By design, shared vars won't exist so they can be redefined differently for diff…

…erent modules without interference. ntfsvol var and script written.

By design, shared vars won't exist so they can be redefined differently for diff…
…erent modules without interference. ntfsvol var and script written.
Imanol-Mikel Barba Sabariego
1 parent 40231d86
Showing 14 changed files with 166 additions and 81 deletions
.idea/workspace.xml
__pycache__/module.cpython-34.pyc
__pycache__/modulevar.cpython-34.pyc
__pycache__/runcmd.cpython-34.pyc
digger.py
module.py
modules/__pycache__/mft.cpython-34.pyc
modules/mft.py
modulevar.py
runcmd.py
scripts/digger.sh
scripts/list_ntfs.sh
vars/__pycache__/ntfsvol.cpython-34.pyc
vars/ntfsvol.py
@@ -2,15 +2,15 @@
 <project version="4">
   <component name="ChangeListManager">
     <list default="true" id="33419617-7da8-422e-9ac6-68e0b317ebf8" name="Default" comment="">
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/.idea/vcs.xml" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/digger.py" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/module.py" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/modules/__init__.py" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/modules/mft.py" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/modulevar.py" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/dig.service" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/digger.sh" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/vars/ntfsvol.py" />
+      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/runcmd.py" />
+      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/list_ntfs.sh" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/.idea/workspace.xml" afterPath="$PROJECT_DIR$/.idea/workspace.xml" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/digger.py" afterPath="$PROJECT_DIR$/digger.py" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/module.py" afterPath="$PROJECT_DIR$/module.py" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/modules/mft.py" afterPath="$PROJECT_DIR$/modules/mft.py" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/modulevar.py" afterPath="$PROJECT_DIR$/modulevar.py" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/scripts/digger.sh" afterPath="$PROJECT_DIR$/scripts/digger.sh" />
+      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/vars/ntfsvol.py" afterPath="$PROJECT_DIR$/vars/ntfsvol.py" />
     </list>
     <ignored path="gravedigger.iws" />
     <ignored path=".idea/workspace.xml" />
@@ -24,7 +24,7 @@
   </component>
   <component name="ChangesViewManager" flattened_view="true" show_ignored="false" />
   <component name="CoverageDataManager">
-    <SUITE FILE_PATH="coverage/gravedigger$digger.coverage" NAME="digger Coverage Results" MODIFIED="1477298273841" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$" />
+    <SUITE FILE_PATH="coverage/gravedigger$digger.coverage" NAME="digger Coverage Results" MODIFIED="1477314874684" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$" />
   </component>
   <component name="CreatePatchCommitExecutor">
     <option name="PATCH_PATH" value="" />
@@ -39,17 +39,27 @@
         <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
           <provider selected="true" editor-type-id="text-editor">
             <state relative-caret-position="133">
-              <caret line="7" column="39" selection-start-line="7" selection-start-column="39" selection-end-line="7" selection-end-column="39" />
+              <caret line="7" column="26" selection-start-line="7" selection-start-column="26" selection-end-line="7" selection-end-column="26" />
               <folding />
             </state>
           </provider>
         </entry>
       </file>
-      <file leaf-file-name="digger.py" pinned="false" current-in-tab="true">
+      <file leaf-file-name="digger.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/digger.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="57">
-              <caret line="3" column="25" selection-start-line="3" selection-start-column="25" selection-end-line="3" selection-end-column="25" />
+            <state relative-caret-position="-152">
+              <caret line="7" column="0" selection-start-line="7" selection-start-column="0" selection-end-line="7" selection-end-column="23" />
+              <folding />
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file leaf-file-name="runcmd.py" pinned="false" current-in-tab="true">
+        <entry file="file://$PROJECT_DIR$/runcmd.py">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="38">
+              <caret line="2" column="18" selection-start-line="2" selection-start-column="18" selection-end-line="2" selection-end-column="18" />
               <folding />
             </state>
           </provider>
@@ -58,8 +68,8 @@
       <file leaf-file-name="module.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/module.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="95">
-              <caret line="5" column="19" selection-start-line="5" selection-start-column="19" selection-end-line="5" selection-end-column="19" />
+            <state relative-caret-position="304">
+              <caret line="16" column="58" selection-start-line="16" selection-start-column="58" selection-end-line="16" selection-end-column="58" />
               <folding />
             </state>
           </provider>
@@ -68,8 +78,20 @@
       <file leaf-file-name="ntfsvol.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/vars/ntfsvol.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="247">
-              <caret line="13" column="41" selection-start-line="13" selection-start-column="41" selection-end-line="13" selection-end-column="41" />
+            <state relative-caret-position="542">
+              <caret line="32" column="29" selection-start-line="32" selection-start-column="29" selection-end-line="32" selection-end-column="29" />
+              <folding>
+                <element signature="e#0#31#0" expanded="true" />
+              </folding>
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file leaf-file-name="list_ntfs.sh" pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/scripts/list_ntfs.sh">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="38">
+              <caret line="2" column="83" selection-start-line="2" selection-start-column="83" selection-end-line="2" selection-end-column="83" />
               <folding />
             </state>
           </provider>
@@ -78,8 +100,8 @@
       <file leaf-file-name="mft.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/modules/mft.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="266">
-              <caret line="14" column="12" selection-start-line="14" selection-start-column="12" selection-end-line="14" selection-end-column="12" />
+            <state relative-caret-position="285">
+              <caret line="15" column="52" selection-start-line="15" selection-start-column="52" selection-end-line="15" selection-end-column="52" />
               <folding />
             </state>
           </provider>
@@ -88,8 +110,8 @@
       <file leaf-file-name="modulevar.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/modulevar.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="171">
-              <caret line="9" column="29" selection-start-line="9" selection-start-column="29" selection-end-line="9" selection-end-column="29" />
+            <state relative-caret-position="114">
+              <caret line="6" column="21" selection-start-line="6" selection-start-column="21" selection-end-line="6" selection-end-column="21" />
               <folding />
             </state>
           </provider>
@@ -134,10 +156,13 @@
         <option value="$PROJECT_DIR$/dig.service" />
         <option value="$PROJECT_DIR$/modules/module.py" />
         <option value="$PROJECT_DIR$/modulevar.py" />
-        <option value="$PROJECT_DIR$/modules/mft.py" />
-        <option value="$PROJECT_DIR$/vars/ntfsvol.py" />
-        <option value="$PROJECT_DIR$/module.py" />
         <option value="$PROJECT_DIR$/digger.py" />
+        <option value="$PROJECT_DIR$/module.py" />
+        <option value="$PROJECT_DIR$/scripts/digger.sh" />
+        <option value="$PROJECT_DIR$/runcmd.py" />
+        <option value="$PROJECT_DIR$/vars/ntfsvol.py" />
+        <option value="$PROJECT_DIR$/modules/mft.py" />
+        <option value="$PROJECT_DIR$/scripts/list_ntfs.sh" />
       </list>
     </option>
   </component>
@@ -536,58 +561,76 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
+    <entry file="file://$PROJECT_DIR$/modules/__init__.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="133">
-          <caret line="7" column="39" selection-start-line="7" selection-start-column="39" selection-end-line="7" selection-end-column="39" />
+        <state relative-caret-position="0">
+          <caret line="0" column="0" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/modules/__init__.py">
+    <entry file="file://$PROJECT_DIR$/modulevar.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="0">
-          <caret line="0" column="0" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
+        <state relative-caret-position="114">
+          <caret line="6" column="21" selection-start-line="6" selection-start-column="21" selection-end-line="6" selection-end-column="21" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/modulevar.py">
+    <entry file="file://$PROJECT_DIR$/digger.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="171">
-          <caret line="9" column="29" selection-start-line="9" selection-start-column="29" selection-end-line="9" selection-end-column="29" />
+        <state relative-caret-position="-152">
+          <caret line="7" column="0" selection-start-line="7" selection-start-column="0" selection-end-line="7" selection-end-column="23" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/vars/ntfsvol.py">
+    <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="133">
+          <caret line="7" column="26" selection-start-line="7" selection-start-column="26" selection-end-line="7" selection-end-column="26" />
+          <folding />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/module.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="247">
-          <caret line="13" column="41" selection-start-line="13" selection-start-column="41" selection-end-line="13" selection-end-column="41" />
+        <state relative-caret-position="304">
+          <caret line="16" column="58" selection-start-line="16" selection-start-column="58" selection-end-line="16" selection-end-column="58" />
           <folding />
         </state>
       </provider>
     </entry>
     <entry file="file://$PROJECT_DIR$/modules/mft.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="266">
-          <caret line="14" column="12" selection-start-line="14" selection-start-column="12" selection-end-line="14" selection-end-column="12" />
+        <state relative-caret-position="285">
+          <caret line="15" column="52" selection-start-line="15" selection-start-column="52" selection-end-line="15" selection-end-column="52" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/module.py">
+    <entry file="file://$PROJECT_DIR$/vars/ntfsvol.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="95">
-          <caret line="5" column="19" selection-start-line="5" selection-start-column="19" selection-end-line="5" selection-end-column="19" />
+        <state relative-caret-position="542">
+          <caret line="32" column="29" selection-start-line="32" selection-start-column="29" selection-end-line="32" selection-end-column="29" />
+          <folding>
+            <element signature="e#0#31#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/scripts/list_ntfs.sh">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="38">
+          <caret line="2" column="83" selection-start-line="2" selection-start-column="83" selection-end-line="2" selection-end-column="83" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/digger.py">
+    <entry file="file://$PROJECT_DIR$/runcmd.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="57">
-          <caret line="3" column="25" selection-start-line="3" selection-start-column="25" selection-end-line="3" selection-end-column="25" />
+        <state relative-caret-position="38">
+          <caret line="2" column="18" selection-start-line="2" selection-start-column="18" selection-end-line="2" selection-end-column="18" />
           <folding />
         </state>
       </provider>
@@ -10,8 +10,6 @@ import subprocess as sp
 sys.path.append('modules')
 sys.path.append('vars')
-vars = {}
-
 def getModules():
     choiceList = []
     modules = []
@@ -22,7 +20,7 @@ def getModules():
     for modname in modules:
         try:
             module = __import__(modname)
-            instance = module.getInstance(vars)
+            instance = module.getInstance()
             choiceList.append((instance.name,instance.description,False))
             del instance
             del module
@@ -34,13 +32,13 @@ def getModules():
     return choiceList
 def prepareModule(moduleName):
-    module = __import__(moduleName).getInstance(vars)
+    module = __import__(moduleName).getInstance()
     module.getVars()
     return module
 locale.setlocale(locale.LC_ALL, '')
 d = Dialog(dialog="dialog",autowidgetsize=True)
-d.set_background_title("My little program")
+d.set_background_title("Gravedigger")
 moduleList = getModules()
 code, tags = d.checklist("Select modules to execute",
@@ -48,18 +46,24 @@ code, tags = d.checklist(&quot;Select modules to execute&quot;,
                          title="Module selection")
 if code == d.OK:
     runlist = []
-    if "All" in tags:
-        for module in moduleList:
-            runlist.append(prepareModule(module))
-    else:
-        for tag in tags:
-            runlist.append(prepareModule(tag))
+    try:
+        if "All" in tags:
+            for module in moduleList:
+                runlist.append(prepareModule(module))
+        else:
+            for tag in tags:
+                runlist.append(prepareModule(tag))
+
+        sp.call('clear', shell=True)
+
+        for module in runlist:
+            print("Running " + module.name + "...")
+            try:
+                module.run()
+            except Exception as e:
+                print("Exception raised while running " + module.name + ": " + str(e))
+
+    except Exception as e:
+        print("Exception raised while preparing module: " + str(e))
-    sp.call('clear', shell=True)
-    for module in runlist:
-        print("Running " + module.name + "...")
-        try:
-            module.run()
-        except Exception as e:
-            print("Exception raised while running " + module.name + ": " + str(e))
@@ -3,19 +3,17 @@ from abc import ABCMeta, abstractmethod
 class Module(object):
     __metaclass__ = ABCMeta
-    sharedVars = {}
     name = ""
     description = ""
-    vars = []
+    vars = {}
+    requiredVars = []
     @abstractmethod
     def run(self):
         pass
     def getVars(self):
-        for var in self.vars:
-            if var in self.sharedVars:
-                continue
-            modvar = __import__(var).getInstance()
+        for var in self.requiredVars:
+            modvar = __import__(var).getInstance(self.name)
             modvar.query()
-            self.sharedVars[modvar.name] = modvar
 \ No newline at end of file
+            self.vars[modvar.name] = modvar
 \ No newline at end of file
 from module import Module
-def getInstance(vars):
-    return MFTModule(vars)
+def getInstance():
+    return MFTModule()
 class MFTModule(Module):
-    def __init__(self,vars):
-        self.sharedVars = vars
+    def __init__(self):
         self.name = "mft"
         self.description = "Extracts NTFS MFT"
-        self.vars = ["ntfsvol"]
+        self.requiredVars = ["ntfsvol"]
+        self.vars = {}
     def run(self):
-        pass
+        for x in self.vars:
+            print(x + ": " + str(self.vars[x].value))
@@ -4,6 +4,7 @@ class Modulevar(object):
     __metaclass__ = ABCMeta
     name = ""
+    parentModule = ""
     description = ""
     value = None
+import subprocess
+
+def runProcess(cmd):
+    out = subprocess.Popen(cmd, stderr=subprocess.STDOUT, stdout=subprocess.PIPE)
+    return out.communicate()[0], out.returncode
 \ No newline at end of file
@@ -5,4 +5,6 @@ GD_PATH=&quot;/opt/gravedigger&quot;
 #set tty
 /bin/stty -echoprt
-/usr/bin/env python3 $GD_PATH/digger.py
 \ No newline at end of file
+pushd $GD_PATH > /dev/null
+/usr/bin/env python3 digger.py
+popd
 \ No newline at end of file
+#!/bin/bash
+
+# Outputs, separated by newlines, the list of NTFS volumes present on this computer
+
+for disk in $(cat /proc/partitions  | awk -F " " '{print $NF}' | tail -n+3); do
+    HEADER=$(dd if="/dev/$disk" bs=1 skip=3 count=4 2> /dev/null)
+    if [[ $HEADER == "NTFS" ]]; then
+        echo $disk
+    fi
+done
 \ No newline at end of file
 from modulevar import Modulevar
+from dialog import Dialog
+from runcmd import runProcess
-def getInstance():
-    return NTFSVol()
+def getInstance(modname):
+    return NTFSVol(modname)
 class NTFSVol(Modulevar):
-    def __init__(self):
+    def __init__(self,modname):
         self.name = "ntfsvol"
+        self.parentModule = modname
         self.description = "NTFS Volume"
         self.value = None
+    def getNTFSVolumes(self):
+        result = runProcess("scripts/list_ntfs.sh")
+        volumes = result[0].decode("utf-8").splitlines()
+        print(volumes)
+        choices = []
+        for vol in volumes:
+            choices.append((vol,"",False))
+        return choices
+
     def query(self):
-        print("WHAT IS VAR " + self.name)
 \ No newline at end of file
+        d = Dialog(dialog="dialog", autowidgetsize=True)
+        d.set_background_title("[" + self.parentModule + "] Setting variable: ntfsvol")
+        volumeList = self.getNTFSVolumes()
+        code, vols = d.checklist("Select NTFS volumes to extract the MFT",
+                                 choices=volumeList,
+                                 title="Module selection")
+        if code == d.OK:
+            self.value = vols
+        else:
+            raise Exception("[" + self.name + "] Operation Cancelled")
 \ No newline at end of file