # first_attr_offset
            self.get_ushort_le(22),  # flags
            self.get_uint_le(24),  # used_size
            self.get_ushort_le(28),  # allocated_size
            self.get_ulonglong_le(30),  # base_file_record
            self.get_ushort_le(38),  # next_attr_id
            self.get_uint_le(42)  # mft_record_number
        )

        self.name_str = self._get_entry_name(self.index)
        self._load_attributes()
Ejemplo n.º 3
0
    def __init__(
        self,
        data=None,
        offset=None,
        filename=None
    ):

        RawStruct.__init__(
            self,
            data=data,
            offset=offset,
            length=BPB_SIZE + EXTENDED_BPB_SIZE,
            filename=filename
        )

        self.bytes_per_sector = self.get_ushort_le(0)
        self.sectors_per_cluster = self.get_uchar(2)
        self.reserved_sectors = self.get_ushort_le(3)
        self.media_descriptor = self.get_uchar(10)

        self.sectors_per_track = self.get_ushort_le(13)
        self.number_of_heads = self.get_ushort_le(15)
        self.hidden_sectors = self.get_uint_le(17)

        self.total_sectors = self.get_ulonglong_le(29)
        self.mft_cluster = self.get_ulonglong_le(37)
        self.mft_mirror_cluster = self.get_ulonglong_le(45)
        self.clusters_per_mft = self.get_char(53)
        self.clusters_per_index = self.get_uchar(57)
        self.volume_serial = self.get_ulonglong_le(58)
        self.checksum = self.get_uint_le(66)
Ejemplo n.º 4
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.type_str = "$UNKNOWN"
        non_resident_flag = self.get_ubyte(8)
        name_length = self.get_ubyte(9)
        header_size = 0

        if non_resident_flag:
            if name_length == 0:
                # Non Resident, No Name
                header_size = 0x40
            else:
                # Non Resident, Has Name
                header_size = 0x40 + 2 * name_length
        else:
            if name_length == 0:
                # Resident, No Name
                header_size = 0x18
            else:
                # Resident, Has Name
                header_size = 0x18 + 2 * name_length

        self.header = MftAttrHeader(
            self.get_chunk(0, header_size)
        )
Ejemplo n.º 5
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.type_str = "$UNKNOWN"
        non_resident_flag = self.get_ubyte(8)
        name_length = self.get_ubyte(9)
        header_size = 0

        if non_resident_flag:
            if name_length == 0:
                # Non Resident, No Name
                header_size = 0x40
            else:
                # Non Resident, Has Name
                header_size = 0x40 + 2 * name_length
        else:
            if name_length == 0:
                # Resident, No Name
                header_size = 0x18
            else:
                # Resident, Has Name
                header_size = 0x18 + 2 * name_length

        self.header = MftAttrHeader(
            self.get_chunk(0, header_size)
        )
Ejemplo n.º 6
0
    def __init__(self, data=None, offset=None, length=None, filename=None):
        RawStruct.__init__(
            self,
            data=data,
            offset=offset,
            length=length,
            filename=filename
        )

        self.oem_id = self.get_string(3, 8)

        self.bpb = BIOS_PARAMETER_BLOCK(
            self.get_ushort_le(0x0B),       # bytes_per_sector
            self.get_ubyte(0x0D),           # sectors_per_cluster
            self.get_ushort_le(0x0E),       # reserved_sectors
            self.get_ubyte(0x15),           # media_type
            self.get_ushort_le(0x18),       # sectors_per_track
            self.get_ushort_le(0x1A),       # heads
            self.get_uint_le(0x1C),         # hidden_sectors
            self.get_ulonglong_le(0x28),    # total sectors
        )

        self.extended_bpb = EXTENDED_BIOS_PARAMETER_BLOCK(
            self.get_ulonglong_le(0x30),    # mft_cluster
            self.get_ulonglong_le(0x38),    # mft_mirror_cluster
            self.get_byte(0x40),            # clusters_per_mft
            self.get_ubyte(0x44),           # clusters_per_index
            self.get_ulonglong_le(0x48),    # volume_serial
        )
Ejemplo n.º 7
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.type = self.get_uint_le(0)
        self.length = self.get_uint_le(0x4)
        self.non_resident_flag = self.get_uchar(0x08)   # 0 - resident, 1 - not
        self.length_of_name = self.get_uchar(0x09)      # Used only for ADS
        self.offset_to_name = self.get_ushort_le(0x0A)     # Used only for ADS

