def ParseFolder(self, uuidtext_folder_path): '''Parse the uuidtext folder specified and parse all uuidtext/dsc files, adding them to the cache''' try: # dsc dsc_path = self.vfs.path_join(uuidtext_folder_path, 'dsc') entries = self.vfs.listdir(dsc_path) for dsc_name in entries: if len(dsc_name) == 32: dsc_path_obj = self.vfs.get_virtual_file( self.vfs.path_join(dsc_path, dsc_name), 'Dsc') dsc = dsc_file.Dsc(dsc_path_obj) dsc.Parse() self.cached_dsc[dsc_name] = dsc # uuidtext - can't have this or python will complain of too many open files! # entries = self.vfs.listdir(uuidtext_folder_path) # index = 0 # for index in range(0x100): # folder_name = '{:02X}'.format(index) # #if vfs.path_exists(folder_path): # if folder_name in entries: # folder_path = self.vfs.path_join(uuidtext_folder_path, folder_name) # uuid_names = self.vfs.listdir(folder_path) # for uuid_name in uuid_names: # if len(uuid_name) == 30: # filtering out possibly other files there! # uuidtext_path = self.vfs.path_join(folder_path, uuid_name) # file_object = self.vfs.get_virtual_file(uuidtext_path, 'Uuidtext') # ut = uuidtext_file.Uuidtext(file_object, UUID(folder_name + uuid_name)) # ut.Parse() # self.cached_uuidtext[folder_name + uuid_name] = ut # else: # logger.debug(folder_name + ' does not exist') except Exception: logger.exception('')
def ReadTimesyncFile(buffer, ts_list): try: pos = 0 size = len(buffer) while pos < size: sig, header_size, unk1 = struct.unpack("<HHI", buffer[pos:pos + 8]) if sig != 0xBBB0: logger.error( "not the right signature for Timesync header, got 0x{:04X} instead of 0x{:04X}, pos was 0x{:08X}" .format(sig, 0x0030BBB0, pos)) break uuid = UUID(bytes=buffer[pos + 8:pos + 24]) ts_numer, ts_denom, t_stamp, tz, is_dst = struct.unpack( "<IIqiI", buffer[pos + 24:pos + 48]) ts_header = resources.TimesyncHeader(sig, unk1, uuid, ts_numer, ts_denom, t_stamp, tz, is_dst) pos += header_size # 0x30 (48) by default if header_size != 0x30: logger.info( "Timesync header was 0x{:X} bytes instead of 0x30(48) bytes!" .format(size)) logger.debug("TIMEHEAD {} 0x{:016X} {} {}".format( uuid, t_stamp, ReadAPFSTime(t_stamp), 'boot')) #TODO - TEST search ts_list for existing, not seen so far existing_ts = None for ts in ts_list: if ts.header.boot_uuid == uuid: existing_ts = ts break if existing_ts: ts_obj = existing_ts else: ts_obj = resources.Timesync(ts_header) ts_list.append(ts_obj) # Adding header timestamp as Ts type too with cont_time = 0 timesync_item = resources.TimesyncItem(0, 0, t_stamp, tz, is_dst) ts_obj.items.append(timesync_item) while pos < size: if buffer[pos:pos + 4] == b'Ts \x00': ts_unknown, cont_time, t_stamp, bias, is_dst = struct.unpack( "<IqqiI", buffer[pos + 4:pos + 32]) timesync_item = resources.TimesyncItem( ts_unknown, cont_time, t_stamp, bias, is_dst) ts_obj.items.append(timesync_item) logger.debug("TIMESYNC {} 0x{:016X} {} {}".format( uuid, t_stamp, ReadAPFSTime(t_stamp), ts_unknown)) else: break # break this loop, parse as header pos += 32 except Exception as ex: logger.exception("Exception reading TimesyncFile")
