Parses an Amcache Root/Programs key for events.

    Args:
      am_entry (pyregf.key): amcache Programs key.
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
352622
def _ProcessAMCacheProgramKey(self, am_entry, parser_mediator):
    
    amcache_datetime = am_entry.get_value_by_name(
        self._AMCACHE_P_INSTALLDATE).get_data_as_integer()
    event_data = AmcacheProgramEventData()

    name = am_entry.get_value_by_name(self._AMCACHE_P_NAME)
    if name:
      event_data.name = name.get_data_as_string()

    version = am_entry.get_value_by_name(self._AMCACHE_P_VERSION)
    if version:
      event_data.version = version.get_data_as_string()

    publisher = am_entry.get_value_by_name(self._AMCACHE_P_PUBLISHER)
    if publisher:
      event_data.publisher = publisher.get_data_as_string()

    languagecode = am_entry.get_value_by_name(self._AMCACHE_P_LANGUAGECODE)
    if languagecode:
      event_data.languagecode = languagecode.get_data_as_string()

    entrytype = am_entry.get_value_by_name(self._AMCACHE_P_ENTRYTYPE)
    if entrytype:
      event_data.entrytype = entrytype.get_data_as_string()

    uninstallkey = am_entry.get_value_by_name(self._AMCACHE_P_UNINSTALLKEY)
    if uninstallkey:
      uninstallkey = uninstallkey.get_data()
      uninstallkey = uninstallkey.decode('utf-16-LE')
      event_data.uninstallkey = uninstallkey

    filepaths = am_entry.get_value_by_name(self._AMCACHE_P_FILEPATHS)
    if filepaths:
      filepaths = filepaths.get_data()
      filepaths = filepaths.decode('utf-16-LE')
      event_data.filepaths = filepaths

    productcode = am_entry.get_value_by_name(self._AMCACHE_P_PRODUCTCODE)
    if productcode:
      event_data.productcode = productcode.get_data_as_string()

    packagecode = am_entry.get_value_by_name(self._AMCACHE_P_PACKAGECODE)
    if packagecode:
      event_data.packagecode = packagecode.get_data_as_string()

    msiproductcode = am_entry.get_value_by_name(self._AMCACHE_P_MSIPRODUCTCODE)
    if msiproductcode:
      msiproductcode = msiproductcode.get_data()
      msiproductcode = msiproductcode.decode('utf-16-LE')
      event_data.msiproductcode = msiproductcode

    msipackagecode = am_entry.get_value_by_name(self._AMCACHE_P_MSIPACKAGECODE)
    if msipackagecode:
      msipackagecode = msipackagecode.get_data()
      msipackagecode = msipackagecode.decode('utf-16-LE')
      event_data.msipackagecode = msipackagecode

    files = am_entry.get_value_by_name(self._AMCACHE_P_FILES)
    if files:
      files = files.get_data()
      files = files.decode('utf-16-LE')
      event_data.files = files

    event = time_events.DateTimeValuesEvent(
        posix_time.PosixTime(amcache_datetime),
        definitions.TIME_DESCRIPTION_INSTALLATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)
850698
def ParseCookieRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    cookie_data = self._GetRowValue(query_hash, row, 'value')
    cookie_name = self._GetRowValue(query_hash, row, 'name')

    hostname = self._GetRowValue(query_hash, row, 'host')
    if hostname.startswith('.'):
      hostname = hostname[1:]

    is_secure = bool(self._GetRowValue(query_hash, row, 'isSecure'))
    if is_secure:
      url_scheme = 'https'
    else:
      url_scheme = 'http'

    path = self._GetRowValue(query_hash, row, 'path')
    url = '{0:s}://{1:s}{2:s}'.format(url_scheme, hostname, path)

    event_data = FirefoxCookieEventData()
    event_data.cookie_name = cookie_name
    event_data.data = cookie_data
    event_data.host = hostname
    event_data.httponly = bool(self._GetRowValue(query_hash, row, 'isHttpOnly'))
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.path = path
    event_data.query = query
    event_data.secure = is_secure
    event_data.url = url

