예제 #1
0
        /// <summary>
        /// Create a TrackerDataBlock from a given byte array
        /// </summary>
        /// <param name="ba">The byte array</param>
        /// <returns>A TrackerDataBlock object</returns>
        public static TrackerDataBlock FromByteArray(byte[] ba)
        {
            TrackerDataBlock TrackerDataBlock = new TrackerDataBlock();

            if (ba.Length < 0x60)
            {
                throw new ArgumentException(String.Format("Size of the TrackerDataBlock Structure is less than 96 ({0})", ba.Length));
            }

            UInt32 BlockSize = BitConverter.ToUInt32(ba, 0);

            if (BlockSize > ba.Length)
            {
                throw new ArgumentException(String.Format("BlockSize is {0} is incorrect (expected {1})", BlockSize, TrackerDataBlock.BlockSize));
            }

            BlockSignature BlockSignature = (BlockSignature)BitConverter.ToUInt32(ba, 4);

            if (BlockSignature != TrackerDataBlock.BlockSignature)
            {
                throw new ArgumentException(String.Format("BlockSignature is {0} is incorrect (expected {1})", BlockSignature, TrackerDataBlock.BlockSignature));
            }

            UInt32 Length = BitConverter.ToUInt32(ba, 8);

            if (Length < 0x58)
            {
                throw new ArgumentException(String.Format("Length is {0} is incorrect (expected 88)", Length));
            }

            TrackerDataBlock.Version = BitConverter.ToUInt32(ba, 12);

            byte[] MachineID = new byte[Length - 0x48];
            Buffer.BlockCopy(ba, 16, MachineID, 0, MachineID.Length);
            TrackerDataBlock.MachineID = Encoding.Default.GetString(MachineID).TrimEnd(new char[] { (char)0 });

            byte[] Guid = new byte[16];
            Buffer.BlockCopy(ba, 16 + MachineID.Length, Guid, 0, Guid.Length);
            TrackerDataBlock.Droid    = new Guid[2];
            TrackerDataBlock.Droid[0] = new Guid(Guid);
            Buffer.BlockCopy(ba, 32 + MachineID.Length, Guid, 0, Guid.Length);
            TrackerDataBlock.Droid[1] = new Guid(Guid);

            Buffer.BlockCopy(ba, 48 + MachineID.Length, Guid, 0, Guid.Length);
            TrackerDataBlock.DroidBirth    = new Guid[2];
            TrackerDataBlock.DroidBirth[0] = new Guid(Guid);
            Buffer.BlockCopy(ba, 64 + MachineID.Length, Guid, 0, Guid.Length);
            TrackerDataBlock.DroidBirth[1] = new Guid(Guid);

            return(TrackerDataBlock);
        }
예제 #2
0
        /// <inheritdoc />
        public override String ToString()
        {
            StringBuilder builder = new StringBuilder();

            builder.Append(base.ToString());

            if (ConsoleDataBlock != null)
            {
                builder.Append(ConsoleDataBlock.ToString());
            }

            if (ConsoleFEDataBlock != null)
            {
                builder.Append(ConsoleFEDataBlock.ToString());
            }

            if (DarwinDataBlock != null)
            {
                builder.Append(DarwinDataBlock.ToString());
            }

            if (EnvironmentVariableDataBlock != null)
            {
                builder.Append(EnvironmentVariableDataBlock.ToString());
            }

            if (IconEnvironmentDataBlock != null)
            {
                builder.Append(IconEnvironmentDataBlock.ToString());
            }

            if (KnownFolderDataBlock != null)
            {
                builder.Append(KnownFolderDataBlock.ToString());
            }

            if (PropertyStoreDataBlock != null)
            {
                builder.Append(PropertyStoreDataBlock.ToString());
            }

            if (ShimDataBlock != null)
            {
                builder.Append(ShimDataBlock.ToString());
            }

            if (SpecialFolderDataBlock != null)
            {
                builder.Append(SpecialFolderDataBlock.ToString());
            }

            if (TrackerDataBlock != null)
            {
                builder.Append(TrackerDataBlock.ToString());
            }

            if (VistaAndAboveIDListDataBlock != null)
            {
                builder.Append(VistaAndAboveIDListDataBlock.ToString());
            }

            return(builder.ToString());
        }
예제 #3
0
        /// <summary>
        /// Create an ExtraData from a given byte array
        /// </summary>
        /// <param name="ba">The byte array</param>
        /// <returns>An ExtraData object</returns>
        public static ExtraData FromByteArray(byte[] ba)
        {
            ExtraData ExtraData = new ExtraData();

            if (ba.Length < 4)
            {
                throw new ArgumentException(String.Format("Size of the ExtraData Structure is less than 4 ({0})", ba.Length));
            }

