コード例 #1
0
ファイル: BinaryXml.cs プロジェクト: 453483289/PowerForensics
        internal BinXmlTemplateInstanceData(byte[] bytes, int chunkOffset, int offset)
        {
            ValueCount = BitConverter.ToInt32(bytes, offset);

            // Remove this if eventually
            if (ValueCount != 1376264)
            {
                ValueTypeArray = new BinXmlTemplateValueDescriptor[ValueCount];
                ValueArray = new Object[ValueCount];

                offset += 0x04;
                for (int i = 0; i < ValueCount; i++)
                {
                    ValueTypeArray[i] = new BinXmlTemplateValueDescriptor(bytes, offset);
                    offset += 0x04;
                }

                for (int i = 0; i < ValueCount; i++)
                {
                    switch(ValueTypeArray[i].ValueType)
                    {
                        case BinaryXml.VALUE_TYPE.NullType:
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.StringType:
                            ValueArray[i] = Encoding.Unicode.GetString(bytes, offset, ValueTypeArray[i].ValueSize);
                            break;
                        case BinaryXml.VALUE_TYPE.AnsiStringType:
                            ValueArray[i] = Encoding.ASCII.GetString(bytes, offset, ValueTypeArray[i].ValueSize);
                            break;
                        case BinaryXml.VALUE_TYPE.Int8Type:
                            ValueArray[i] = bytes[offset];
                            break;
                        case BinaryXml.VALUE_TYPE.UInt8Type:
                            ValueArray[i] = bytes[offset];
                            break;
                        case BinaryXml.VALUE_TYPE.Int16Type:
                            ValueArray[i] = BitConverter.ToInt16(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.UInt16Type:
                            ValueArray[i] = BitConverter.ToUInt16(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.Int32Type:
                            ValueArray[i] = BitConverter.ToInt32(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.UInt32Type:
                            ValueArray[i] = BitConverter.ToUInt32(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.Int64Type:
                            ValueArray[i] = BitConverter.ToInt64(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.UInt64Type:
                            ValueArray[i] = BitConverter.ToUInt64(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.Real32Type:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Real64Type:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.BoolType:
                            int value = BitConverter.ToInt32(bytes, offset);
                            if (value > 0x00)
                            {
                                ValueArray[i] = true;
                            }
                            else
                            {
                                ValueArray[i] = false;
                            }
                            break;
                        case BinaryXml.VALUE_TYPE.BinaryType:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.GuidType:
                            ValueArray[i] = new Guid(Util.GetSubArray(bytes, (uint)offset, 0x10));
                            break;
                        case BinaryXml.VALUE_TYPE.SizeTType:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.FileTimeType:
                            ValueArray[i] = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, offset));
                            break;
                        case BinaryXml.VALUE_TYPE.SysTimeType:
                            ValueArray[i] = Systemtime.Get(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.SidType:
                            ValueArray[i] = new SecurityIdentifier(bytes, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.HexInt32Type:
                            ValueArray[i] = String.Format("0x{0:X}", BitConverter.ToInt32(bytes, offset));
                            break;
                        case BinaryXml.VALUE_TYPE.HexInt64Type:
                            ValueArray[i] = String.Format("0x{0:X}", BitConverter.ToInt64(bytes, offset));;
                            break;
                        case BinaryXml.VALUE_TYPE.BinXmlType:
                            //Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            //ValueArray[i] = NativeMethods.GetSubArray(bytes, (uint)offset, (uint)ValueTypeArray[i].ValueSize);
                            //ValueArray[i] = new BinXmlTemplateInstance(bytes, chunkOffset, offset);
                            break;
                        case BinaryXml.VALUE_TYPE.StringType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.AnsiStringType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Int8Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.UInt8Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Int16Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.UInt16Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Int32Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.UInt32Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Int64Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.UInt64Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Real32Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.Real64Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.BoolType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.BinaryType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.GuidType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.SizeTType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.FileTimeType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.SysTimeType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.SidType_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.HexInt32Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                        case BinaryXml.VALUE_TYPE.HexInt64Type_Array:
                            Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                            ValueArray[i] = null;
                            break;
                    }
                    offset += ValueTypeArray[i].ValueSize;
                }
            }
        }
コード例 #2
0
        internal BinXmlTemplateInstanceData(byte[] bytes, int chunkOffset, int offset)
        {
            ValueCount = BitConverter.ToInt32(bytes, offset);

