コード例 #1
0
ファイル: IndexRoot.cs プロジェクト: antonini/PowerForensics
        internal IndexRoot(ResidentHeader header, byte[] bytes, int offset, string attrName)
        {
            // Get ResidentHeader (includes Common Header)
            Name          = (ATTR_TYPE)header.commonHeader.ATTRType;
            NameString    = attrName;
            NonResident   = header.commonHeader.NonResident;
            AttributeId   = header.commonHeader.Id;
            AttributeSize = header.commonHeader.TotalSize;

            // IndexRoot
            AttributeType          = (ATTR_TYPE)BitConverter.ToUInt32(bytes, 0x00 + offset);
            CollationSortingRule   = BitConverter.ToUInt32(bytes, 0x04 + offset);
            IndexSize              = BitConverter.ToUInt32(bytes, 0x08 + offset);
            ClustersPerIndexRecord = bytes[0x0C + offset];

            // IndexHeader
            StartOffset   = (BitConverter.ToInt32(bytes, 0x10 + offset) + 0x10 + offset); // Add 0x10 bytes to start offset to account for its offset
            TotalSize     = BitConverter.ToInt32(bytes, 0x14 + offset);
            AllocatedSize = BitConverter.ToInt32(bytes, 0x18 + offset);
            Flags         = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(bytes, 0x1C + offset));

            // IndexEntry[]
            EntryBytes = Helper.GetSubArray(bytes, StartOffset, TotalSize);

            // Iterate through IndexEntry object
            int indexEntryOffset = 0;

            if (AttributeType == ATTR_TYPE.FILE_NAME)
            {
                // Instantiate empty IndexEntry List
                List <IndexEntry> entryList = new List <IndexEntry>();

                while (indexEntryOffset < (EntryBytes.Length - 0x10))
                {
                    // There has to be a better way
                    if (BitConverter.ToUInt16(EntryBytes, 0x0A + indexEntryOffset) == 0)
                    {
                        break;
                    }

                    // Instantiate an IndexEntry Object
                    IndexEntry indexEntry = new IndexEntry(EntryBytes, indexEntryOffset);

                    // Add IndexEntry Object to FileName List
                    entryList.Add(indexEntry);

                    // Increment indexEntryOffset
                    indexEntryOffset += indexEntry.Size;
                }

                Entries = entryList.ToArray();
            }
        }
コード例 #2
0
        internal IndexRoot(ResidentHeader header, byte[] attrBytes, string attrName)
        {
            #region ResidentHeader

            // Get ResidentHeader (includes Common Header)
            Name        = (ATTR_TYPE)header.commonHeader.ATTRType;
            NameString  = attrName;
            NonResident = header.commonHeader.NonResident;
            AttributeId = header.commonHeader.Id;

            #endregion ResidentHeader

            #region IndexRoot

            // IndexRoot
            AttributeType          = (ATTR_TYPE)BitConverter.ToUInt32(attrBytes, 0x00);
            CollationSortingRule   = BitConverter.ToUInt32(attrBytes, 0x04);
            IndexSize              = BitConverter.ToUInt32(attrBytes, 0x08);
            ClustersPerIndexRecord = attrBytes[0x0C];

            #endregion IndexRoot

            #region IndexHeader

            // IndexHeader
            StartOffset   = (BitConverter.ToUInt32(attrBytes, 0x10) + 0x10); // Add 0x10 bytes to start offset to account for its offset
            TotalSize     = BitConverter.ToUInt32(attrBytes, 0x14);
            AllocatedSize = BitConverter.ToUInt32(attrBytes, 0x18);
            Flags         = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(attrBytes, 0x1C));

            #endregion IndexHeader

            #region IndexEntryArray

            if (TotalSize > StartOffset)
            {
                // IndexEntry[]
                byte[] EntryBytes = Helper.GetSubArray(attrBytes, (int)StartOffset, (int)TotalSize - (int)StartOffset);


                // Iterate through IndexEntry object
                int indexEntryOffset = 0;

                if (AttributeType == ATTR_TYPE.FILE_NAME)
                {
                    // Instantiate empty IndexEntry List
                    List <IndexEntry> entryList = new List <IndexEntry>();

                    while (indexEntryOffset < (EntryBytes.Length - 0x10))
                    {
                        // Creat byte array representing IndexEntry Object
                        int indexEntrySizeOffset = indexEntryOffset + 0x08;

                        // Instantiate an IndexEntry Object
                        IndexEntry indexEntry = new IndexEntry(Helper.GetSubArray(EntryBytes, indexEntryOffset, BitConverter.ToUInt16(EntryBytes, indexEntrySizeOffset)));

                        // Add IndexEntry Object to FileName List
                        entryList.Add(indexEntry);

                        // Increment indexEntryOffset
                        indexEntryOffset += indexEntry.Size;
                    }

                    Entries = entryList.ToArray();
                }
            }
            #endregion IndexEntryArray
        }
コード例 #3
0
ファイル: IndexRoot.cs プロジェクト: sha8e/PowerForensics
        internal IndexRoot(ResidentHeader header, byte[] bytes, int offset, string attrName)
        {
            #region ResidentHeader