        # (Compressed, Encrypted, Sparse)
        self.flags = self.get_ushort_le(0x0C)
        self.identifier = self.get_ushort_le(0x0E)

        if (self.non_resident_flag):
            # Attribute is Non-Resident
            self.lowest_vcn = self.get_ulonglong_le(0x10)
            self.highest_vcn = self.get_ulonglong_le(0x18)
            self.data_run_offset = self.get_ushort_le(0x20)
            self.comp_unit_size = self.get_ushort_le(0x22)
            # 4 byte 0x00 padding @ 0x24
            self.alloc_size = self.get_ulonglong_le(0x28)
            self.real_size = self.get_ulonglong_le(0x30)
            self.data_size = self.get_ulonglong_le(0x38)

            if (self.length_of_name > 0):
                self.attr_name = self.get_chunk(
                    0x40, 2 * self.length_of_name).decode('utf-16')
                # print self.attr_name.decode('utf-16')
        else:
            # Attribute is Resident
            self.attr_length = self.get_uint_le(0x10)
            self.attr_offset = self.get_ushort_le(0x14)
            self.indexed = self.get_uchar(0x16)
            if (self.length_of_name > 0):
                self.attr_name = self.get_chunk(
                    0x18, 2 * self.length_of_name).decode('utf-16')
Ejemplo n.º 8
0
    def __init__(
        self, data=None, offset=None, length=None,
        filename=None, index=None
    ):
        RawStruct.__init__(
            self,
            data=data,
            filename=filename,
            offset=offset,
            length=length
        )

        self.index = index
        self.attributes = []
        self.fname_str = ""

        self.header = MFT_RECORD_HEADER(
            self.get_string(0, 4),      # signature
            self.get_ushort_le(4),      # upd_seq_array_offset
            self.get_ushort_le(6),      # upd_seq_array_size
            self.get_ulonglong_le(8),   # logfile_seq_number
            self.get_ushort_le(16),     # seq_number
            self.get_ushort_le(18),     # hard_link_count
            self.get_ushort_le(20),     # first_attr_offset
            self.get_ushort_le(22),     # flags
            self.get_uint_le(24),       # used_size
            self.get_ushort_le(28),     # allocated_size
            self.get_ulonglong_le(30),  # base_file_record
            self.get_ushort_le(38),     # next_attr_id
            self.get_uint_le(42)        # mft_record_number
        )

        self.name_str = self._get_entry_name(self.index)
        self._load_attributes()
Ejemplo n.º 9
0
    def __init__(self, data=None, offset=None, length=None, filename=None):
        RawStruct.__init__(self,
                           data=data,
                           offset=offset,
                           length=length,
                           filename=filename)

        self.oem_id = self.get_string(3, 8)

        self.bpb = BIOS_PARAMETER_BLOCK(
            self.get_ushort_le(0x0B),  # bytes_per_sector
            self.get_ubyte(0x0D),  # sectors_per_cluster
            self.get_ushort_le(0x0E),  # reserved_sectors
            self.get_ubyte(0x15),  # media_type
            self.get_ushort_le(0x18),  # sectors_per_track
            self.get_ushort_le(0x1A),  # heads
            self.get_uint_le(0x1C),  # hidden_sectors
            self.get_ulonglong_le(0x28),  # total sectors
        )

        self.extended_bpb = EXTENDED_BIOS_PARAMETER_BLOCK(
            self.get_ulonglong_le(0x30),  # mft_cluster
            self.get_ulonglong_le(0x38),  # mft_mirror_cluster
            self.get_byte(0x40),  # clusters_per_mft
            self.get_ubyte(0x44),  # clusters_per_index
            self.get_ulonglong_le(0x48),  # volume_serial
        )
Ejemplo n.º 10
0
    def __init__(self, **kwargs):
        RawStruct.__init__(self, **kwargs)

