public override int GetHashCode()
{
unchecked
{
var hashCode = base.GetHashCode();
hashCode = (hashCode * 397) ^ (_messages != null ? _messages.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Result != null ? Result.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ _timeOut;
hashCode = (hashCode * 397) ^ IsObject.GetHashCode();
hashCode = (hashCode * 397) ^ (ObjectName != null ? ObjectName.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (DisplayName != null ? DisplayName.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ RabbitMQSourceResourceId.GetHashCode();
hashCode = (hashCode * 397) ^ (QueueName != null ? QueueName.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Response != null ? Response.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Prefetch != null ? Prefetch.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ Acknowledge.GetHashCode();
hashCode = (hashCode * 397) ^ (TimeOut != null ? TimeOut.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ ReQueue.GetHashCode();
hashCode = (hashCode * 397) ^ (Consumer != null ? Consumer.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Connection != null ? Connection.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Channel != null ? Channel.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (RabbitSource != null ? RabbitSource.GetHashCode() : 0);
return(hashCode);
}
}
/// <summary>
/// The ProcessRecord method returns a Prefetch object for the File specified
/// by the Path property, or iterates through all .pf files in the
/// C:\Windows\Prefetch directory to output an array of Prefetch objects.
/// </summary>
protected override void ProcessRecord()
{
switch (ParameterSetName)
{
case "ByVolume":
if (fast)
{
WriteObject(Prefetch.GetInstances(volume, fast));
}
else
{
WriteObject(Prefetch.GetInstances(volume));
}
break;
case "ByPath":
if (fast)
{
// Output the Prefetch object for the corresponding file
WriteObject(Prefetch.Get(filePath, fast));
}
else
{
// Output the Prefetch object for the corresponding file
WriteObject(Prefetch.Get(filePath));
}
break;
}
}
#pragma warning disable S1541 // Methods and properties should not be too complex
public override int GetHashCode()
#pragma warning restore S1541 // Methods and properties should not be too complex
{
unchecked
{
var hashCode = base.GetHashCode();
hashCode = (hashCode * 397) ^ (_messages != null ? _messages.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Result != null ? Result.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ _timeOut;
hashCode = (hashCode * 397) ^ IsObject.GetHashCode();
hashCode = (hashCode * 397) ^ (ObjectName != null ? ObjectName.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (DisplayName != null ? DisplayName.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ RabbitMQSourceResourceId.GetHashCode();
hashCode = (hashCode * 397) ^ (QueueName != null ? QueueName.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Response != null ? Response.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Prefetch != null ? Prefetch.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ Acknowledge.GetHashCode();
hashCode = (hashCode * 397) ^ (TimeOut != null ? TimeOut.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ ReQueue.GetHashCode();
hashCode = (hashCode * 397) ^ (Consumer != null ? Consumer.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Connection != null ? Connection.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (Channel != null ? Channel.GetHashCode() : 0);
hashCode = (hashCode * 397) ^ (RabbitSource != null ? RabbitSource.GetHashCode() : 0);
return(hashCode);
}
}
/// <summary>
/// GC safe dispose wrapper
/// </summary>
/// <param name="disposing">truth check</param>
protected virtual void Dispose(bool disposing)
{
if (Disposed)
{
return;
}
Hasher?.Dispose();
Prefetch.Dispose();
foreach (var(_, cache) in CacheFiles)
{
cache?.Dispose();
}
if (disposing)
{
CacheFiles.Clear();
CacheFiles = default;
FileMap.Clear();
FileMap = default;
Prefetch = default;
}
Disposed = true;
}
public (string headerName, string headerValue) ToString(ICspNonceService nonceService)
{
string headerName;
if (ReportOnly)
{
headerName = "Content-Security-Policy-Report-Only";
}
else
{
headerName = "Content-Security-Policy";
}
var values = new List <string>
{
Default.ToString(nonceService),
Script.ToString(nonceService),
Style.ToString(nonceService),
#pragma warning disable CS0618 // Type or member is obsolete
Child.ToString(nonceService),
#pragma warning restore CS0618 // Type or member is obsolete
Connect.ToString(nonceService),
Manifest.ToString(nonceService),
Font.ToString(nonceService),
FormAction.ToString(nonceService),
Img.ToString(nonceService),
Media.ToString(nonceService),
Object.ToString(nonceService),
FrameAncestors.ToString(),
PluginTypes.ToString(),
Frame.ToString(nonceService),
Worker.ToString(nonceService),
Prefetch.ToString(nonceService),
BaseUri.ToString(nonceService),
RequireSri.ToString()
};
if (BlockAllMixedContent)
{
values.Insert(0, "block-all-mixed-content");
}
if (UpgradeInsecureRequests)
{
values.Insert(0, "upgrade-insecure-requests");
}
if (EnableSandbox)
{
values.Add(Sandbox.ToString());
}
if (ReportUri != null)
{
values.Add("report-uri " + ReportUri);
}
string headerValue = string.Join(";", values.Where(s => s.Length > 0));
return(headerName, headerValue);
}
/// <summary>
///
/// </summary>
/// <param name="input"></param>
/// <returns></returns>
public static ForensicTimeline[] Get(Prefetch input)
{
List <ForensicTimeline> mactimeList = new List <ForensicTimeline>();
foreach (DateTime time in input.PrefetchAccessTime)
{
mactimeList.Add(new ForensicTimeline(time, "MACB", "PREFETCH", "", input.Path, input.ToString()));
}
return(mactimeList.ToArray());
}
/// <summary>
/// The ProcessRecord method returns a Prefetch object for the File specified
/// by the Path property, or iterates through all .pf files in the
/// C:\Windows\Prefetch directory to output an array of Prefetch objects.