            UInt32 BlockSize = BitConverter.ToUInt32(ba, 0);

            while (BlockSize > 4)
            {
                if (BlockSize > ba.Length)
                {
                    throw new ArgumentException(String.Format("BlockSize is {0} is incorrect (bytes left {1})", BlockSize, ba.Length));
                }
                BlockSignature BlockSignature = (BlockSignature)BitConverter.ToUInt32(ba, 4);
                switch (BlockSignature)
                {
                case BlockSignature.CONSOLE_PROPS:
                    ExtraData.ConsoleDataBlock = ConsoleDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.CONSOLE_FE_PROPS:
                    ExtraData.ConsoleFEDataBlock = ConsoleFEDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.DARWIN_PROPS:
                    ExtraData.DarwinDataBlock = DarwinDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.ENVIRONMENT_PROPS:
                    ExtraData.EnvironmentVariableDataBlock = EnvironmentVariableDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.ICON_ENVIRONMENT_PROPS:
                    ExtraData.IconEnvironmentDataBlock = IconEnvironmentDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.KNOWN_FOLDER_PROPS:
                    ExtraData.KnownFolderDataBlock = KnownFolderDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.PROPERTY_STORE_PROPS:
                    ExtraData.PropertyStoreDataBlock = PropertyStoreDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.SHIM_PROPS:
                    ExtraData.ShimDataBlock = ShimDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.SPECIAL_FOLDER_PROPS:
                    ExtraData.SpecialFolderDataBlock = SpecialFolderDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.TRACKER_PROPS:
                    ExtraData.TrackerDataBlock = TrackerDataBlock.FromByteArray(ba);
                    break;

                case BlockSignature.VISTA_AND_ABOVE_IDLIST_PROPS:
                    ExtraData.VistaAndAboveIDListDataBlock = VistaAndAboveIDListDataBlock.FromByteArray(ba);
                    break;

                default:
                    throw new ArgumentException(String.Format("BlockSignature is {0} is incorrect", BlockSignature));
                }
                ba        = ba.Skip((int)BlockSize).ToArray();
                BlockSize = BitConverter.ToUInt32(ba, 0);
            }

            return(ExtraData);
        }
예제 #4
0
        /// <inheritdoc />
        public override byte[] GetBytes()
        {
            int Offset = 0;

            byte[] ExtraData = new byte[ExtraDataSize];

            if (ConsoleDataBlock != null)
            {
                Buffer.BlockCopy(ConsoleDataBlock.GetBytes(), 0, ExtraData, Offset, (int)ConsoleDataBlock.BlockSize);
                Offset += (int)ConsoleDataBlock.BlockSize;
            }

            if (ConsoleFEDataBlock != null)
            {
                Buffer.BlockCopy(ConsoleFEDataBlock.GetBytes(), 0, ExtraData, Offset, (int)ConsoleFEDataBlock.BlockSize);
                Offset += (int)ConsoleFEDataBlock.BlockSize;
            }

            if (DarwinDataBlock != null)
            {
                Buffer.BlockCopy(DarwinDataBlock.GetBytes(), 0, ExtraData, Offset, (int)DarwinDataBlock.BlockSize);
                Offset += (int)DarwinDataBlock.BlockSize;
            }

            if (EnvironmentVariableDataBlock != null)
            {
                Buffer.BlockCopy(EnvironmentVariableDataBlock.GetBytes(), 0, ExtraData, Offset, (int)EnvironmentVariableDataBlock.BlockSize);
                Offset += (int)EnvironmentVariableDataBlock.BlockSize;
            }

            if (IconEnvironmentDataBlock != null)
            {
                Buffer.BlockCopy(IconEnvironmentDataBlock.GetBytes(), 0, ExtraData, Offset, (int)IconEnvironmentDataBlock.BlockSize);
                Offset += (int)IconEnvironmentDataBlock.BlockSize;
            }

            if (KnownFolderDataBlock != null)
            {
                Buffer.BlockCopy(KnownFolderDataBlock.GetBytes(), 0, ExtraData, Offset, (int)KnownFolderDataBlock.BlockSize);
                Offset += (int)KnownFolderDataBlock.BlockSize;
            }

            if (PropertyStoreDataBlock != null)
            {
                Buffer.BlockCopy(PropertyStoreDataBlock.GetBytes(), 0, ExtraData, Offset, (int)PropertyStoreDataBlock.BlockSize);
                Offset += (int)PropertyStoreDataBlock.BlockSize;
            }

            if (ShimDataBlock != null)
            {
                Buffer.BlockCopy(ShimDataBlock.GetBytes(), 0, ExtraData, Offset, (int)ShimDataBlock.BlockSize);
                Offset += (int)ShimDataBlock.BlockSize;
            }

            if (SpecialFolderDataBlock != null)
            {
                Buffer.BlockCopy(SpecialFolderDataBlock.GetBytes(), 0, ExtraData, Offset, (int)SpecialFolderDataBlock.BlockSize);
                Offset += (int)SpecialFolderDataBlock.BlockSize;
            }

            if (TrackerDataBlock != null)
            {
                Buffer.BlockCopy(TrackerDataBlock.GetBytes(), 0, ExtraData, Offset, (int)TrackerDataBlock.BlockSize);
                Offset += (int)TrackerDataBlock.BlockSize;
            }

            if (VistaAndAboveIDListDataBlock != null)
            {
                Buffer.BlockCopy(VistaAndAboveIDListDataBlock.GetBytes(), 0, ExtraData, Offset, (int)VistaAndAboveIDListDataBlock.BlockSize);
                Offset += (int)VistaAndAboveIDListDataBlock.BlockSize;
            }

            Buffer.BlockCopy(TerminalBlock.GetBytes(), 0, ExtraData, Offset, 4);
            return(ExtraData);
        }