def DecompressTraceV3(trace_file, out_file): ''' Creates an uncompressed version of the .traceV3 file. Input parameters: trace_file = file pointer to .traceV3 file (opened as 'rb') out_file = file pointer to blank file (opened as 'wb') Returns True/False ''' try: index = 0 tag = trace_file.read(4) while tag: begin_pos = trace_file.tell() - 4 trace_file.seek(begin_pos + 8) struct_len = struct.unpack('<Q', trace_file.read(8))[0] logger.debug("index={} pos=0x{:X} tag=0x{}".format( index, begin_pos, binascii.hexlify(tag)[::-1])) trace_file.seek(begin_pos) chunk_data_incl_header = trace_file.read(16 + struct_len) if tag == b'\x00\x10\x00\x00': # header out_file.write(chunk_data_incl_header ) # boot_uuid header, write to output directly elif tag[0] == b'\x0B': out_file.write(chunk_data_incl_header ) # uncompressed, write to output directly elif tag[0] == b'\x0D': uncompressed = DecompressChunkData(chunk_data_incl_header[16:], struct_len) out_file.write(chunk_data_incl_header[0:8]) # Same Header ! out_file.write(struct.pack('<Q', len(uncompressed))) # New size out_file.write(uncompressed) else: logger.error('Unknown chunk tag value encountered : {}'.format( binascii.hexlify(tag))) out_file.write(chunk_data_incl_header) if struct_len % 8: # Go to QWORD boundary struct_len += 8 - (struct_len % 8) if out_file.tell() % 8: # Go to QWORD boundary on output out_file.write( b'\x00\x00\x00\x00\x00\x00\x00'[0:(8 - out_file.tell() % 8)]) trace_file.seek(begin_pos + 16 + struct_len) tag = trace_file.read(4) index += 1 except Exception as ex: logger.exception('') return False return True
def _ReadCString(self, data, max_len=1024): '''Returns a C utf8 string (excluding terminating null)''' pos = 0 max_len = min(len(data), max_len) string = '' try: null_pos = data.find(b'\x00', 0, max_len) if null_pos == -1: logger.warning("Possible corrupted string encountered") string = data.decode('utf8') else: string = data[0:null_pos].decode('utf8') except: logger.exception('Error reading C-String') return string
def _ReadCStringAndEndPos(self, data, max_len=1024): '''Returns a tuple containing a C utf8 string (excluding terminating null) and the end position in the data ("utf8-string", pos) ''' pos = 0 max_len = min(len(data), max_len) string = '' null_pos = -1 try: null_pos = data.find(b'\x00', 0, max_len) if null_pos == -1: logger.warning("Possible corrupted string encountered") string = data.decode('utf8') else: string = data[0:null_pos].decode('utf8') except: logger.exception('Error reading C-String') return string, null_pos
def Parse(self): '''Parses a uuidtext file. self._file.is_valid is set to False if this method encounters issues parsing the file. Returns: bool: True if the dsc file-like object was successfully parsed, False otherwise. ''' file_object = self._file.open() if not file_object: return False try: result = self._ParseFileObject(file_object) except (OSError, struct.error): logger.exception('Uuidtext Parser error') result = False if not result: self._file.is_valid = False return result
def ReadTimesyncFolder(path, ts_list, vfs): '''Reads files in the timesync folder specified by 'path' and populates ts_list with timesync entries. vfs = VirtualFileSystem object ''' try: entries = vfs.listdir(path) for entry in sorted( entries ): # sort the files by name, so continuous time will be sequential automatically if entry.endswith(".timesync"): file_path = vfs.path_join(path, entry) logger.debug( 'Trying to read timesync file {}'.format(file_path)) f = vfs.get_virtual_file(file_path, 'TimeSync').open() if f: buffer = f.read() # should be a fairly small file! ReadTimesyncFile(buffer, ts_list) f.close() else: logger.error( "In Timesync folder, found non-ts file {}".format(entry)) except Exception: logger.exception('')