Skip to content

Commit 970c5d1

Browse files
danilbazdanilbaz
committed
spellcheck
1 parent 03fcfc4 commit 970c5d1

File tree

2 files changed

+49
-54
lines changed

2 files changed

+49
-54
lines changed

‎lib/rex/parser/fs/ntfs.rb

Lines changed: 48 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
# -*- coding: binary -*-
22
module Rex
33
module Parser
4-
54
###
65
#
76
# This class parses the contents of an NTFS partition file.
@@ -19,17 +18,17 @@ def initialize(file_handler)
1918
@file_handler = file_handler
2019
data = @file_handler.read(4096)
2120
# Boot sector reading
22-
@bytes_per_sector = data[11, 2].unpack("v")[0]
23-
@sector_per_cluster = data[13].unpack("C")[0]
24-
@cluster_per_mft_record = data[64].unpack("c")[0]
21+
@bytes_per_sector = data[11, 2].unpack('v')[0]
22+
@sector_per_cluster = data[13].unpack('C')[0]
23+
@cluster_per_mft_record = data[64].unpack('c')[0]
2524
if @cluster_per_mft_record < 0
2625
@bytes_per_mft_record = 2**(-@cluster_per_mft_record)
2726
@cluster_per_mft_record = @bytes_per_mft_record.to_f / @bytes_per_sector / @sector_per_cluster
2827
else
2928
@bytes_per_mft_record = @bytes_per_sector * @sector_per_cluster * @cluster_per_mft_record
3029
end
3130
@bytes_per_cluster = @sector_per_cluster * @bytes_per_sector
32-
@mft_logical_cluster_number = data[48, 8].unpack("Q<")[0]
31+
@mft_logical_cluster_number = data[48, 8].unpack('Q<')[0]
3332
@mft_offset = @mft_logical_cluster_number * @sector_per_cluster * @bytes_per_sector
3433
@file_handler.seek(@mft_offset)
3534
@mft = @file_handler.read(@bytes_per_mft_record)
@@ -40,7 +39,7 @@ def initialize(file_handler)
4039
#
4140
def mft_record_from_mft_num(mft_num)
4241
mft_num_offset = mft_num * @cluster_per_mft_record
43-
mft_data_attribute = mft_record_attribute(@mft)[DATA_ATTRIBUTE_ID]["data"]
42+
mft_data_attribute = mft_record_attribute(@mft)[DATA_ATTRIBUTE_ID]['data']
4443
cluster_from_attribute_non_resident(mft_data_attribute, mft_num_offset, @bytes_per_mft_record)
4544
end
4645

@@ -49,7 +48,7 @@ def mft_record_from_mft_num(mft_num)
4948
#
5049
def real_size_from_filenameattribute(attribute)
5150
filename_attribute = attribute
52-
filename_attribute[48, 8].unpack("Q<")[0]
51+
filename_attribute[48, 8].unpack('Q<')[0]
5352
end
5453

5554
#
@@ -59,7 +58,7 @@ def filename_from_filenameattribute(attribute)
5958
filename_attribute = attribute
6059
length_of_name = filename_attribute[64].ord
6160
# uft16 *2
62-
d = ::Encoding::Converter.new("UTF-16LE", "UTF-8")
61+
d = ::Encoding::Converter.new('UTF-16LE', 'UTF-8')
6362
d.convert(filename_attribute[66, (length_of_name * 2)])
6463
end
6564

@@ -72,10 +71,10 @@ def filename_from_filenameattribute(attribute)
7271
def file_content_from_mft_num(mft_num, size)
7372
mft_record = mft_record_from_mft_num(mft_num)
7473
attribute_list = mft_record_attribute(mft_record)
75-
if attribute_list[DATA_ATTRIBUTE_ID]["resident"]
76-
return attribute_list[DATA_ATTRIBUTE_ID]["data"]
74+
if attribute_list[DATA_ATTRIBUTE_ID]['resident']
75+
return attribute_list[DATA_ATTRIBUTE_ID]['data']
7776
else
78-
data_attribute = attribute_list[DATA_ATTRIBUTE_ID]["data"]
77+
data_attribute = attribute_list[DATA_ATTRIBUTE_ID]['data']
7978
return cluster_from_attribute_non_resident(data_attribute)[0, size]
8079
end
8180
end
@@ -85,14 +84,15 @@ def file_content_from_mft_num(mft_num, size)
8584
#
8685
def parse_index(index_entry)
8786
res = {}
88-
filename_size = index_entry[10, 2].unpack("v")[0]
87+
filename_size = index_entry[10, 2].unpack('v')[0]
8988
filename_attribute = index_entry[16, filename_size]
9089
# Should be 8 bytes but it doesn't work
91-
# mft_offset = index_entry[0.unpack("Q<",:8])[0]
90+
# mft_offset = index_entry[0.unpack('Q<',:8])[0]
9291
# work with 4 bytes
93-
mft_offset = index_entry[0, 4].unpack("V")[0]
94-
res[filename_from_filenameattribute(filename_attribute)] = { "mft_offset" => mft_offset,
95-
"file_size" => real_size_from_filenameattribute(filename_attribute) }
92+
mft_offset = index_entry[0, 4].unpack('V')[0]
93+
res[filename_from_filenameattribute(filename_attribute)] = {
94+
'mft_offset' => mft_offset,
95+
'file_size' => real_size_from_filenameattribute(filename_attribute) }
9696
res
9797
end
9898

