def __init__(self, header, data, fat, minifat, parent, mfsobj): self.extraAttr = None Struct.__init__(self,header, None, header.DirectoryEntry, data) self.fat = fat self.minifat = minifat invalidNameCounter = 1 if self.objectName[1] == "\x00": #Some compound file like MSI as invalid name this is an ugly way to test self.objectName = unicode(self.objectName[:self.nameLen - 2], 'UTF-16').encode('UTF-8') else: #global invalidNameCounter #invalidNameCounter += 1 self.objectName = str("Unknown-" + str(invalidNameCounter)).encode('UTF-8') try: self.objectType = self.Type[ord(self.objectType)] except KeyError: self.objectType = self.Type[0x0] if len(self.objectName) == 0 or self.objectType == 'TypeUnknown': return self.CLSID = UUID(self.CLSID) if len(self.objectName) and mfsobj: realSize = self.offsetsSize() if self.streamSize > realSize: streamSize = realSize else: streamSize = self.streamSize if self.objectName[0] <= "\x05": self.objectName = self.objectName[1:] Node.__init__(self, self.objectName, streamSize, None, mfsobj) self.__disown__() if self.objectType == "RootStorageObject": self.minifat.setRootStorageObject(self)
def __init__(self, worddocument, offsets, size): self.offsets = offsets self.worddocument = worddocument #nom du document Node.__init__(self, 'Text', size, self.worddocument, self.worddocument.fsobj()) self.__disown__()
def __init__(self, name, size, parent, fsobj): Node.__init__(self, name, size, parent, fsobj) self.__disown__() self._fsobj = fsobj self._fm = FileMapping(self) self._aspace = None self._baseaddr = -1
def __init__(self, name, parent, fsobj): Node.__init__(self, name, 0, None, fsobj) self.__fsobj = fsobj self._kdbg = self.__fsobj._kdbg self._aspace = self.__fsobj._aspace self.__attrs = self.__attributes() self.setDir() self.__disown__()
def __init__(self, vfile): #XXX WMF and other type self.parent = vfile.node() self.Size = unpack('I', vfile.read(4))[0] self.cbFormat = self.ClipboardFormat[unpack('i', vfile.read(4))[0]] self.cbDataFormat = self.ClipboardDataFormat[unpack('I', vfile.read(4))[0]] if self.cbDataFormat == "CF_METAFILEPICT": (mappingMode, x) = unpack('II', vfile.read(8)) self.Size -= 8 self.Size -= 4 self.pos = vfile.tell() Node.__init__(self, 'Thumbnail', self.Size, self.parent, vfile.node().fsobj()) self.__disown__()
def __init__(self, rhive, parent, node, value): mfso = rhive.mfso if value.name: name = value.name.encode('utf-8') else: name = "default" self.__type = value.type self.__chunk = None try: size = self.fetchData(value.data_off, value.data_size, value.data_in_offset, value, rhive) except Exception as e: size = 0 if not size: size = 0 Node.__init__(self, name, size, parent, mfso) self.__disown__()
def __init__(self, mfso, name, size): Node.__init__(self, name, size, None, mfso) self.__disown__()
def __init__(self, parent, offset, size, count): self.parent = parent self.offset = offset Node.__init__(self, 'Picture' + str(count), size, self.parent, self.parent.fsobj()) self.__disown__()
def __init__(self, name, size, parent, fsobj, attributes): Node.__init__(self, name, size, parent, fsobj) self.__disown__() self.attr = VMap() self.attr["VBA"] = attributes self.setTag("suspicious")
def __init__(self, mfso, parent, name, node, key): Node.__init__(self, name, key.cell_size, parent, mfso) self.__disown__() self.timestamp = key.mtime self.offset = key.offset
def __init__(self, parent, name): Node.__init__(self, name, 0, parent, None) self.__disown__() self.setDir()
def __init__(self, name, size, parent, fsobj, zipfile): Node.__init__(self, name, size, parent, fsobj) self.zipfile = zipfile self.setFile() self.reader = fsobj self.__disown__()