Commit 2a93f6491dec605d979333e7de4d3b9078afde7b

Authored by Imanol-Mikel Barba Sabariego
1 parent 40231d86

By design, shared vars won't exist so they can be redefined differently for diff…

…erent modules without interference. ntfsvol var and script written.
.idea/workspace.xml
... ... @@ -2,15 +2,15 @@
2 2 <project version="4">
3 3 <component name="ChangeListManager">
4 4 <list default="true" id="33419617-7da8-422e-9ac6-68e0b317ebf8" name="Default" comment="">
5   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/.idea/vcs.xml" />
6   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/digger.py" />
7   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/module.py" />
8   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/modules/__init__.py" />
9   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/modules/mft.py" />
10   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/modulevar.py" />
11   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/dig.service" />
12   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/digger.sh" />
13   - <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/vars/ntfsvol.py" />
  5 + <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/runcmd.py" />
  6 + <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/list_ntfs.sh" />
  7 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/.idea/workspace.xml" afterPath="$PROJECT_DIR$/.idea/workspace.xml" />
  8 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/digger.py" afterPath="$PROJECT_DIR$/digger.py" />
  9 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/module.py" afterPath="$PROJECT_DIR$/module.py" />
  10 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/modules/mft.py" afterPath="$PROJECT_DIR$/modules/mft.py" />
  11 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/modulevar.py" afterPath="$PROJECT_DIR$/modulevar.py" />
  12 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/scripts/digger.sh" afterPath="$PROJECT_DIR$/scripts/digger.sh" />
  13 + <change type="MODIFICATION" beforePath="$PROJECT_DIR$/vars/ntfsvol.py" afterPath="$PROJECT_DIR$/vars/ntfsvol.py" />
14 14 </list>
15 15 <ignored path="gravedigger.iws" />
16 16 <ignored path=".idea/workspace.xml" />
... ... @@ -24,7 +24,7 @@
24 24 </component>
25 25 <component name="ChangesViewManager" flattened_view="true" show_ignored="false" />
26 26 <component name="CoverageDataManager">
27   - <SUITE FILE_PATH="coverage/gravedigger$digger.coverage" NAME="digger Coverage Results" MODIFIED="1477298273841" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$" />
  27 + <SUITE FILE_PATH="coverage/gravedigger$digger.coverage" NAME="digger Coverage Results" MODIFIED="1477314874684" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$" />
28 28 </component>
29 29 <component name="CreatePatchCommitExecutor">
30 30 <option name="PATCH_PATH" value="" />
... ... @@ -39,17 +39,27 @@
39 39 <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
40 40 <provider selected="true" editor-type-id="text-editor">
41 41 <state relative-caret-position="133">
42   - <caret line="7" column="39" selection-start-line="7" selection-start-column="39" selection-end-line="7" selection-end-column="39" />
  42 + <caret line="7" column="26" selection-start-line="7" selection-start-column="26" selection-end-line="7" selection-end-column="26" />
43 43 <folding />
44 44 </state>
45 45 </provider>
46 46 </entry>
47 47 </file>
48   - <file leaf-file-name="digger.py" pinned="false" current-in-tab="true">
  48 + <file leaf-file-name="digger.py" pinned="false" current-in-tab="false">
49 49 <entry file="file://$PROJECT_DIR$/digger.py">
50 50 <provider selected="true" editor-type-id="text-editor">
51   - <state relative-caret-position="57">
52   - <caret line="3" column="25" selection-start-line="3" selection-start-column="25" selection-end-line="3" selection-end-column="25" />
  51 + <state relative-caret-position="-152">
  52 + <caret line="7" column="0" selection-start-line="7" selection-start-column="0" selection-end-line="7" selection-end-column="23" />
  53 + <folding />
  54 + </state>
  55 + </provider>
  56 + </entry>
  57 + </file>
  58 + <file leaf-file-name="runcmd.py" pinned="false" current-in-tab="true">
  59 + <entry file="file://$PROJECT_DIR$/runcmd.py">
  60 + <provider selected="true" editor-type-id="text-editor">
  61 + <state relative-caret-position="38">
  62 + <caret line="2" column="18" selection-start-line="2" selection-start-column="18" selection-end-line="2" selection-end-column="18" />
53 63 <folding />
54 64 </state>