        self.inodes_count = self.get_uint_le(0)
        self.blocks_count = self.get_uint_le(4)
        self.reserved_blocks_count = self.get_uint_le(8)
        self.free_blocks_count = self.get_uint_le(12)
        self.free_inodes_count = self.get_uint_le(16)
        self.first_data_block = self.get_uint_le(20)
        self.log_block_size = self.get_uint_le(24)

        self.log_fragment_size = self.get_int_le(28)

        self.blocks_per_group = self.get_uint_le(32)
        self.fragments_per_group = self.get_uint_le(36)
        self.inodes_per_group = self.get_uint_le(40)
        self.mtime = self.get_uint_le(44)
        self.wtime = self.get_uint_le(48)

        self.mount_count = self.get_ushort_le(52)
        self.max_mount_count = self.get_ushort_le(54)
        self.magic = self.get_ushort_le(56)
        self.state = self.get_ushort_le(58)
        self.errors = self.get_ushort_le(60)
        self.minor_revision_level = self.get_ushort_le(62)

        self.lastcheck = self.get_uint_le(64)
        self.checkinterval = self.get_uint_le(68)
        self.creator_os = self.get_uint_le(72)
        self.revision_level = self.get_uint_le(76)

        self.default_resuid = self.get_ushort_le(80)
        self.default_resgid = self.get_ushort_le(82)
Ejemplo n.º 11
0
 def __init__(self, data):
     RawStruct.__init__(self, data)
     self.type_guid = self.get_uuid_le(0x00)
     self.part_guid = self.get_uuid_le(0x10)
     self.first_lba = self.get_ulonglong_le(0x20)
     self.last_lba = self.get_ulonglong_le(0x28)
     self.attr_flags = self.get_ulonglong_le(0x30)
     self.name = self.get_chunk(0x38, 72).decode('utf-16')
Ejemplo n.º 12
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.entries = []

        for i in range(0, MBR_NUM_PARTS):
            entry = MbrPartitionEntry(
                self.get_chunk(PARTITION_ENTRY_SIZE * i, PARTITION_ENTRY_SIZE))

            if entry.fields.part_type != 0:
                self.entries.append(entry)
Ejemplo n.º 13
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.__partitions = []

        for i in range(0, MBR_NUM_PARTS):
            entry = MbrPartitionEntry(
                self.get_chunk(PARTITION_ENTRY_SIZE * i, PARTITION_ENTRY_SIZE)
            )

            if entry.fields.part_type != 0:
                self.__partitions.append(entry)
Ejemplo n.º 14
0
    def test_init_from_data_with_offset(self):
        offset = 2
        length = 3
        r1 = RawStruct(data=self.sample_data, offset=offset)
        r2 = RawStruct(data=self.sample_data, offset=offset, length=length)
        self.assertEqual(
            (r1.size, r1.data),
            (len(self.sample_data) - offset, self.sample_data[offset:]))

        self.assertEqual((r2.size, r2.data),
                         (length, self.sample_data[offset:offset + length]))
Ejemplo n.º 15
0
    def __init__(self, filename=None, load_partition_table=True):
        RawStruct.__init__(self, filename=filename, length=MBR_SIZE)

        self.bootstrap = self.get_chunk(0, 446)
        signature = self.get_ushort_le(MBR_SIG_OFFSET)

        if signature != MBR_SIGNATURE:
            raise Exception("Invalid MBR signature")

        if load_partition_table:
            self._load_partition_table()
Ejemplo n.º 16
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.entries = []

        for i in range(0, 4):
            entry = MbrPartitionEntry(
                self.get_chunk(PT_ENTRY_SIZE * i, PT_ENTRY_SIZE)
            )

            if (entry.fields.part_type != 0):
                self.entries.append(entry)
Ejemplo n.º 17
0
    def __init__(self, data=None, offset=None, length=None, filename=None):
        RawStruct.__init__(
            self,
            data=data,
            offset=offset,
            length=length,
            filename=filename
        )

