Class: Rex::Parser::AppleBackupManifestDB

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/parser/apple_backup_manifestdb.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(mbdb_data, mbdx_data) ⇒ AppleBackupManifestDB

Returns a new instance of AppleBackupManifestDB.



17
18
19
20
21
22
23
24
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 17

def initialize(mbdb_data, mbdx_data)
	self.entries = {}
	self.entry_offsets = {}
	self.mbdb_data = mbdb_data
	self.mbdx_data = mbdx_data
	parse_mbdb
	parse_mbdx
end

Instance Attribute Details

#entries ⇒ Object

Returns the value of attribute entries.



12
13
14
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 12

def entries
  @entries
end

#entry_offsets ⇒ Object

Returns the value of attribute entry_offsets.



11
12
13
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 11

def entry_offsets
  @entry_offsets
end

#mbdb ⇒ Object

Returns the value of attribute mbdb.



13
14
15
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 13

def mbdb
  @mbdb
end

#mbdb_data ⇒ Object

Returns the value of attribute mbdb_data.



14
15
16
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 14

def mbdb_data
  @mbdb_data
end

#mbdb_offset ⇒ Object

Returns the value of attribute mbdb_offset.



15
16
17
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 15

def mbdb_offset
  @mbdb_offset
end

#mbdx ⇒ Object

Returns the value of attribute mbdx.



13
14
15
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 13

def mbdx
  @mbdx
end

#mbdx_data ⇒ Object

Returns the value of attribute mbdx_data.



14
15
16
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 14

def mbdx_data
  @mbdx_data
end

#mbdx_offset ⇒ Object

Returns the value of attribute mbdx_offset.



15
16
17
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 15

def mbdx_offset
  @mbdx_offset
end

Class Method Details

.from_files(mbdb_file, mbdx_file) ⇒ Object 



26
27
28
29
30
31
32
33
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 26

def self.from_files(mbdb_file, mbdx_file)
	mbdb_data = ""
	::File.open(mbdb_file, "rb") {|fd| mbdb_data = fd.read(fd.stat.size) }
	mbdx_data = ""
	::File.open(mbdx_file, "rb") {|fd| mbdx_data = fd.read(fd.stat.size) }

	self.new(mbdb_data, mbdx_data)
end

Instance Method Details

#mbdb_read_int(size) ⇒ Object 



101
102
103
104
105
106
107
108
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 101

def mbdb_read_int(size)
	val = 0
	size.downto(1) do |i|
		val = (val << 8) + self.mbdb_data[self.mbdb_offset, 1].unpack("C")[0]
		self.mbdb_offset += 1
	end
	val
end

#mbdb_read_string ⇒ Object

Raises:



91
92
93
94
95
96
97
98
99
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 91

def mbdb_read_string
	raise RuntimeError, "Corrupted MBDB file" if self.mbdb_offset > self.mbdb_data.length
	len = self.mbdb_data[self.mbdb_offset, 2].unpack("n")[0]
	self.mbdb_offset += 2
	return '' if len == 65535
	val = self.mbdb_data[self.mbdb_offset, len]
	self.mbdb_offset += len
	return val
end

#mbdx_read_int(size) ⇒ Object 



120
121
122
123
124
125
126
127
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 120

def mbdx_read_int(size)
	val = 0
	size.downto(1) do |i|
		val = (val << 8) + self.mbdx_data[self.mbdx_offset, 1].unpack("C")[0]
		self.mbdx_offset += 1
	end
		val
end

#mbdx_read_string ⇒ Object

Raises:



110
111
112
113
114
115
116
117
118
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 110

def mbdx_read_string
	raise RuntimeError, "Corrupted MBDX file" if self.mbdx_offset > self.mbdx_data.length
	len = self.mbdx_data[self.mbdx_offset, 2].unpack("n")[0]
	self.mbdx_offset += 2
	return '' if len == 65535
	val = self.mbdx_data[self.mbdx_offset, len]
	self.mbdx_offset += len
	return val
end

#parse_mbdb ⇒ Object

Raises:



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 35

def parse_mbdb
	raise ArgumentError, "Not valid MBDB data" if self.mbdb_data[0,4] != "mbdb"
	self.mbdb_offset = 4
	self.mbdb_offset = self.mbdb_offset + 2 # Maps to \x05 \x00 (unknown)

	while self.mbdb_offset < self.mbdb_data.length
		info = {}
		info[:start_offset] = self.mbdb_offset
		info[:domain]       = mbdb_read_string
		info[:filename]     = mbdb_read_string
		info[:linktarget]   = mbdb_read_string
		info[:datahash]     = mbdb_read_string
		info[:unknown1]     = mbdb_read_string
		info[:mode]         = mbdb_read_int(2)
		info[:unknown2]     = mbdb_read_int(4)
		info[:unknown3]     = mbdb_read_int(4)
		info[:uid]          = mbdb_read_int(4)
		info[:gid]          = mbdb_read_int(4)
		info[:mtime]        = Time.at(mbdb_read_int(4))
		info[:atime]        = Time.at(mbdb_read_int(4))
		info[:ctime]        = Time.at(mbdb_read_int(4))
		info[:length]       = mbdb_read_int(8)
		info[:flag]         = mbdb_read_int(1)
		property_count      = mbdb_read_int(1)
		info[:properties]   = {}
		1.upto(property_count) do |i|
			k = mbdb_read_string
			v = mbdb_read_string
			info[:properties][k] = v
		end
		self.entry_offsets[ info[:start_offset] ] = info
	end
	self.mbdb_data = ""
end

#parse_mbdx ⇒ Object

Raises:



70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/rex/parser/apple_backup_manifestdb.rb', line 70

def parse_mbdx
	raise ArgumentError, "Not a valid MBDX file" if self.mbdx_data[0,4] != "mbdx"

	self.mbdx_offset = 4
	self.mbdx_offset = self.mbdx_offset + 2 # Maps to \x02 \x00 (unknown)

	file_count = mbdx_read_int(4)

	while self.mbdx_offset < self.mbdx_data.length
		file_id = self.mbdx_data[self.mbdx_offset, 20].unpack("C*").map{|c| "%02x" % c}.join
		self.mbdx_offset += 20
		entry_offset = mbdx_read_int(4) + 6
		mode = mbdx_read_int(2)
		entry = entry_offsets[ entry_offset ]
		# May be corrupted if there is no matching entry, but what to do about it?
		next if not entry
		self.entries[file_id] = entry.merge({:mbdx_mode => mode, :file_id => file_id})
	end
	self.mbdx_data = ""
end