def ParseFolder(self, uuidtext_folder_path):
'''Parse the uuidtext folder specified and parse all uuidtext/dsc files, adding them to the cache'''
try:
# dsc
dsc_path = self.vfs.path_join(uuidtext_folder_path, 'dsc')
entries = self.vfs.listdir(dsc_path)
for dsc_name in entries:
if len(dsc_name) == 32:
dsc_path_obj = self.vfs.get_virtual_file(
self.vfs.path_join(dsc_path, dsc_name), 'Dsc')
dsc = dsc_file.Dsc(dsc_path_obj)
dsc.Parse()
self.cached_dsc[dsc_name] = dsc
# uuidtext - can't have this or python will complain of too many open files!
# entries = self.vfs.listdir(uuidtext_folder_path)
# index = 0
# for index in range(0x100):
# folder_name = '{:02X}'.format(index)
# #if vfs.path_exists(folder_path):
# if folder_name in entries:
# folder_path = self.vfs.path_join(uuidtext_folder_path, folder_name)
# uuid_names = self.vfs.listdir(folder_path)
# for uuid_name in uuid_names:
# if len(uuid_name) == 30: # filtering out possibly other files there!
# uuidtext_path = self.vfs.path_join(folder_path, uuid_name)
# file_object = self.vfs.get_virtual_file(uuidtext_path, 'Uuidtext')
# ut = uuidtext_file.Uuidtext(file_object, UUID(folder_name + uuid_name))
# ut.Parse()
# self.cached_uuidtext[folder_name + uuid_name] = ut
# else:
# logger.debug(folder_name + ' does not exist')
except Exception:
logger.exception('')
def ReadTimesyncFile(buffer, ts_list):
try:
pos = 0
size = len(buffer)
while pos < size:
sig, header_size, unk1 = struct.unpack("<HHI", buffer[pos:pos + 8])
if sig != 0xBBB0:
logger.error(
"not the right signature for Timesync header, got 0x{:04X} instead of 0x{:04X}, pos was 0x{:08X}"
.format(sig, 0x0030BBB0, pos))
break
uuid = UUID(bytes=buffer[pos + 8:pos + 24])
ts_numer, ts_denom, t_stamp, tz, is_dst = struct.unpack(
"<IIqiI", buffer[pos + 24:pos + 48])
ts_header = resources.TimesyncHeader(sig, unk1, uuid, ts_numer,
ts_denom, t_stamp, tz, is_dst)
pos += header_size # 0x30 (48) by default
if header_size != 0x30:
logger.info(
"Timesync header was 0x{:X} bytes instead of 0x30(48) bytes!"
.format(size))
logger.debug("TIMEHEAD {} 0x{:016X} {} {}".format(
uuid, t_stamp, ReadAPFSTime(t_stamp), 'boot'))
#TODO - TEST search ts_list for existing, not seen so far
existing_ts = None
for ts in ts_list:
if ts.header.boot_uuid == uuid:
existing_ts = ts
break
if existing_ts:
ts_obj = existing_ts
else:
ts_obj = resources.Timesync(ts_header)
ts_list.append(ts_obj)
# Adding header timestamp as Ts type too with cont_time = 0
timesync_item = resources.TimesyncItem(0, 0, t_stamp, tz,
is_dst)
ts_obj.items.append(timesync_item)
while pos < size:
if buffer[pos:pos + 4] == b'Ts \x00':
ts_unknown, cont_time, t_stamp, bias, is_dst = struct.unpack(
"<IqqiI", buffer[pos + 4:pos + 32])
timesync_item = resources.TimesyncItem(
ts_unknown, cont_time, t_stamp, bias, is_dst)
ts_obj.items.append(timesync_item)
logger.debug("TIMESYNC {} 0x{:016X} {} {}".format(
uuid, t_stamp, ReadAPFSTime(t_stamp), ts_unknown))
else:
break # break this loop, parse as header
pos += 32
except Exception as ex:
logger.exception("Exception reading TimesyncFile")
def DecompressTraceV3(trace_file, out_file):
''' Creates an uncompressed version of the .traceV3 file.