        self.oem_id = self.get_string(3, 8)
        self.bpb = Bpb(self.get_chunk(
            BPB_OFFSET, BPB_SIZE + EXTENDED_BPB_SIZE))
Ejemplo n.º 18
0
    def __init__(self, data):
        RawStruct.__init__(self, data)

        self.fields = GPT_PARTITION_ENTRY(
            (c_ubyte * 16).from_buffer_copy(self.get_chunk(0,
                                                           16)),  # type_guid
            (c_ubyte * 16).from_buffer_copy(self.get_chunk(0x10,
                                                           16)),  # part_guid
            self.get_ulonglong_le(0x20),  # first_lba
            self.get_ulonglong_le(0x28),  # last_lba
            self.get_ulonglong_le(0x30),  # attr_flags
            self.get_chunk(0x38, 72).decode('utf-16'),  # name
        )
Ejemplo n.º 19
0
    def __init__(self, data):
        RawStruct.__init__(self, data)

        self.fields = GPT_PARTITION_ENTRY(
            (c_ubyte * 16).from_buffer_copy(
                self.get_chunk(0, 16)),                 # type_guid
            (c_ubyte * 16).from_buffer_copy(
                self.get_chunk(0x10, 16)),              # part_guid
            self.get_ulonglong_le(0x20),                # first_lba
            self.get_ulonglong_le(0x28),                # last_lba
            self.get_ulonglong_le(0x30),                # attr_flags
            self.get_chunk(0x38, 72).decode('utf-16'),  # name
        )
Ejemplo n.º 20
0
 def __init__(self, data):
     RawStruct.__init__(self, data)
     self.file_signature = self.get_string(0, 4)
     self.update_seq_array_offset = self.get_ushort_le(4)
     self.update_seq_array_size = self.get_ushort_le(6)
     self.logfile_seq_number = self.get_ulonglong_le(8)
     self.seq_number = self.get_ushort_le(16)
     self.hard_link_count = self.get_ushort_le(18)
     self.first_attr_offset = self.get_ushort_le(20)
     self.flags = self.get_ushort_le(22)
     self.used_size = self.get_uint_le(24)
     self.allocated_size = self.get_ushort_le(28)
     self.base_file_record = self.get_ulonglong_le(30)
     self.next_attr_id = self.get_ushort_le(38)
     self.mft_record_number = self.get_uint_le(42)
Ejemplo n.º 21
0
    def __init__(self, filename=None, load_partition_table=True):
        RawStruct.__init__(
            self,
            filename=filename,
            length=MBR_SIZE
        )

        self.bootstrap = self.get_chunk(0, 446)
        signature = self.get_ushort_le(MBR_SIG_OFFSET)

        if (signature != MBR_SIGNATURE):
            raise Exception("Invalid MBR signature")

        if (load_partition_table):
            self._load_partition_table()
Ejemplo n.º 22
0
    def __init__(self, filename=None):
        RawStruct.__init__(
            self,
            filename=filename,
            length=MBR_SIZE
        )

        signature = self.get_ushort_le(MBR_SIG_OFFSET)

        if (signature != MBR_SIGNATURE):
            raise Exception("Invalid MBR signature")

        self.partition_table = PartitionTable(
            self.get_chunk(PT_TABLE_OFFSET, PT_TABLE_SIZE)
        )
Ejemplo n.º 23
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.boot_indicator = self.get_uchar(0)
        self.starting_head = self.get_uchar(1)
        tmp = self.get_uchar(2)
        self.starting_sector = tmp & 0x3F   # Only bits 0-5 are used
        self.starting_cylinder = ((tmp & 0xC0) << 2) + \
            self.get_uchar(3)
        self.part_type = self.get_uchar(4)
        self.ending_head = self.get_uchar(5)