    timestamp = self._GetRowValue(query_hash, row, 'creationTime')
    if timestamp:
      date_time = dfdatetime_posix_time.PosixTimeInMicroseconds(
          timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(
          date_time, definitions.TIME_DESCRIPTION_CREATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    timestamp = self._GetRowValue(query_hash, row, 'lastAccessed')
    if timestamp:
      date_time = dfdatetime_posix_time.PosixTimeInMicroseconds(
          timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(
          date_time, definitions.TIME_DESCRIPTION_LAST_ACCESS)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    timestamp = self._GetRowValue(query_hash, row, 'expiry')
    if timestamp:
      # Expiry time (nsCookieService::GetExpiry in
      # netwerk/cookie/nsCookieService.cpp).
      # It's calculated as the difference between the server time and the time
      # the server wants the cookie to expire and adding that difference to the
      # client time. This localizes the client time regardless of whether or not
      # the TZ environment variable was set on the client.

      date_time = dfdatetime_posix_time.PosixTime(
          timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(
          date_time, definitions.TIME_DESCRIPTION_EXPIRATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    # Go through all cookie plugins to see if there are is any specific parsing
    # needed.
    for cookie_plugin in self._cookie_plugins:
      try:
        cookie_plugin.UpdateChainAndProcess(
            parser_mediator, cookie_name=cookie_name, cookie_data=cookie_data,
            url=url)
      except errors.WrongPlugin:
        pass
1298830
def GetEntries(
      self, parser_mediator, cookie_data=None, url=None, **kwargs):
    
    fields = cookie_data.split('.')
    number_of_fields = len(fields)

    if number_of_fields > 5:
      variables = '.'.join(fields[4:])
      fields = fields[0:4]
      fields.append(variables)
      number_of_fields = len(fields)

    if number_of_fields not in (1, 5):
      parser_mediator.ProduceExtractionWarning(
          'unsupported number of fields: {0:d} in cookie: {1:s}'.format(
              number_of_fields, self.COOKIE_NAME))
      return

    if number_of_fields == 1:
      domain_hash = None

      try:
        # TODO: fix that we're losing precision here use dfdatetime.
        last_visit_posix_time = int(fields[0], 10) / 10000000
      except ValueError:
        last_visit_posix_time = None

      number_of_sessions = None
      number_of_sources = None
      extra_attributes = {}

    elif number_of_fields == 5:
      domain_hash = fields[0]

      try:
        last_visit_posix_time = int(fields[1], 10)
      except ValueError:
        last_visit_posix_time = None

      try:
        number_of_sessions = int(fields[2], 10)
      except ValueError:
        number_of_sessions = None

      try:
        number_of_sources = int(fields[3], 10)
      except ValueError:
        number_of_sources = None

      extra_variables = fields[4].split('|')

      extra_attributes = {}
      for variable in extra_variables:
        key, _, value = variable.partition('=')

        # Urllib2 in Python 2 requires a 'str' argument, not 'unicode'. We thus
        # need to convert the value argument to 'str" and back again, but only
        # in Python 2.
        if isinstance(value, py2to3.UNICODE_TYPE) and py2to3.PY_2:
          try:
            value = codecs.decode(value, 'ascii')
          except UnicodeEncodeError:
            value = codecs.decode(value, 'ascii', errors='replace')
            parser_mediator.ProduceExtractionWarning(
                'Cookie contains non 7-bit ASCII characters, which have been '
                'replaced with a "?".')

        value = urlparse.unquote(value)

        if py2to3.PY_2:
          try:
            value = codecs.encode(value, 'utf-8')
          except UnicodeDecodeError:
            value = codecs.encode(value, 'utf-8', errors='replace')
            parser_mediator.ProduceExtractionWarning(
                'Cookie value did not contain a Unicode string. Non UTF-8 '
                'characters have been replaced.')