Input parameters:
trace_file = file pointer to .traceV3 file (opened as 'rb')
out_file = file pointer to blank file (opened as 'wb')
Returns True/False
'''
try:
index = 0
tag = trace_file.read(4)
while tag:
begin_pos = trace_file.tell() - 4
trace_file.seek(begin_pos + 8)
struct_len = struct.unpack('<Q', trace_file.read(8))[0]
logger.debug("index={} pos=0x{:X} tag=0x{}".format(
index, begin_pos,
binascii.hexlify(tag)[::-1]))
trace_file.seek(begin_pos)
chunk_data_incl_header = trace_file.read(16 + struct_len)
if tag == b'\x00\x10\x00\x00': # header
out_file.write(chunk_data_incl_header
) # boot_uuid header, write to output directly
elif tag[0] == b'\x0B':
out_file.write(chunk_data_incl_header
) # uncompressed, write to output directly
elif tag[0] == b'\x0D':
uncompressed = DecompressChunkData(chunk_data_incl_header[16:],
struct_len)
out_file.write(chunk_data_incl_header[0:8]) # Same Header !
out_file.write(struct.pack('<Q',
len(uncompressed))) # New size
out_file.write(uncompressed)
else:
logger.error('Unknown chunk tag value encountered : {}'.format(
binascii.hexlify(tag)))
out_file.write(chunk_data_incl_header)
if struct_len % 8: # Go to QWORD boundary
struct_len += 8 - (struct_len % 8)
if out_file.tell() % 8: # Go to QWORD boundary on output
out_file.write(
b'\x00\x00\x00\x00\x00\x00\x00'[0:(8 -
out_file.tell() % 8)])
trace_file.seek(begin_pos + 16 + struct_len)
tag = trace_file.read(4)
index += 1
except Exception as ex:
logger.exception('')
return False
return True
def _ReadCString(self, data, max_len=1024):
'''Returns a C utf8 string (excluding terminating null)'''
pos = 0
max_len = min(len(data), max_len)
string = ''
try:
null_pos = data.find(b'\x00', 0, max_len)
if null_pos == -1:
logger.warning("Possible corrupted string encountered")
string = data.decode('utf8')
else:
string = data[0:null_pos].decode('utf8')
except:
logger.exception('Error reading C-String')
return string
def _ReadCStringAndEndPos(self, data, max_len=1024):
'''Returns a tuple containing a C utf8 string (excluding terminating null)
and the end position in the data
("utf8-string", pos)
'''
pos = 0
max_len = min(len(data), max_len)
string = ''
null_pos = -1
try:
null_pos = data.find(b'\x00', 0, max_len)
if null_pos == -1:
logger.warning("Possible corrupted string encountered")
string = data.decode('utf8')
else:
string = data[0:null_pos].decode('utf8')
except:
logger.exception('Error reading C-String')
return string, null_pos
def Parse(self):
'''Parses a uuidtext file.
self._file.is_valid is set to False if this method encounters issues
parsing the file.
Returns:
bool: True if the dsc file-like object was successfully parsed,
False otherwise.
'''
file_object = self._file.open()
if not file_object:
return False
try:
result = self._ParseFileObject(file_object)
except (OSError, struct.error):
logger.exception('Uuidtext Parser error')
result = False
if not result:
self._file.is_valid = False
return result
def ReadTimesyncFolder(path, ts_list, vfs):
'''Reads files in the timesync folder specified by 'path' and populates ts_list
with timesync entries.
vfs = VirtualFileSystem object
'''
try:
entries = vfs.listdir(path)
for entry in sorted(
entries
): # sort the files by name, so continuous time will be sequential automatically
if entry.endswith(".timesync"):
file_path = vfs.path_join(path, entry)
logger.debug(
'Trying to read timesync file {}'.format(file_path))
f = vfs.get_virtual_file(file_path, 'TimeSync').open()
if f:
buffer = f.read() # should be a fairly small file!
ReadTimesyncFile(buffer, ts_list)
f.close()
else:
logger.error(
"In Timesync folder, found non-ts file {}".format(entry))
except Exception:
logger.exception('')