        tmp = self.get_uchar(6)
        self.ending_sector = tmp & 0x3F
        self.ending_cylinder = ((tmp & 0xC0) << 2) + \
            self.get_uchar(7)
        self.relative_sector = self.get_uint_le(8)
        self.total_sectors = self.get_uint_le(12)
        self.part_offset = SECTOR_SIZE*self.relative_sector
Ejemplo n.º 24
0
    def __init__(self, data):
        RawStruct.__init__(self, data)

        tmp = self.get_ubyte(2)
        tmp2 = self.get_ubyte(6)

        self.fields = MBR_PARTITION_ENTRY(
            self.get_ubyte(0),  # boot indicator
            self.get_ubyte(1),  # starting_head
            tmp & 0x3F,  # starting_sector
            ((tmp & 0xC0) << 2) + self.get_ubyte(3),  # starting cylinder
            self.get_ubyte(4),  # part_type
            self.get_ubyte(5),  # ending_head
            tmp2 & 0x3F,  # ending_sector
            ((tmp2 & 0xC0) << 2) + self.get_ubyte(7),  # ending cylinder
            self.get_uint_le(8),  # relative sector
            self.get_uint_le(12),  # total sectors
        )
Ejemplo n.º 25
0
    def __init__(
        self, data=None, offset=None, length=None,
        filename=None, index=None
    ):
        RawStruct.__init__(
            self,
            data=data,
            filename=filename,
            offset=offset,
            length=length
        )

        self.index = index
        self.attributes = []
        self.fname_str = ""
        header_data = self.get_chunk(0, MFT_ENTRY_HEADER_SIZE)
        self.header = MftEntryHeader(header_data)
        self.name_str = self._get_entry_name(self.index)
        self._load_attributes()
Ejemplo n.º 26
0
    def __init__(self, data):
        RawStruct.__init__(self, data)

        tmp = self.get_ubyte(2)
        tmp2 = self.get_ubyte(6)

        self.fields = MBR_PARTITION_ENTRY(
            self.get_ubyte(0),          # boot indicator
            self.get_ubyte(1),          # starting_head
            tmp & 0x3F,                 # starting_sector
            ((tmp & 0xC0) << 2) +
            self.get_ubyte(3),          # starting cylinder
            self.get_ubyte(4),          # part_type
            self.get_ubyte(5),          # ending_head
            tmp2 & 0x3F,                # ending_sector
            ((tmp2 & 0xC0) << 2) +
            self.get_ubyte(7),      # ending cylinder
            self.get_uint_le(8),        # relative sector
            self.get_uint_le(12),       # total sectors
        )
Ejemplo n.º 27
0
    def __init__(self, data):
        RawStruct.__init__(self, data)
        self.signature = self.get_string(0, 8)

        if (self.signature != GPT_SIGNATURE):
            raise Exception("Invalid GPT signature")

        self.revision = self.get_uint_le(0x08)
        self.header_size = self.get_uint_le(0x0C)
        self.crc32 = self.get_uint_le(0x10)
        # 4 bytes @0x14 reserved, must be 0
        self.current_lba = self.get_ulonglong_le(0x18)
        self.backup_lba = self.get_ulonglong_le(0x20)
        self.first_usable_lba = self.get_ulonglong_le(0x28)
        self.last_usable_lba = self.get_ulonglong_le(0x30)
        # Not sure if this is correct
        self.disk_guid = self.get_uuid_le(0x38)
        self.part_lba = self.get_ulonglong_le(0x48)
        self.num_partitions = self.get_uint_le(0x50)
        self.part_size = self.get_uint_le(0x54)
        self.part_array_crc32 = self.get_uint_le(0x58)
Ejemplo n.º 28
0
    def test_init_with_filename(self):
        offset = 2
        length = 3
        file_mock = mock.MagicMock()
        with mock.patch('builtins.open', file_mock):
            manager = file_mock.return_value.__enter__.return_value
            manager.read.side_effect = \
                lambda length: self.sample_data[offset:offset+length]
            r = RawStruct(filename='test', offset=offset, length=length)

            self.assertEqual(
                (r.size, r.data),
                (length, self.sample_data[offset:offset + length]))
Ejemplo n.º 29
0
    def detect(self, filename, offset):
        """Verifies NTFS filesystem signature.