/// </summary>
protected override void ProcessRecord()
{
// Get current volume
string volLetter = Directory.GetCurrentDirectory().Split('\\')[0];
string volume = @"\\.\" + volLetter;
// Get a handle to the volume
IntPtr hVolume = NativeMethods.getHandle(volume);
// Create a FileStream to read from the volume handle
FileStream streamToRead = NativeMethods.getFileStream(hVolume);
// Get a byte array representing the Master File Table
byte[] MFT = MasterFileTable.GetBytes(hVolume, streamToRead);
// If the FilePath parameter is used
if (this.MyInvocation.BoundParameters.ContainsKey("Path"))
{
//Test that FilePath exists
if (File.Exists(filePath))
{
// Output the Prefetch object for the corresponding file
WriteObject(Prefetch.Get(volume, streamToRead, MFT, filePath));
}
// If file doesnt exist, throw error
else
{
throw new FileNotFoundException((filePath + " does not exist. Please enter a valid file path."));
}
}
// If no FilePath is provided, return all Prefetch files
else
{
// Build Prefetch directory path
string prefetchPath = volLetter + @"\\Windows\\Prefetch";
// Get list of file in the Prefetch directory that end in the .pf extension
var pfFiles = System.IO.Directory.GetFiles(prefetchPath, "*.pf");
// Iterate through Prefetch Files
foreach (var file in pfFiles)
{
// Output the Prefetch object for the corresponding file
WriteObject(Prefetch.Get(volume, streamToRead, MFT, file));
}
}
} // ProcessRecord
private bool CreatePatch()
{
//remove failed patches
FileBackup.CleanupBackups(Configs.PatchPath);
using (var oldPatch = new FileBackup(Configs.PatchPath))
{
var patcher = new Patcher();
var patch = patcher.StartPatch();
foreach (var module in Plugins)
{
IoC.Notif.ShowStatus($"Generating patch ({module.PluginName})...");
module.ApplyChanges(patch);
}
IoC.Notif.ShowStatus("Generating plugin patches...");
patcher.ApplyCustomPatches(patch, PluginManager);
IoC.Notif.ShowStatus("Generating patch (rebuild prefetch)...");
var p = Prefetch.Load(patch);
if (p.Rebuild(patch))
{
p.Save();
}
if (!Directory.Exists(patch.WorkingDir))
{
IoC.Notif.ShowStatus("No changes found, aborting pack creation.");
return(false);
}
IoC.Notif.ShowStatus("Generating patch (packing)...");
patcher.PackPatch(patch);
IoC.Notif.ShowStatus("Copying patch...");
patcher.InstallPatch(patch);
oldPatch.Delete();
#if !DEBUG
Paths.Cleanup(IoC.Config.TempPath);
#endif
}
return(true);
}
private List <CharacterModel> LoadCharacterModels(bool unique)
{
if (_cache.TryLoadCache(out var cached))
{
var validCached = cached.Where(x => x.UniqueCharacter == unique).ToList();
if (validCached.Any())
{
return(validCached);
}
}
else
{
cached = new List <CharacterModel>();
}
var files = Prefetch.Load().Files.Keys;
var modelBag = new ConcurrentBag <CharacterModel>();
var tasks = new ParallelTasks <string>(
Environment.ProcessorCount, file =>
{
if (IsValid(file, unique))
{
foreach (var model in GetCharacterModels(file))
{
modelBag.Add(model);
}
}
});
tasks.Start();
tasks.AddItems(files);
tasks.WaitForComplete();
GC.Collect();
var modelList = modelBag.ToList();
cached.AddRange(modelList);
_cache.Save(cached);
return(modelList);
}
private List <T> LoadInternal()
