How to use the plaso.lib.py2to3 function in plaso

To help you get started, we’ve selected a few plaso examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github log2timeline / plaso / plaso / output / manager.py View on Github external
def GetOutputClass(cls, name):
    """Retrieves the output class for a specific name.

    Args:
      name (str): name of the output module.

    Returns:
      type: output module class.

    Raises:
      KeyError: if there is no output class found with the supplied name.
      ValueError: if name is not a string.
    """
    if not isinstance(name, py2to3.STRING_TYPES):
      raise ValueError('Name attribute is not a string.')

    name = name.lower()
    if name not in cls._output_classes:
      raise KeyError(
          'Name: [{0:s}] not registered as an output module.'.format(name))

    return cls._output_classes[name]
github log2timeline / plaso / plaso / formatters / olecf.py View on Github external
event_values = event_data.CopyToDict()

    security = event_values.get('security', None)
    if security:
      security_flags = []
      for flag, description in iter(self._SECURITY_VALUES.items()):
        if security & flag:
          security_flags.append(description)

      security_string = '0x{0:08x}: {1:s}'.format(
          security, ','.join(security_flags))

      event_values['security'] = security_string

    for key, value in iter(event_values.items()):
      if isinstance(value, py2to3.BYTES_TYPE):
        event_values[key] = repr(value)

    return self._ConditionalFormatMessages(event_values)
github log2timeline / plaso / plaso / output / shared_elastic.py View on Github external
event_values = {}
    for attribute_name, attribute_value in event_data.GetAttributes():
      # TODO: remove regvalue, which is kept for backwards compatibility.
      # Ignore the regvalue attribute as it cause issues when indexing.
      if attribute_name == 'regvalue':
        continue

      if attribute_name == 'pathspec':
        try:
          attribute_value = JsonPathSpecSerializer.WriteSerialized(
              attribute_value)
        except TypeError:
          continue
      event_values[attribute_name] = attribute_value

      if isinstance(attribute_value, py2to3.BYTES_TYPE):
        # Some parsers have written bytes values to storage.
        attribute_value = attribute_value.decode('utf-8', 'replace')
        logger.warning(
            'Found bytes value for attribute "{0:s}" for data type: '
            '{1!s}. Value was converted to UTF-8: "{2:s}"'.format(
                attribute_name, event_data.data_type, attribute_value))
        event_values[attribute_name] = attribute_value

    # Add a string representation of the timestamp.
    try:
      attribute_value = timelib.Timestamp.RoundToSeconds(event.timestamp)
    except TypeError as exception:
      logger.warning((
          'Unable to round timestamp {0!s}. error: {1!s}. '
          'Defaulting to 0').format(event.timestamp, exception))
      attribute_value = 0
github log2timeline / plaso / plaso / parsers / esedb_plugins / msie_webcache.py View on Github external
redirect_url = record_values.get('RedirectUrl', None)
        sync_count = record_values.get('SyncCount', None)

        url = record_values.get('Url', '')
        # Ignore an URL that start with a binary value.
        if ord(url[0]) < 0x20 or ord(url[0]) == 0x7f:
          url = None

        request_headers = record_values.get('RequestHeaders', None)
        # Ignore non-Unicode request headers values.
        if not isinstance(request_headers, py2to3.UNICODE_TYPE):
          request_headers = None

        response_headers = record_values.get('ResponseHeaders', None)
        # Ignore non-Unicode response headers values.
        if not isinstance(response_headers, py2to3.UNICODE_TYPE):
          response_headers = None

        event_data = MsieWebCacheContainerEventData()
        event_data.access_count = access_count
        event_data.cached_filename = cached_filename
        event_data.cached_file_size = cached_file_size
        event_data.cache_identifier = cache_identifier
        event_data.container_identifier = container_identifier
        event_data.entry_identifier = entry_identifier
        event_data.file_extension = file_extension
        event_data.redirect_url = redirect_url
        event_data.request_headers = request_headers
        event_data.response_headers = response_headers
        event_data.sync_count = sync_count
        event_data.url = url
github log2timeline / plaso / plaso / lib / binary.py View on Github external
def ReadUTF16(string_buffer):
  """Returns a decoded UTF-16 string from a string buffer.

  Args:
    string_buffer(bytes): byte string.

  Returns:
    str: Unicode string.
  """
  if isinstance(string_buffer, (list, tuple)):
    use_buffer = ''.join(string_buffer)
  else:
    use_buffer = string_buffer

  if not isinstance(use_buffer, py2to3.BYTES_TYPE):
    return ''

  try:
    return codecs.decode(use_buffer, 'utf-16').replace('\x00', '')
  except SyntaxError as exception:
    logging.error('Unable to decode string: {0:s} with error: {1!s}.'.format(
        HexifyBuffer(string_buffer), exception))
  except (UnicodeDecodeError, UnicodeEncodeError) as exception:
    logging.error('Unable to decode string: {0:s} with error: {1!s}'.format(
        HexifyBuffer(string_buffer), exception))

  return codecs.decode(
      use_buffer, 'utf-16', errors='ignore').replace('\x00', '')
github log2timeline / plaso / plaso / lib / binary.py View on Github external
This is a little complicated because of the necessity of supporting Python 2
  and 3.

  Args:
    byte_stream (bytes): byte string.
    offset (int): byte stream offset to check.

  Returns:
    bool: whether there's a UTF-16 null terminator in the stream at the given
        offset.
  """
  byte_1 = byte_stream[offset]
  byte_2 = byte_stream[offset + 1]
  if py2to3.PY_2 and byte_1 == b'\x00' and byte_2 == b'\x00':
    return True
  if py2to3.PY_3 and byte_1 == 0 and byte_2 == 0:
    return True
  return False
github log2timeline / plaso / plaso / output / l2t_csv.py View on Github external
def _WriteOutputValues(self, output_values):
    """Writes values to the output.

    Args:
      output_values (list[str]): output values.
    """
    for index, value in enumerate(output_values):
      if not isinstance(value, py2to3.STRING_TYPES):
        value = ''
      output_values[index] = value.replace(',', ' ')

    output_line = ','.join(output_values)
    output_line = '{0:s}\n'.format(output_line)
    self._output_writer.Write(output_line)
github log2timeline / plaso / plaso / output / manager.py View on Github external
def HasOutputClass(cls, name):
    """Determines if a specific output class is registered with the manager.

    Args:
      name (str): name of the output module.

    Returns:
      bool: True if the output class is registered.
    """
    if not isinstance(name, py2to3.STRING_TYPES):
      return False

    return name.lower() in cls._output_classes