        extra_attributes[key] = value

    if last_visit_posix_time is not None:
      date_time = dfdatetime_posix_time.PosixTime(
          timestamp=last_visit_posix_time)
      timestamp_description = definitions.TIME_DESCRIPTION_LAST_VISITED
    else:
      date_time = dfdatetime_semantic_time.SemanticTime('Not set')
      timestamp_description = definitions.TIME_DESCRIPTION_NOT_A_TIME

    event_data = GoogleAnalyticsEventData('utmz')
    event_data.cookie_name = self.COOKIE_NAME
    event_data.domain_hash = domain_hash
    event_data.sessions = number_of_sessions
    event_data.sources = number_of_sources
    event_data.url = url

    for key, value in iter(extra_attributes.items()):
      setattr(event_data, key, value)

    event = time_events.DateTimeValuesEvent(date_time, timestamp_description)
    parser_mediator.ProduceEventWithEventData(event, event_data)
1172566
def parse_entry(source, loc, tokens):
    
    type_ = tokens[1].lower()
    entry_type = structures.TypeRegistry.get_type(type_)
    if entry_type is None or not issubclass(entry_type, structures.Entry):
        raise exceptions.UnsupportedEntryType(
                "%s is not a supported entry type" % type_
            )
    new_entry = entry_type()
    new_entry.name = tokens[3]
    for key, value in [t for t in tokens[4:-1] if t != ',']:
        new_entry[key] = value
    return new_entry
1214332
def ParseFileEntry(self, parser_mediator, file_entry):
    
    filename = parser_mediator.GetFilename()
    database = SQLiteDatabase(
        filename, temporary_directory=parser_mediator.temporary_directory)

    file_object = file_entry.GetFileObject()
    try:
      database.Open(file_object)

    except (IOError, ValueError, sqlite3.DatabaseError) as exception:
      parser_mediator.ProduceExtractionWarning(
          'unable to open SQLite database with error: {0!s}'.format(exception))
      file_object.close()
      return

    database_wal, wal_file_entry = self._OpenDatabaseWithWAL(
        parser_mediator, file_entry, file_object, filename)

    file_object.close()

    # Create a cache in which the resulting tables are cached.
    cache = SQLiteCache()
    try:
      table_names = frozenset(database.tables)

      for plugin in self._plugins:
        if not plugin.REQUIRED_TABLES.issubset(table_names):
          continue

        schema_match = plugin.CheckSchema(database)
        if plugin.REQUIRES_SCHEMA_MATCH and not schema_match:
          parser_mediator.ProduceExtractionWarning((
              'plugin: {0:s} found required tables but not a matching '
              'schema').format(plugin.NAME))
          continue

        parser_mediator.SetFileEntry(file_entry)
        parser_mediator.AddEventAttribute('schema_match', schema_match)

        try:
          plugin.UpdateChainAndProcess(
              parser_mediator, cache=cache, database=database,
              database_wal=database_wal, wal_file_entry=wal_file_entry)

        except Exception as exception:  # pylint: disable=broad-except
          parser_mediator.ProduceExtractionWarning((
              'plugin: {0:s} unable to parse SQLite database with error: '
              '{1!s}').format(plugin.NAME, exception))

        finally:
          parser_mediator.RemoveEventAttribute('schema_match')

        if not database_wal:
          continue

        schema_match = plugin.CheckSchema(database)

        parser_mediator.SetFileEntry(wal_file_entry)
        parser_mediator.AddEventAttribute('schema_match', schema_match)

        try:
          plugin.UpdateChainAndProcess(
              parser_mediator, cache=cache, database=database,
              database_wal=database_wal, wal_file_entry=wal_file_entry)

        except Exception as exception:  # pylint: disable=broad-except
          parser_mediator.ProduceExtractionWarning((
              'plugin: {0:s} unable to parse SQLite database and WAL with '
              'error: {1!s}').format(plugin.NAME, exception))

        finally:
          parser_mediator.RemoveEventAttribute('schema_match')

    finally:
      database.Close()
907504
def Parse(self, parser_mediator):
    
    file_entry = parser_mediator.GetFileEntry()
    if not file_entry:
      raise errors.UnableToParseFile('Invalid file entry')

    parser_mediator.AppendToParserChain(self)
    try:
      self.ParseFileEntry(parser_mediator, file_entry)
    finally:
      parser_mediator.PopFromParserChain()
617424
def ParseMessageRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = KikIOSMessageEventData()
    event_data.body = self._GetRowValue(query_hash, row, 'ZBODY')
    event_data.displayname = self._GetRowValue(query_hash, row, 'ZDISPLAYNAME')
    event_data.message_status = self._GetRowValue(query_hash, row, 'ZSTATE')
    event_data.message_type = self._GetRowValue(query_hash, row, 'ZTYPE')
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query
    event_data.username = self._GetRowValue(query_hash, row, 'ZUSERNAME')

    timestamp = self._GetRowValue(query_hash, row, 'ZRECEIVEDTIMESTAMP')
    # Convert the floating point value to an integer.
    timestamp = int(timestamp)
    date_time = dfdatetime_cocoa_time.CocoaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_CREATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)
840023
def parse_entry(self, soup):
    