@@ -101,29 +101,29 @@ def parse_index(index_entry)
101101
# INDEX_ALLOCATION
102102
#
103103
def parse_index_list(index_record, index_allocation_attribute)
104-
offset_index_entry_list = index_record[0, 4].unpack("V")[0]
105-
index_size = index_record[offset_index_entry_list + 8, 2].unpack("v")[0]
104+
offset_index_entry_list = index_record[0, 4].unpack('V')[0]
105+
index_size = index_record[offset_index_entry_list + 8, 2].unpack('v')[0]
106106
index_entry = index_record[offset_index_entry_list, index_size]
107107
res = {}
108-
while index_entry[12, 4].unpack("V")[0] & 2 != 2
108+
while index_entry[12, 4].unpack('V')[0] & 2 != 2
109109
res.update(parse_index(index_entry))
110110
# if son
111-
if index_entry[12, 4].unpack("V")[0] & 1 == 1
111+
if index_entry[12, 4].unpack('V')[0] & 1 == 1
112112
# should be 8 bytes length
113-
vcn = index_entry[-8, 4].unpack("V")[0]
113+
vcn = index_entry[-8, 4].unpack('V')[0]
114114
vcn_in_bytes = vcn * @bytes_per_cluster
115115
index_size_in_bytes = index_size * @bytes_per_cluster
116116
res_son = parse_index_list(index_allocation_attribute[vcn_in_bytes + 24, index_size_in_bytes], index_allocation_attribute)
117117
res.update(res_son)
118118
end
119119
offset_index_entry_list += index_size
120-
index_size = index_record[offset_index_entry_list + 8, 2].unpack("v")[0]
120+
index_size = index_record[offset_index_entry_list + 8, 2].unpack('v')[0]
121121
index_entry = index_record [offset_index_entry_list, index_size]
122122
end
123123
# if son on the last
124-
if index_entry[12, 4].unpack("V")[0] & 1 == 1
124+
if index_entry[12, 4].unpack('V')[0] & 1 == 1
125125
# should be 8 bytes length
126-
vcn = index_entry[-8, 4].unpack("V")[0]
126+
vcn = index_entry[-8, 4].unpack('V')[0]
127127
vcn_in_bytes = vcn * @bytes_per_cluster
128128
index_size_in_bytes = index_size * @bytes_per_cluster
129129
res_son = parse_index_list(index_allocation_attribute[vcn_in_bytes + 24, index_size_in_bytes], index_allocation_attribute)
@@ -141,16 +141,16 @@ def index_list_from_attributes(attributes)
141141
if attributes.key?(INDEX_ALLOCATION_ID)
142142
return parse_index_list(index_record, attributes[INDEX_ALLOCATION_ID])
143143
else
144-
return parse_index_list(index_record, "")
144+
return parse_index_list(index_record, '')
145145
end
146146
end
147147

148148
def cluster_from_attribute_non_resident(attribute, cluster_num = 0, size_max = ((2**31) - 1))
149-
lowvcn = attribute[16, 8].unpack("Q<")[0]
150-
highvcn = attribute[24, 8].unpack("Q<")[0]
151-
offset = attribute[32, 2].unpack("v")[0]
152-
real_size = attribute[48, 8].unpack("Q<")[0]
153-
attribut = ""
149+
lowvcn = attribute[16, 8].unpack('Q<')[0]
150+
highvcn = attribute[24, 8].unpack('Q<')[0]
151+
offset = attribute[32, 2].unpack('v')[0]
152+
real_size = attribute[48, 8].unpack('Q<')[0]
153+
attribut = ''
154154
run_list_num = lowvcn
155155
old_offset = 0
156156

@@ -160,7 +160,7 @@ def cluster_from_attribute_non_resident(attribute, cluster_num = 0, size_max = (
160160
run_length_size = first_runlist_byte & 15
161161
run_length = attribute[offset + 1, run_length_size]
162162
run_length += "\x00" * (8 - run_length_size)
163-
run_length = run_length.unpack("Q<")[0]
163+
run_length = run_length.unpack('Q<')[0]
164164