        Returns:
            bool: True if filesystem signature at offset 0x03 \
            matches 'NTFS    ', False otherwise.
        """
        r = RawStruct(filename=filename,
                      offset=offset + SIG_OFFSET,
                      length=SIG_SIZE)

        oem_id = r.data

        if oem_id == b"NTFS    ":
            return True

        return False
Ejemplo n.º 30
0
class TestRawStruct(unittest.TestCase):
    def setUp(self):
        self.sample_data = b'\xa1\xb1\xc1\xd1\xe1\xf1\xb1\xa1\xc1'
        self.sample_uuid_data = b'\x12\x34\x56\x78'*4
        self.rwstruct = RawStruct(self.sample_data)

    def test_init_from_data(self):
        self.assertEqual(
            (self.rwstruct.size, self.rwstruct.data),
            (len(self.sample_data), self.sample_data))

    def test_init_from_data_with_offset(self):
        offset = 2
        length = 3
        r1 = RawStruct(data=self.sample_data, offset=offset)
        r2 = RawStruct(data=self.sample_data, offset=offset, length=length)
        self.assertEqual(
            (r1.size, r1.data),
            (len(self.sample_data) - offset, self.sample_data[offset:])
        )

        self.assertEqual(
            (r2.size, r2.data),
            (length, self.sample_data[offset:offset + length])
        )

    def test_init_with_filename(self):
        offset = 2
        length = 3
        file_mock = mock.MagicMock()
        with mock.patch('__builtin__.open', file_mock):
            manager = file_mock.return_value.__enter__.return_value
            manager.read.side_effect = \
                lambda length: self.sample_data[offset:offset+length]
            r = RawStruct(filename='test', offset=offset, length=length)

            self.assertEqual(
                (r.size, r.data),
                (length, self.sample_data[offset:offset + length])
            )

    def test_init_without_filename_or_data(self):
        with self.assertRaises(ValueError):
            RawStruct()

    def test_get_field(self):
        offset = 2
        format = "B"
        length = 1
        self.assertEqual(
            self.rwstruct.get_field(offset, length, format),
            struct.unpack(format, self.sample_data[offset:offset+length])[0])

    def test_get_uchar(self):
        offset = 2
        self.assertEqual(
            self.rwstruct.get_ubyte(offset),
            struct.unpack("B", self.sample_data[offset:offset+1])[0])

    def test_get_ushort_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ushort_le(offset),
            struct.unpack("<H", self.sample_data[offset:offset+2])[0])

    def test_get_ushort_be(self):
        offset = 2
        self.assertEqual(
            self.rwstruct.get_ushort_be(offset),
            struct.unpack(">H", self.sample_data[offset:offset+2])[0])

    def test_get_uint_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_uint_le(offset),
            struct.unpack("<I", self.sample_data[offset:offset+4])[0])

    def test_get_uint_be(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_uint_be(offset),
            struct.unpack(">I", self.sample_data[offset:offset+4])[0])

    def test_get_int_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_int_le(offset),
            struct.unpack("<I", self.sample_data[offset:offset+4])[0])

    def test_get_ulong_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulong_le(offset),
            struct.unpack("<L", self.sample_data[offset:offset+4])[0])

    def test_get_ulong_be(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulong_be(offset),
            struct.unpack(">L", self.sample_data[offset:offset+4])[0])

    def test_get_ulonglong_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulonglong_le(offset),
            struct.unpack("<Q", self.sample_data[offset:offset+8])[0])

    def test_get_ulonglong_be(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulonglong_be(offset),
            struct.unpack(">Q", self.sample_data[offset:offset+8])[0])

    def test_get_uuid_le(self):
        r = RawStruct(data=self.sample_uuid_data)
        self.assertEqual(
            r.get_uuid_le(0),
            uuid.UUID(bytes_le=self.sample_uuid_data))

    def test_get_uuid_be(self):
        r = RawStruct(data=self.sample_uuid_data)
        self.assertEqual(
            r.get_uuid_be(0),
            uuid.UUID(bytes=self.sample_uuid_data))