{
if (_cache.TryLoadCache(out var cached))
{
if (cached.Any())
{
return(cached);
}
}
else
{
cached = new List <T>();
}
var files = Prefetch.Load().Files.Keys;
var bag = new ConcurrentBag <T>();
var parallels = IoC.Debug.SingleThread ? 1 : Environment.ProcessorCount;
var tasks = new ParallelTasks <string>(
parallels, file =>
{
if (_fileNameValidator(file) && !Ignored.Any(x => x.IsMatch(file)))
{
foreach (var item in _itemGetter(file))
{
bag.Add(item);
}
}
});
tasks.Start();
tasks.AddItems(files);
tasks.WaitForComplete();
GC.Collect();
var itemList = bag.ToList();
cached.AddRange(itemList);
_cache.Save(cached);
return(itemList);
}
/// <summary>
///
/// </summary>
/// <param name="volume"></param>
/// <returns></returns>
public static ForensicTimeline[] GetInstances(string volume)
{
List <ForensicTimeline> list = new List <ForensicTimeline>();
string volLetter = Helper.GetVolumeLetter(volume);
// File System
list.AddRange(ForensicTimeline.GetInstances(FileRecord.GetInstances(volume)));
// Amcache
list.AddRange(ForensicTimeline.GetInstances(Amcache.GetInstances(volume)));
// Prefetch
list.AddRange(ForensicTimeline.GetInstances(Prefetch.GetInstances(volume)));
// ScheduledJob
list.AddRange(ForensicTimeline.GetInstances(ScheduledJob.GetInstances(volume)));
// UserAssist
list.AddRange(ForensicTimeline.GetInstances(UserAssist.GetInstances(volume)));
// ShellLink
list.AddRange(ForensicTimeline.GetInstances(ShellLink.GetInstances(volume)));
// UsnJnrl
list.AddRange(ForensicTimeline.GetInstances(UsnJrnl.GetInstances(volume)));
// EventLog
list.AddRange(ForensicTimeline.GetInstances(EventRecord.GetInstances(volume)));
// Registry
list.AddRange(ForensicTimeline.GetInstances(NamedKey.GetInstancesRecurse(volLetter + "\\Windows\\system32\\config\\DRIVERS")));
list.AddRange(ForensicTimeline.GetInstances(NamedKey.GetInstancesRecurse(volLetter + "\\Windows\\system32\\config\\SAM")));
list.AddRange(ForensicTimeline.GetInstances(NamedKey.GetInstancesRecurse(volLetter + "\\Windows\\system32\\config\\SECURITY")));
list.AddRange(ForensicTimeline.GetInstances(NamedKey.GetInstancesRecurse(volLetter + "\\Windows\\system32\\config\\SOFTWARE")));
list.AddRange(ForensicTimeline.GetInstances(NamedKey.GetInstancesRecurse(volLetter + "\\Windows\\system32\\config\\SYSTEM")));
return(list.ToArray());
}
protected override void ProcessRecord()
{
// If the FilePath parameter is used
if (this.MyInvocation.BoundParameters.ContainsKey("Path"))
{
//Test that FilePath exists
if (File.Exists(filePath))
{
if (fast)
{
// Output the Prefetch object for the corresponding file
WriteObject(Prefetch.Get(filePath, fast));
}
else
{
// Output the Prefetch object for the corresponding file
WriteObject(Prefetch.Get(filePath));
}
}
// If file doesnt exist, throw error
else
{
throw new FileNotFoundException((filePath + " does not exist. Please enter a valid file path."));
}
}
// If no FilePath is provided, return all Prefetch files
else
{
if (fast)
{
WriteObject(Prefetch.GetInstances(volume, fast));
}
else
{
WriteObject(Prefetch.GetInstances(volume));
}
}
} // ProcessRecord
public static Mactime[] Get(Prefetch pf)
{
return(null);
}
