Parses an Amcache Root/File key for events.

    Args:
      am_entry (pyregf.key): amcache File key.
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
5145
def _ProcessAMCacheFileKey(self, am_entry, parser_mediator):
    "
    amcache_datetime = am_entry.get_value_by_name(
        self._AMCACHE_DATETIME).get_data_as_integer()
    event_data = AmcacheEventData()

    event_data.full_path = am_entry.get_value_by_name(
        self._AMCACHE_FULL_PATH).get_data_as_string()
    # Strip off the 4 leading zero's from the sha1 hash.
    event_data.sha1 = am_entry.get_value_by_name(
        self._AMCACHE_SHA1).get_data_as_string()[4:]

    productname = am_entry.get_value_by_name(self._AMCACHE_PRODUCTNAME)
    if productname:
      event_data.productname = productname.get_data_as_string()

    companyname = am_entry.get_value_by_name(self._AMCACHE_COMPANYNAME)
    if companyname:
      event_data.companyname = companyname.get_data_as_string()

    fileversion = am_entry.get_value_by_name(self._AMCACHE_FILEVERSION)
    if fileversion:
      event_data.fileversion = fileversion.get_data_as_string()

    languagecode = am_entry.get_value_by_name(self._AMCACHE_LANGUAGECODE)
    if languagecode:
      event_data.languagecode = languagecode.get_data_as_integer()

    filesize = am_entry.get_value_by_name(self._AMCACHE_FILESIZE)
    if filesize:
      event_data.filesize = filesize.get_data_as_integer()

    filedescription = am_entry.get_value_by_name(self._AMCACHE_FILEDESCRIPTION)
    if filedescription:
      event_data.filedescription = filedescription.get_data_as_string()

    linkerts = am_entry.get_value_by_name(self._AMCACHE_LINKERTS)
    if linkerts:
      event_data.linkerts = linkerts.get_data_as_integer()

    lastmodifiedts = am_entry.get_value_by_name(self._AMCACHE_LASTMODIFIEDTS)
    if lastmodifiedts:
      event_data.lastmodifiedts = lastmodifiedts.get_data_as_integer()

    createdts = am_entry.get_value_by_name(self._AMCACHE_CREATEDTS)
    if createdts:
      event_data.createdts = createdts.get_data_as_integer()

    programid = am_entry.get_value_by_name(self._AMCACHE_PROGRAMID)
    if programid:
      event_data.programid = programid.get_data_as_string()

    event = time_events.DateTimeValuesEvent(
        filetime.Filetime(amcache_datetime),
        definitions.TIME_DESCRIPTION_MODIFICATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)

    if event_data.createdts:
      event = time_events.DateTimeValuesEvent(
          filetime.Filetime(event_data.createdts),
          definitions.TIME_DESCRIPTION_CREATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    if event_data.lastmodifiedts:
      event = time_events.DateTimeValuesEvent(
          filetime.Filetime(event_data.lastmodifiedts),
          definitions.TIME_DESCRIPTION_MODIFICATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    if event_data.linkerts:
      event = time_events.DateTimeValuesEvent(
          posix_time.PosixTime(event_data.linkerts),
          definitions.TIME_DESCRIPTION_CHANGE)
      parser_mediator.ProduceEventWithEventData(event, event_data)
1353562
def parse_resource_entry(self, rva):
        """"""

        try:
            data = self.get_data( rva, Structure(self.__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__).sizeof() )
        except PEFormatError, excp:
            # A warning will be added by the caller if this method returns None
            return None

        resource = self.__unpack_data__(
            self.__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__, data,
            file_offset = self.get_offset_from_rva(rva) )
        
        if resource is None:
            return None
        
        #resource.NameIsString = (resource.Name & 0x80000000L) >> 31
        resource.NameOffset = resource.Name & 0x7FFFFFFFL
        
        resource.__pad = resource.Name & 0xFFFF0000L
        resource.Id = resource.Name & 0x0000FFFFL
        
        resource.DataIsDirectory = (resource.OffsetToData & 0x80000000L) >> 31
        resource.OffsetToDirectory = resource.OffsetToData & 0x7FFFFFFFL
        
        return resource
1140446
def ExamineEvent(self, mediator, event):
    
    pathspec = getattr(event, 'pathspec', None)
    if pathspec is None:
      return
    if self._paths_with_hashes.get(pathspec, None):
      # We've already processed an event with this pathspec and extracted the
      # hashes from it.
      return
    hash_attributes = {}
    for attribute_name, attribute_value in event.GetAttributes():
      if attribute_name.endswith('_hash'):
        hash_attributes[attribute_name] = attribute_value
    self._paths_with_hashes[pathspec] = hash_attributes
177359
def ParseMessagesRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = HangoutsMessageData()
    event_data.sender = self._GetRowValue(query_hash, row, 'full_name')
    event_data.body = self._GetRowValue(query_hash, row, 'text')
    event_data.offset = self._GetRowValue(query_hash, row, '_id')
    event_data.query = query
    event_data.message_status = self._GetRowValue(query_hash, row, 'status')
    event_data.message_type = self._GetRowValue(query_hash, row, 'type')

    timestamp = self._GetRowValue(query_hash, row, 'timestamp')
    date_time = dfdatetime_posix_time.PosixTimeInMicroseconds(
        timestamp=timestamp)