    def test_export(self):
        m = mock.mock_open()
        with mock.patch('__builtin__.open', m, create=True):
            self.rwstruct.export('filename')

        m.assert_called_once_with('filename', 'w')
        handle = m()
        handle.write.assert_called_once_with(self.sample_data)

    def test_export_with_offset_and_length(self):
        offset = 2
        length = 4
        m = mock.mock_open()
        with mock.patch('__builtin__.open', m, create=True):
            self.rwstruct.export('filename', offset, length)
            handle = m()
            handle.write.assert_called_once_with(
                self.sample_data[offset:length]
            )

    @mock.patch('hexdump.hexdump')
    def test_hexdump(self, mock_hexdump):
        self.rwstruct.hexdump()
        mock_hexdump.assert_called_with(self.sample_data)
Ejemplo n.º 31
0
class TestRawStruct(unittest.TestCase):
    def setUp(self):
        self.sample_data = b'\xa1\xb1\xc1\xd1\xe1\xf1\xb1\xa1\xc1'
        self.sample_uuid_data = b'\x12\x34\x56\x78' * 4
        self.rwstruct = RawStruct(self.sample_data)

    def test_init_from_data(self):
        self.assertEqual((self.rwstruct.size, self.rwstruct.data),
                         (len(self.sample_data), self.sample_data))

    def test_init_from_data_with_offset(self):
        offset = 2
        length = 3
        r1 = RawStruct(data=self.sample_data, offset=offset)
        r2 = RawStruct(data=self.sample_data, offset=offset, length=length)
        self.assertEqual(
            (r1.size, r1.data),
            (len(self.sample_data) - offset, self.sample_data[offset:]))

        self.assertEqual((r2.size, r2.data),
                         (length, self.sample_data[offset:offset + length]))

    def test_init_with_filename(self):
        offset = 2
        length = 3
        file_mock = mock.MagicMock()
        with mock.patch('builtins.open', file_mock):
            manager = file_mock.return_value.__enter__.return_value
            manager.read.side_effect = \
                lambda length: self.sample_data[offset:offset+length]
            r = RawStruct(filename='test', offset=offset, length=length)

            self.assertEqual(
                (r.size, r.data),
                (length, self.sample_data[offset:offset + length]))

    def test_init_without_filename_or_data(self):
        with self.assertRaises(ValueError):
            RawStruct()

    def test_get_field(self):
        offset = 2
        format = "B"
        length = 1
        self.assertEqual(
            self.rwstruct.get_field(offset, length, format),
            struct.unpack(format, self.sample_data[offset:offset + length])[0])

    def test_get_uchar(self):
        offset = 2
        self.assertEqual(
            self.rwstruct.get_ubyte(offset),
            struct.unpack("B", self.sample_data[offset:offset + 1])[0])

    def test_get_ushort_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ushort_le(offset),
            struct.unpack("<H", self.sample_data[offset:offset + 2])[0])

    def test_get_ushort_be(self):
        offset = 2
        self.assertEqual(
            self.rwstruct.get_ushort_be(offset),
            struct.unpack(">H", self.sample_data[offset:offset + 2])[0])

    def test_get_uint_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_uint_le(offset),
            struct.unpack("<I", self.sample_data[offset:offset + 4])[0])

    def test_get_uint_be(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_uint_be(offset),
            struct.unpack(">I", self.sample_data[offset:offset + 4])[0])

    def test_get_int_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_int_le(offset),
            struct.unpack("<I", self.sample_data[offset:offset + 4])[0])

    def test_get_ulong_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulong_le(offset),
            struct.unpack("<L", self.sample_data[offset:offset + 4])[0])

    def test_get_ulong_be(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulong_be(offset),
            struct.unpack(">L", self.sample_data[offset:offset + 4])[0])

    def test_get_ulonglong_le(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulonglong_le(offset),
            struct.unpack("<Q", self.sample_data[offset:offset + 8])[0])

