def __init__(self, header, data, fat, minifat, parent, mfsobj):
self.extraAttr = None
Struct.__init__(self,header, None, header.DirectoryEntry, data)
self.fat = fat
self.minifat = minifat
invalidNameCounter = 1
if self.objectName[1] == "\x00": #Some compound file like MSI as invalid name this is an ugly way to test
self.objectName = unicode(self.objectName[:self.nameLen - 2], 'UTF-16').encode('UTF-8')
else:
#global invalidNameCounter
#invalidNameCounter += 1
self.objectName = str("Unknown-" + str(invalidNameCounter)).encode('UTF-8')
try:
self.objectType = self.Type[ord(self.objectType)]
except KeyError:
self.objectType = self.Type[0x0]
if len(self.objectName) == 0 or self.objectType == 'TypeUnknown':
return
self.CLSID = UUID(self.CLSID)
if len(self.objectName) and mfsobj:
realSize = self.offsetsSize()
if self.streamSize > realSize:
streamSize = realSize
else:
streamSize = self.streamSize
if self.objectName[0] <= "\x05":
self.objectName = self.objectName[1:]
Node.__init__(self, self.objectName, streamSize, None, mfsobj)
self.__disown__()
if self.objectType == "RootStorageObject":
self.minifat.setRootStorageObject(self)
def __init__(self, stream, matchingSectionCLSID = None): #add some sectionCLSID to match to avoid parsing all section
self.sectionList = []
vfile = stream.open()
try:
magic = vfile.read(2)
if magic != "\xfe\xff":
vfile.close()
raise RuntimeError('Not a property stream')
vfile.seek(0)
data = vfile.read(28)
self.header = Header(PropertySetStreamHeader)
Struct.__init__(self, self.header, None, self.header.PropertySetStream, data)
self.CLSID = UUID(self.CLSID)
try :
os = self.OSID[self.OSType]
self.OSVersion = os + ' - ' + str(self.OSVersion & 0x00ff) + '.' + str(self.OSVersion >> 8)
except KeyError:
self.OSVersion = "Unknown"
count = 0
vfile.seek(28)
while count < self.SectionCount:
sectionListData = vfile.read(20)
sectionHeader = Struct(self.header, None, self.header.SectionList, sectionListData)
sectionHeader.CLSID = UUID(sectionHeader.CLSID)
currentSectionListOffset = vfile.tell()
if not matchingSectionCLSID or (sectionHeader.CLSID in matchingSectionCLSID):
vfile.seek(sectionHeader.Offset)
data = vfile.read(8)
sectionHeader.Section = Struct(self.header, None, self.header.Section, data)
sectionHeader.Section.PropertyList = PropertyList()
maxReadSize = stream.size() - vfile.tell()
if maxReadSize <= 0:
break
if sectionHeader.Section.Length < maxReadSize:
readSize = sectionHeader.Section.Length
else:
readSize = maxReadSize
data = vfile.read(readSize)
propertyCount = 0
while propertyCount < sectionHeader.Section.PropertyCount:
propert = Struct(self.header, None, self.header.PropertyList, data[propertyCount*8:(propertyCount*8)+8])
sectionHeader.Section.PropertyList.append(propert)
propertyCount += 1
vfile.seek(sectionHeader.Offset + propert.Offset)
propert.Variant = MSVariant(vfile)
self.sectionList.append(sectionHeader)
vfile.seek(currentSectionListOffset)
count += 1
except :
vfile.close()
raise
vfile.close()
def readFibRgCsNew(self, vfile, header):
#getting right nFib
self.cswNew = unpack('H', vfile.read(2))[0]
self.FibRgCswNew = None
data = vfile.read(self.cswNew * 2)
if self.cswNew == 0:
self.nFib = self.FibBase.nFib
elif self.cswNew * 2 == 4:
self.FibRgCswNew = Struct(header, None, header.FibRgCswNewData2000,
data)
self.nFib = self.FibRgCswNew.nFibNew
elif self.cswNew * 2 == 10:
self.FibRgCswNew = Struct(header, None, header.FibRgCswNewData2007,
data)
self.nFib = self.FibRgCswNew.nFibNew
def __init__(self, node):
header = Header(MSDocHeader)
self.node = node
vfile = self.node.open()
try :
data = vfile.read(154)
Struct.__init__(self, header, None, header.Fib, data)
if self.FibBase.wIdent != 0xA5EC:
vfile.close()
raise RuntimeError("Header wIdent is invalid on stream " + str(self.node.absolute()))
self.readFib(vfile, header)
self.readFibRgCsNew(vfile, header)
except :
vfile.close()
raise
vfile.close()
self.initBitField()
self.setTableAndDataStream()
def __init__(self, node):
header = Header(MSDocHeader)
self.node = node
vfile = self.node.open()
try:
data = vfile.read(154)
Struct.__init__(self, header, None, header.Fib, data)
if self.FibBase.wIdent != 0xA5EC:
vfile.close()
raise RuntimeError("Header wIdent is invalid on stream " +
str(self.node.absolute()))
self.readFib(vfile, header)
self.readFibRgCsNew(vfile, header)
except:
vfile.close()
raise
vfile.close()
self.initBitField()
self.setTableAndDataStream()
def __init__(self, node, mfsobj):
self.header = Header(OLEHeader)
self.node = node
self.mfsobj = mfsobj
self.vfile = node.open()
try :
self.vfile.seek(0)
data = self.vfile.read(self.header.CompoundDocumentHeader.ssize)
except :
self.vfile.close()
raise
self.vfile.close()
Struct.__init__(self, self.header, None, self.header.CompoundDocumentHeader, data)
if self.OLEHeaderSignature != self.OleSignature:
raise Exception('OLE Header is not valid.')
if self.SectorShift == 0x9:
self.SectorSize = 512
elif self.SectorShift == 0xc:
self.SectorSize = 4096
self.CLSID = UUID(self.CLSID)
self.entries = []
def __init__(self, node):
self.node = node
self.vfile = node.open()
self.attr = {}
try :
self.header = Header(self.PrefetchHeader)
self.vfile.seek(0)
magic_data = self.vfile.read(8)
for magic, version, version_name in self.PrefetchMagic:
if magic_data == magic:
prefetch_version = getattr(self.header, version)
self.version_name = version_name
if not version:
self.vfile.close
return
self.vfile.seek(0)
self.data = self.vfile.read(prefetch_version.ssize)
self.prefetch = Struct(self.header, self.vfile, prefetch_version, self.data)
self.vfile.seek(self.prefetch.Standard.FirstFilePathBlock)
self.data = self.vfile.read(self.prefetch.Standard.FirstFilePathSize)
self.prefetchFileList = unicode(self.data.decode('utf-16')).split("\x00")
try:
self.prefetchFileList.remove('')
except ValueError:
pass
self.prefetchFileList = map(lambda x : (x, str), self.prefetchFileList)
self.vfile.seek(self.prefetch.Standard.VolumeInformationBlock.VolumePathOffset + self.prefetch.Standard.VolumeInformationBlock.pointer)
self.volumePath = self.vfile.read(self.prefetch.Standard.VolumeInformationBlock.VolumePathLength *2).decode('UTF-16')
self.VolumePrefetchList = []
self.vfile.seek(self.prefetch.Standard.VolumeInformationBlock.pointer + self.prefetch.Standard.VolumeInformationBlock.OffsetToFolderPaths)
pathSize = unpack('h', self.vfile.read(2))[0]
count = 0
while (pathSize > 0 and count < self.prefetch.Standard.VolumeInformationBlock.NumberOfFolderPaths):
self.VolumePrefetchList.append((unicode(self.vfile.read(pathSize * 2+2)).decode('UTF-16'), str))
count += 1
pathSize = unpack('h', self.vfile.read(2))[0]
self.vfile.close()
except :
#err_type, err_value, err_traceback = sys.exc_info()
#for n in traceback.format_exception_only(err_type, err_value):
#print n
#for n in traceback.format_tb(err_traceback):
#print n
self.vfile.close()
raise Exception("Init error")
def readFib(self, vfile, header):
try:
fibRgFcLcbVersion = self.VersionList[self.cbRgFcLcbSizeFibVersion[
self.cbRgFcLcb * 8]]
except KeyError:
raise Exception("No valid nFib/version")
fibRgFcLcbVersionHeader = getattr(header, fibRgFcLcbVersion)
data = vfile.read(fibRgFcLcbVersionHeader.ssize)
currentc = Struct(header, None, fibRgFcLcbVersionHeader, data)
setattr(self, fibRgFcLcbVersion, currentc)
#After have reading so much MS header I started to write code as cryptic as them
for x in range(self.cbRgFcLcbSizeFibVersion[self.cbRgFcLcb * 8] + 1,
5):
currentc = getattr(currentc, self.VersionList[x])
setattr(self, self.VersionList[x], currentc)
def __init__(self, node):
try:
self.node = node
self.vfile = node.open()
self.header = Header(ShellLinkHeader)
self.vfile.seek(0)
self.data = self.vfile.read(self.header.ShellLinkHeader.ssize)
self.shellLink = Struct(self.header, self.vfile,
self.header.ShellLinkHeader, self.data)
self.shellLink.FileAttributes = FlagsList(
self.shellLink.FileAttributes, FileAttributesFlags)
self.shellLink.LinkFlags = FlagsList(self.shellLink.LinkFlags,
LinkFlags)
self.shellLink.LinkCLSID = UUID(self.shellLink.LinkCLSID)
try:
self.shellLink.ShowCommand = ShowCommandFlagsMap[
self.shellLink.ShowCommand]
except KeyError:
self.shellLink.ShowCommand = str(
hex(self.shellLink.ShowCommand))
if ("HasLinkTargetIDList", str) in self.shellLink.LinkFlags:
self.getLinkTargetIDList()
if ("HasLinkInfo", str) in self.shellLink.LinkFlags:
self.getLinkInfo()
for dataName in ("HasName", "HasRelativePath", "HasWorkingDir",
"HasArguments", "HasIconLocation"):
self.readStringData(dataName)
if self.vfile.tell() < self.vfile.node().size():
self.getDataBlock()
self.vfile.close()
except:
err_type, err_value, err_traceback = sys.exc_info()
print traceback.format_exception_only(err_type, err_value)
print traceback.format_tb(err_traceback)
self.vfile.close()
def getLinkInfo(self):
linkInfoStartOffset = self.vfile.tell()
self.data = self.vfile.read(self.header.LinkInfo.ssize)
self.linkInfo = Struct(self.header, self.vfile, self.header.LinkInfo, self.data)
self.linkInfoAttr = {}
self.linkInfoAttr["Link info header size"] = (self.linkInfo.HeaderSize, int)
self.linkInfo.Flags = FlagsList(self.linkInfo.Flags, LinkInfoFlags)
self.linkInfoAttr["Link info flags"] = (self.linkInfo.Flags, list)
if ("VolumeIDAndLocalBasePath", str) in self.linkInfo.Flags:
self.vfile.seek(linkInfoStartOffset + self.linkInfo.VolumeIDOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
VolumeIDStruct = Struct(self.header, self.vfile, self.header.VolumeID, buff)
VolumeIDAttr = {}
try :
VolumeIDAttr["Drive type"] = (DriveTypeMaps[VolumeIDStruct.DriveType], str)
except KeyError:
pass
VolumeIDAttr["Drive serial number"] = (VolumeIDStruct.DriveSerialNumber, int)
if VolumeIDStruct.LabelOffset != 0x14:
pos = buff[VolumeIDStruct.LabelOffset:].find('\x00')
if pos != -1:
VolumeIDAttr["Volume label"] = (buff[VolumeIDStruct.LabelOffset:VolumeIDStruct.LabelOffset+pos+1], str)
else:
LabelOffsetUnicode = buff[16:20]
VolumeIDAttr["Volume label (Unicode)"]= (UnicodeBuff(buff[LabelOffsetUnicode:]), str)
if len(VolumeIDAttr):
self.linkInfoAttr["Volume ID"] = (VolumeIDAttr, dict)
self.vfile.seek(linkInfoStartOffset + self.linkInfo.LocalBasePathOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
pos = buff.find('\x00')
if pos != -1:
self.linkInfoAttr["Local base path"] = (buff[:pos], str)
if self.linkInfo.HeaderSize >= 0x24:
self.vfile.seek(linkInfoStartOffset + self.linkInfo.LocalBasePathUnicode)
sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
self.linkInfoAttr["Local base path (Unicode)"] = (UnicodeBuff(buff), str)
elif ("CommonNetworkRelativeLinkAndPathSuffix", str) in self.linkInfo.Flags:
self.vfile.seek(linkInfoStartOffset + self.linkInfo.CommonNetworkRelativeLinkOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
CommonNetworkRelativeLinkStruct = Struct(self.header, self.vfile, self.header.CommonNetworkRelativeLink, buff)
CommonNetworkRelativeLinkAttr = {}
CommonNetworkRelativeLinkStruct.LinkFlags = FlagsList(CommonNetworkRelativeLinkStruct.LinkFlags, CommonNetworkRelativeLinkFlags)
CommonNetworkRelativeLinkAttr["Link flags"] = (CommonNetworkRelativeLinkStruct.LinkFlags, list)
if ("ValidDevice", str) in CommonNetworkRelativeLinkStruct.LinkFlags:
#XXX UNTESTED
if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14:
DeviceNameUnicodeOffset = unpack("I", buff[24:28])[0]
pos = buff[DeviceNameUnicodeOffset:].find('\x00\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Deivce name (unicode)"] = (unicode(buff[DeviceNameUnicodeOffset:DeviceNameUnicodeOffset+pos+3].decode('UTF-16')), str)
else:
pos = buff[CommonNetworkRelativeLinkStruct.DeviceNameOffset:].find('\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Device name"] = (buff[CommonNetworkRelativeLinkStruct.DeviceNameOffset:CommonNetworkRelativeLinkStruct.DeviceNameOffset + pos+1], str)
if ("ValidNetType", str) in CommonNetworkRelativeLinkStruct.LinkFlags:
if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14:
NetNameUnicodeOffset = unpack("I", buff[20:24])[0]
pos = buff[NetNameUnicodeOffset:].find('\x00\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Net name (unicode)"] = (unicode(buff[NetNameUnicodeOffset:NetNameUnicodeOffset+pos+3].decode('UTF-16')), str)
else:
pos = buff[CommonNetworkRelativeLinkStruct.NetNameOffset:].find('\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Net name"] = (buff[CommonNetworkRelativeLinkStruct.NetNameOffset:CommonNetworkRelativeLinkStruct.NetNameOffset + pos+1], str)
try:
CommonNetworkRelativeLinkAttr["Provider type"] = (NetworkProviderType[CommonNetworkRelativeLinkStruct.NetworkProviderType], str)
except KeyError:
CommonNetworkRelativeLinkAttr["Provider type"] = (CommonNetworkRelativeLinkStruct.NetworkProviderType, int)
self.vfile.seek(linkInfoStartOffset + self.linkInfo.CommonPathSuffixOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell() + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
pos = buff.find('\x00')
if pos != -1:
self.linkInfoAttr["Common path suffix"] = (buff[:pos], str)
if self.linkInfo.HeaderSize >= 0x24:
pass
#print "get unicode common suffix "
if len(CommonNetworkRelativeLinkAttr):
self.linkInfoAttr["Common network relative link"] = (CommonNetworkRelativeLinkAttr, dict)
self.vfile.seek(linkInfoStartOffset + self.linkInfo.StructSize)
def getLinkInfo(self):
linkInfoStartOffset = self.vfile.tell()
self.data = self.vfile.read(self.header.LinkInfo.ssize)
self.linkInfo = Struct(self.header, self.vfile, self.header.LinkInfo,
self.data)
self.linkInfoAttr = {}
self.linkInfoAttr["Link info header size"] = (self.linkInfo.HeaderSize,
int)
self.linkInfo.Flags = FlagsList(self.linkInfo.Flags, LinkInfoFlags)
self.linkInfoAttr["Link info flags"] = (self.linkInfo.Flags, list)
if ("VolumeIDAndLocalBasePath", str) in self.linkInfo.Flags:
self.vfile.seek(linkInfoStartOffset + self.linkInfo.VolumeIDOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell(
) + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
VolumeIDStruct = Struct(self.header, self.vfile,
self.header.VolumeID, buff)
VolumeIDAttr = {}
try:
VolumeIDAttr["Drive type"] = (
DriveTypeMaps[VolumeIDStruct.DriveType], str)
except KeyError:
pass
VolumeIDAttr["Drive serial number"] = (
VolumeIDStruct.DriveSerialNumber, int)
if VolumeIDStruct.LabelOffset != 0x14:
pos = buff[VolumeIDStruct.LabelOffset:].find('\x00')
if pos != -1:
VolumeIDAttr["Volume label"] = (
buff[VolumeIDStruct.
