| find . -printf "0|%p|%i|%m|%U|%G|%s|%A@|%T@|%C@|0\n" |
| #!/usr/bin/python | |
| # TODOs | |
| # Add support for: | |
| # - WHOIS/WHO/WHOWAS | |
| # - AWAY | |
| # - creating chats | |
| # - TOPIC (setting) | |
| import logging |
| import sys | |
| from datetime import datetime | |
| import struct | |
| buf = sys.stdin.read().rstrip("\r\n") | |
| y, mo, w, d, h, mi, s, _ = struct.unpack("<HHHHHHHH", buf) | |
| print datetime(y, mo, d, h, mi, s).isoformat("T") + "Z" |
| Git/INDXParse - [master●] » python list_mft.py /evidence/case001/CMFT --prefix "C:" --format "{{ record.inode }}, {{ prefix }}{{ record.path }}, {{ record.is_active }}, {{ record.standard_information.accessed }}, {{ record.filename_information.created }}, {{ record.size }}" | head | |
| 0, C:\$MFT, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 181895168 | |
| 1, C:\$MFTMirr, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 4096 | |
| 2, C:\$LogFile, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 67108864 | |
| 3, C:\$Volume, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 0 | |
| 4, C:\$AttrDef, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 2560 | |
| 5, C:, 1, 2012-03-19 13:18:46.741314, 2005-04-30 21:04:47.484373, 0 | |
| 6, C:\$Bitmap, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 2442136 | |
| 7, C:\$Boot, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 8192 | |
| 8, C:\$BadClus, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373 |
By default, rip.pl continues to use a default tempate
In subsequent examples, the template name is "legacy".
» perl rip.pl -r samples/XP/system -p appcompatcache
Launching appcompatcache v.20130425
appcompatcache v.20130425
(System) Parse files from System hive Shim Cache
| from idaapi import * | |
| GEN_REG = 0x1 | |
| MEM_REF = 0x2 | |
| BASE_INDEX = 0x3 | |
| BASE_INDEX_DISP = 0x4 | |
| IMMED = 0x5 | |
| def doone(ea): | |
| xrefs = [] |
| """ | |
| The shellcode in Challege 6 compares the string in RDI | |
| against a bunch of conditions. This script extracts the | |
| conditions and solves the constraints, yielding the | |
| expected string. | |
| """ | |
| from idaapi import * | |
| from williutils import * | |
| #!/usr/bin/env python | |
| from __future__ import with_statement | |
| import datetime | |
| from errno import EACCES | |
| from os.path import realpath | |
| from sys import argv, exit | |
| from threading import Lock |
| """ | |
| mutablenamedtuple is like collections.namedtuple, but the fields | |
| may be modified. This makes it basically a record type. | |
| Desired usage: | |
| F = mutablenamedtuple("F", ["foo", "bar", "baz"]) | |
| f = F(1, bar=2, baz=3) | |
| f.baz = 9 | |
| print(f) | |
| --> "F(foo=1, bar=2, baz=9)" |