    def test_get_ulonglong_be(self):
        offset = 0
        self.assertEqual(
            self.rwstruct.get_ulonglong_be(offset),
            struct.unpack(">Q", self.sample_data[offset:offset + 8])[0])

    def test_get_uuid_le(self):
        r = RawStruct(data=self.sample_uuid_data)
        self.assertEqual(r.get_uuid_le(0),
                         uuid.UUID(bytes_le=self.sample_uuid_data))

    def test_get_uuid_be(self):
        r = RawStruct(data=self.sample_uuid_data)
        self.assertEqual(r.get_uuid_be(0),
                         uuid.UUID(bytes=self.sample_uuid_data))

    def test_export(self):
        m = mock.mock_open()
        with mock.patch('builtins.open', m, create=True):
            self.rwstruct.export('filename')

        m.assert_called_once_with('filename', 'w')
        handle = m()
        handle.write.assert_called_once_with(self.sample_data)

    def test_export_with_offset_and_length(self):
        offset = 2
        length = 4
        m = mock.mock_open()
        with mock.patch('builtins.open', m, create=True):
            self.rwstruct.export('filename', offset, length)
            handle = m()
            handle.write.assert_called_once_with(
                self.sample_data[offset:length])

    @mock.patch('hexdump.hexdump')
    def test_hexdump(self, mock_hexdump):
        self.rwstruct.hexdump()
        mock_hexdump.assert_called_with(self.sample_data)
Ejemplo n.º 32
0
 def setUp(self):
     self.sample_data = b'\xa1\xb1\xc1\xd1\xe1\xf1\xb1\xa1\xc1'
     self.sample_uuid_data = b'\x12\x34\x56\x78' * 4
     self.rwstruct = RawStruct(self.sample_data)
Ejemplo n.º 33
0
 def test_get_uuid_be(self):
     r = RawStruct(data=self.sample_uuid_data)
     self.assertEqual(r.get_uuid_be(0),
                      uuid.UUID(bytes=self.sample_uuid_data))
Ejemplo n.º 34
0
 def test_init_without_filename_or_data(self):
     with self.assertRaises(ValueError):
         RawStruct()
Ejemplo n.º 35
0
 def test_get_ushort_be(self):
     offset = 2
     r = RawStruct(data=self.sample_data)
     self.assertEqual(
         r.get_ushort_be(offset),
         struct.unpack(">H", self.sample_data[offset:offset+2])[0])
Ejemplo n.º 36
0
 def test_get_uint_be(self):
     offset = 0
     r = RawStruct(data=self.sample_data)
     self.assertEqual(
         r.get_uint_be(offset),
         struct.unpack(">I", self.sample_data[offset:offset+4])[0])
Ejemplo n.º 37
0
 def test_get_ulonglong_le(self):
     offset = 0
     r = RawStruct(data=self.sample_data)
     self.assertEqual(
         r.get_ulonglong_le(offset),
         struct.unpack("<Q", self.sample_data[offset:offset+8])[0])
Ejemplo n.º 38
0
 def setUp(self):
     self.sample_data = b'\xa1\xb1\xc1\xd1\xe1\xf1\xb1\xa1\xc1'
     self.sample_uuid_data = b'\x12\x34\x56\x78'*4
     self.rwstruct = RawStruct(self.sample_data)
Ejemplo n.º 39
0
 def test_get_uuid_be(self):
     r = RawStruct(data=self.sample_uuid_data)
     self.assertEqual(
         r.get_uuid_be(0),
         uuid.UUID(bytes=self.sample_uuid_data))
Ejemplo n.º 40
0
 def test_get_uchar(self):
     offset = 2
     r = RawStruct(data=self.sample_data)
     self.assertEqual(
         r.get_uchar(offset),
         struct.unpack("B", self.sample_data[offset:offset+1])[0])
Ejemplo n.º 41
0
 def __init__(self, data):
     RawStruct.__init__(self, data)
     self.signature = self.get_string(0x00, 2)
     # HFS+ everything is stored in big-endian
     self.version = self.get_ushort_be(0x02)
     self.attributes = self.get_uint_be(0x04)