diff --git a/framework/SampleModules/CalcFileSize/CalcFileSizeModule.cpp b/framework/SampleModules/CalcFileSize/CalcFileSizeModule.cpp new file mode 100755 index 0000000000000000000000000000000000000000..6e161b63bdd51d7c4f411ac52061e9d1672690fc --- /dev/null +++ b/framework/SampleModules/CalcFileSize/CalcFileSizeModule.cpp @@ -0,0 +1,117 @@ +/* + * + * The Sleuth Kit + * + * Contact: Brian Carrier [carrier <at> sleuthkit [dot] org] + * Copyright (c) 2010-2011 Basis Technology Corporation. All Rights + * reserved. + * + * This software is distributed under the Common Public License 1.0 + */ + + +/* Sample module that reads a file and posts the size to the blackboard */ + +#include <sstream> +#include <math.h> + +#if defined(_WIN32) + #define FILE_SIZE_EXPORT __declspec(dllexport) +#else + #define FILE_SIZE_EXPORT +#endif + + +// Framework includes +#include "Pipeline/TskModule.h" +#include "Services/TskSystemPropertiesImpl.h" +#include "Services/TskBlackboard.h" +#include "Services/TskServices.h" + +// We process the file 8k at a time +static const uint32_t FILE_BUFFER_SIZE = 8193; + +extern "C" +{ + /** + * Module initialization function. Takes a string as input that allows + * arguments to be passed into the module. + * @param arguments This module takes no arguments + */ + TskModule::Status FILE_SIZE_EXPORT initialize(std::string& arguments) + { + return TskModule::OK; + } + /** + * The run() method is where the modules work is performed. + * The module will be passed a pointer to a file from which both + * content and metadata can be retrieved. + * @param pFile A pointer to a file to be processed. + * @returns TskModule::OK on success and TskModule::FAIL on error. + */ + TskModule::Status FILE_SIZE_EXPORT run(TskFile * pFile) + { + if (pFile == NULL) + { + LOGERROR(L"CalcFileSizeModule module passed NULL file pointer."); + return TskModule::FAIL; + } + + try + { + if (!pFile->exists()) + { + std::wstringstream msg; + msg << L"File to be analyzed does not exist: " << pFile->getPath().c_str(); + LOGERROR(msg.str()); + return TskModule::FAIL; + } + + // Open file. + pFile->open(); + + unsigned __int8 byte = 0; + long byteCounts[256]; + memset(byteCounts, 0, sizeof(long) * 256); + long totalBytes = 0; + char buffer[FILE_BUFFER_SIZE]; + int bytesRead = 0; + + // Read file content into buffer and write it to the DigestOutputStream. + do + { + memset(buffer, 0, FILE_BUFFER_SIZE); + bytesRead = pFile->read(buffer, FILE_BUFFER_SIZE); + totalBytes += bytesRead; + } while (bytesRead > 0); + + // Post the digest to the blackboard + TskBlackboard& blackboard = TskServices::Instance().getBlackboard(); + + blackboard.set(pFile->id(), "ByteCount", totalBytes, "CalcFileSizeModule"); + + // Close file. + pFile->close(); + } + catch (TskException& tskEx) + { + std::wstringstream msg; + msg << L"CalcFileSizeModule - Caught framework exception: " << tskEx.what(); + LOGERROR(msg.str()); + return TskModule::FAIL; + } + catch (std::exception& ex) + { + std::wstringstream msg; + msg << L"CalcFileSizeModule - Caught exception: " << ex.what(); + LOGERROR(msg.str()); + return TskModule::FAIL; + } + return TskModule::OK; + } + + TskModule::Status FILE_SIZE_EXPORT finalize() + { + return TskModule::OK; + } +} \ No newline at end of file diff --git a/framework/win32/CalcFileSize/CalcFileSize.vcproj b/framework/win32/CalcFileSize/CalcFileSize.vcproj new file mode 100755 index 0000000000000000000000000000000000000000..ace1270f8f3c7bcc20010ea53f9b9294b8813ba4 --- /dev/null +++ b/framework/win32/CalcFileSize/CalcFileSize.vcproj @@ -0,0 +1,185 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<VisualStudioProject + ProjectType="Visual C++" + Version="9.00" + Name="CalcFileSizeModule" + ProjectGUID="{FA3FF845-E341-4BE3-A17F-8042C99A374F}" + RootNamespace="CalcFileSize" + Keyword="Win32Proj" + TargetFrameworkVersion="196613" + > + <Platforms> + <Platform + Name="Win32" + /> + </Platforms> + <ToolFiles> + </ToolFiles> + <Configurations> + <Configuration + Name="Debug|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="2" + CharacterSet="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="0" + AdditionalIncludeDirectories=""$(ProjectDir)\..\..\..";"$(ProjectDir)\..\..";"$(POCO_HOME)\Foundation\include";"$(POCO_HOME)\Util\include"" + PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;CALCFILESIZE_EXPORTS" + MinimalRebuild="true" + BasicRuntimeChecks="3" + RuntimeLibrary="3" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="4" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="2" + AdditionalLibraryDirectories=""$(POCO_HOME)\lib"" + GenerateDebugInformation="true" + SubSystem="2" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + <Configuration + Name="Release|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="2" + CharacterSet="1" + WholeProgramOptimization="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="2" + EnableIntrinsicFunctions="true" + AdditionalIncludeDirectories=""$(ProjectDir)\..\..\..";"$(ProjectDir)\..\..";"$(POCO_HOME)\Foundation\include";"$(POCO_HOME)\Util\include"" + PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;CALCFILESIZE_EXPORTS" + RuntimeLibrary="2" + EnableFunctionLevelLinking="true" + UsePrecompiledHeader="2" + WarningLevel="3" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="1" + AdditionalLibraryDirectories=""$(POCO_HOME)\lib"" + GenerateDebugInformation="true" + SubSystem="2" + OptimizeReferences="2" + EnableCOMDATFolding="2" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + </Configurations> + <References> + </References> + <Files> + <Filter + Name="Source Files" + Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx" + UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}" + > + <File + RelativePath="..\..\SampleModules\CalcFileSize\CalcFileSizeModule.cpp" + > + </File> + </Filter> + </Files> + <Globals> + </Globals> +</VisualStudioProject>