55 65 </provider>
... ... @@ -58,8 +68,8 @@
58 68 <file leaf-file-name="module.py" pinned="false" current-in-tab="false">
59 69 <entry file="file://$PROJECT_DIR$/module.py">
60 70 <provider selected="true" editor-type-id="text-editor">
61   - <state relative-caret-position="95">
62   - <caret line="5" column="19" selection-start-line="5" selection-start-column="19" selection-end-line="5" selection-end-column="19" />
  71 + <state relative-caret-position="304">
  72 + <caret line="16" column="58" selection-start-line="16" selection-start-column="58" selection-end-line="16" selection-end-column="58" />
63 73 <folding />
64 74 </state>
65 75 </provider>
... ... @@ -68,8 +78,20 @@
68 78 <file leaf-file-name="ntfsvol.py" pinned="false" current-in-tab="false">
69 79 <entry file="file://$PROJECT_DIR$/vars/ntfsvol.py">
70 80 <provider selected="true" editor-type-id="text-editor">
71   - <state relative-caret-position="247">
72   - <caret line="13" column="41" selection-start-line="13" selection-start-column="41" selection-end-line="13" selection-end-column="41" />
  81 + <state relative-caret-position="542">
  82 + <caret line="32" column="29" selection-start-line="32" selection-start-column="29" selection-end-line="32" selection-end-column="29" />
  83 + <folding>
  84 + <element signature="e#0#31#0" expanded="true" />
  85 + </folding>
  86 + </state>
  87 + </provider>
  88 + </entry>
  89 + </file>
  90 + <file leaf-file-name="list_ntfs.sh" pinned="false" current-in-tab="false">
  91 + <entry file="file://$PROJECT_DIR$/scripts/list_ntfs.sh">
  92 + <provider selected="true" editor-type-id="text-editor">
  93 + <state relative-caret-position="38">
  94 + <caret line="2" column="83" selection-start-line="2" selection-start-column="83" selection-end-line="2" selection-end-column="83" />
73 95 <folding />
74 96 </state>
75 97 </provider>
... ... @@ -78,8 +100,8 @@
78 100 <file leaf-file-name="mft.py" pinned="false" current-in-tab="false">
79 101 <entry file="file://$PROJECT_DIR$/modules/mft.py">
80 102 <provider selected="true" editor-type-id="text-editor">
81   - <state relative-caret-position="266">
82   - <caret line="14" column="12" selection-start-line="14" selection-start-column="12" selection-end-line="14" selection-end-column="12" />
  103 + <state relative-caret-position="285">
  104 + <caret line="15" column="52" selection-start-line="15" selection-start-column="52" selection-end-line="15" selection-end-column="52" />
83 105 <folding />
84 106 </state>
85 107 </provider>
... ... @@ -88,8 +110,8 @@
88 110 <file leaf-file-name="modulevar.py" pinned="false" current-in-tab="false">
89 111 <entry file="file://$PROJECT_DIR$/modulevar.py">
90 112 <provider selected="true" editor-type-id="text-editor">
91   - <state relative-caret-position="171">
92   - <caret line="9" column="29" selection-start-line="9" selection-start-column="29" selection-end-line="9" selection-end-column="29" />
  113 + <state relative-caret-position="114">
  114 + <caret line="6" column="21" selection-start-line="6" selection-start-column="21" selection-end-line="6" selection-end-column="21" />
93 115 <folding />
94 116 </state>
95 117 </provider>
... ... @@ -134,10 +156,13 @@
134 156 <option value="$PROJECT_DIR$/dig.service" />
135 157 <option value="$PROJECT_DIR$/modules/module.py" />
136 158 <option value="$PROJECT_DIR$/modulevar.py" />
137   - <option value="$PROJECT_DIR$/modules/mft.py" />
138   - <option value="$PROJECT_DIR$/vars/ntfsvol.py" />
139   - <option value="$PROJECT_DIR$/module.py" />
140 159 <option value="$PROJECT_DIR$/digger.py" />
  160 + <option value="$PROJECT_DIR$/module.py" />
  161 + <option value="$PROJECT_DIR$/scripts/digger.sh" />
  162 + <option value="$PROJECT_DIR$/runcmd.py" />
  163 + <option value="$PROJECT_DIR$/vars/ntfsvol.py" />
  164 + <option value="$PROJECT_DIR$/modules/mft.py" />
  165 + <option value="$PROJECT_DIR$/scripts/list_ntfs.sh" />
141 166 </list>
142 167 </option>
143 168 </component>
... ... @@ -536,58 +561,76 @@
536 561 </state>
537 562 </provider>
538 563 </entry>
539   - <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
  564 + <entry file="file://$PROJECT_DIR$/modules/__init__.py">
540 565 <provider selected="true" editor-type-id="text-editor">
541   - <state relative-caret-position="133">
542   - <caret line="7" column="39" selection-start-line="7" selection-start-column="39" selection-end-line="7" selection-end-column="39" />
  566 + <state relative-caret-position="0">
  567 + <caret line="0" column="0" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
