예제 #1
0
파일: ntfs.py 프로젝트: bossadvisors/rekall
    def _read_chunk(self, addr, length):
        addr = int(addr)
        try:
            virt_addr, file_address, file_length, comp = self.runs.find_le(
                addr)
            if comp:
                block_data = lznt1.decompress_data(
                    self.base.read(file_address, file_length) + "\x00" * 10)

                available_length = (self.compression_unit_size -
                                    (addr - virt_addr))

                physical_offset = addr - virt_addr

                return block_data[physical_offset:physical_offset +
                                  min(length, available_length)]

            available_length = file_length - (addr - virt_addr)
            physical_offset = addr - virt_addr + file_address

            if available_length > 0:
                return self.base.read(physical_offset,
                                      min(length, available_length))

        except ValueError:
            pass

        try:
            # Addr is outside any run, (i.e. run is sparse). We need to find the
            # next available run and return the number of bytes we need to skip
            # until then.
            virt_addr, _, _ = self.runs.find_ge(addr)
            return "\x00" * (virt_addr - addr)
        except ValueError:
            return "\x00" * length
예제 #2
0
파일: ntfs.py 프로젝트: Ankit89234/rekall
    def _read_chunk(self, addr, length):
        addr = int(addr)
        try:
            virt_addr, file_address, file_length, comp = self.runs.find_le(addr)
            if comp:
                block_data = lznt1.decompress_data(self.base.read(
                    file_address, file_length) + "\x00" * 10)

                available_length = (self.compression_unit_size - (
                    addr - virt_addr))

                physical_offset = addr - virt_addr

                return block_data[
                    physical_offset:
                    physical_offset + min(length, available_length)]

            available_length = file_length - (addr - virt_addr)
            physical_offset = addr - virt_addr + file_address

            if available_length > 0:
                return self.base.read(
                    physical_offset, min(length, available_length))

        except ValueError:
            pass

        try:
            # Addr is outside any run, (i.e. run is sparse). We need to find the
            # next available run and return the number of bytes we need to skip
            # until then.
            virt_addr, _, _ = self.runs.find_ge(addr)
            return "\x00" * (virt_addr - addr)
        except ValueError:
            return "\x00" * length
예제 #3
0
파일: ntfs.py 프로젝트: james-baud/rekall
    def _read_chunk(self, addr, length):
        addr = int(addr)
        try:
            virt_addr, file_address, file_length, comp = self.runs.find_le(addr)
            if comp:
                block_data = lznt1.decompress_data(
                    self.base.read(file_address, file_length) + "\x00" * 10,
                    logger=self.session.logging.getChild("ntfs"))

                available_length = (self.compression_unit_size - (
                    addr - virt_addr))

                physical_offset = addr - virt_addr

                result = block_data[
                    physical_offset:
                    physical_offset + min(length, available_length)]

                # Decompression went wrong - just zero pad.
                if len(result) < length:
                    result += "\x00" * (length - len(result))

                return result


            available_length = file_length - (addr - virt_addr)
            physical_offset = addr - virt_addr + file_address

            if available_length > 0:
                return self.base.read(
                    physical_offset, min(length, available_length))

        except ValueError:
            pass

        try:
            # Addr is outside any run, (i.e. run is sparse). We need to find the
            # next available run and return the number of bytes we need to skip
            # until then.
            virt_addr, _, _ = self.runs.find_ge(addr)
            return "\x00" * (virt_addr - addr)
        except ValueError:
            return "\x00" * length
예제 #4
0
파일: ntfs.py 프로젝트: scudette/rekall
    def _read_chunk(self, addr, length):
        addr = int(addr)
        start, end, run = self.runs.get_containing_range(addr)

        # addr is not in any range, pad to the next range.
        if start is None:
            end = self.runs.get_next_range_start(addr)
            if end is None:
                end = addr + length

            return "\x00" * min(end - addr, length)

        if run.data.get("compression"):
            block_data = lznt1.decompress_data(
                self.base.read(run.file_offset, run.length) + "\x00" * 10,
                logger=self.session.logging.getChild("ntfs"))

            available_length = (self.compression_unit_size - (addr - run.start))

            block_offset = addr - run.start

            result = block_data[
                block_offset:
                block_offset + min(length, available_length)]

            # Decompression went wrong - just zero pad.
            if len(result) < length:
                result += "\x00" * (length - len(result))

            return result

        available_length = run.length - (addr - run.start)
        block_offset = addr - run.start + run.file_offset

        if available_length > 0:
            return self.base.read(
                block_offset, min(length, available_length))
예제 #5
0
    def _read_chunk(self, addr, length):
        addr = int(addr)
        start, end, run = self.runs.get_containing_range(addr)

        # addr is not in any range, pad to the next range.
        if start is None:
            end = self.runs.get_next_range_start(addr)
            if end is None:
                end = addr + length

            return "\x00" * min(end - addr, length)

        if run.data.get("compression"):
            block_data = lznt1.decompress_data(
                self.base.read(run.file_offset, run.length) + "\x00" * 10,
                logger=self.session.logging.getChild("ntfs"))

            available_length = (self.compression_unit_size - (addr - run.start))

            block_offset = addr - run.start

            result = block_data[
                block_offset:
                block_offset + min(length, available_length)]

            # Decompression went wrong - just zero pad.
            if len(result) < length:
                result += "\x00" * (length - len(result))

            return result

        available_length = run.length - (addr - run.start)
        block_offset = addr - run.start + run.file_offset

        if available_length > 0:
            return self.base.read(
                block_offset, min(length, available_length))