def test_init_from_data_with_offset(self): offset = 2 length = 3 r1 = RawStruct(data=self.sample_data, offset=offset) r2 = RawStruct(data=self.sample_data, offset=offset, length=length) self.assertEqual( (r1.size, r1.data), (len(self.sample_data) - offset, self.sample_data[offset:])) self.assertEqual((r2.size, r2.data), (length, self.sample_data[offset:offset + length]))
def test_init_with_filename(self): offset = 2 length = 3 file_mock = mock.MagicMock() with mock.patch('builtins.open', file_mock): manager = file_mock.return_value.__enter__.return_value manager.read.side_effect = \ lambda length: self.sample_data[offset:offset+length] r = RawStruct(filename='test', offset=offset, length=length) self.assertEqual( (r.size, r.data), (length, self.sample_data[offset:offset + length]))
def detect(self, filename, offset): """Verifies NTFS filesystem signature. Returns: bool: True if filesystem signature at offset 0x03 \ matches 'NTFS ', False otherwise. """ r = RawStruct(filename=filename, offset=offset + SIG_OFFSET, length=SIG_SIZE) oem_id = r.data if oem_id == b"NTFS ": return True return False
def test_init_without_filename_or_data(self): with self.assertRaises(ValueError): RawStruct()
def test_get_uuid_be(self): r = RawStruct(data=self.sample_uuid_data) self.assertEqual(r.get_uuid_be(0), uuid.UUID(bytes=self.sample_uuid_data))
def setUp(self): self.sample_data = b'\xa1\xb1\xc1\xd1\xe1\xf1\xb1\xa1\xc1' self.sample_uuid_data = b'\x12\x34\x56\x78' * 4 self.rwstruct = RawStruct(self.sample_data)