    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_CREATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)
1270477
def ParseCallsRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    call_type = self._GetRowValue(query_hash, row, 'type')
    call_type = self.CALL_TYPE.get(call_type, 'UNKNOWN')
    duration = self._GetRowValue(query_hash, row, 'duration')
    timestamp = self._GetRowValue(query_hash, row, 'date')

    event_data = AndroidCallEventData()
    event_data.call_type = call_type
    event_data.duration = self._GetRowValue(query_hash, row, 'duration')
    event_data.name = self._GetRowValue(query_hash, row, 'name')
    event_data.number = self._GetRowValue(query_hash, row, 'number')
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query

    date_time = dfdatetime_java_time.JavaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(date_time, 'Call Started')
    parser_mediator.ProduceEventWithEventData(event, event_data)

    if duration:
      if isinstance(duration, py2to3.STRING_TYPES):
        try:
          duration = int(duration, 10)
        except ValueError:
          duration = 0

      # The duration is in seconds and the date value in milliseconds.
      timestamp += duration * 1000

      date_time = dfdatetime_java_time.JavaTime(timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(date_time, 'Call Ended')
      parser_mediator.ProduceEventWithEventData(event, event_data)
139257
def ParseActivityLogUncompressedRow(
      self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = ChromeExtensionActivityEventData()
    event_data.action_type = self._GetRowValue(query_hash, row, 'action_type')
    event_data.activity_id = self._GetRowValue(query_hash, row, 'activity_id')
    event_data.api_name = self._GetRowValue(query_hash, row, 'api_name')
    event_data.arg_url = self._GetRowValue(query_hash, row, 'arg_url')
    event_data.args = self._GetRowValue(query_hash, row, 'args')
    event_data.extension_id = self._GetRowValue(query_hash, row, 'extension_id')
    event_data.other = self._GetRowValue(query_hash, row, 'other')
    event_data.page_title = self._GetRowValue(query_hash, row, 'page_title')
    event_data.page_url = self._GetRowValue(query_hash, row, 'page_url')
    event_data.query = query

    timestamp = self._GetRowValue(query_hash, row, 'time')
    date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_UNKNOWN)
    parser_mediator.ProduceEventWithEventData(event, event_data)
266045
def ParseBookmarkRow(
      self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    rev_host = self._GetRowValue(query_hash, row, 'rev_host')
    bookmark_type = self._GetRowValue(query_hash, row, 'type')

    event_data = FirefoxPlacesBookmarkEventData()
    event_data.host = rev_host or 'N/A'
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.places_title = self._GetRowValue(query_hash, row, 'places_title')
    event_data.query = query
    event_data.title = self._GetRowValue(query_hash, row, 'bookmark_title')
    event_data.type = self._BOOKMARK_TYPES.get(bookmark_type, 'N/A')
    event_data.url = self._GetRowValue(query_hash, row, 'url')
    event_data.visit_count = self._GetRowValue(query_hash, row, 'visit_count')

    timestamp = self._GetRowValue(query_hash, row, 'dateAdded')
    if timestamp:
      date_time = dfdatetime_posix_time.PosixTimeInMicroseconds(
          timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(
          date_time, definitions.TIME_DESCRIPTION_ADDED)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    timestamp = self._GetRowValue(query_hash, row, 'lastModified')
    if timestamp:
      date_time = dfdatetime_posix_time.PosixTimeInMicroseconds(
          timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(
          date_time, definitions.TIME_DESCRIPTION_MODIFICATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)
864055
def _ParseRecords(self, parser_mediator, evt_file):
    
    # To handle errors when parsing a Windows EventLog (EVT) file in the most
    # granular way the following code iterates over every event record. The
    # call to evt_file.get_record() and access to members of evt_record should
    # be called within a try-except.

