diff options
Diffstat (limited to 'src/attr_x30.rs')
| -rw-r--r-- | src/attr_x30.rs | 151 |
1 files changed, 98 insertions, 53 deletions
diff --git a/src/attr_x30.rs b/src/attr_x30.rs index 9218156..2c722ac 100644 --- a/src/attr_x30.rs +++ b/src/attr_x30.rs @@ -1,23 +1,22 @@ use errors::{MftError}; use rwinstructs::timestamp::{WinTimestamp}; use rwinstructs::reference::{MftReference}; -use rwinstructs::serialize::{serialize_u64}; use byteorder::{ReadBytesExt, LittleEndian}; use encoding::{Encoding, DecoderTrap}; use encoding::all::UTF_16LE; use std::io::Read; use std::mem; +use serde::ser::SerializeStruct; +use serde::ser; -#[derive(Serialize, Clone, Debug)] +#[derive(Clone, Debug)] pub struct FileNameAttr { pub parent: MftReference, pub created: WinTimestamp, pub modified: WinTimestamp, pub mft_modified: WinTimestamp, pub accessed: WinTimestamp, - #[serde(serialize_with = "serialize_u64")] pub logical_size: u64, - #[serde(serialize_with = "serialize_u64")] pub physical_size: u64, pub flags: u32, pub reparse_value: u32, @@ -27,27 +26,60 @@ pub struct FileNameAttr { pub fullname: Option<String> } impl FileNameAttr { - pub fn new<R: Read>(mut reader: R) -> Result<FileNameAttr,MftError> { - let mut attribute: FileNameAttr = unsafe { - mem::zeroed() - }; - - attribute.parent = MftReference(reader.read_u64::<LittleEndian>()?); - attribute.created = WinTimestamp(reader.read_u64::<LittleEndian>()?); - attribute.modified = WinTimestamp(reader.read_u64::<LittleEndian>()?); - attribute.mft_modified = WinTimestamp(reader.read_u64::<LittleEndian>()?); - attribute.accessed = WinTimestamp(reader.read_u64::<LittleEndian>()?); - attribute.logical_size = reader.read_u64::<LittleEndian>()?; - attribute.physical_size = reader.read_u64::<LittleEndian>()?; - attribute.flags = reader.read_u32::<LittleEndian>()?; - attribute.reparse_value = reader.read_u32::<LittleEndian>()?; - attribute.name_length = reader.read_u8()?; - attribute.namespace = reader.read_u8()?; + /// Parse a Filename attrbiute buffer. + /// + /// # Example + /// + /// Parse a raw buffer. + /// + /// ``` + /// use rustymft::attr_x30::FileNameAttr; + /// # fn test_filename_attribute() { + /// let attribute_buffer: &[u8] = &[ + /// 0x05,0x00,0x00,0x00,0x00,0x00,0x05,0x00,0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01, + /// 0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01,0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01, + /// 0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00, + /// 0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + /// 0x08,0x03,0x24,0x00,0x4C,0x00,0x6F,0x00,0x67,0x00,0x46,0x00,0x69,0x00,0x6C,0x00, + /// 0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00 + /// ]; + /// + /// let attribute = match FileNameAttr::new(attribute_buffer) { + /// Ok(attribute) => attribute, + /// Err(error) => panic!(error) + /// }; + /// + /// assert_eq!(attribute.parent.0, 1407374883553285); + /// assert_eq!(attribute.created.0, 130146182088895957); + /// assert_eq!(attribute.modified.0, 130146182088895957); + /// assert_eq!(attribute.mft_modified.0, 130146182088895957); + /// assert_eq!(attribute.accessed.0, 130146182088895957); + /// assert_eq!(attribute.logical_size, 67108864); + /// assert_eq!(attribute.physical_size, 67108864); + /// assert_eq!(attribute.flags, 6); + /// assert_eq!(attribute.reparse_value, 0); + /// assert_eq!(attribute.name_length, 8); + /// assert_eq!(attribute.namespace, 3); + /// assert_eq!