Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
Sleuthkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Sleuthkit
Commits
8e5fc7dc
Commit
8e5fc7dc
authored
13 years ago
by
Brian Carrier
Browse files
Options
Downloads
Patches
Plain Diff
Added sample module to framework
parent
df95f4e8
No related branches found
No related tags found
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
framework/SampleModules/CalcFileSize/CalcFileSizeModule.cpp
+117
-0
117 additions, 0 deletions
framework/SampleModules/CalcFileSize/CalcFileSizeModule.cpp
framework/win32/CalcFileSize/CalcFileSize.vcproj
+185
-0
185 additions, 0 deletions
framework/win32/CalcFileSize/CalcFileSize.vcproj
with
302 additions
and
0 deletions
framework/SampleModules/CalcFileSize/CalcFileSizeModule.cpp
0 → 100755
+
117
−
0
View file @
8e5fc7dc
/*
*
* The Sleuth Kit
*
* Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
* Copyright (c) 2010-2011 Basis Technology Corporation. All Rights
* reserved.
*
* This software is distributed under the Common Public License 1.0
*/
/* Sample module that reads a file and posts the size to the blackboard */
#include
<sstream>
#include
<math.h>
#if defined(_WIN32)
#define FILE_SIZE_EXPORT __declspec(dllexport)
#else
#define FILE_SIZE_EXPORT
#endif
// Framework includes
#include
"Pipeline/TskModule.h"
#include
"Services/TskSystemPropertiesImpl.h"
#include
"Services/TskBlackboard.h"
#include
"Services/TskServices.h"
// We process the file 8k at a time
static
const
uint32_t
FILE_BUFFER_SIZE
=
8193
;
extern
"C"
{
/**
* Module initialization function. Takes a string as input that allows
* arguments to be passed into the module.
* @param arguments This module takes no arguments
*/
TskModule
::
Status
FILE_SIZE_EXPORT
initialize
(
std
::
string
&
arguments
)
{
return
TskModule
::
OK
;
}
/**
* The run() method is where the modules work is performed.
* The module will be passed a pointer to a file from which both
* content and metadata can be retrieved.
* @param pFile A pointer to a file to be processed.
* @returns TskModule::OK on success and TskModule::FAIL on error.
*/
TskModule
::
Status
FILE_SIZE_EXPORT
run
(
TskFile
*
pFile
)
{
if
(
pFile
==
NULL
)
{
LOGERROR
(
L"CalcFileSizeModule module passed NULL file pointer."
);
return
TskModule
::
FAIL
;
}
try
{
if
(
!
pFile
->
exists
())
{
std
::
wstringstream
msg
;
msg
<<
L"File to be analyzed does not exist: "
<<
pFile
->
getPath
().
c_str
();
LOGERROR
(
msg
.
str
());
return
TskModule
::
FAIL
;
}
// Open file.
pFile
->
open
();
unsigned
__int8
byte
=
0
;
long
byteCounts
[
256
];
memset
(
byteCounts
,
0
,
sizeof
(
long
)
*
256
);
long
totalBytes
=
0
;
char
buffer
[
FILE_BUFFER_SIZE
];
int
bytesRead
=
0
;
// Read file content into buffer and write it to the DigestOutputStream.
do
{
memset
(
buffer
,
0
,
FILE_BUFFER_SIZE
);
bytesRead
=
pFile
->
read
(
buffer
,
FILE_BUFFER_SIZE
);
totalBytes
+=
bytesRead
;
}
while
(
bytesRead
>
0
);
// Post the digest to the blackboard
TskBlackboard
&
blackboard
=
TskServices
::
Instance
().
getBlackboard
();
blackboard
.
set
(
pFile
->
id
(),
"ByteCount"
,
totalBytes
,
"CalcFileSizeModule"
);
// Close file.
pFile
->
close
();
}
catch
(
TskException
&
tskEx
)
{
std
::
wstringstream
msg
;
msg
<<
L"CalcFileSizeModule - Caught framework exception: "
<<
tskEx
.
what
();
LOGERROR
(
msg
.
str
());
return
TskModule
::
FAIL
;
}
catch
(
std
::
exception
&
ex
)
{
std
::
wstringstream
msg
;
msg
<<
L"CalcFileSizeModule - Caught exception: "
<<
ex
.
what
();
LOGERROR
(
msg
.
str
());
return
TskModule
::
FAIL
;
}
return
TskModule
::
OK
;
}
TskModule
::
Status
FILE_SIZE_EXPORT
finalize
()
{
return
TskModule
::
OK
;
}
}
\ No newline at end of file
This diff is collapsed.
Click to expand it.
framework/win32/CalcFileSize/CalcFileSize.vcproj
0 → 100755
+
185
−
0
View file @
8e5fc7dc
<?xml version="1.0" encoding="Windows-1252"?>
<VisualStudioProject
ProjectType=
"Visual C++"
Version=
"9.00"
Name=
"CalcFileSizeModule"
ProjectGUID=
"{FA3FF845-E341-4BE3-A17F-8042C99A374F}"
RootNamespace=
"CalcFileSize"
Keyword=
"Win32Proj"
TargetFrameworkVersion=
"196613"
>
<Platforms>
<Platform
Name=
"Win32"
/>
</Platforms>
<ToolFiles>
</ToolFiles>
<Configurations>
<Configuration
Name=
"Debug|Win32"
OutputDirectory=
"$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory=
"$(ConfigurationName)"
ConfigurationType=
"2"
CharacterSet=
"1"
>
<Tool
Name=
"VCPreBuildEventTool"
/>
<Tool
Name=
"VCCustomBuildTool"
/>
<Tool
Name=
"VCXMLDataGeneratorTool"
/>
<Tool
Name=
"VCWebServiceProxyGeneratorTool"
/>
<Tool
Name=
"VCMIDLTool"
/>
<Tool
Name=
"VCCLCompilerTool"
Optimization=
"0"
AdditionalIncludeDirectories=
""$(ProjectDir)\..\..\..";"$(ProjectDir)\..\..";"$(POCO_HOME)\Foundation\include";"$(POCO_HOME)\Util\include""
PreprocessorDefinitions=
"WIN32;_DEBUG;_WINDOWS;_USRDLL;CALCFILESIZE_EXPORTS"
MinimalRebuild=
"true"
BasicRuntimeChecks=
"3"
RuntimeLibrary=
"3"
UsePrecompiledHeader=
"0"
WarningLevel=
"3"
DebugInformationFormat=
"4"
/>
<Tool
Name=
"VCManagedResourceCompilerTool"
/>
<Tool
Name=
"VCResourceCompilerTool"
/>
<Tool
Name=
"VCPreLinkEventTool"
/>
<Tool
Name=
"VCLinkerTool"
LinkIncremental=
"2"
AdditionalLibraryDirectories=
""$(POCO_HOME)\lib""
GenerateDebugInformation=
"true"
SubSystem=
"2"
TargetMachine=
"1"
/>
<Tool
Name=
"VCALinkTool"
/>
<Tool
Name=
"VCManifestTool"
/>
<Tool
Name=
"VCXDCMakeTool"
/>
<Tool
Name=
"VCBscMakeTool"
/>
<Tool
Name=
"VCFxCopTool"
/>
<Tool
Name=
"VCAppVerifierTool"
/>
<Tool
Name=
"VCPostBuildEventTool"
/>
</Configuration>
<Configuration
Name=
"Release|Win32"
OutputDirectory=
"$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory=
"$(ConfigurationName)"
ConfigurationType=
"2"
CharacterSet=
"1"
WholeProgramOptimization=
"1"
>
<Tool
Name=
"VCPreBuildEventTool"
/>
<Tool
Name=
"VCCustomBuildTool"
/>
<Tool
Name=
"VCXMLDataGeneratorTool"
/>
<Tool
Name=
"VCWebServiceProxyGeneratorTool"
/>
<Tool
Name=
"VCMIDLTool"
/>
<Tool
Name=
"VCCLCompilerTool"
Optimization=
"2"
EnableIntrinsicFunctions=
"true"
AdditionalIncludeDirectories=
""$(ProjectDir)\..\..\..";"$(ProjectDir)\..\..";"$(POCO_HOME)\Foundation\include";"$(POCO_HOME)\Util\include""
PreprocessorDefinitions=
"WIN32;NDEBUG;_WINDOWS;_USRDLL;CALCFILESIZE_EXPORTS"
RuntimeLibrary=
"2"
EnableFunctionLevelLinking=
"true"
UsePrecompiledHeader=
"2"
WarningLevel=
"3"
DebugInformationFormat=
"3"
/>
<Tool
Name=
"VCManagedResourceCompilerTool"
/>
<Tool
Name=
"VCResourceCompilerTool"
/>
<Tool
Name=
"VCPreLinkEventTool"
/>
<Tool
Name=
"VCLinkerTool"
LinkIncremental=
"1"
AdditionalLibraryDirectories=
""$(POCO_HOME)\lib""
GenerateDebugInformation=
"true"
SubSystem=
"2"
OptimizeReferences=
"2"
EnableCOMDATFolding=
"2"
TargetMachine=
"1"
/>
<Tool
Name=
"VCALinkTool"
/>
<Tool
Name=
"VCManifestTool"
/>
<Tool
Name=
"VCXDCMakeTool"
/>
<Tool
Name=
"VCBscMakeTool"
/>
<Tool
Name=
"VCFxCopTool"
/>
<Tool
Name=
"VCAppVerifierTool"
/>
<Tool
Name=
"VCPostBuildEventTool"
/>
</Configuration>
</Configurations>
<References>
</References>
<Files>
<Filter
Name=
"Source Files"
Filter=
"cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
UniqueIdentifier=
"{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
>
<File
RelativePath=
"..\..\SampleModules\CalcFileSize\CalcFileSizeModule.cpp"
>
</File>
</Filter>
</Files>
<Globals>
</Globals>
</VisualStudioProject>
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment