mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-22 16:50:36 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-253, GP-725 Gfilesystem ByteProviders, obfuscated temp files, passwords

Browse Source 
Migrate GFilesystem methods to use ByteProviders instead of java Files for their source, and to produce ByteProviders instead of InputStreams.

Refactor file info query method to return a structured collection of enum specified meta data instead of a free-form multiline string.

Add locked icon badge to files in the file system browser that are password protected.

Reduces the number of temp files created on disk, and obfuscates files that are created to avoid the wrath of virus scanners (in the same manner that ghidra db files are obfuscated).

Add support for filesystems to query for passwords to decrypt files.

Refactor the SevenZipFileSystem implementation to decrypt files embedded inside zips that were created with passwords.

Fix Ext4 to support 128 byte inodes.
This commit is contained in:
dev747368
2021-10-01 10:09:38 -04:00
parent a0afc0b8c2
commit 72fe7b89d2
156 changed files with 7948 additions and 4714 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
GhidraBuild/Skeleton/src/main/java/skeleton/SkeletonFileSystem.java
View File

@@ -15,15 +15,17 @@
*/
package skeleton;
import java.io.*;
import java.util.*;
import java.io.IOException;
import java.util.List;
import ghidra.app.util.bin.ByteProvider;
import ghidra.app.util.bin.ByteProviderInputStream;
import ghidra.app.util.bin.ByteProviderWrapper;
import ghidra.formats.gfilesystem.*;
import ghidra.formats.gfilesystem.annotations.FileSystemInfo;
import ghidra.formats.gfilesystem.factory.GFileSystemFactoryFull;
import ghidra.formats.gfilesystem.factory.GFileSystemProbeFull;
import ghidra.formats.gfilesystem.factory.GFileSystemFactoryByteProvider;
import ghidra.formats.gfilesystem.factory.GFileSystemProbeByteProvider;
import ghidra.formats.gfilesystem.fileinfo.FileAttributeType;
import ghidra.formats.gfilesystem.fileinfo.FileAttributes;
import ghidra.util.exception.CancelledException;
import ghidra.util.task.TaskMonitor;
@@ -111,14 +113,14 @@ public class SkeletonFileSystem implements GFileSystem {
}
@Override
public InputStream getInputStream(GFile file, TaskMonitor monitor)
public ByteProvider getByteProvider(GFile file, TaskMonitor monitor)
throws IOException, CancelledException {
// TODO: Get an input stream for a file. The following is an example of how the metadata
// might be used to get an input stream from a stored provider offset.
// TODO: Get an ByteProvider for a file. The following is an example of how the metadata
// might be used to get an sub-ByteProvider from a stored provider offset.
MyMetadata metadata = fsih.getMetadata(file);
return (metadata != null)
? new ByteProviderInputStream(provider, metadata.offset, metadata.size)
? new ByteProviderWrapper(provider, metadata.offset, metadata.size, file.getFSRL())
: null;
}
@@ -128,30 +130,25 @@ public class SkeletonFileSystem implements GFileSystem {
}
@Override
public String getInfo(GFile file, TaskMonitor monitor) {
public FileAttributes getFileAttributes(GFile file, TaskMonitor monitor) {
MyMetadata metadata = fsih.getMetadata(file);
return (metadata == null) ? null : FSUtilities.infoMapToString(getInfoMap(metadata));
}
public Map<String, String> getInfoMap(MyMetadata metadata) {
Map<String, String> info = new LinkedHashMap<>();
// TODO: Customize information about a file system entry. The following is sample
// information that might be useful.
info.put("Name", metadata.name);
info.put("Size",
"" + Long.toString(metadata.size) + ", 0x" + Long.toHexString(metadata.size));
return info;
FileAttributes result = new FileAttributes();
if (metadata != null) {
result.add(FileAttributeType.NAME_ATTR, metadata.name);
result.add(FileAttributeType.SIZE_ATTR, metadata.size);
}
return result;
}
// TODO: Customize for the real file system.
public static class MyFileSystemFactory
implements GFileSystemFactoryFull<SkeletonFileSystem>, GFileSystemProbeFull {
implements GFileSystemFactoryByteProvider<SkeletonFileSystem>,
GFileSystemProbeByteProvider {
@Override
public SkeletonFileSystem create(FSRL containerFSRL, FSRLRoot targetFSRL,
ByteProvider byteProvider, File containerFile, FileSystemService fsService,
TaskMonitor monitor) throws IOException, CancelledException {
public SkeletonFileSystem create(FSRLRoot targetFSRL,
ByteProvider byteProvider, FileSystemService fsService, TaskMonitor monitor)
throws IOException, CancelledException {
SkeletonFileSystem fs = new SkeletonFileSystem(targetFSRL, byteProvider);
fs.mount(monitor);
@@ -159,9 +156,8 @@ public class SkeletonFileSystem implements GFileSystem {
}
@Override
public boolean probe(FSRL containerFSRL, ByteProvider byteProvider, File containerFile,
FileSystemService fsService, TaskMonitor monitor)
throws IOException, CancelledException {
public boolean probe(ByteProvider byteProvider, FileSystemService fsService,
TaskMonitor monitor) throws IOException, CancelledException {
// TODO: Quickly and efficiently examine the bytes in 'byteProvider' to determine if
// it's a valid file system. If it is, return true.