Python FlagFramework.calculate_offset_suffix方法代码示例

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import calculate_offset_suffix [as 别名]
    def search_next_text_region(self, query, result):
        """ searches for the next text region and updates query['period_number'] """
        ## Open all the disks
        filenames = query.getarray('filename') 
        fds = [ IO.open_URL(f) for f in filenames ]
        if query.get('ismissing',False):
            fds.append(ParityFD(copy.deepcopy(filenames)))
        period_number = int(query.get('period_number',0)) + 1
        blocksize = FlagFramework.calculate_offset_suffix(query['blocksize'])
        period = FlagFramework.calculate_offset_suffix(query['period'])

        p=0
        while 1:
            offset = blocksize  * (p + period_number * period)
            for fd in fds:
                fd.seek(offset)
                ## We classify a text region as one with 20 chars at
                ## the start of the period
                data = fd.read(20)
                if not data:
                    result.heading("Error")
                    result.para("Unable to read data from %r" % fd)
                    return
                
                m = self.text_re.match(data)
                if m:
                    period_number = period_number + p / period
                    query.set('period_number',period_number)
                    result.refresh(0, query, 'parent')
                    return

                p += 1

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import calculate_offset_suffix [as 别名]
    def create(self, name,case, query):
        offset = FlagFramework.calculate_offset_suffix(query.get('offset','0'))
        filenames = self.glob_filenames(query.getarray('filename'))

        ## Open the io sources here
        fds = [ IO.open_URL(f) for f in filenames ]
        blocksize = FlagFramework.calculate_offset_suffix(query.get('blocksize','32k'))
        period = int(query.get('period',3))
        return RAIDFD(fds, blocksize, query['map'], offset, period)

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import calculate_offset_suffix [as 别名]
        def map_popup(query,result):
            result.decoration = 'naked'
            try:
                map = str(query['map']).split('.')
            except KeyError:
                map = []

            result.start_form(query)
            ## Open all the disks
            filenames = query.getarray('filename') 
            fds = [ IO.open_URL(f) for f in filenames ]

            if query.get('ismissing',False):
                fds += [ParityFD(copy.deepcopy(filenames))]
                filenames += ('Missing Disk',)


            uis = [ result.__class__(result) for f in filenames ]

            period_number = int(query.get('period_number',0))
            blocksize = FlagFramework.calculate_offset_suffix(query['blocksize'])
            period = FlagFramework.calculate_offset_suffix(query['period'])
            logical_period_size = period * (len(fds)-1)
            ## Let the user know our disk offset
            result.para("Disk Offset is %s (%s periods)" %  (blocksize  * (period_number * period), period_number))

            if query.has_key("__submit__"):
                ## Build the new map variable
                query.clear('map')
                map = []
                for x in range(period * len(fds)):
                    map.append(query['position_%s' % x])
                    query.clear('position_%s' % x)
                    
                query.set('map', '.'.join(map))
                ## Now check that this map is valid by instantiating a
                ## RAIDFD (we will raise if anything is wrong:
                try:
                    RAIDFD(fds, blocksize, query['map'], 0, period)
                    result.refresh(0,query,pane='parent')
                except Exception,e:
                    result.heading("Error with map")
                    result.para("%s" % e)

                return result

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import calculate_offset_suffix [as 别名]
    def handle_key(self, ui ,key):
        if self.state == None:
            self.state = 'prompt'
            ## Read the current bytes off the memory image
            offset = ui.mark
            ui.fd.seek(offset)
            data = ui.fd.read(4)
            location = "0x%08X" % (struct.unpack("<I",data)[0])
            
            ui.status_bar = Hexeditor.PowerEdit("Goto Virtual Address: ", location)
            ui.status_bar.focus = True
            
        elif self.state == 'prompt':
            if key=='esc':
                ui.mode = None
                self.state = None
                ui.status_bar = urwid.Text('')
            elif key=='enter':
                ui.mode = None
                self.state = None
                offset = ui.status_bar.get_edit_text()
                ui.status_bar = urwid.Text('')
                try:
                    offset = FlagFramework.calculate_offset_suffix(offset)
                except Exception,e:
                    ui.message = "Cant parse %s as offset" % offset
                    return True

                ## Now we need to work out what the VA offset is:
                import VolatilityLinux

                v = VolatilityLinux.get_vol_object(self.case, self.m)
                phy_offset = v.addr_space.vtop(offset)
                
                ui.set_mark(phy_offset)
            else:
            ## Pass key strokes to the text box:
                ui.status_bar.keypress( (ui.width, ), key)

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import calculate_offset_suffix [as 别名]
 def create(self, name, case, query):
     offset = FlagFramework.calculate_offset_suffix(query.get('offset','0'))
     filenames = self.glob_filenames(query.getarray('filename'))
     fd = pyaff.open(filenames[0])
     return OffsettedFDFile((fd,), offset)