    for record_index in range(evt_file.number_of_records):
      if parser_mediator.abort:
        break

      try:
        evt_record = evt_file.get_record(record_index)
        self._ParseRecord(parser_mediator, record_index, evt_record)
      except IOError as exception:
        parser_mediator.ProduceExtractionWarning(
            'unable to parse event record: {0:d} with error: {1!s}'.format(
                record_index, exception))

    for record_index in range(evt_file.number_of_recovered_records):
      if parser_mediator.abort:
        break

      try:
        evt_record = evt_file.get_recovered_record(record_index)
        self._ParseRecord(
            parser_mediator, record_index, evt_record, recovered=True)
      except IOError as exception:
        parser_mediator.ProduceExtractionWarning((
            'unable to parse recovered event record: {0:d} with error: '
            '{1!s}').format(record_index, exception))
1258425
def libvlc_media_discoverer_event_manager(p_mdis):
    '''
    '''
    f = _Cfunctions.get('libvlc_media_discoverer_event_manager', None) or \
        _Cfunction('libvlc_media_discoverer_event_manager', ((1,),), class_result(EventManager),
                    ctypes.c_void_p, MediaDiscoverer)
    return f(p_mdis)
331424
def _ParseShellItem(self, parser_mediator, shell_item):
    
    path_segment = self._ParseShellItemPathSegment(shell_item)
    self._path_segments.append(path_segment)

    event_data = shell_item_events.ShellItemFileEntryEventData()
    event_data.origin = self._origin
    event_data.shell_item_path = self.CopyToPath()

    if isinstance(shell_item, pyfwsi.file_entry):
      event_data.name = shell_item.name

      for extension_block in shell_item.extension_blocks:
        if isinstance(extension_block, pyfwsi.file_entry_extension):
          long_name = extension_block.long_name
          localized_name = extension_block.localized_name
          file_reference = extension_block.file_reference
          if file_reference:
            file_reference = '{0:d}-{1:d}'.format(
                file_reference & 0xffffffffffff, file_reference >> 48)

          event_data.file_reference = file_reference
          event_data.localized_name = localized_name
          event_data.long_name = long_name

          fat_date_time = extension_block.get_creation_time_as_integer()
          if fat_date_time != 0:
            date_time = dfdatetime_fat_date_time.FATDateTime(
                fat_date_time=fat_date_time)
            event = time_events.DateTimeValuesEvent(
                date_time, definitions.TIME_DESCRIPTION_CREATION)
            parser_mediator.ProduceEventWithEventData(event, event_data)

          fat_date_time = extension_block.get_access_time_as_integer()
          if fat_date_time != 0:
            date_time = dfdatetime_fat_date_time.FATDateTime(
                fat_date_time=fat_date_time)
            event = time_events.DateTimeValuesEvent(
                date_time, definitions.TIME_DESCRIPTION_LAST_ACCESS)
            parser_mediator.ProduceEventWithEventData(event, event_data)

      fat_date_time = shell_item.get_modification_time_as_integer()
      if fat_date_time != 0:
        date_time = dfdatetime_fat_date_time.FATDateTime(
            fat_date_time=fat_date_time)
        event = time_events.DateTimeValuesEvent(
            date_time, definitions.TIME_DESCRIPTION_MODIFICATION)
        parser_mediator.ProduceEventWithEventData(event, event_data)
856001
def ParseVideoRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = KodiVideoEventData()
    event_data.filename = self._GetRowValue(query_hash, row, 'strFilename')
    event_data.play_count = self._GetRowValue(query_hash, row, 'playCount')
    event_data.query = query

    timestamp = self._GetRowValue(query_hash, row, 'lastPlayed')
    date_time = dfdatetime_time_elements.TimeElements()
    date_time.CopyFromDateTimeString(timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_LAST_VISITED)
    parser_mediator.ProduceEventWithEventData(event, event_data)
1188103
function FileMediatorService(mediator, config) {
  this.mediator = mediator;
  this.config = config || {};
  
  this.usersTopics = new MediatorTopicUtility(mediator).prefix(CONSTANTS.TOPIC_PREFIX).entity(CONSTANTS.USERS_ENTITY_NAME);
  this.filesTopics = new MediatorTopicUtility(mediator).prefix(CONSTANTS.TOPIC_PREFIX).entity(CONSTANTS.FILES_ENTITY_NAME);
  this.fileUITopics = new MediatorTopicUtility(mediator).prefix(CONSTANTS.FILE_UI_TOPIC_PREFIX).entity(CONSTANTS.FILE);
}
510342
def ParseSmsRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    sms_read = self._GetRowValue(query_hash, row, 'read')
    sms_type = self._GetRowValue(query_hash, row, 'type')

    event_data = AndroidSMSEventData()
    event_data.address = self._GetRowValue(query_hash, row, 'address')
    event_data.body = self._GetRowValue(query_hash, row, 'body')
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query
    event_data.sms_read = self.SMS_READ.get(sms_read, 'UNKNOWN')
    event_data.sms_type = self.SMS_TYPE.get(sms_type, 'UNKNOWN')

    timestamp = self._GetRowValue(query_hash, row, 'date')
    date_time = dfdatetime_java_time.JavaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_CREATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)
955784
def _ParseMRUListValue(self, registry_key):
    
    mrulist_value = registry_key.GetValueByName('MRUList')

    # The key exists but does not contain a value named "MRUList".
    if not mrulist_value:
      return None

    mrulist_entries_map = self._GetDataTypeMap('mrulist_entries')

    context = dtfabric_data_maps.DataTypeMapContext(values={
        'data_size': len(mrulist_value.data)})

    return self._ReadStructureFromByteStream(
        mrulist_value.data, 0, mrulist_entries_map, context=context)
897408
def GetEntries(self, parser_mediator, match=None, **unused_kwargs):
    
    device_cache = match.get('DeviceCache', {})
    for device, value in iter(device_cache.items()):
      name = value.get('Name', '')
      if name:
        name = ''.join(('Name:', name))

      event_data = plist_event.PlistTimeEventData()
      event_data.root = '/DeviceCache'

      datetime_value = value.get('LastInquiryUpdate', None)
      if datetime_value:
        event_data.desc = ' '.join(
            filter(None, ('Bluetooth Discovery', name)))
        event_data.key = '{0:s}/LastInquiryUpdate'.format(device)

        event = time_events.PythonDatetimeEvent(
            datetime_value, definitions.TIME_DESCRIPTION_WRITTEN)
        parser_mediator.ProduceEventWithEventData(event, event_data)

        if device in match.get('PairedDevices', []):
          event_data.desc = 'Paired:True {0:s}'.format(name)
          event_data.key = device

          event = time_events.PythonDatetimeEvent(
              datetime_value, definitions.TIME_DESCRIPTION_WRITTEN)
          parser_mediator.ProduceEventWithEventData(event, event_data)

      datetime_value = value.get('LastNameUpdate', None)
      if datetime_value:
        event_data.desc = ' '.join(filter(None, ('Device Name Set', name)))
        event_data.key = '{0:s}/LastNameUpdate'.format(device)

        event = time_events.PythonDatetimeEvent(
            datetime_value, definitions.TIME_DESCRIPTION_WRITTEN)
        parser_mediator.ProduceEventWithEventData(event, event_data)

      datetime_value = value.get('LastServicesUpdate', None)
      if datetime_value:
        event_data.desc = ' '.join(filter(None, ('Services Updated', name)))
        event_data.key = '{0:s}/LastServicesUpdate'.format(device)

        event = time_events.PythonDatetimeEvent(
            datetime_value, definitions.TIME_DESCRIPTION_WRITTEN)
        parser_mediator.ProduceEventWithEventData(event, event_data)
279404
def ParseFileObject(self, parser_mediator, file_object):
    
    try:
      self._ParseFileHeader(file_object)
    except errors.ParseError as exception:
      raise errors.ParseError(
          'Unable to parse index file header with error: {0!s}'.format(
              exception))
    # Skip over the LRU data, which is 112 bytes in size.
    file_object.seek(112, os.SEEK_CUR)
    self._ParseIndexTable(file_object)
338256
def GetEntries(
      self, parser_mediator, cookie_data=None, url=None, **kwargs):
    
    fields = cookie_data.split('.')
    number_of_fields = len(fields)

    if number_of_fields != 1:
      parser_mediator.ProduceExtractionWarning(
          'unsupported number of fields: {0:d} in cookie: {1:s}'.format(
              number_of_fields, self.COOKIE_NAME))
      return

    try:
      # TODO: fix that we're losing precision here use dfdatetime.
      last_visit_posix_time = int(fields[0], 10) / 10000000
    except ValueError:
      last_visit_posix_time = None

    if last_visit_posix_time is not None:
      date_time = dfdatetime_posix_time.PosixTime(
          timestamp=last_visit_posix_time)
      timestamp_description = definitions.TIME_DESCRIPTION_LAST_VISITED
    else:
      date_time = dfdatetime_semantic_time.SemanticTime('Not set')
      timestamp_description = definitions.TIME_DESCRIPTION_NOT_A_TIME

    event_data = GoogleAnalyticsEventData('utmt')
    event_data.cookie_name = self.COOKIE_NAME
    event_data.url = url

    event = time_events.DateTimeValuesEvent(date_time, timestamp_description)
    parser_mediator.ProduceEventWithEventData(event, event_data)