543 568 <folding />
544 569 </state>
545 570 </provider>
546 571 </entry>
547   - <entry file="file://$PROJECT_DIR$/modules/__init__.py">
  572 + <entry file="file://$PROJECT_DIR$/modulevar.py">
548 573 <provider selected="true" editor-type-id="text-editor">
549   - <state relative-caret-position="0">
550   - <caret line="0" column="0" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
  574 + <state relative-caret-position="114">
  575 + <caret line="6" column="21" selection-start-line="6" selection-start-column="21" selection-end-line="6" selection-end-column="21" />
551 576 <folding />
552 577 </state>
553 578 </provider>
554 579 </entry>
555   - <entry file="file://$PROJECT_DIR$/modulevar.py">
  580 + <entry file="file://$PROJECT_DIR$/digger.py">
556 581 <provider selected="true" editor-type-id="text-editor">
557   - <state relative-caret-position="171">
558   - <caret line="9" column="29" selection-start-line="9" selection-start-column="29" selection-end-line="9" selection-end-column="29" />
  582 + <state relative-caret-position="-152">
  583 + <caret line="7" column="0" selection-start-line="7" selection-start-column="0" selection-end-line="7" selection-end-column="23" />
559 584 <folding />
560 585 </state>
561 586 </provider>
562 587 </entry>
563   - <entry file="file://$PROJECT_DIR$/vars/ntfsvol.py">
  588 + <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
  589 + <provider selected="true" editor-type-id="text-editor">
  590 + <state relative-caret-position="133">
  591 + <caret line="7" column="26" selection-start-line="7" selection-start-column="26" selection-end-line="7" selection-end-column="26" />
  592 + <folding />
  593 + </state>
  594 + </provider>
  595 + </entry>
  596 + <entry file="file://$PROJECT_DIR$/module.py">
564 597 <provider selected="true" editor-type-id="text-editor">
565   - <state relative-caret-position="247">
566   - <caret line="13" column="41" selection-start-line="13" selection-start-column="41" selection-end-line="13" selection-end-column="41" />
  598 + <state relative-caret-position="304">
  599 + <caret line="16" column="58" selection-start-line="16" selection-start-column="58" selection-end-line="16" selection-end-column="58" />
567 600 <folding />
568 601 </state>
569 602 </provider>
570 603 </entry>
571 604 <entry file="file://$PROJECT_DIR$/modules/mft.py">
572 605 <provider selected="true" editor-type-id="text-editor">
573   - <state relative-caret-position="266">
574   - <caret line="14" column="12" selection-start-line="14" selection-start-column="12" selection-end-line="14" selection-end-column="12" />
  606 + <state relative-caret-position="285">
  607 + <caret line="15" column="52" selection-start-line="15" selection-start-column="52" selection-end-line="15" selection-end-column="52" />
575 608 <folding />
576 609 </state>
577 610 </provider>
578 611 </entry>
579   - <entry file="file://$PROJECT_DIR$/module.py">
  612 + <entry file="file://$PROJECT_DIR$/vars/ntfsvol.py">
580 613 <provider selected="true" editor-type-id="text-editor">
581   - <state relative-caret-position="95">
582   - <caret line="5" column="19" selection-start-line="5" selection-start-column="19" selection-end-line="5" selection-end-column="19" />
  614 + <state relative-caret-position="542">
  615 + <caret line="32" column="29" selection-start-line="32" selection-start-column="29" selection-end-line="32" selection-end-column="29" />
  616 + <folding>
  617 + <element signature="e#0#31#0" expanded="true" />
  618 + </folding>
  619 + </state>
  620 + </provider>
  621 + </entry>
  622 + <entry file="file://$PROJECT_DIR$/scripts/list_ntfs.sh">
  623 + <provider selected="true" editor-type-id="text-editor">
  624 + <state relative-caret-position="38">
  625 + <caret line="2" column="83" selection-start-line="2" selection-start-column="83" selection-end-line="2" selection-end-column="83" />
583 626 <folding />
584 627 </state>
585 628 </provider>
586 629 </entry>
587   - <entry file="file://$PROJECT_DIR$/digger.py">
  630 + <entry file="file://$PROJECT_DIR$/runcmd.py">
588 631 <provider selected="true" editor-type-id="text-editor">
589   - <state relative-caret-position="57">
590   - <caret line="3" column="25" selection-start-line="3" selection-start-column="25" selection-end-line="3" selection-end-column="25" />
  632 + <state relative-caret-position="38">
  633 + <caret line="2" column="18" selection-start-line="2" selection-start-column="18" selection-end-line="2" selection-end-column="18" />
591 634 <folding />
592 635 </state>
593 636 </provider>
... ...
