def GetFormatSpecification(cls): """Retrieves the format specification. Returns: FormatSpecification: format specification. """ format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature(b'BAAD', offset=0) format_specification.AddNewSignature(b'FILE', offset=0) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification. Returns: FormatSpecification: format specification. """ format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature(b'SCCA', offset=4) format_specification.AddNewSignature(b'MAM\x04', offset=0) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification. Returns: FormatSpecification: format specification. """ format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature(cls._DLS_V1_SIGNATURE, offset=0) format_specification.AddNewSignature(cls._DLS_V2_SIGNATURE, offset=0) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification. Returns: FormatSpecification: format specification. """ format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature( b'Client\x20UrlCache\x20MMF\x20Ver\x20', offset=0) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification. Returns: FormatSpecification: format specification. """ format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature( b'\x02\xE9\xC7\x43\xEF\xCD\xAB\x89', offset=0) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification. Returns: FormatSpecification: format specification. """ format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature( b'\x01\x14\x02\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46', offset=4) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification.""" format_specification = specification.FormatSpecification(cls.NAME) # OLECF format_specification.AddNewSignature( b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1', offset=0) # OLECF beta format_specification.AddNewSignature( b'\x0e\x11\xfc\x0d\xd0\xcf\x11\x0e', offset=0) return format_specification
def _ReadSpecificationFile(self, path): """Reads the format specification file. Args: path (str): path of the format specification file. Returns: FormatSpecificationStore: format specification store. """ specification_store = specification.FormatSpecificationStore() with io.open( path, 'rt', encoding=self._SPECIFICATION_FILE_ENCODING) as file_object: for line in file_object.readlines(): line = line.strip() if not line or line.startswith('#'): continue try: identifier, offset, pattern = line.split() except ValueError: logger.error('[skipping] invalid line: {0:s}'.format(line)) continue try: offset = int(offset, 10) except ValueError: logger.error( '[skipping] invalid offset in line: {0:s}'.format( line)) continue try: # TODO: find another way to do this that doesn't use an undocumented # API. pattern = codecs.escape_decode(pattern)[0] # ValueError is raised when the patterns contains invalid escaped # characters, such as "\xg1". except ValueError: logger.error( '[skipping] invalid pattern in line: {0:s}'.format( line)) continue format_specification = specification.FormatSpecification( identifier) format_specification.AddNewSignature(pattern, offset=offset) specification_store.AddSpecification(format_specification) return specification_store
def ReadSpecificationFile(self, path): """Reads the format specification file. Args: path: the path of the format specification file. Returns: The format specification store (instance of FormatSpecificationStore). """ specification_store = specification.FormatSpecificationStore() with open(path, 'rb') as file_object: for line in file_object.readlines(): line = line.strip() if not line or line.startswith(b'#'): continue try: identifier, offset, pattern = line.split() except ValueError: logging.error(u'[skipping] invalid line: {0:s}'.format( line.decode(u'utf-8'))) continue try: offset = int(offset, 10) except ValueError: logging.error( u'[skipping] invalid offset in line: {0:s}'.format( line.decode(u'utf-8'))) continue try: pattern = pattern.decode(u'string_escape') # ValueError is raised e.g. when the patterns contains "\xg1". except ValueError: logging.error( u'[skipping] invalid pattern in line: {0:s}'.format( line.decode(u'utf-8'))) continue format_specification = specification.FormatSpecification( identifier) format_specification.AddNewSignature(pattern, offset=offset) specification_store.AddSpecification(format_specification) return specification_store
def GetFormatSpecification(cls): """Retrieves the format specification.""" format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature(b'SQLite format 3', offset=0) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification.""" format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature(b'\xef\xcd\xab\x89', offset=4) return format_specification
def GetFormatSpecification(cls): """Retrieves the format specification.""" format_specification = specification.FormatSpecification(cls.NAME) format_specification.AddNewSignature(cls._FILE_SIGNATURE, offset=4) return format_specification