(attribute.name, "$LogFile"); + /// # } + /// ``` + pub fn new(mut buffer: &[u8]) -> Result<FileNameAttr,MftError> { + let parent = MftReference(buffer.read_u64::<LittleEndian>()?); + let created = WinTimestamp(buffer.read_u64::<LittleEndian>()?); + let modified = WinTimestamp(buffer.read_u64::<LittleEndian>()?); + let mft_modified = WinTimestamp(buffer.read_u64::<LittleEndian>()?); + let accessed = WinTimestamp(buffer.read_u64::<LittleEndian>()?); + let logical_size = buffer.read_u64::<LittleEndian>()?; + let physical_size = buffer.read_u64::<LittleEndian>()?; + let flags = buffer.read_u32::<LittleEndian>()?; + let reparse_value = buffer.read_u32::<LittleEndian>()?; + let name_length = buffer.read_u8()?; + let namespace = buffer.read_u8()?; - let mut name_buffer = vec![0; (attribute.name_length as usize * 2) as usize]; - reader.read_exact(&mut name_buffer)?; + let mut name_buffer = vec![0; (name_length as usize * 2) as usize]; + buffer.read_exact(&mut name_buffer)?; - attribute.name = match UTF_16LE.decode(&name_buffer,DecoderTrap::Ignore){ + let name = match UTF_16LE.decode(&name_buffer,DecoderTrap::Ignore){ Ok(filename) => filename, Err(error) => return Err( MftError::decode_error( @@ -56,41 +88,54 @@ impl FileNameAttr { ) }; - Ok(attribute) + let fullname = None; + + Ok( + FileNameAttr { + parent: parent, + created: created, + modified: modified, + mft_modified: mft_modified, + accessed: accessed, + logical_size: logical_size, + physical_size: physical_size, + flags: flags, + reparse_value: reparse_value, + name_length: name_length, + namespace: namespace, + name: name, + fullname: fullname + } + ) } } -#[cfg(test)] -mod tests { - use super::FileNameAttr; +impl ser::Serialize for FileNameAttr { + fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> + where S: ser::Serializer + { + let mut state = serializer.serialize_struct("FileNameAttr", 13)?; - #[test] - fn fn_attribute_test_01() { - let attribute_buffer: &[u8] = &[ - 0x05,0x00,0x00,0x00,0x00,0x00,0x05,0x00,0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01, - 0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01,0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01, - 0xD5,0x2D,0x48,0x58,0x43,0x5F,0xCE,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00, - 0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00, - 0x08,0x03,0x24,0x00,0x4C,0x00,0x6F,0x00,0x67,0x00,0x46,0x00,0x69,0x00,0x6C,0x00, - 0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ]; + state.serialize_field("parent",&self.parent)?; + state.serialize_field("created", &format!("{}",&self.created))?; + state.serialize_field("modified", &format!("{}",&self.modified))?; + state.serialize_field("mft_modified", &format!("{}",&self.mft_modified))?; + state.serialize_field("accessed", &self.accessed)?; + state.serialize_field("logical_size", &self.logical_size)?; + state.serialize_field("physical_size", &self.physical_size)?; + state.serialize_field("flags", &self.flags)?; + state.serialize_field("reparse_value", &self.reparse_value)?; + state.serialize_field("name_length", &self.name_length)?; + state.serialize_field("namespace", &self.namespace)?; + state.serialize_field("name", &format!("{}",&self.name))?; - let attribute = match FileNameAttr::new(attribute_buffer) { - Ok(attribute) => attribute, - Err(error) => panic!(error) - }; + match self.fullname { + Some(ref fullname) => { + state.serialize_field("fullname", &format!("{}",&fullname))?; + }, + None => {} + } - assert_eq!(attribute.parent.0, 1407374883553285); - assert_eq!(attribute.created.0, 130146182088895957); - assert_eq!(attribute.modified.0, 130146182088895957); - assert_eq!(attribute.mft_modified.0, 130146182088895957); - assert_eq!(attribute.accessed.0, 130146182088895957); - assert_eq!(attribute.logical_size, 67108864); - assert_eq!(attribute.physical_size, 67108864); - assert_eq!(attribute.flags, 6); - assert_eq!(attribute.reparse_value, 0); - assert_eq!(attribute.name_length, 8); - assert_eq!(attribute.namespace, 3); - assert_eq!(attribute.name, "$LogFile"); + state.end() } } |