def attributesTypes(values, types): if (types == DateTime): val = DateTime(values) val.thisown = False elif (types == MS64DateTime): val = MS64DateTime(values) val.thisown = False elif (types == DosDateTime): val = DosDateTime(*values) val.thisown = False elif (types == int) or (types == long): if type(values) == str: #XXX strange ? values = 0 val = types(values) elif (types == dict): val = VMap() for k, v in values.iteritems(): vval = Variant(attributesTypes(*v)) val[k] = vval elif (types == list): val = VList() for v in values: vval = Variant(attributesTypes(*v)) val.append(vval) elif (types == str): if type(values) == unicode: val = values.encode("UTF-8", "replace") else: val = str(values) elif (types == VLink): #return node is already created val = values else: val = types(values) return val
def attributes(self, node): attr = VMap() vfile = node.open() img = Image.open(vfile) info = img._getexif() vfile.close() for tag, values in info.items(): if tag in self.dateTimeTags: try: decoded = str(TAGS.get(tag, tag)) try: dt = strptime(values, "%Y:%m:%d %H:%M:%S") except ValueError: try: dt = strptime(values[:-6], "%Y-%m-%dT%H:%M:%S") except ValueError: dt = strptime(values.rstrip(' '), "%a %b %d %H:%M:%S") vt = DateTime(dt.tm_year, dt.tm_mon, dt.tm_mday, dt.tm_hour, dt.tm_min, dt.tm_sec) vt.thisown = False attr[decoded] = Variant(vt) except Exception as e: attr[decoded] = Variant(str(values)) else: decoded = str(TAGS.get(tag, tag)) if decoded == "GPSInfo": try: gpsMap = VMap() for subvalue in values: subDecoded = GPSTAGS.get(subvalue, subvalue) v = values[subvalue] if str(subDecoded) == "GPSLatitude": degree = self.toDegree(v) try: ref = gpsMap["GPSLatitudeRef"] except: ref = "" if str(ref) != "N": degree = 0 - degree gpsMap["GPSLatitudeRef"] = Variant(str(degree)) elif str(subDecoded) == "GPSLongitude": degree = self.toDegree(v) try: ref = gpsMap["GPSLongitudeRef"] except: ref = "" if str(ref) != "E": degree = 0 - degree gpsMap["GPSLongitudeRef"] = Variant( str(degree)) #Variant don't handle float.. elif type(v) == str: gpsMap[str(subDecoded)] = Variant(str(v)) elif type(v) == unicode: gpsMap[str(subDecoded)] = Variant( str(v.encode('ascii', 'replace'))) elif type(v) == tuple: vl = VList() for vv in v: if type(vv) == tuple: vl.push_back(Variant(str(vv))) gpsMap[str(subDecoded)] = vl #XXX handle gps datetime else: gpsMap[str(subDecoded)] = Variant(str(v)) attr[decoded] = gpsMap except Exception as e: pass #print "Metaexif error encoding: ", e elif isinstance(values, tuple): vl = VList() for value in values: if type(values) == unicode: vl.push_back( Variant(value.encode('ascii', 'replace'))) elif type(values) == tuple: vl.push_back(Variant(str(value))) else: vl.push_back(Variant(value)) attr[decoded] = vl else: if type(values) == unicode: attr[decoded] = Variant( values.encode('ascii', 'replace')) elif type(values) == tuple: attr[decoded] = Variant(str(values)) else: attr[decoded] = Variant(values) return attr
def __attributes(self): attribs = VMap() kdbg_offsets = VMap() proc_head = VMap() mod_head = VMap() sys_info = VMap() sys_info["Chosen profile"] = Variant(self.__fsobj._config.PROFILE) sys_info["Major"] = Variant( self._kdbg.obj_vm.profile.metadata.get('major', 0)) sys_info["Minor"] = Variant( self._kdbg.obj_vm.profile.metadata.get('minor', 0)) sys_info["Build"] = Variant( self._kdbg.obj_vm.profile.metadata.get('build', 0)) if hasattr(self._kdbg.obj_vm, 'vtop'): kdbg_offsets["virtual"] = Variant(self._kdbg.obj_offset) kdbg_offsets["physical"] = Variant( self._kdbg.obj_vm.vtop(self._kdbg.obj_offset)) sys_info["Service Pack (CmNtCSDVersion)"] = Variant( self._kdbg.ServicePack) sys_info["Build string (NtBuildLab)"] = Variant( str(self._kdbg.NtBuildLab.dereference())) try: num_tasks = len(list(self._kdbg.processes())) except AttributeError: num_tasks = 0 try: num_modules = len(list(self._kdbg.modules())) except AttributeError: num_modules = 0 cpu_blocks = list(self._kdbg.kpcrs()) proc_head["offset"] = Variant(long(self._kdbg.PsActiveProcessHead)) proc_head["process count"] = Variant(num_tasks) mod_head["offset"] = Variant(long(self._kdbg.PsLoadedModuleList)) mod_head["modules count"] = Variant(num_modules) try: dos_header = obj.Object("_IMAGE_DOS_HEADER", offset=self._kdbg.KernBase, vm=self._kdbg.obj_vm) nt_header = dos_header.get_nt_header() except: pass else: sys_info["Major (OptionalHeader)"] = Variant( long(nt_header.OptionalHeader.MajorOperatingSystemVersion)) sys_info["Minor (OptionalHeader)"] = Variant( long(nt_header.OptionalHeader.MinorOperatingSystemVersion)) i = 0 kpcrs = VMap() for kpcr in cpu_blocks: kpcrs["CPU " + str(kpcr.ProcessorBlock.Number)] = Variant( kpcr.obj_offset) attribs["KPCR(s)"] = Variant(kpcrs) attribs["DTB"] = Variant(self._aspace.dtb) volmagic = obj.VolMagic(self._aspace) KUSER_SHARED_DATA = volmagic.KUSER_SHARED_DATA.v() if KUSER_SHARED_DATA: attribs["KUSER_SHARED_DATA"] = Variant(KUSER_SHARED_DATA) k = obj.Object("_KUSER_SHARED_DATA", offset=KUSER_SHARED_DATA, vm=self._aspace) if k: stime = k.SystemTime vtstime = MS64DateTime(stime.as_windows_timestamp()) vtstime.thisown = False attribs["Image date and time"] = Variant(vtstime) tz = timefmt.OffsetTzInfo( -k.TimeZoneBias.as_windows_timestamp() / 10000000) lsystime = stime.as_datetime().astimezone(tz) vtlstime = DateTime(lsystime.year, lsystime.month, lsystime.day, lsystime.hour, lsystime.minute, lsystime.second) vtlstime.thisown = False attribs["Image local date and time"] = Variant(vtlstime) else: kdbg_offsets["physical"] = Variant(self._kdbg.obj_offset) proc_head["offset"] = Variant(self._kdbg.PsActiveProcessHead) mod_head["offset"] = Variant(self._kdbg.PsLoadedModuleList) attribs["PsActiveProcessHead"] = Variant(proc_head) attribs["PsLoadedModuleList"] = Variant(mod_head) attribs["KDBG offsets"] = Variant(kdbg_offsets) attribs["KernelBase"] = Variant(long(self._kdbg.KernBase)) if not hasattr(self._aspace, "pae"): attribs["PAE type"] = Variant("No PAE") else: attribs["PAE type"] = Variant("PAE") verinfo = self._kdbg.dbgkd_version64() if verinfo: ver64 = VMap() ver64["Major"] = Variant(long(verinfo.MajorVersion)) ver64["Minor"] = Variant(long(verinfo.MinorVersion)) ver64["offset"] = Variant(verinfo.obj_offset) sys_info["Version 64"] = Variant(ver64) attribs["System Information"] = Variant(sys_info) return attribs
def getTime(self, timestamp): vt = DateTime(timestamp) vt.thisown = False v = Variant(vt) return v