Python biplist.readPlistFromString方法代码示例

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def decrypt_secret_data(self, class_key):
        key = AESUnwrap(class_key, self.encrypted_secret_data_wrapped_key)
        if not key:
            raise ValueError("Failed to unwrap key. Bad class key?")

        plist = readPlistFromString(self.protobuf_item.encryptedSecretData.ciphertext)
        authenticated = ns_keyed_unarchiver(plist)
        #decrypted = gcm_decrypt(key,
        #                        authenticated['SFInitializationVector'],
        #                        authenticated['SFCiphertext'], '',
        #                        authenticated['SFAuthenticationCode'])
        
        gcm = AES.new(key, AES.MODE_GCM, authenticated['SFInitializationVector'])
        decrypted = gcm.decrypt_and_verify(authenticated['SFCiphertext'], authenticated['SFAuthenticationCode'])

        if not decrypted:
            raise ValueError("Failed to decrypt")

        return decrypted 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def view(self):
        current_app.logger.debug(request.data)

        try:
            plist_data = biplist.readPlistFromString(request.data)
        except biplist.NotBinaryPlistException:
            abort(400, 'The request body does not contain a plist as expected')
        except biplist.InvalidPlistException:
            abort(400, 'The request body does not contain a valid plist')

        for kvr in self.kv_routes:
            if kvr['key'] not in plist_data:
                continue

            if plist_data[kvr['key']] == kvr['value']:
                return kvr['handler'](plist_data)

        abort(404, 'No matching plist route') 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def hdiutil(cmd, *args, **kwargs):
    plist = kwargs.get('plist', True)
    all_args = ['/usr/bin/hdiutil', cmd]
    all_args.extend(args)
    if plist:
        all_args.append('-plist')
    p = subprocess.Popen(all_args, stdout=subprocess.PIPE, close_fds=True)
    output, errors = p.communicate()
    if plist:
        results = biplist.readPlistFromString(output)
    else:
        results = output
    retcode = p.wait()
    return retcode, results

# On Python 2 we can just execfile() it, but Python 3 deprecated that 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def decode(bytes):
        return biplist.readPlistFromString(bytes) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def ParseNotificationcenterRow(
      self, parser_mediator, query, row, **unused_kwargs):
    """Parses a message row.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      query (str): query that created the row.
      row (sqlite3.Row): row.
    """
    query_hash = hash(query)

    event_data = MacNotificationCenterEventData()
    event_data.bundle_name = self._GetRowValue(query_hash, row, 'bundle_name')
    event_data.presented = self._GetRowValue(query_hash, row, 'presented')

    blob = self._GetRowValue(query_hash, row, 'dataBlob')

    try:
      full_biplist = biplist.readPlistFromString(blob)
      # req is the 'req' dictionary from the plist containing extra information
      # about the notification entry.
      req = full_biplist['req']

    except (biplist.InvalidPlistException, KeyError) as exception:
      parser_mediator.ProduceExtractionWarning(
          'unable to read plist from database with error: {0!s}'.format(
              exception))
      return

    event_data.title = req.get('titl', None)
    event_data.subtitle = req.get('subt', None)
    event_data.body = req.get('body', None)

    timestamp = self._GetRowValue(query_hash, row, 'timestamp')
    date_time = dfdatetime_cocoa_time.CocoaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_CREATION)
    parser_mediator.ProduceEventWithEventData(event, event_data) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def decrypt_metadata(self, metadata_class_key):
        wrapped_plist = readPlistFromString(self.protobuf_item.encryptedMetadata.wrappedKey)
        wrapped_sf_params = ns_keyed_unarchiver(wrapped_plist)

        #metadata_key = gcm_decrypt(metadata_class_key,
        #                        wrapped_sf_params['SFInitializationVector'],
        #                        wrapped_sf_params['SFCiphertext'], '',
        #                        wrapped_sf_params['SFAuthenticationCode'])

        gcm = AES.new(metadata_class_key, AES.MODE_GCM, wrapped_sf_params['SFInitializationVector'])
        metadata_key = gcm.decrypt_and_verify(wrapped_sf_params['SFCiphertext'], wrapped_sf_params['SFAuthenticationCode'])

        if not metadata_key:
            raise ValueError("Failed to decrypt metadata key")

        ciphertext = ns_keyed_unarchiver(readPlistFromString(
            self.protobuf_item.encryptedMetadata.ciphertext))

        #metadata =  gcm_decrypt(metadata_key,
        #                        ciphertext['SFInitializationVector'],
        #                        ciphertext['SFCiphertext'], '',
        #                        ciphertext['SFAuthenticationCode'])

        gcm = AES.new(metadata_key, AES.MODE_GCM, ciphertext['SFInitializationVector'])
        metadata = gcm.decrypt_and_verify(ciphertext['SFCiphertext'], ciphertext['SFAuthenticationCode'])

        if not metadata:
            raise ValueError("Failed to decrypt metadata")

        return metadata 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def _get_bplisthtml(self, buf):
        parsed = biplist.readPlistFromString(buf)
        html = """<button class="btn btn-primary btn-sm" onclick="hideshow(this);">
                Show XML <span class="glyphicon glyphicon-chevron-down"></span>
                </button>"""
        content = biplist.writePlistToString(parsed,False)
        html += self._get_xmlhtml(content, hidden=True) 
        return html 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def plist_to_dict(plist):
    """
    Converts a plist file output to a python dictionary

    :param str plist: the output of a plist file
    :return: a dict with the plist contents
    """
    import biplist
    return biplist.readPlistFromString(plist) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def _DictFromSubprocess(command):
  """Returns a dict based upon a subprocess call with a -plist argument.

  Args:
    command(list(str)): the command to be executed as a list.
  Returns:
    dict: dictionary from command output.
  Raises:
    MacDiskError: if the command failed to run.
  """

  try:
    task = subprocess.Popen(
        command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
  except OSError as e:
    raise MacDiskError('Could not execute: {0:s}'.format(e.strerror))
  (stdout, stderr) = task.communicate()

  if task.returncode != 0:
    raise MacDiskError(
        'Error running command: {0:s}, stderr: {1:s}' .format(
            ' '.join(command), stderr))

  try:
    return biplist.readPlistFromString(stdout)
  except (biplist.InvalidPlistException, biplist.NotBinaryPlistException):
    raise MacDiskError(
        'Error creating plist from output: {0:s}'.format(stdout)) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def ReadPlist(path):
        '''
            Safely open and read a plist.
            Returns a tuple (True/False, plist/None, "error_message")
        '''
        #log.debug("Trying to open plist file : " + path)
        error = ''
        try:
            with open(path, 'rb') as f:
                if f != None:
                    try:
                        #log.debug("Trying to read plist file : " + path)
                        plist = biplist.readPlist(f)
                        return (True, plist, '')
                    except biplist.InvalidPlistException as ex:
                        try:
                            # Perhaps this is manually edited or incorrectly formatted by a non-Apple utility  
                            # that has left whitespaces at the start of file before <?xml tag
                            f.seek(0)
                            data = f.read()
                            data = data.lstrip(" \r\n\t")
                            plist = biplist.readPlistFromString(data)
                            return (True, plist, '')
                        except biplist.InvalidPlistException as ex:
                            error = 'Could not read plist: ' + path + " Error was : " + str(ex)
                    except OSError as ex:
                        error = 'OSError while reading plist: ' + path + " Error was : " + str(ex)
                else:
                    error = 'Failed to open file'
        except OSError as ex:
            error = 'Exception from ReadPlist while trying to open file. Exception=' + str(ex)
        return (False, None, error) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def _ReadPasswordPolicyData(self, password_policy_data, target_user):
        try:
            plist2 = biplist.readPlistFromString(password_policy_data[0])
            target_user.failed_login_count = plist2.get('failedLoginCount', 0)
            target_user.failed_login_timestamp = plist2.get('failedLoginTimestamp', None)
            target_user.last_login_timestamp = plist2.get('lastLoginTimestamp', None)
            target_user.password_last_set_time = plist2.get('passwordLastSetTime', None)
        except (biplist.InvalidPlistException, biplist.NotBinaryPlistException):
            log.exception('Error reading password_policy_data embedded plist') 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def _ReadAccountPolicyData(self, account_policy_data, target_user):
        try:
            plist2 = biplist.readPlistFromString(account_policy_data[0])
            target_user.creation_time = CommonFunctions.ReadUnixTime(plist2.get('creationTime', None))
            target_user.failed_login_count = plist2.get('failedLoginCount', 0)
            target_user.failed_login_timestamp = CommonFunctions.ReadUnixTime(plist2.get('failedLoginTimestamp', None))
            target_user.password_last_set_time = CommonFunctions.ReadUnixTime(plist2.get('passwordLastSetTime', None))
        except (biplist.InvalidPlistException, biplist.NotBinaryPlistException):
            log.exception('Error reading password_policy_data embedded plist') 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def extplist(plistfile):
    #print "Processing " + plistfile
    try:
        plistelements=biplist.readPlist(plistfile)
    except biplist.InvalidPlistException:
        print "Invalid plist file: " + plistfile
        return
    except OverflowError:
        print "Invalid plist data: " + plistfile
        return
    except IOError:
        print "Bad file name: " + plistfile
        return

    # Sometimes we get a list or string, not a dictionary
    if not isinstance(plistelements, dict):
        return

    for key in plistelements:
        if isinstance(plistelements[key], biplist.Data):
            # Try to extract plist
            try:
                newp=biplist.readPlistFromString(plistelements[key])
            except biplist.InvalidPlistException:
                # Not valid plist data
                continue

            newfilename=os.path.basename(plistfile[:-6]) + "-" + key + ".plist"
            i=1
            while True:
                if not os.path.exists(newfilename):
                    break
                else:
                    newfilename=os.path.basename(plistfile[:-6]) + "-" + key + "-" + str(i) + ".plist"
                    i+=1
            print "Writing " + newfilename
            try:
                biplist.writePlist(newp,newfilename)
            except:
                print "Could not write plist file " + newfilename
                print sys.exc_info()[0]
            extplist(newfilename) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def ReadPlist(self, path, deserialize=False):
        '''Safely open and read a plist; returns tuple (True/False, plist/None, "error_message")'''
        log.debug("Trying to open plist file : " + path)
        error = ''
        try:
            f = self.Open(path)
            if f != None:
                try:
                    log.debug("Trying to read plist file : " + path)
                    plist = biplist.readPlist(f)
                    if deserialize:
                        try:
                            f.seek(0)
                            plist = self.DeserializeNsKeyedPlist(f)
                            f.close()
                            return (True, plist, '')
                        except:
                            f.close()
                            error = 'Could not read deserialized plist: ' + path + " Error was : " + str(ex)  
                    else:
                        f.close()
                        return (True, plist, '')
                except biplist.InvalidPlistException as ex:
                    try:
                        # Perhaps this is manually edited or incorrectly formatted by a non-Apple utility  
                        # that has left whitespaces at the start of file before <?xml tag
                        # This is assuming XML format!
                        f.seek(0)
                        data = f.read().decode('utf8', 'ignore')
                        f.close()
                        data = data.lstrip(" \r\n\t").encode('utf8', 'backslashreplace')
                        if deserialize:
                            try:
                                temp_file = BytesIO(data)
                                plist = self.DeserializeNsKeyedPlist(temp_file)
                                temp_file.close()
                                return (True, plist, '')
                            except:
                                error = 'Could not read deserialized plist: ' + path + " Error was : " + str(ex)
                        else:
                            plist = biplist.readPlistFromString(data)                        
                            return (True, plist, '')
                    except (biplist.InvalidPlistException, biplist.NotBinaryPlistException) as ex:
                        error = 'Could not read plist: ' + path + " Error was : " + str(ex)
                except OSError as ex:
                    error = 'OSError while reading plist: ' + path + " Error was : " + str(ex)
            else:
                error = 'Failed to open file'
        except Exception as ex:
            error = 'Exception from ReadPlist, trying to open file. Exception=' + str(ex)
        return (False, None, error) 

# 需要导入模块: import biplist [as 别名]
# 或者: from biplist import readPlistFromString [as 别名]
def ReadApfsVolumes(self):
        '''Read volume information into an sqlite db'''
        decryption_key = None
        # Process Preboot volume first
        preboot_vol = self.apfs_container.preboot_volume
        if preboot_vol:
            apfs_parser = ApfsFileSystemParser(preboot_vol, self.apfs_db)
            apfs_parser.read_volume_records()
            preboot_vol.dbo = self.apfs_db
        # Process other volumes now
        for vol in self.apfs_container.volumes:
            vol.dbo = self.apfs_db
            if vol == preboot_vol:
                continue
            elif vol.is_encrypted and self.apfs_container.is_sw_encrypted: # For hardware encryption(T2), do nothing, it should have been acquired as decrypted..
                if self.password == '':
                    log.error(f'Skipping vol {vol.volume_name}. The vol is ENCRYPTED and user did not specify a password to decrypt it!' +
                                f' If you know the password, run mac_apt again with the -p option to decrypt this volume.')
                    continue

                uuid_folders = []
                preboot_dir = preboot_vol.ListItemsInFolder('/')
                for items in preboot_dir:
                    if len(items['name']) == 36: # UUID Named folder
                        uuid_folders.append(items['name'])
                if len(uuid_folders) > 1:
                    log.warning("There are more than 1 UUID like folders:\n" + str(uuid_folders) + "\nThe volume cannot be unencrypted by this script. Please contact the developers")
                elif len(uuid_folders) == 0:
                    log.error("There are no UUID like folders in the Preboot volume! Decryption cannot continue")
                else:
                    plist_path = uuid_folders[0] +  "/var/db/CryptoUserInfo.plist"
                    if preboot_vol.DoesFileExist(plist_path):
                        plist_raw_data = preboot_vol.open(plist_path).readAll()
                        plist_data = biplist.readPlistFromString(plist_raw_data)
                        decryption_key = decryptor.EncryptedVol(vol, plist_data, self.password).decryption_key
                        if decryption_key is None:
                            log.error(f"No decryption key found. Did you enter the right password? Volume '{vol.volume_name}' cannot be decrypted!")
                        else:
                            log.debug(f"Starting decryption of filesystem, VEK={decryption_key.hex().upper()}")
                            vol.encryption_key = decryption_key
                            apfs_parser = ApfsFileSystemParser(vol, self.apfs_db)
                            apfs_parser.read_volume_records()
            else:
                apfs_parser = ApfsFileSystemParser(vol, self.apfs_db)
                apfs_parser.read_volume_records()