    # parse the media object first.
    media_attrs = self.parse_entry_media_attributes(soup)
    media_id = media_attrs[u'id']
    del media_attrs[u'id']
    media = getattr(self.session, self.type)(media_id).set(media_attrs)

    entry_info = {}
    try:
      entry_info[u'started'] = utilities.parse_profile_date(soup.find(u'my_start_date').text)
    except ValueError:
      entry_info[u'started'] = None
    except:
      if not self.session.suppress_parse_exceptions:
        raise

    try:
      entry_info[u'finished'] = utilities.parse_profile_date(soup.find(u'my_finish_date').text)
    except ValueError:
      entry_info[u'finished'] = None
    except:
      if not self.session.suppress_parse_exceptions:
        raise

    try:
      entry_info[u'status'] = self.user_status_terms[int(soup.find(u'my_status').text)]
    except:
      if not self.session.suppress_parse_exceptions:
        raise

    try:
      entry_info[u'score'] = int(soup.find(u'my_score').text)
      # if user hasn't set a score, set it to None to indicate as such.
      if entry_info[u'score'] == 0:
        entry_info[u'score'] = None
    except:
      if not self.session.suppress_parse_exceptions:
        raise

    try:
      entry_info[u'last_updated'] = datetime.datetime.fromtimestamp(int(soup.find(u'my_last_updated').text))
    except:
      if not self.session.suppress_parse_exceptions:
        raise

    return media,entry_info
198100
def post_parse_action(self, entry):
        """"""
        if 'source_host' in entry.keys():
            host = self.ip_port_regex.findall(entry['source_host'])
            if host:
                hlist = host[0].split('.')
                entry['source_host'] = '.'.join(hlist[:4])
                entry['source_port'] = hlist[-1]
        if 'dest_host' in entry.keys():
            host = self.ip_port_regex.findall(entry['dest_host'])
            if host:
                hlist = host[0].split('.')
                entry['dest_host'] = '.'.join(hlist[:4])
                entry['dest_port'] = hlist[-1]

        return entry
522933
def _ParseRecords(self, parser_mediator, evtx_file):
    
    # To handle errors when parsing a Windows XML EventLog (EVTX) file in the
    # most granular way the following code iterates over every event record.
    # The call to evt_file.get_record() and access to members of evt_record
    # should be called within a try-except.

    for record_index in range(evtx_file.number_of_records):
      if parser_mediator.abort:
        break

      try:
        evtx_record = evtx_file.get_record(record_index)
        self._ParseRecord(parser_mediator, record_index, evtx_record)

      except IOError as exception:
        parser_mediator.ProduceExtractionWarning(
            'unable to parse event record: {0:d} with error: {1!s}'.format(
                record_index, exception))

    for record_index in range(evtx_file.number_of_recovered_records):
      if parser_mediator.abort:
        break

      try:
        evtx_record = evtx_file.get_recovered_record(record_index)
        self._ParseRecord(
            parser_mediator, record_index, evtx_record, recovered=True)

      except IOError as exception:
        parser_mediator.ProduceExtractionWarning((
            'unable to parse recovered event record: {0:d} with error: '
            '{1!s}').format(record_index, exception))
1341427
def _parse_transaction_entry(entry):
    
    parts = entry.split()

    date_string = parts[0]
    try:
        date = datetime.datetime.strptime(date_string[:-1], '%Y-%m-%d').date()
    except ValueError:
        raise ValueError('Invalid date in vacationrc for entry: {}'.format(entry))

    if len(parts) < 2:
        raise ValueError('.vacationrc missing an action for entry: {}'.format(entry))
    action = parts[1].lower()
    if action not in ('days', 'rate', 'off', 'adjust', 'show'):
        raise ValueError('Invalid action in vacationrc for entry: {}'.format(entry))

    try:
        value = float(parts[2])
    except IndexError:
        value = None
    except (ValueError, TypeError):
        raise ValueError('Invalid value in vacationrc for entry: {}'.format(entry))

    return (date, action, value)
120748
def _ParseKeyWithPlugin(self, parser_mediator, registry_key, plugin):
    
    try:
      plugin.UpdateChainAndProcess(parser_mediator, registry_key)
    except (IOError, dfwinreg_errors.WinRegistryValueError) as exception:
      parser_mediator.ProduceExtractionWarning(
          'in key: {0:s} error: {1!s}'.format(registry_key.path, exception))
1199342
def GetEntries(self, parser_mediator, top_level=None, **unused_kwargs):
    
    for entry in top_level:
      datetime_value = entry.get('date', None)
      package_identifiers = entry.get('packageIdentifiers', [])

      if not datetime_value or not package_identifiers:
        continue

      display_name = entry.get('displayName', '<UNKNOWN>')
      display_version = entry.get('displayVersion', '<DISPLAY_VERSION>')
      process_name = entry.get('processName', '<PROCESS_NAME>')
      package_identifiers = ', '.join(package_identifiers)

      event_data = plist_event.PlistTimeEventData()
      event_data.desc = (
          'Installation of [{0:s} {1:s}] using [{2:s}]. Packages: '
          '{3:s}.').format(
              display_name, display_version, process_name, package_identifiers)
      event_data.key = ''
      event_data.root = '/item'

      event = time_events.PythonDatetimeEvent(
          datetime_value, definitions.TIME_DESCRIPTION_WRITTEN)
      parser_mediator.ProduceEventWithEventData(event, event_data)
1297519
function(proto, key, desc) {
		var val = desc.value;
		if (gui.Type.isObject(val)) {
			if (val.getter || val.setter) {
				if (this._isactive(val)) {
					desc = this._activeaccessor(proto, key, val);
				}
			}
		}
		return desc;
	}
327752
def ProcessPathSpec(self, mediator, path_spec):
    
    self.last_activity_timestamp = time.time()
    self.processing_status = definitions.STATUS_INDICATOR_RUNNING

    file_entry = path_spec_resolver.Resolver.OpenFileEntry(
        path_spec, resolver_context=mediator.resolver_context)

    if file_entry is None:
      display_name = mediator.GetDisplayNameForPathSpec(path_spec)
      logger.warning(
          'Unable to open file entry with path spec: {0:s}'.format(
              display_name))
      self.processing_status = definitions.STATUS_INDICATOR_IDLE
      return

    mediator.SetFileEntry(file_entry)

    try:
      if file_entry.IsDirectory():
        self._ProcessDirectory(mediator, file_entry)
      self._ProcessFileEntry(mediator, file_entry)

    finally:
      mediator.ResetFileEntry()

      self.last_activity_timestamp = time.time()
      self.processing_status = definitions.STATUS_INDICATOR_IDLE
139257
def ParseActivityLogUncompressedRow(
      self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = ChromeExtensionActivityEventData()
    event_data.action_type = self._GetRowValue(query_hash, row, 'action_type')
    event_data.activity_id = self._GetRowValue(query_hash, row, 'activity_id')
    event_data.api_name = self._GetRowValue(query_hash, row, 'api_name')
    event_data.arg_url = self._GetRowValue(query_hash, row, 'arg_url')
    event_data.args = self._GetRowValue(query_hash, row, 'args')
    event_data.extension_id = self._GetRowValue(query_hash, row, 'extension_id')
    event_data.other = self._GetRowValue(query_hash, row, 'other')
    event_data.page_title = self._GetRowValue(query_hash, row, 'page_title')
    event_data.page_url = self._GetRowValue(query_hash, row, 'page_url')
    event_data.query = query

    timestamp = self._GetRowValue(query_hash, row, 'time')
    date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_UNKNOWN)
    parser_mediator.ProduceEventWithEventData(event, event_data)
139302
def ParseFileObject(self, parser_mediator, file_object):
    
    display_name = parser_mediator.GetDisplayName()
    self.ParseFileLNKFile(parser_mediator, file_object, display_name)