__pycache__/module.cpython-34.pyc
No preview for this file type
__pycache__/modulevar.cpython-34.pyc
No preview for this file type
__pycache__/runcmd.cpython-34.pyc 0 → 100644
No preview for this file type
digger.py
... ... @@ -10,8 +10,6 @@ import subprocess as sp
10 10 sys.path.append('modules')
11 11 sys.path.append('vars')
12 12  
13   -vars = {}
14   -
15 13 def getModules():
16 14 choiceList = []
17 15 modules = []
... ... @@ -22,7 +20,7 @@ def getModules():
22 20 for modname in modules:
23 21 try:
24 22 module = __import__(modname)
25   - instance = module.getInstance(vars)
  23 + instance = module.getInstance()
26 24 choiceList.append((instance.name,instance.description,False))
27 25 del instance
28 26 del module
... ... @@ -34,13 +32,13 @@ def getModules():
34 32 return choiceList
35 33  
36 34 def prepareModule(moduleName):
37   - module = __import__(moduleName).getInstance(vars)
  35 + module = __import__(moduleName).getInstance()
38 36 module.getVars()
39 37 return module
40 38  
41 39 locale.setlocale(locale.LC_ALL, '')
42 40 d = Dialog(dialog="dialog",autowidgetsize=True)
43   -d.set_background_title("My little program")
  41 +d.set_background_title("Gravedigger")
44 42  
45 43 moduleList = getModules()
46 44 code, tags = d.checklist("Select modules to execute",
... ... @@ -48,18 +46,24 @@ code, tags = d.checklist(&quot;Select modules to execute&quot;,
48 46 title="Module selection")
49 47 if code == d.OK:
50 48 runlist = []
51   - if "All" in tags:
52   - for module in moduleList:
53   - runlist.append(prepareModule(module))
54   - else:
55   - for tag in tags:
56   - runlist.append(prepareModule(tag))
  49 + try:
  50 + if "All" in tags:
  51 + for module in moduleList:
  52 + runlist.append(prepareModule(module))
  53 + else:
  54 + for tag in tags:
  55 + runlist.append(prepareModule(tag))
  56 +
  57 + sp.call('clear', shell=True)
  58 +
  59 + for module in runlist:
  60 + print("Running " + module.name + "...")
  61 + try:
  62 + module.run()
  63 + except Exception as e:
  64 + print("Exception raised while running " + module.name + ": " + str(e))
  65 +
  66 + except Exception as e:
  67 + print("Exception raised while preparing module: " + str(e))
57 68  
58   - sp.call('clear', shell=True)
59 69  
60   - for module in runlist:
61   - print("Running " + module.name + "...")
62   - try:
63   - module.run()
64   - except Exception as e:
65   - print("Exception raised while running " + module.name + ": " + str(e))
... ...
module.py
... ... @@ -3,19 +3,17 @@ from abc import ABCMeta, abstractmethod
3 3 class Module(object):
4 4 __metaclass__ = ABCMeta
5 5  
6   - sharedVars = {}
7 6 name = ""
8 7 description = ""
9   - vars = []
  8 + vars = {}
  9 + requiredVars = []
10 10  
11 11 @abstractmethod
12 12 def run(self):
13 13 pass
14 14  
15 15 def getVars(self):
16   - for var in self.vars:
17   - if var in self.sharedVars:
18   - continue
19   - modvar = __import__(var).getInstance()
  16 + for var in self.requiredVars:
  17 + modvar = __import__(var).getInstance(self.name)
20 18 modvar.query()
21   - self.sharedVars[modvar.name] = modvar
22 19 \ No newline at end of file
  20 + self.vars[modvar.name] = modvar
23 21 \ No newline at end of file
... ...
modules/__pycache__/mft.cpython-34.pyc
No preview for this file type
modules/mft.py
1 1 from module import Module
2 2  
3   -def getInstance(vars):
4   - return MFTModule(vars)
  3 +def getInstance():
  4 + return MFTModule()
5 5  
6 6 class MFTModule(Module):
7 7  
8   - def __init__(self,vars):
9   - self.sharedVars = vars
  8 + def __init__(self):
10 9 self.name = "mft"
11 10 self.description = "Extracts NTFS MFT"
12   - self.vars = ["ntfsvol"]
  11 + self.requiredVars = ["ntfsvol"]
  12 + self.vars = {}
13 13  
14 14 def run(self):
15   - pass
  15 + for x in self.vars:
  16 + print(x + ": " + str(self.vars[x].value))
16 17  
... ...
modulevar.py
... ... @@ -4,6 +4,7 @@ class Modulevar(object):
4 4 __metaclass__ = ABCMeta
5 5  
6 6 name = ""
  7 + parentModule = ""
7 8 description = ""
8 9 value = None
9 10  
... ...
runcmd.py 0 → 100644
  1 +import subprocess
  2 +
  3 +def runProcess(cmd):
  4 + out = subprocess.Popen(cmd, stderr=subprocess.STDOUT, stdout=subprocess.PIPE)
  5 + return out.communicate()[0], out.returncode
0 6 \ No newline at end of file
... ...
scripts/digger.sh 100644 → 100755
... ... @@ -5,4 +5,6 @@ GD_PATH=&quot;/opt/gravedigger&quot;
5 5 #set tty
6 6 /bin/stty -echoprt
7 7  
8   -/usr/bin/env python3 $GD_PATH/digger.py
9 8 \ No newline at end of file
  9 +pushd $GD_PATH > /dev/null
  10 +/usr/bin/env python3 digger.py
  11 +popd
10 12 \ No newline at end of file
... ...
scripts/list_ntfs.sh 0 → 100755
  1 +#!/bin/bash
  2 +
  3 +# Outputs, separated by newlines, the list of NTFS volumes present on this computer
  4 +
  5 +for disk in $(cat /proc/partitions | awk -F " " '{print $NF}' | tail -n+3); do
  6 + HEADER=$(dd if="/dev/$disk" bs=1 skip=3 count=4 2> /dev/null)
  7 + if [[ $HEADER == "NTFS" ]]; then
  8 + echo $disk
  9 + fi
  10 +done
0 11 \ No newline at end of file
... ...
vars/__pycache__/ntfsvol.cpython-34.pyc
No preview for this file type
vars/ntfsvol.py
1 1 from modulevar import Modulevar
  2 +from dialog import Dialog
  3 +from runcmd import runProcess
2 4  
3   -def getInstance():
4   - return NTFSVol()
  5 +def getInstance(modname):
  6 + return NTFSVol(modname)
5 7  
6 8 class NTFSVol(Modulevar):
7 9  
8   - def __init__(self):
  10 + def __init__(self,modname):
9 11 self.name = "ntfsvol"
  12 + self.parentModule = modname
10 13 self.description = "NTFS Volume"
11 14 self.value = None
12 15  
  16 + def getNTFSVolumes(self):
  17 + result = runProcess("scripts/list_ntfs.sh")
  18 + volumes = result[0].decode("utf-8").splitlines()
  19 + print(volumes)
  20 + choices = []
  21 + for vol in volumes:
  22 + choices.append((vol,"",False))
  23 + return choices
  24 +
13 25 def query(self):
14   - print("WHAT IS VAR " + self.name)
15 26 \ No newline at end of file
  27 + d = Dialog(dialog="dialog", autowidgetsize=True)
  28 + d.set_background_title("[" + self.parentModule + "] Setting variable: ntfsvol")
  29 + volumeList = self.getNTFSVolumes()
  30 + code, vols = d.checklist("Select NTFS volumes to extract the MFT",
  31 + choices=volumeList,
  32 + title="Module selection")
  33 + if code == d.OK:
  34 + self.value = vols
  35 + else:
  36 + raise Exception("[" + self.name + "] Operation Cancelled")
16 37 \ No newline at end of file
... ...