LabelOffset:VolumeIDStruct.LabelOffset + pos + 1],
str)
else:
LabelOffsetUnicode = buff[16:20]
VolumeIDAttr["Volume label (Unicode)"] = (UnicodeBuff(
buff[LabelOffsetUnicode:]), str)
if len(VolumeIDAttr):
self.linkInfoAttr["Volume ID"] = (VolumeIDAttr, dict)
self.vfile.seek(linkInfoStartOffset +
self.linkInfo.LocalBasePathOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell(
) + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
pos = buff.find('\x00')
if pos != -1:
self.linkInfoAttr["Local base path"] = (buff[:pos], str)
if self.linkInfo.HeaderSize >= 0x24:
self.vfile.seek(linkInfoStartOffset +
self.linkInfo.LocalBasePathUnicode)
sizeMax = self.linkInfo.StructSize - self.vfile.tell(
) + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
self.linkInfoAttr["Local base path (Unicode)"] = (
UnicodeBuff(buff), str)
elif ("CommonNetworkRelativeLinkAndPathSuffix",
str) in self.linkInfo.Flags:
self.vfile.seek(linkInfoStartOffset +
self.linkInfo.CommonNetworkRelativeLinkOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell(
) + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
CommonNetworkRelativeLinkStruct = Struct(
self.header, self.vfile, self.header.CommonNetworkRelativeLink,
buff)
CommonNetworkRelativeLinkAttr = {}
CommonNetworkRelativeLinkStruct.LinkFlags = FlagsList(
CommonNetworkRelativeLinkStruct.LinkFlags,
CommonNetworkRelativeLinkFlags)
CommonNetworkRelativeLinkAttr["Link flags"] = (
CommonNetworkRelativeLinkStruct.LinkFlags, list)
if ("ValidDevice",
str) in CommonNetworkRelativeLinkStruct.LinkFlags:
#XXX UNTESTED
if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14:
DeviceNameUnicodeOffset = unpack("I", buff[24:28])[0]
pos = buff[DeviceNameUnicodeOffset:].find('\x00\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr[
"Deivce name (unicode)"] = (unicode(
buff[DeviceNameUnicodeOffset:
DeviceNameUnicodeOffset + pos +
3].decode('UTF-16')), str)
else:
pos = buff[CommonNetworkRelativeLinkStruct.
DeviceNameOffset:].find('\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Device name"] = (buff[
CommonNetworkRelativeLinkStruct.DeviceNameOffset:
CommonNetworkRelativeLinkStruct.DeviceNameOffset +
pos + 1], str)
if ("ValidNetType",
str) in CommonNetworkRelativeLinkStruct.LinkFlags:
if CommonNetworkRelativeLinkStruct.NetNameOffset > 0x14:
NetNameUnicodeOffset = unpack("I", buff[20:24])[0]
pos = buff[NetNameUnicodeOffset:].find('\x00\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Net name (unicode)"] = (
unicode(buff[
NetNameUnicodeOffset:NetNameUnicodeOffset +
pos + 3].decode('UTF-16')), str)
else:
pos = buff[CommonNetworkRelativeLinkStruct.
NetNameOffset:].find('\x00')
if pos != -1:
CommonNetworkRelativeLinkAttr["Net name"] = (
buff[CommonNetworkRelativeLinkStruct.
NetNameOffset:CommonNetworkRelativeLinkStruct.
NetNameOffset + pos + 1], str)
try:
CommonNetworkRelativeLinkAttr["Provider type"] = (
NetworkProviderType[CommonNetworkRelativeLinkStruct.
NetworkProviderType], str)
except KeyError:
CommonNetworkRelativeLinkAttr["Provider type"] = (
CommonNetworkRelativeLinkStruct.NetworkProviderType,
int)
self.vfile.seek(linkInfoStartOffset +
self.linkInfo.CommonPathSuffixOffset)
sizeMax = self.linkInfo.StructSize - self.vfile.tell(
) + linkInfoStartOffset
buff = self.vfile.read(sizeMax)
pos = buff.find('\x00')
if pos != -1:
self.linkInfoAttr["Common path suffix"] = (buff[:pos], str)
if self.linkInfo.HeaderSize >= 0x24:
pass
#print "get unicode common suffix "
if len(CommonNetworkRelativeLinkAttr):
self.linkInfoAttr["Common network relative link"] = (
CommonNetworkRelativeLinkAttr, dict)
self.vfile.seek(linkInfoStartOffset + self.linkInfo.StructSize)
def getDataBlock(self):
dataBlockHeader = Header(DataBlockHeader)
pos = None
while (self.vfile.tell() <
self.vfile.node().size() - 4) and (pos != self.vfile.tell()):
pos = self.vfile.tell()
data = self.vfile.read(dataBlockHeader.DataBlockStandard.ssize)
standard = Struct(dataBlockHeader, self.vfile,
dataBlockHeader.DataBlockStandard, data)
try:
self.vfile.seek(pos)
dataBlockType = ExtraDataBlockMaps[standard.BlockSignature]
data = self.vfile.read(standard.BlockSize)
try:
setattr(
self, dataBlockType,
Struct(dataBlockHeader, self.vfile,
getattr(dataBlockHeader, dataBlockType), data))
if dataBlockType == 'ConsoleDataBlock':
self.ConsoleDataBlock.FillAttributes = FlagsList(
self.ConsoleDataBlock.FillAttributes,
FillAttributesFlags)
self.ConsoleDataBlock.PopupFillAttributes = FlagsList(
self.ConsoleDataBlock.PopupFillAttributes,
FillAttributesFlags)
try:
self.ConsoleDataBlock.FontFamily = FontFamily[
self.ConsoleDataBlock.FontFamily]
except KeyError:
pass
self.ConsoleDataBlock.FaceName = UnicodeBuff(
self.ConsoleDataBlock.FaceName)
if dataBlockType == 'TrackerDataBlock':
self.TrackerDataBlock.DroidVolume = UUID(
self.TrackerDataBlock.DroidVolume)
self.TrackerDataBlock.DroidFile = UUID(
self.TrackerDataBlock.DroidFile)
self.TrackerDataBlock.DroidBirthVolume = UUID(
self.TrackerDataBlock.DroidBirthVolume)
self.TrackerDataBlock.DroidBirthFile = UUID(
self.TrackerDataBlock.DroidBirthFile)
#elif windowsvsita...
#elif shindataBLock
elif dataBlockType == 'EnvironmentVariableDataBlock':
self.EnvironmentVariableDataBlock.TargetUnicode = UnicodeBuff(
self.EnvironmentVariableDataBlock.TargetUnicode)
elif dataBlockType == 'IconEnvironmentDataBlock':
self.IconEnvironmentDataBlock.Environment.TargetUnicode = UnicodeBuff(
self.IconEnvironmentDataBlock.Environment.
TargetUnicode)
elif dataBlockType == 'DarwinDataBlock':
self.DarwinDataBlock.DataUnicode = UnicodeBuff(
self.DarwinDataBlock.DataUnicode)
elif dataBlockType == 'KnownFolderDataBlock':
self.KnownFolderDataBlock.ID = UUID(
self.KnownFolderDataBlock.ID)
elif dataBlockType == 'PropertyStoreDataBlock':
serializedPropertyHeader = Header(
SerializedPropertyHeader)
self.PropertyStoreSerializedAttr = {}
while len(data) >= 32:
self.PropertyStoreDataBlock.Property.FormatID = UUID(
self.PropertyStoreDataBlock.Property.FormatID)
if self.PropertyStoreDataBlock.Property.StorageSize and len(
data) > 40:
if self.PropertyStoreDataBlock.Property.FormatID != "D5CDD505-2E9C-101B-9397-08002B2CF9AE":
serializedPropertyData = data[32:]
IntegerName = Struct(
serializedPropertyHeader, self.vfile,
serializedPropertyHeader.IntegerName,
serializedPropertyData)
try:
value = 'Undef Type'
value = PropertyType[
IntegerName.TypedValue.Type]
value = PropertyTypeConverter[value](
serializedPropertyData[13:])
except KeyError:
pass
self.PropertyStoreSerializedAttr[str(
IntegerName.Id)] = (value, str)
data = data[self.PropertyStoreDataBlock.
Property.StorageSize:]
if len(data) >= 32:
setattr(
self, dataBlockType,
Struct(
dataBlockHeader, self.vfile,
getattr(
dataBlockHeader,
dataBlockType), data))
else:
break
else:
#StringType
break
else:
break
except AttributeError, e:
break #avoid infinite loop, possibly skip decodable data block
except KeyError, e:
if (dataBlockHeader.DataBlockStandard.ssize
== 0) or (standard.BlockSize == 0):
break
