def preprocess(self, **k):
self.entropy = self.APPLE_ENTROPY
with open(k["aoskit"], "rb") as f:
plist = CFPropertyList.CFPropertyList(f)
plist.load()
plist_values = CFPropertyList.native_types(plist.value)
self.account = plist_values.keys()[0]
plist_data_dict = plist_values[self.account]
self.dpapiblob = blob.DPAPIBlob(plist_data_dict['data'])
def main(self, history):
placeValues = {}
formValues = {}
places = cfp.CFPropertyList(history)
places.load()
places = cfp.native_types(places.value)
i = 0
for place in places.get('WebHistoryDates', []):
i += 1
placeValues['place%d' % i] = {
'url': place[''],
'title': place['title'],
'count': place['visitCount'],
'date': place['lastVisitedDate'],
'domain': format(place[''])
}
return {
self.__class__.__name__: {
'places': placeValues,
'forms': formValues
}
}
def parsed_binary(filename):
plist = CFPropertyList.CFPropertyList('reference/%s.plist' % filename)
plist.load()
return CFPropertyList.native_types(plist.value)
def preprocess(self, **k):
plist = CFPropertyList.CFPropertyList(k['keychain'])
plist.load()
self.entries = CFPropertyList.native_types(plist.value).get('version1')