165165
offset_run_offset = offset + 1 + run_length_size
166166
run_offset = attribute[offset_run_offset, run_offset_size]
@@ -169,7 +169,7 @@ def cluster_from_attribute_non_resident(attribute, cluster_num = 0, size_max = (
169169
else
170170
run_offset += "\x00" * (8 - run_offset_size)
171171
end
172-
run_offset = run_offset.unpack("q<")[0]
172+
run_offset = run_offset.unpack('q<')[0]
173173

174174
size_wanted = [run_length * @bytes_per_cluster, size_max - attribut.length].min
175175

@@ -179,7 +179,7 @@ def cluster_from_attribute_non_resident(attribute, cluster_num = 0, size_max = (
179179
run_list_offset = run_list_offset.to_i
180180
@file_handler.seek(run_list_offset)
181181

182-
data = ""
182+
data = ''
183183
while data.length < size_wanted
184184
data << @file_handler.read(size_wanted - data.length)
185185
end
@@ -195,22 +195,21 @@ def cluster_from_attribute_non_resident(attribute, cluster_num = 0, size_max = (
195195

196196
#
197197
# return the attribute list from the MFT record
198-
# deal with resident and non resident attributes (but not $DATA due to perforemence issue)
198+
# deal with resident and non resident attributes (but not $DATA due to performance issue)
199199
#
200200
def mft_record_attribute(mft_record)
201-
attribute_list_offset = mft_record[20, 2].unpack("C")[0]
201+
attribute_list_offset = mft_record[20, 2].unpack('C')[0]
202202
curs = attribute_list_offset
203-
attribute_identifier = mft_record[curs, 4].unpack("V")[0]
203+
attribute_identifier = mft_record[curs, 4].unpack('V')[0]
204204
res = {}
205205
while attribute_identifier != 0xFFFFFFFF
206-
# attribute_size=mft_record[curs + 4, 4].unpack("V")[0]
206+
# attribute_size=mft_record[curs + 4, 4].unpack('V')[0]
207207
# should be on 4 bytes but doesnt work
208-
attribute_size = mft_record[curs + 4, 2].unpack("v")[0]
209-
#print_debug("attribute_size: #{attribute_size}, attribute_identifier: #{attribute_identifier}")
208+
attribute_size = mft_record[curs + 4, 2].unpack('v')[0]
210209
# resident
211210
if mft_record[curs + 8] == "\x00"
212-
content_size = mft_record[curs + 16, 4].unpack("V")[0]
213-
content_offset = mft_record[curs + 20, 2].unpack("v")[0]
211+
content_size = mft_record[curs + 16, 4].unpack('V')[0]
212+
content_offset = mft_record[curs + 20, 2].unpack('v')[0]
214213
res[attribute_identifier] = mft_record[curs + content_offset, content_size]
215214
else
216215
# non resident
@@ -221,11 +220,12 @@ def mft_record_attribute(mft_record)
221220
end
222221
end
223222
if attribute_identifier == DATA_ATTRIBUTE_ID
224-
res[attribute_identifier] = { "data" => res[attribute_identifier],
225-
"resident" => mft_record[curs + 8] == "\x00" }
223+
res[attribute_identifier] = {
224+
'data' => res[attribute_identifier],
225+
'resident' => mft_record[curs + 8] == "\x00" }
226226
end
227227
curs += attribute_size
228-
attribute_identifier = mft_record[curs, 4].unpack("V")[0]
228+
attribute_identifier = mft_record[curs, 4].unpack('V')[0]
229229
end
230230
res
231231
end
@@ -236,22 +236,17 @@ def mft_record_attribute(mft_record)
236236
def file(path)
237237
repertory = mft_record_from_mft_num(5)
238238
index_entry = {}
239-
for r in path.split("\\")
239+
for r in path.split('\\')
240240
attributes = mft_record_attribute(repertory)
241241
index = index_list_from_attributes(attributes)
242-
#print_debug("#{index}")
243242
unless index.key?(r)
244-
fail ArgumentError, "File path does not exist", caller
243+
fail ArgumentError, 'File path does not exist', caller
245244
end
246245
index_entry = index[r]
247-
repertory = mft_record_from_mft_num(index_entry["mft_offset"])
246+
repertory = mft_record_from_mft_num(index_entry['mft_offset'])
248247
end
249-
file_content_from_mft_num(index_entry["mft_offset"], index_entry["file_size"])
248+
file_content_from_mft_num(index_entry['mft_offset'], index_entry['file_size'])
250249
end
251250
end
252251
end
253252
end
254-
# f = open(ARGV[0],"r")
255-
# ntfs = NTFS.new(f)
256-
# puts ntfs.file(ARGV[1])
257-
# f.close

‎modules/post/windows/gather/file_in_raw_ntfs.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ def run
7575
ensure
7676
client.railgun.kernel32.CloseHandle(@handle)
7777
end
78-
print_status("Post Successfuly")
78+
print_status("Post Successful")
7979
end
8080

8181
def read(size)

0 commit comments

Comments
 (0)