Skip to content
Snippets Groups Projects
Commit 8e5fc7dc authored by Brian Carrier's avatar Brian Carrier
Browse files

Added sample module to framework

parent df95f4e8
No related branches found
No related tags found
No related merge requests found
/*
*
* The Sleuth Kit
*
* Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
* Copyright (c) 2010-2011 Basis Technology Corporation. All Rights
* reserved.
*
* This software is distributed under the Common Public License 1.0
*/
/* Sample module that reads a file and posts the size to the blackboard */
#include <sstream>
#include <math.h>
#if defined(_WIN32)
#define FILE_SIZE_EXPORT __declspec(dllexport)
#else
#define FILE_SIZE_EXPORT
#endif
// Framework includes
#include "Pipeline/TskModule.h"
#include "Services/TskSystemPropertiesImpl.h"
#include "Services/TskBlackboard.h"
#include "Services/TskServices.h"
// We process the file 8k at a time
static const uint32_t FILE_BUFFER_SIZE = 8193;
extern "C"
{
/**
* Module initialization function. Takes a string as input that allows
* arguments to be passed into the module.
* @param arguments This module takes no arguments
*/
TskModule::Status FILE_SIZE_EXPORT initialize(std::string& arguments)
{
return TskModule::OK;
}
/**
* The run() method is where the modules work is performed.
* The module will be passed a pointer to a file from which both
* content and metadata can be retrieved.
* @param pFile A pointer to a file to be processed.
* @returns TskModule::OK on success and TskModule::FAIL on error.
*/
TskModule::Status FILE_SIZE_EXPORT run(TskFile * pFile)
{
if (pFile == NULL)
{
LOGERROR(L"CalcFileSizeModule module passed NULL file pointer.");
return TskModule::FAIL;
}
try
{
if (!pFile->exists())
{
std::wstringstream msg;
msg << L"File to be analyzed does not exist: " << pFile->getPath().c_str();
LOGERROR(msg.str());
return TskModule::FAIL;
}
// Open file.
pFile->open();
unsigned __int8 byte = 0;
long byteCounts[256];
memset(byteCounts, 0, sizeof(long) * 256);
long totalBytes = 0;
char buffer[FILE_BUFFER_SIZE];
int bytesRead = 0;
// Read file content into buffer and write it to the DigestOutputStream.
do
{
memset(buffer, 0, FILE_BUFFER_SIZE);
bytesRead = pFile->read(buffer, FILE_BUFFER_SIZE);
totalBytes += bytesRead;
} while (bytesRead > 0);
// Post the digest to the blackboard
TskBlackboard& blackboard = TskServices::Instance().getBlackboard();
blackboard.set(pFile->id(), "ByteCount", totalBytes, "CalcFileSizeModule");
// Close file.
pFile->close();
}
catch (TskException& tskEx)
{
std::wstringstream msg;
msg << L"CalcFileSizeModule - Caught framework exception: " << tskEx.what();
LOGERROR(msg.str());
return TskModule::FAIL;
}
catch (std::exception& ex)
{
std::wstringstream msg;
msg << L"CalcFileSizeModule - Caught exception: " << ex.what();
LOGERROR(msg.str());
return TskModule::FAIL;
}
return TskModule::OK;
}
TskModule::Status FILE_SIZE_EXPORT finalize()
{
return TskModule::OK;
}
}
\ No newline at end of file
<?xml version="1.0" encoding="Windows-1252"?>
<VisualStudioProject
ProjectType="Visual C++"
Version="9.00"
Name="CalcFileSizeModule"
ProjectGUID="{FA3FF845-E341-4BE3-A17F-8042C99A374F}"
RootNamespace="CalcFileSize"
Keyword="Win32Proj"
