<s> """<STR_LIT>""" <EOL> import os , sys <EOL> import logging <EOL> from rekall import session as rekall_session <EOL> from rekall . plugins . addrspaces import standard <EOL> from rekall . plugins . renderers . data_export import DataExportRenderer <EOL> from rekall . ui . json_renderer import JsonEncoder <EOL> import collections <EOL> import datetime <EOL> import pprint <EOL> import pytz <EOL> import gevent <EOL> try : <EOL> from cStringIO import StringIO <EOL> except ImportError : <EOL> from StringIO import StringIO <EOL> def gsleep ( ) : <EOL> '''<STR_LIT>''' <EOL> print '<STR_LIT>' <EOL> gevent . sleep ( <NUM_LIT:0> ) <EOL> class RekallAdapter ( object ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self ) : <EOL> """<STR_LIT>""" <EOL> logging . getLogger ( ) . setLevel ( logging . ERROR ) <EOL> self . plugin_name = '<STR_LIT>' <EOL> def set_plugin_name ( self , name ) : <EOL> '''<STR_LIT>''' <EOL> self . plugin_name = name <EOL> def execute ( self , input_data ) : <EOL> '''<STR_LIT>''' <EOL> raw_bytes = input_data [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> session = MemSession ( raw_bytes ) <EOL> renderer = WorkbenchRenderer ( session = session ) <EOL> session . RunPlugin ( self . plugin_name , renderer = renderer ) <EOL> return renderer . get_output ( ) <EOL> @ classmethod <EOL> def process_row ( cls , data , column_map ) : <EOL> """<STR_LIT>""" <EOL> row = { } <EOL> for key , value in data . iteritems ( ) : <EOL> if not value : <EOL> value = '<STR_LIT:->' <EOL> elif isinstance ( value , list ) : <EOL> value = value [ <NUM_LIT:1> ] <EOL> elif isinstance ( value , dict ) : <EOL> if '<STR_LIT>' in value : <EOL> if '<STR_LIT>' in value [ '<STR_LIT>' ] : <EOL> value = datetime . datetime . utcfromtimestamp ( value [ '<STR_LIT>' ] ) <EOL> if value == datetime . datetime ( <NUM_LIT> , <NUM_LIT:1> , <NUM_LIT:1> , <NUM_LIT:0> , <NUM_LIT:0> ) : <EOL> value = '<STR_LIT:->' <EOL> row [ column_map [ key ] ] = value <EOL> return row <EOL> class MemSession ( rekall_session . JsonSerializableSession ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , raw_bytes , fhandle = None ) : <EOL> """<STR_LIT>""" <EOL> local = os . path . join ( os . path . dirname ( os . path . realpath ( __file__ ) ) , '<STR_LIT>' ) <EOL> remote = '<STR_LIT>' <EOL> profile_path = [ local , remote ] <EOL> super ( MemSession , self ) . __init__ ( profile_path = profile_path ) <EOL> mem_file = StringIO ( raw_bytes ) <EOL> self . physical_address_space = standard . FDAddressSpace ( fhandle = mem_file , session = self ) <EOL> self . GetParameter ( "<STR_LIT>" ) <EOL> class WorkbenchRenderer ( DataExportRenderer ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , session ) : <EOL> """<STR_LIT>""" <EOL> self . __class__ . __name__ = '<STR_LIT>' <EOL> self . output = [ ] <EOL> self . session = session <EOL> self . column_map = { } <EOL> self . current_table_name = '<STR_LIT>' <EOL> self . verbose = False <EOL> self . incoming_section = False <EOL> super ( WorkbenchRenderer , self ) . __init__ ( session = session ) <EOL> def get_output ( self ) : <EOL> return self . output <EOL> def start ( self , plugin_name = None , kwargs = None ) : <EOL> """<STR_LIT>""" <EOL> self . output = [ ] <EOL> super ( WorkbenchRenderer , self ) . start ( plugin_name = plugin_name ) <EOL> return self <EOL> def format ( self , formatstring , * args ) : <EOL> """<STR_LIT>""" <EOL> if self . incoming_section : <EOL> self . SendMessage ( [ '<STR_LIT:s>' , { '<STR_LIT:name>' : args } ] ) <EOL> self . incoming_section = False <EOL> def section ( self , name = None , ** _kwargs ) : <EOL> """<STR_LIT>""" <EOL> if not name : <EOL> self . incoming_section = True <EOL> def SendMessage ( self , statement ) : <EOL> """<STR_LIT>""" <EOL> message_type = statement [ <NUM_LIT:0> ] <EOL> message_data = statement [ <NUM_LIT:1> ] <EOL> self . output . append ( { '<STR_LIT:type>' : message_type , '<STR_LIT:data>' : message_data } ) <EOL> def open ( self , directory = None , filename = None , mode = "<STR_LIT:rb>" ) : <EOL> """<STR_LIT>""" <EOL> path = os . path . join ( directory , filename ) <EOL> return open ( path , mode ) <EOL> def test ( ) : <EOL> '''<STR_LIT>''' <EOL> import zerorpc <EOL> c = zerorpc . Client ( timeout = <NUM_LIT> , heartbeat = <NUM_LIT> ) <EOL> c . connect ( "<STR_LIT>" ) <EOL> data_path = os . path . join ( os . path . dirname ( os . path . realpath ( __file__ ) ) , '<STR_LIT>' ) <EOL> if not os . path . isfile ( data_path ) : <EOL> print '<STR_LIT>' <EOL> import urllib <EOL> urllib . urlretrieve ( '<STR_LIT>' , data_path ) <EOL> if not os . path . isfile ( data_path ) : <EOL> print '<STR_LIT>' <EOL> print '<STR_LIT>' <EOL> exit ( <NUM_LIT:1> ) <EOL> md5 = c . store_sample ( open ( data_path , '<STR_LIT:rb>' ) . read ( ) , '<STR_LIT>' , '<STR_LIT>' ) <EOL> input_data = c . get_sample ( md5 ) <EOL> adapter = RekallAdapter ( ) <EOL> print '<STR_LIT>' <EOL> adapter . set_plugin_name ( '<STR_LIT>' ) <EOL> output = adapter . execute ( input_data ) <EOL> pprint . pprint ( output ) <EOL> adapter . set_plugin_name ( '<STR_LIT>' ) <EOL> output = adapter . execute ( input_data ) <EOL> pprint . pprint ( output ) <EOL> adapter . set_plugin_name ( '<STR_LIT>' ) <EOL> output = adapter . execute ( input_data ) <EOL> pprint . pprint ( output ) <EOL> if __name__ == "<STR_LIT:__main__>" : <EOL> test ( ) </s>