            // Get ResidentHeader (includes Common Header)
            Name = (ATTR_TYPE)header.commonHeader.ATTRType;
            NameString = attrName;
            NonResident = header.commonHeader.NonResident;
            AttributeId = header.commonHeader.Id;
            AttributeSize = header.commonHeader.TotalSize;

            #endregion ResidentHeader

            #region IndexRoot

            // IndexRoot
            AttributeType = (ATTR_TYPE)BitConverter.ToUInt32(bytes, 0x00 + offset);
            CollationSortingRule = BitConverter.ToUInt32(bytes, 0x04 + offset);
            IndexSize = BitConverter.ToUInt32(bytes, 0x08 + offset);
            ClustersPerIndexRecord = bytes[0x0C + offset];

            #endregion IndexRoot

            #region IndexHeader

            // IndexHeader
            StartOffset = (BitConverter.ToInt32(bytes, 0x10 + offset) + 0x10 + offset);  // Add 0x10 bytes to start offset to account for its offset
            TotalSize = BitConverter.ToInt32(bytes, 0x14 + offset);
            AllocatedSize = BitConverter.ToInt32(bytes, 0x18 + offset);
            Flags = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(bytes, 0x1C + offset));

            #endregion IndexHeader

            #region IndexEntryArray

            // IndexEntry[]
            byte[] EntryBytes = Helper.GetSubArray(bytes, StartOffset, TotalSize);

            // Iterate through IndexEntry object
            int indexEntryOffset = 0;

            if (AttributeType == ATTR_TYPE.FILE_NAME)
            {
                // Instantiate empty IndexEntry List
                List<IndexEntry> entryList = new List<IndexEntry>();

                while (indexEntryOffset < (EntryBytes.Length - 0x10))
                {
                    // There has to be a better way
                    if(BitConverter.ToUInt16(EntryBytes, 0x0A + indexEntryOffset) == 0)
                    {
                        break;
                    }

                    // Instantiate an IndexEntry Object
                    IndexEntry indexEntry = new IndexEntry(EntryBytes, indexEntryOffset);

                    // Add IndexEntry Object to FileName List
                    entryList.Add(indexEntry);

                    // Increment indexEntryOffset
                    indexEntryOffset += indexEntry.Size;
                }

                Entries = entryList.ToArray();
            }
            #endregion IndexEntryArray
        }
コード例 #4
0
        internal IndexRoot(ResidentHeader header, byte[] attrBytes, string attrName)
        {
            #region ResidentHeader

            // Get ResidentHeader (includes Common Header)
            Name = (ATTR_TYPE)header.commonHeader.ATTRType;
            NameString = attrName;
            NonResident = header.commonHeader.NonResident;
            AttributeId = header.commonHeader.Id;
            
            #endregion ResidentHeader

            #region IndexRoot

            // IndexRoot
            AttributeType = (ATTR_TYPE)BitConverter.ToUInt32(attrBytes, 0x00);
            CollationSortingRule = BitConverter.ToUInt32(attrBytes, 0x04);
            IndexSize = BitConverter.ToUInt32(attrBytes, 0x08);
            ClustersPerIndexRecord = attrBytes[0x0C];

            #endregion IndexRoot

            #region IndexHeader

            // IndexHeader
            StartOffset = (BitConverter.ToUInt32(attrBytes, 0x10) + 0x10);  // Add 0x10 bytes to start offset to account for its offset
            TotalSize = BitConverter.ToUInt32(attrBytes, 0x14);
            AllocatedSize = BitConverter.ToUInt32(attrBytes, 0x18);
            Flags = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(attrBytes, 0x1C));
            
            #endregion IndexHeader

            #region IndexEntryArray

            if(TotalSize > StartOffset){
                // IndexEntry[]
                byte[] EntryBytes = Util.GetSubArray(attrBytes, StartOffset, TotalSize - StartOffset);


                // Iterate through IndexEntry object
                int indexEntryOffset = 0;

                if (AttributeType == ATTR_TYPE.FILE_NAME)
                {
                    // Instantiate empty IndexEntry List
                    List<IndexEntry> entryList = new List<IndexEntry>();

                    while (indexEntryOffset < (EntryBytes.Length - 0x10))
                    {                
                        // Creat byte array representing IndexEntry Object
                        int indexEntrySizeOffset = indexEntryOffset + 0x08;

                        // Instantiate an IndexEntry Object
                        IndexEntry indexEntry = new IndexEntry(Util.GetSubArray(EntryBytes, (uint)indexEntryOffset, (uint)BitConverter.ToUInt16(EntryBytes, indexEntrySizeOffset)));

                        // Add IndexEntry Object to FileName List
                        entryList.Add(indexEntry);

                        // Increment indexEntryOffset
                        indexEntryOffset += indexEntry.Size;
                    } 
                
                    Entries = entryList.ToArray();
                }
            }
            #endregion IndexEntryArray
        }