TargetFrameworkVersion="196613"
>
<Platforms>
<Platform
Name="Win32"
/>
</Platforms>
<ToolFiles>
</ToolFiles>
<Configurations>
<Configuration
Name="Debug|Win32"
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory="$(ConfigurationName)"
ConfigurationType="2"
CharacterSet="1"
>
<Tool
Name="VCPreBuildEventTool"
/>
<Tool
Name="VCCustomBuildTool"
/>
<Tool
Name="VCXMLDataGeneratorTool"
/>
<Tool
Name="VCWebServiceProxyGeneratorTool"
/>
<Tool
Name="VCMIDLTool"
/>
<Tool
Name="VCCLCompilerTool"
Optimization="0"
AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\..&quot;;&quot;$(ProjectDir)\..\..&quot;;&quot;$(POCO_HOME)\Foundation\include&quot;;&quot;$(POCO_HOME)\Util\include&quot;"
PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;CALCFILESIZE_EXPORTS"
MinimalRebuild="true"
BasicRuntimeChecks="3"
RuntimeLibrary="3"
UsePrecompiledHeader="0"
WarningLevel="3"
DebugInformationFormat="4"
/>
<Tool
Name="VCManagedResourceCompilerTool"
/>
<Tool
Name="VCResourceCompilerTool"
/>
<Tool
Name="VCPreLinkEventTool"
/>
<Tool
Name="VCLinkerTool"
LinkIncremental="2"
AdditionalLibraryDirectories="&quot;$(POCO_HOME)\lib&quot;"
GenerateDebugInformation="true"
SubSystem="2"
TargetMachine="1"
/>
<Tool
Name="VCALinkTool"
/>
<Tool
Name="VCManifestTool"
/>
<Tool
Name="VCXDCMakeTool"
/>
<Tool
Name="VCBscMakeTool"
/>
<Tool
Name="VCFxCopTool"
/>
<Tool
Name="VCAppVerifierTool"
/>
<Tool
Name="VCPostBuildEventTool"
/>
</Configuration>
<Configuration
Name="Release|Win32"
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory="$(ConfigurationName)"
ConfigurationType="2"
CharacterSet="1"
WholeProgramOptimization="1"
>
<Tool
Name="VCPreBuildEventTool"
/>
<Tool
Name="VCCustomBuildTool"
/>
<Tool
Name="VCXMLDataGeneratorTool"
/>
<Tool
Name="VCWebServiceProxyGeneratorTool"
/>
<Tool
Name="VCMIDLTool"
/>
<Tool
Name="VCCLCompilerTool"
Optimization="2"
EnableIntrinsicFunctions="true"
AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\..&quot;;&quot;$(ProjectDir)\..\..&quot;;&quot;$(POCO_HOME)\Foundation\include&quot;;&quot;$(POCO_HOME)\Util\include&quot;"
PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;CALCFILESIZE_EXPORTS"
RuntimeLibrary="2"
EnableFunctionLevelLinking="true"
UsePrecompiledHeader="2"
WarningLevel="3"
DebugInformationFormat="3"
/>
<Tool
Name="VCManagedResourceCompilerTool"
/>
<Tool
Name="VCResourceCompilerTool"
/>
<Tool
Name="VCPreLinkEventTool"
/>
<Tool
Name="VCLinkerTool"
LinkIncremental="1"
AdditionalLibraryDirectories="&quot;$(POCO_HOME)\lib&quot;"
GenerateDebugInformation="true"
SubSystem="2"
OptimizeReferences="2"
EnableCOMDATFolding="2"
TargetMachine="1"
/>
<Tool
Name="VCALinkTool"
/>
<Tool
Name="VCManifestTool"
/>
<Tool
Name="VCXDCMakeTool"
/>
<Tool
Name="VCBscMakeTool"
/>
<Tool
Name="VCFxCopTool"
/>
<Tool
Name="VCAppVerifierTool"
/>
<Tool
Name="VCPostBuildEventTool"
/>
</Configuration>
</Configurations>
<References>
</References>
<Files>
<Filter
Name="Source Files"
Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
>
<File
RelativePath="..\..\SampleModules\CalcFileSize\CalcFileSizeModule.cpp"
>
</File>
</Filter>
</Files>
<Globals>
</Globals>
</VisualStudioProject>
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment