Commit f4f0472d by devttys0

Added --carve option; made delayed extraction the default.

parent d5eb11e0
...@@ -111,7 +111,8 @@ def usage(fd): ...@@ -111,7 +111,8 @@ def usage(fd):
fd.write("\t-e, --extract=[file] Automatically extract known file types; load rules from file, if specified\n") fd.write("\t-e, --extract=[file] Automatically extract known file types; load rules from file, if specified\n")
fd.write("\t-M, --matryoshka=[n] Recursively scan extracted files, up to n levels deep (8 levels of recursion is the default)\n") fd.write("\t-M, --matryoshka=[n] Recursively scan extracted files, up to n levels deep (8 levels of recursion is the default)\n")
fd.write("\t-r, --rm Cleanup extracted files and zero-size files\n") fd.write("\t-r, --rm Cleanup extracted files and zero-size files\n")
fd.write("\t-d, --delay Delay file extraction for files with known footers\n") fd.write("\t-j, --ignore-footers Ignore file footers and extract up to EOF\n")
fd.write("\t-z, --carve Carve data from files, but don't execute extraction utilities\n")
fd.write("\n") fd.write("\n")
fd.write("Plugin Options:\n") fd.write("Plugin Options:\n")
...@@ -165,11 +166,12 @@ def main(): ...@@ -165,11 +166,12 @@ def main():
show_legend = True show_legend = True
entropy_scan = False entropy_scan = False
enable_plugins = True enable_plugins = True
exec_commands = True
show_invalid = False show_invalid = False
entropy_algorithm = None entropy_algorithm = None
format_to_terminal = False format_to_terminal = False
custom_signature = None custom_signature = None
delay_extraction = False delay_extraction = True
ignore_time_skew = True ignore_time_skew = True
extract_rules_file = None extract_rules_file = None
ignore_failed_open = False ignore_failed_open = False
...@@ -194,7 +196,7 @@ def main(): ...@@ -194,7 +196,7 @@ def main():
config = binwalk.Config() config = binwalk.Config()
short_options = "AaBbCcdEeGHhIiJkLMNnOPpQqrSTtUuvWw?D:F:f:g:K:o:l:m:R:s:X:x:Y:y:" short_options = "AaBbCcdEeGHhIiJjkLMNnOPpQqrSTtUuvWwz?D:F:f:g:K:o:l:m:R:s:X:x:Y:y:"
long_options = [ long_options = [
"rm", "rm",
"help", "help",
...@@ -212,8 +214,10 @@ def main(): ...@@ -212,8 +214,10 @@ def main():
"keep-going", "keep-going",
"show-invalid", "show-invalid",
"ignore-time-skew", "ignore-time-skew",
"ignore-footers",
"carve",
"profile", "profile",
"delay", "delay", # delay is depreciated, but kept for backwards compatability
"skip-unopened", "skip-unopened",
"term", "term",
"tim", "tim",
...@@ -266,6 +270,8 @@ def main(): ...@@ -266,6 +270,8 @@ def main():
examples() examples()
elif opt in ("-d", "--delay"): elif opt in ("-d", "--delay"):
delay_extraction = True delay_extraction = True
elif opt in ("-j", "--ignore-footers"):
delay_extraction = False
elif opt in ("-f", "--file"): elif opt in ("-f", "--file"):
log_file = arg log_file = arg
elif opt in ("-c", "--csv"): elif opt in ("-c", "--csv"):
...@@ -336,6 +342,8 @@ def main(): ...@@ -336,6 +342,8 @@ def main():
plugin_whitelist.append(arg) plugin_whitelist.append(arg)
elif opt in ("-T", "--ignore-time-skew"): elif opt in ("-T", "--ignore-time-skew"):
ignore_time_skew = False ignore_time_skew = False
elif opt in ("-z", "--carve"):
exec_commands = False
elif opt in ("-H", "--heuristic", "--math"): elif opt in ("-H", "--heuristic", "--math"):
do_comp = True do_comp = True
...@@ -453,7 +461,15 @@ def main(): ...@@ -453,7 +461,15 @@ def main():
usage(sys.stderr) usage(sys.stderr)
# Instantiate the Binwalk class # Instantiate the Binwalk class
bwalk = binwalk.Binwalk(magic_files=magic_files, flags=magic_flags, verbose=verbose, log=log_file, quiet=quiet, ignore_smart_keywords=ignore_signature_keywords, load_plugins=enable_plugins, ignore_time_skews=ignore_time_skew) bwalk = binwalk.Binwalk(magic_files=magic_files,
flags=magic_flags,
verbose=verbose,
log=log_file,
quiet=quiet,
ignore_smart_keywords=ignore_signature_keywords,
load_plugins=enable_plugins,
ignore_time_skews=ignore_time_skew,
exec_commands=exec_commands)
# If a custom signature was specified, create a temporary magic file containing the custom signature # If a custom signature was specified, create a temporary magic file containing the custom signature
# and ensure that it is the only magic file that will be loaded when Binwalk.scan() is called. # and ensure that it is the only magic file that will be loaded when Binwalk.scan() is called.
