Esempio n. 1
0
        internal void LoadFile(string filename, Folder f)
        {
            FileEntry fileEntry = f.searchForFile(filename);

            if (fileEntry == null)
            {
                fileEntry = f.searchForFile(filename + ".md");
                if (fileEntry == null)
                {
                    this.State        = MemoryForensicsExe.MemForensicsState.Error;
                    this.ErrorMessage = string.Format(LocaleTerms.Loc("File {0} not found in current folder!"), (object)filename);
                    return;
                }
            }
            try
            {
                this.ActiveMem          = MemoryContents.GetMemoryFromEncodedFileString(fileEntry.data);
                this.filenameLoaded     = filename;
                this.State              = MemoryForensicsExe.MemForensicsState.ReadingFile;
                this.timeInCurrentState = 0.0f;
            }
            catch (Exception ex)
            {
                this.State        = MemoryForensicsExe.MemForensicsState.Error;
                this.ErrorMessage = LocaleTerms.Loc("Error deserializing memory dump.") + "\r\n\r\n" + Utils.GenerateReportFromException(ex);
            }
        }
Esempio n. 2
0
        private void DownloadMemoryDump()
        {
            string encodedFileString = this.target.Memory.GetEncodedFileString();

            if (this.os.thisComputer == this.target)
            {
                List <string> stringList = new List <string>();
                for (int index = 0; index < this.os.exes.Count; ++index)
                {
                    NotesExe ex = this.os.exes[index] as NotesExe;
                    if (ex != null)
                    {
                        stringList.AddRange((IEnumerable <string>)ex.notes);
                    }
                }
                encodedFileString = new MemoryContents()
                {
                    DataBlocks  = new List <string>((IEnumerable <string>)stringList.ToArray()),
                    CommandsRun = this.os.terminal.GetRecentTerminalHistoryList()
                }.GetEncodedFileString();
            }
            string reportFilename = this.getReportFilename(this.target.name);
            Folder folder         = this.os.thisComputer.files.root.searchForFolder("home");
            Folder f = folder.searchForFolder("MemDumps");

            if (f == null)
            {
                folder.folders.Add(new Folder("MemDumps"));
                f = folder.searchForFolder("MemDumps");
            }
            string repeatingFilename = Utils.GetNonRepeatingFilename(reportFilename, ".mem", f);

            f.files.Add(new FileEntry(encodedFileString, repeatingFilename));
            this.savedFileName = "home/MemDumps/" + repeatingFilename;
        }
Esempio n. 3
0
 public static void InjectMemory(string memoryFilepath, object computer)
 {
     using (FileStream fileStream = File.OpenRead(memoryFilepath))
     {
         MemoryContents memoryContents = MemoryContents.Deserialize(XmlReader.Create((Stream)fileStream));
         ((Computer)computer).Memory = memoryContents;
     }
 }
Esempio n. 4
0
        public static MemoryContents Deserialize(XmlReader rdr)
        {
            MemoryContents ret = new MemoryContents();

            while (rdr.Name != "Memory")
            {
                rdr.Read();
                if (rdr.EOF)
                {
                    throw new FormatException("Unexpected end of file looking for start of Memory tag");
                }
            }
            do
            {
                rdr.Read();
                if (rdr.Name == "Memory" && !rdr.IsStartElement())
                {
                    return(ret);
                }
                Utils.ProcessXmlElementInParent(rdr, "Commands", "Command", (Action)(() =>
                {
                    int content = (int)rdr.MoveToContent();
                    string s = rdr.ReadElementContentAsString();
                    if (s.Contains("\n"))
                    {
                        string[] strArray = s.Split(Utils.robustNewlineDelim, StringSplitOptions.None);
                        for (int index = 0; index < strArray.Length; ++index)
                        {
                            if (string.IsNullOrEmpty(strArray[index]))
                            {
                                strArray[index] = " ";
                            }
                            ret.CommandsRun.Add(ComputerLoader.filter(Folder.deFilter(strArray[index])));
                        }
                    }
                    else
                    {
                        ret.CommandsRun.Add(ComputerLoader.filter(Folder.deFilter(s)));
                    }
                }));
                Utils.ProcessXmlElementInParent(rdr, "Data", "Block", (Action)(() =>
                {
                    int content = (int)rdr.MoveToContent();
                    ret.DataBlocks.Add(ComputerLoader.filter(Folder.deFilter(rdr.ReadElementContentAsString())));
                }));
                Utils.ProcessXmlElementInParent(rdr, "FileFragments", "File", (Action)(() =>
                {
                    string s1 = "UNKNOWN";
                    if (rdr.MoveToAttribute("name"))
                    {
                        s1 = rdr.ReadContentAsString();
                    }
                    int content = (int)rdr.MoveToContent();
                    string s2 = rdr.ReadElementContentAsString();
                    ret.FileFragments.Add(new KeyValuePair <string, string>(Folder.deFilter(s1), Folder.deFilter(s2)));
                }));
                Utils.ProcessXmlElementInParent(rdr, "Images", "Image", (Action)(() =>
                {
                    int content = (int)rdr.MoveToContent();
                    ret.Images.Add(Folder.deFilter(rdr.ReadElementContentAsString()));
                }));
            }while (!rdr.EOF);
            throw new FormatException("Unexpected end of file trying to deserialize memory contents!");
        }
Esempio n. 5
0
        public string TestEqualsWithErrorReport(MemoryContents other)
        {
            string str1 = "";

