forensics
/
pymuleparser
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Added support for .part.met files

This commit is contained in:
JayPiKay 2017-09-29 08:32:30 +02:00
parent 2e7f4bb4f5
commit 9a5ee03426
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
ED2K.py
View File

@ -1,3 +1,5 @@
#!/usr/bin/env python3
"""
#define FT_FILENAME 0x01 // <string>
#define FT_FILESIZE 0x02 // <uint32> (or <uint64> when supported)
@ -68,10 +70,13 @@
#define FT_FILERATING 0xF7 // <uint8>
"""
import os
import binascii
HEADER_MET_FILE = b'\x0e'
HEADER_KNOWN_MET_FILE = b'\x0e'
HEADER_PART_MET_FILE = b'\xe0'
FT_FILENAME = 0x01
FT_FILESIZE = 0x02
@ -219,16 +224,20 @@ def load_record(fd):
def load_knownfiles(filename):
with open(filename, 'rb') as fd:
magic = fd.read(1)
count = int.from_bytes(fd.read(4), byteorder='little')
print('Number of records: {}'.format(count))
if magic == HEADER_MET_FILE:
if os.path.basename(filename) == 'known.met':
count = int.from_bytes(fd.read(4), byteorder='little')
print('Number of records: {}'.format(count))
if magic == HEADER_KNOWN_MET_FILE:
for index in range(count):
print('>>> [{}] NEW RECORD ***'.format(index+1))
print('Record offset: {}'.format(fd.tell()))
load_record(fd)
print('')
elif magic == HEADER_PART_MET_FILE:
print('>>> [{}] NEW RECORD ***'.format(0))
load_record(fd)
if __name__ == '__main__':
load_knownfiles('.\\data\\known.met')
# load_knownfiles('.\\data\\known.met')
load_knownfiles('.\\data\\008.part.met')