diff --git a/cmd/enrichment/enrichment/tasks/raw_data_tag/bof_reg_collect_parser.py b/cmd/enrichment/enrichment/tasks/raw_data_tag/bof_reg_collect_parser.py index 38ccf7c..70a6f03 100644 --- a/cmd/enrichment/enrichment/tasks/raw_data_tag/bof_reg_collect_parser.py +++ b/cmd/enrichment/enrichment/tasks/raw_data_tag/bof_reg_collect_parser.py @@ -16,26 +16,32 @@ REG_FULL_RESOURCE_DESCRIPTOR = 9 REG_RESOURCE_REQUIREMENTS_LIST = 10 REG_QWORD = 11 + def read_unsigned_int(data: bytes) -> Tuple[int, bytes]: (ret,), data = struct.unpack('>I', data[:4]), data[4:] return ret, data + def read_unsigned_long(data: bytes) -> Tuple[int, bytes]: (ret,), data = struct.unpack(' Tuple[int, bytes]: (ret,), data = struct.unpack('>L', data[:4]), data[4:] return ret, data + def read_unsigned_long_long(data: bytes) -> Tuple[int, bytes]: (ret,), data = struct.unpack(' Tuple[bytes, bytes]: (ret,) = struct.unpack(f'>{length}s', data[:length]) return ret, data[length:] + def read_string(data: bytes) -> Tuple[bytes, int, bytes]: size, data = read_unsigned_int(data) if size == 0: @@ -43,6 +49,7 @@ def read_string(data: bytes) -> Tuple[bytes, int, bytes]: ret, data = read_fixed_string(data, size) return ret, size, data + class RegKey(NamedTuple): type_: int path: str @@ -52,6 +59,7 @@ class RegKey(NamedTuple): value: Union[bytes, int, List[bytes]] value_size: int + def read_key(data: bytes) -> Tuple[RegKey, bytes]: type_, data = read_unsigned_int(data) path, path_size, data = read_string(data) @@ -90,14 +98,8 @@ def read_key(data: bytes) -> Tuple[RegKey, bytes]: return RegKey(type_, path, path_size, key, key_size, value, value_length), data -if __name__ == '__main__': - if len(sys.argv) != 3: - print('Usage: python nemesis_reg_parser.py ') - sys.exit(1) - - input_path = sys.argv[1] - output_path = sys.argv[2] +def parse_serialized_reg_data(input_path: str) -> List[Tuple[RegKey, bytes]]: with open(input_path, 'rb') as f: data = f.read() arr = [] @@ -106,5 +108,18 @@ if __name__ == '__main__': for i in range(arr_size): reg_key, data = read_key(data) arr.append(reg_key._asdict()) - with open(output_path, 'w') as f: - json.dump(arr, f) + + return arr + + +if __name__ == '__main__': + if len(sys.argv) != 3: + print('Usage: python nemesis_reg_parser.py ') + sys.exit(1) + + input_path = sys.argv[1] + output_path = sys.argv[2] + + parsed_data = parse_serialized_reg_data(input_path) + with open(output_path, 'w') as f: + json.dump(parsed_data, f)