            // Remove this if eventually
            if (ValueCount != 1376264)
            {
                ValueTypeArray = new BinXmlTemplateValueDescriptor[ValueCount];
                ValueArray     = new Object[ValueCount];

                offset += 0x04;
                for (int i = 0; i < ValueCount; i++)
                {
                    ValueTypeArray[i] = new BinXmlTemplateValueDescriptor(bytes, offset);
                    offset           += 0x04;
                }

                for (int i = 0; i < ValueCount; i++)
                {
                    switch (ValueTypeArray[i].ValueType)
                    {
                    case BinaryXml.VALUE_TYPE.NullType:
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.StringType:
                        ValueArray[i] = Encoding.Unicode.GetString(bytes, offset, ValueTypeArray[i].ValueSize);
                        break;

                    case BinaryXml.VALUE_TYPE.AnsiStringType:
                        ValueArray[i] = Encoding.ASCII.GetString(bytes, offset, ValueTypeArray[i].ValueSize);
                        break;

                    case BinaryXml.VALUE_TYPE.Int8Type:
                        ValueArray[i] = bytes[offset];
                        break;

                    case BinaryXml.VALUE_TYPE.UInt8Type:
                        ValueArray[i] = bytes[offset];
                        break;

                    case BinaryXml.VALUE_TYPE.Int16Type:
                        ValueArray[i] = BitConverter.ToInt16(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.UInt16Type:
                        ValueArray[i] = BitConverter.ToUInt16(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.Int32Type:
                        ValueArray[i] = BitConverter.ToInt32(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.UInt32Type:
                        ValueArray[i] = BitConverter.ToUInt32(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.Int64Type:
                        ValueArray[i] = BitConverter.ToInt64(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.UInt64Type:
                        ValueArray[i] = BitConverter.ToUInt64(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.Real32Type:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Real64Type:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.BoolType:
                        int value = BitConverter.ToInt32(bytes, offset);
                        if (value > 0x00)
                        {
                            ValueArray[i] = true;
                        }
                        else
                        {
                            ValueArray[i] = false;
                        }
                        break;

                    case BinaryXml.VALUE_TYPE.BinaryType:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.GuidType:
                        ValueArray[i] = new Guid(Util.GetSubArray(bytes, (uint)offset, 0x10));
                        break;

                    case BinaryXml.VALUE_TYPE.SizeTType:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.FileTimeType:
                        ValueArray[i] = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, offset));
                        break;

                    case BinaryXml.VALUE_TYPE.SysTimeType:
                        ValueArray[i] = Systemtime.Get(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.SidType:
                        ValueArray[i] = new SecurityIdentifier(bytes, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.HexInt32Type:
                        ValueArray[i] = String.Format("0x{0:X}", BitConverter.ToInt32(bytes, offset));
                        break;

                    case BinaryXml.VALUE_TYPE.HexInt64Type:
                        ValueArray[i] = String.Format("0x{0:X}", BitConverter.ToInt64(bytes, offset));;
                        break;

                    case BinaryXml.VALUE_TYPE.BinXmlType:
                        //Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        //ValueArray[i] = NativeMethods.GetSubArray(bytes, (uint)offset, (uint)ValueTypeArray[i].ValueSize);
                        //ValueArray[i] = new BinXmlTemplateInstance(bytes, chunkOffset, offset);
                        break;

                    case BinaryXml.VALUE_TYPE.StringType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.AnsiStringType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Int8Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.UInt8Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Int16Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.UInt16Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Int32Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.UInt32Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Int64Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.UInt64Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Real32Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.Real64Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.BoolType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.BinaryType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.GuidType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.SizeTType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.FileTimeType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.SysTimeType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.SidType_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.HexInt32Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;

                    case BinaryXml.VALUE_TYPE.HexInt64Type_Array:
                        Console.WriteLine("Type: {0}, Size: {1}", ValueTypeArray[i].ValueType, ValueTypeArray[i].ValueSize);
                        ValueArray[i] = null;
                        break;
                    }
                    offset += ValueTypeArray[i].ValueSize;
                }
            }
        }