...@@ -482,9 +498,6 @@ def main(): ...@@ -482,9 +498,6 @@ def main():
# Enable delayed extraction, which will prevent supported file types from having trailing data when extracted # Enable delayed extraction, which will prevent supported file types from having trailing data when extracted
bwalk.extractor.enable_delayed_extract(delay_extraction) bwalk.extractor.enable_delayed_extract(delay_extraction)
# Load the magic file(s)
#bwalk.load_signatures(magic_files=magic_files)
# If --term was specified, enable output formatting to terminal # If --term was specified, enable output formatting to terminal
if format_to_terminal: if format_to_terminal:
bwalk.display.enable_formatting(True) bwalk.display.enable_formatting(True)
......
...@@ -68,7 +68,7 @@ class Binwalk(object): ...@@ -68,7 +68,7 @@ class Binwalk(object):
CUSTOM = 0x40 CUSTOM = 0x40
ENTROPY = 0x80 ENTROPY = 0x80
def __init__(self, magic_files=[], flags=magic.MAGIC_NONE, log=None, quiet=False, verbose=0, ignore_smart_keywords=False, ignore_time_skews=False, load_extractor=False, load_plugins=True): def __init__(self, magic_files=[], flags=magic.MAGIC_NONE, log=None, quiet=False, verbose=0, ignore_smart_keywords=False, ignore_time_skews=False, load_extractor=False, load_plugins=True, exec_commands=True):
''' '''
Class constructor. Class constructor.
...@@ -81,6 +81,7 @@ class Binwalk(object): ...@@ -81,6 +81,7 @@ class Binwalk(object):
@ignore_time_skews - Set to True to ignore file results with timestamps in the future. @ignore_time_skews - Set to True to ignore file results with timestamps in the future.
@load_extractor - Set to True to load the default extraction rules automatically. @load_extractor - Set to True to load the default extraction rules automatically.
@load_plugins - Set to False to disable plugin support. @load_plugins - Set to False to disable plugin support.
@exec_commands - Set to False to disable the execution of external utilities when extracting data from files.
Returns None. Returns None.
''' '''
...@@ -134,7 +135,7 @@ class Binwalk(object): ...@@ -134,7 +135,7 @@ class Binwalk(object):
# o Specify file extraction rules to be applied during a scan # o Specify file extraction rules to be applied during a scan
# #
self.filter = MagicFilter() self.filter = MagicFilter()
self.extractor = Extractor(verbose=extractor_verbose) self.extractor = Extractor(verbose=extractor_verbose, exec_commands=exec_commands)
if load_extractor: if load_extractor:
self.extractor.load_defaults() self.extractor.load_defaults()
......
...@@ -45,18 +45,20 @@ class Extractor: ...@@ -45,18 +45,20 @@ class Extractor:
# Max size of data to read/write at one time when extracting data # Max size of data to read/write at one time when extracting data
MAX_READ_SIZE = 10 * 1024 * 1024 MAX_READ_SIZE = 10 * 1024 * 1024
def __init__(self, verbose=False): def __init__(self, verbose=False, exec_commands=True):
''' '''
Class constructor. Class constructor.
@verbose - Set to True to display the output from any executed external applications. @verbose - Set to True to display the output from any executed external applications.
@exec_commands - Set to False to disable the execution of external utilities when extracting data from files.
Returns None. Returns None.
''' '''
self.config = Config() self.config = Config()
self.enabled = False self.enabled = False
self.delayed = False self.delayed = True
self.verbose = verbose self.verbose = verbose
self.exec_commands = exec_commands
self.extract_rules = [] self.extract_rules = []
self.remove_after_execute = False self.remove_after_execute = False
self.extract_path = os.getcwd() self.extract_path = os.getcwd()
...@@ -465,6 +467,9 @@ class Extractor: ...@@ -465,6 +467,9 @@ class Extractor:
tmp = None tmp = None
retval = True retval = True
if not self.exec_commands:
return retval
try: try:
if callable(cmd): if callable(cmd):
try: try:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment