コード例 #1
0
    def testReadMapOfImage(self):
        fileSize = 629087

        # take the lexicon from our new container
        (version, lex) = Container.identify(self.fileName)

        # setup a resolver
        resolver = data_store.MemoryDataStore(lex)

        # open the two containers within the same resolver (needed so the transitive links work)
        with zip.ZipFile.NewZipFile(resolver, version,
                                    rdfvalue.URN.FromFileName(
                                        self.stdLinear)) as targetContainer:
            with zip.ZipFile.NewZipFile(
                    resolver, version, rdfvalue.URN.FromFileName(
                        self.fileName)) as sourceContainer:

                # open the virtual file and read
                image_urn = sourceContainer.urn.Append("pdf1")
                with resolver.AFF4FactoryOpen(image_urn) as image:
                    # check the size is right
                    self.assertEquals(629087, image.Size())

                    # read the header of the virtual file
                    image.SeekRead(0, 0)
                    self.assertEquals(b"%PDF", image.Read(4))

                    # read the whole virtual file and compare with a known hash of it
                    image.SeekRead(0, 0)
                    buf = image.Read(629087)
                    hash = hashes.new(lexicon.HASH_SHA1)
                    hash.update(buf)
                    self.assertEquals(
                        "5A2FEE16139C7B017B7F1961D842D355A860C7AC".lower(),
                        hash.hexdigest())
コード例 #2
0
ファイル: block_hasher.py プロジェクト: Wenzel/aff4
    def validateContainer(self, filename):
        lex = Container.identify(filename)
        resolver = data_store.MemoryDataStore(lex)

        with zip.ZipFile.NewZipFile(resolver, filename) as zip_file:
            if lex == lexicon.standard:
                self.delegate = InterimStdValidator(resolver, lex,
                                                    self.listener)
            elif lex == lexicon.legacy:
                self.delegate = PreStdValidator(resolver, lex, self.listener)
            else:
                raise ValueError

            self.delegate.doValidateContainer()
コード例 #3
0
ファイル: linear_hasher.py プロジェクト: Wenzel/aff4
    def hashMulti(self, filenamea, filenameb, mapURI, hashDataType):
        lex = Container.identify(filenamea)
        resolver = data_store.MemoryDataStore(lex)

        with zip.ZipFile.NewZipFile(resolver, filenamea) as zip_filea:
            with zip.ZipFile.NewZipFile(resolver, filenameb) as zip_fileb:
                if lex == lexicon.standard:
                    self.delegate = InterimStdLinearHasher(
                        resolver, lex, self.listener)
                elif lex == lexicon.legacy:
                    self.delegate = PreStdLinearHasher(resolver, lex,
                                                       self.listener)
                else:
                    raise ValueError

                return self.delegate.doHash(mapURI, hashDataType)
コード例 #4
0
ファイル: block_hasher.py プロジェクト: Wenzel/aff4
    def validateContainerMultiPart(self, filenamea, filenameb):
        # in this simple example, we assume that both files passed are members of the Container
        lex = Container.identify(filenamea)
        resolver = data_store.MemoryDataStore(lex)

        with zip.ZipFile.NewZipFile(resolver, filenamea) as zip_filea:
            with zip.ZipFile.NewZipFile(resolver, filenameb) as zip_fileb:
                if lex == lexicon.standard:
                    self.delegate = InterimStdValidator(
                        resolver, lex, self.listener)
                elif lex == lexicon.legacy:
                    self.delegate = PreStdValidator(resolver, lex,
                                                    self.listener)
                else:
                    raise ValueError

                self.delegate.doValidateContainer()
コード例 #5
0
ファイル: aff4.py プロジェクト: qqvirus/volatility
    def __init__(self, base, config, **kwargs):
        standard.FileAddressSpace.__init__(self, base, config, layered=True)

        # Must be stacked on a Raw file based image
        self.as_assert(base, "No base address space provided")

        # Must start with the a Zip File Header
        self.as_assert((base.read(0, 4) == zipFileHeaderMAGIC),
                       "Header signature invalid")

        # Cant stack an AFF4 image on another AFF4 images
        self.as_assert(
            type(base) != AFF4AddressSpace,
            "Cant stack AFF4 addressspace on same")
        self.fhandle = Container.open(self.name)
        self.fsize = self.fhandle.Size()
        self.fhandle.seek(0)
        dtb = self.fhandle.parent.getDTB()
        if dtb != 0:
            self.dtb = dtb