def testExistingFileStat(self):
bash_stat = {
"st_ctime":
rdfvalue.RDFDatetimeSeconds(1299502221),
"st_rdev":
0,
"st_mtime":
rdfvalue.RDFDatetimeSeconds(1284154642),
"st_blocks":
16,
"st_nlink":
1,
"st_gid":
0,
"st_blksize":
4096,
"pathspec":
rdf_paths.PathSpec(
path="/bin/bash", pathtype="OS", path_options="CASE_LITERAL"),
"st_dev":
51713,
"st_size":
4874,
"st_ino":
1026148,
"st_uid":
0,
"st_mode":
rdf_client.StatMode(33261),
"st_atime":
rdfvalue.RDFDatetimeSeconds(1299502220)
}
bash_path = os.path.join("/", self.client_name, "fs/os/c/bin/bash")
self.assertItemsEqual(self.passthrough.getattr(bash_path), bash_stat)
def testStatEntryToExportedRegistryKeyConverter(self):
stat = rdfvalue.StatEntry(
aff4path=rdfvalue.RDFURN(
"aff4:/C.0000000000000000/registry/HKEY_USERS/S-1-5-20/Software/"
"Microsoft/Windows/CurrentVersion/Run/Sidebar"),
st_mode=32768,
st_size=51,
st_mtime=1247546054,
registry_type=rdfvalue.StatEntry.RegistryType.REG_EXPAND_SZ,
pathspec=rdfvalue.PathSpec(
path="/HKEY_USERS/S-1-5-20/Software/Microsoft/Windows/"
"CurrentVersion/Run/Sidebar",
pathtype=rdfvalue.PathSpec.PathType.REGISTRY),
registry_data=rdfvalue.DataBlob(string="Sidebar.exe"))
converter = export.StatEntryToExportedRegistryKeyConverter()
results = list(converter.Convert(rdfvalue.ExportedMetadata(), stat,
token=self.token))
self.assertEqual(len(results), 1)
self.assertEqual(results[0].urn, rdfvalue.RDFURN(
"aff4:/C.0000000000000000/registry/HKEY_USERS/S-1-5-20/Software/"
"Microsoft/Windows/CurrentVersion/Run/Sidebar"))
self.assertEqual(results[0].last_modified,
rdfvalue.RDFDatetimeSeconds(1247546054))
self.assertEqual(results[0].type,
rdfvalue.StatEntry.RegistryType.REG_EXPAND_SZ)
self.assertEqual(results[0].data, "Sidebar.exe")
def SetupTestTimeline(self):
self.client_id = self.SetupClient(0)
fixture_test_lib.ClientFixture(self.client_id, token=self.token)
# Choose some directory with pathspec in the ClientFixture.
self.folder_path = "fs/os/Users/中国新闻网新闻中/Shared"
self.file_path = self.folder_path + "/a.txt"
file_urn = self.client_id.Add(self.file_path)
for i in range(0, 5):
with test_lib.FakeTime(i):
with aff4.FACTORY.Create(
file_urn, aff4_grr.VFSFile, mode="w", token=self.token) as fd:
stats = rdf_client.StatEntry(
st_mtime=rdfvalue.RDFDatetimeSeconds().Now())
fd.Set(fd.Schema.STAT, stats)
