def get_login_items_entries(btm_file): with open(btm_file, 'rb') as fp: plist = ccl_bplist.load(fp) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver( plist, parse_whole_structure=True) ccl_bplist.set_object_converter( ccl_bplist.NSKeyedArchiver_common_objects_convertor) return ns_keyed_archiver_obj['root']['backgroundItems'][ 'allContainers']
def process_nsa_plist(input_path, f): '''Returns a deserialized plist. Input is NSKeyedArchive file. input_path field is not used''' global use_as_library try: if not use_as_library: print('Reading file .. ' + input_path) f = extract_nsa_plist(f) ccl_bplist.set_object_converter( ccl_bplist.NSKeyedArchiver_common_objects_convertor) plist = ccl_bplist.load(f) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver( plist, parse_whole_structure=True) root_names = getRootElementNames(f) top_level = [] for root_name in root_names: root = ns_keyed_archiver_obj[root_name] if not use_as_library: print('Trying to deserialize binary plist $top = {}'.format( root_name)) if isinstance(root, dict): plist = {} recurseCreatePlist(plist, root, ns_keyed_archiver_obj.object_table) if root_name.lower() != 'root': plist = {root_name: plist} elif isinstance(root, list): plist = [] recurseCreatePlist(plist, root, ns_keyed_archiver_obj.object_table) if root_name.lower() != 'root': plist = {root_name: plist} else: plist = {root_name: root} if len(root_names) == 1: top_level = plist else: # > 1 top_level.append(plist) except Exception as ex: print('Had an exception (error)') traceback.print_exc() return top_level
def DeserializeNSKeyedArchive(file_pointer): '''Pass an open file pointer (file must be opened as rb) and get a dict or list representation of the plist returned back ''' ccl_bplist.set_object_converter( ccl_bplist.NSKeyedArchiver_common_objects_convertor) plist = ccl_bplist.load(file_pointer) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver( plist, parse_whole_structure=True) root = ns_keyed_archiver_obj['root'] if isinstance(root, dict): plist = {} else: plist = [] recurseCreatePlist(plist, root) return plist
def GetProfileInfo(f): profiles = [] ccl_bplist.set_object_converter(ccl_bplist.NSKeyedArchiver_common_objects_convertor) plist = ccl_bplist.load(f) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver(plist, parse_whole_structure=True) md = ns_keyed_archiver_obj['mapData'] for item in md: if md[item]['NSEntityName'] == 'MCX_Profile': profile_attribs = md[item]['NSAttributeValues'] attributes = [] attributes.append(profile_attribs[0]) # UUID if domain user, else name attributes.append(profile_attribs[1]) # user name attributes.append(profile_attribs[2]) # date first logged in (if domain user), else name # Not interpreting other attributes at this time! profiles.append(attributes) return profiles
def main(): global usage if sys.version_info.major == 2: print( 'ERROR-This will not work with python2. Please run again with python3!' ) return argc = len(sys.argv) if argc < 2 or sys.argv[1].lower() == '-h': print(usage) return input_path = sys.argv[1] if not os.path.exists(input_path): print('Error, file does not exist! Check file path!\r\n') print(usage) return # All OK, process the file now try: f = open(input_path, 'rb') print('Reading file .. ' + input_path) ccl_bplist.set_object_converter( ccl_bplist.NSKeyedArchiver_common_objects_convertor) plist = ccl_bplist.load(f) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver( plist, parse_whole_structure=True) root = ns_keyed_archiver_obj['root'] print('Trying to deserialize binary plist ..') plist = {} recurseCreatePlist(plist, root) print('Writing it back out as .. ' + input_path + '_deserialized.plist') biplist.writePlist(plist, input_path + '_deserialized.plist') print('Done !') except Exception as ex: print('Had an exception (error)') traceback.print_exc()
def _unpack_top_level(f, plist_biplist_obj): '''Does the work to actually unpack the NSKeyedArchive's top level. Returns the top level object. ''' ccl_bplist.set_object_converter( ccl_bplist.NSKeyedArchiver_common_objects_convertor) plist = ccl_bplist.load(f) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver( plist, parse_whole_structure=True) root_names = _get_root_element_names(plist_biplist_obj) top_level = [] for root_name in root_names: root = ns_keyed_archiver_obj[root_name] if isinstance(root, dict): plist = {} _recurse_create_plist(plist, root, ns_keyed_archiver_obj.object_table) if root_name.lower() != 'root': plist = {root_name: plist} elif isinstance(root, list): plist = [] _recurse_create_plist(plist, root, ns_keyed_archiver_obj.object_table) if root_name.lower() != 'root': plist = {root_name: plist} else: plist = {root_name: root} if len(root_names) == 1: top_level = plist else: # > 1 top_level.append(plist) return top_level
def deserialize_plist(path_or_file): ''' Returns a deserialized plist as a dictionary/list. Parameters ---------- path_or_file: Path or file-like object of an NSKeyedArchive file Returns ------- A dictionary or list is returned depending on contents of the plist Exceptions ---------- nska_deserialize.DeserializeError, biplist.NotBinaryPlistException, ccl_bplist.BplistError, ValueError, TypeError, OSError, OverflowError ''' path = '' f = None if isinstance(path_or_file, str): path = path_or_file f = open(path, 'rb') else: # its a file f = path_or_file f = _get_valid_nska_plist(f) ccl_bplist.set_object_converter( ccl_bplist.NSKeyedArchiver_common_objects_convertor) plist = ccl_bplist.load(f) ns_keyed_archiver_obj = ccl_bplist.deserialise_NsKeyedArchiver( plist, parse_whole_structure=True) root_names = _get_root_element_names(f) top_level = [] for root_name in root_names: root = ns_keyed_archiver_obj[root_name] if isinstance(root, dict): plist = {} _recurse_create_plist(plist, root, ns_keyed_archiver_obj.object_table) if root_name.lower() != 'root': plist = {root_name: plist} elif isinstance(root, list): plist = [] _recurse_create_plist(plist, root, ns_keyed_archiver_obj.object_table) if root_name.lower() != 'root': plist = {root_name: plist} else: plist = {root_name: root} if len(root_names) == 1: top_level = plist else: # > 1 top_level.append(plist) return top_level