            if (other == null)
            {
                return("Other memory object is null!");
            }
            if (other.DataBlocks.Count == this.DataBlocks.Count)
            {
                for (int index = 0; index < this.DataBlocks.Count; ++index)
                {
                    if (other.DataBlocks[index] != this.DataBlocks[index])
                    {
                        str1 = str1 + "Data block difference for item " + (object)index + " - mismatch";
                    }
                }
            }
            else
            {
                str1 = str1 + "Datablock count difference - found " + (object)other.DataBlocks.Count + " - expected " + (object)this.DataBlocks.Count;
            }
            if (other.CommandsRun.Count == this.CommandsRun.Count)
            {
                for (int index = 0; index < this.CommandsRun.Count; ++index)
                {
                    if (other.CommandsRun[index] != this.CommandsRun[index])
                    {
                        str1 = str1 + "\n\nCommandsRun difference for item " + (object)index + " - mismatch.\nFound " + other.CommandsRun[index] + "  :vs:  " + this.CommandsRun[index] + "\n";
                    }
                }
            }
            else
            {
                str1 = str1 + "CommandsRun count difference - found " + (object)other.CommandsRun.Count + " - expected " + (object)this.CommandsRun.Count;
            }
            if (other.FileFragments.Count == this.FileFragments.Count)
            {
                for (int index = 0; index < this.FileFragments.Count; ++index)
                {
                    KeyValuePair <string, string> fileFragment = other.FileFragments[index];
                    string key1 = fileFragment.Key;
                    fileFragment = this.FileFragments[index];
                    string key2 = fileFragment.Key;
                    if (key1 != key2)
                    {
                        str1 = str1 + "FileFragments difference for item " + (object)index + " - key mismatch";
                    }
                    fileFragment = other.FileFragments[index];
                    string str2 = fileFragment.Value;
                    fileFragment = this.FileFragments[index];
                    string str3 = fileFragment.Value;
                    if (str2 != str3)
                    {
                        str1 = str1 + "FileFragments difference for item " + (object)index + " - Value mismatch";
                    }
                }
            }
            else
            {
                str1 = str1 + "FileFragments count difference - found " + (object)other.FileFragments.Count + " - expected " + (object)this.FileFragments.Count;
            }
            if (other.Images.Count == this.Images.Count)
            {
                for (int index = 0; index < this.Images.Count; ++index)
                {
                    if (other.Images[index] != this.Images[index])
                    {
                        str1 = str1 + "\n\nImages difference for item " + (object)index + " - mismatch.\nFound " + other.Images[index] + "  :vs:  " + this.Images[index] + "\n";
                    }
                }
            }
            else
            {
                str1 = str1 + "Images count difference - found " + (object)other.Images.Count + " - expected " + (object)this.Images.Count;
            }
            return(str1);
        }
Esempio n. 6
0
 public static MemoryContents GetMemoryFromEncodedFileString(string data)
 {
     using (Stream streamFromString = Utils.GenerateStreamFromString(MemoryContents.ReExpandSaveString(FileEncrypter.DecryptString(data.Substring("MEMORY_DUMP : FORMAT v1.22 ----------\n\n".Length + 400 + 2), "19474-217316293")[2])))
         return(MemoryContents.Deserialize(XmlReader.Create(streamFromString)));
 }