SHARE
TWEET

Untitled

a guest Jun 19th, 2019 81 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/env python
  2.  
  3. import sys
  4. import argparse
  5. from datetime import datetime, timedelta
  6.  
  7.  
  8. def convertFiletime(value):
  9.     '''
  10.    Definition used to parse PR_CONVERSATION_INDEX value and return human readable value.
  11.    '''
  12.  
  13.     hex_data = value.decode('base64')
  14.     hex_chars = map(hex, map(ord, hex_data))
  15.     hex_string = "".join(c[2:4].zfill(2) for c in hex_chars)
  16.     ft_value = hex_string[1:12] + '0000'
  17.     guid = hex_string[12:44]
  18.  
  19.     print "Encoded:\t  " + ft_value
  20.     print int(ft_value[:8], 16)
  21.     print int(ft_value[8:], 16)
  22.  
  23.     time_offset = int(ft_value, 16) / 10.
  24.     filetime = datetime(1601, 1, 1) + timedelta(microseconds=time_offset)
  25.  
  26.     print "Decoded:\t" + hex_string
  27.     print "FILETIME:\t" + str(filetime)
  28.     print "GUID:\t\t" + guid[:8] + "-" + guid[8:12] + "-" + guid[12:16] + "-" + guid[16:20] + "-" + guid[20:]
  29.  
  30.     if hex_string > 44:
  31.         child_blocks = hex_string[44:]
  32.         n = 10
  33.         children = [child_blocks[i:i+n]
  34.                     for i in range(0, len(child_blocks), n)]
  35.         count = 0
  36.  
  37.         for child in children:
  38.             scale = 16
  39.             num_of_bits = 40
  40.             binary = bin(int(child, scale))[2:].zfill(num_of_bits)
  41.  
  42.             print "Delta code:\t" + binary[:1]
  43.             time_diff = '0'*15 + binary[1:32] + '0'*18
  44.             c_time_offset = int(time_diff, 2) / 10.
  45.             filetime = filetime + timedelta(microseconds=c_time_offset)
  46.  
  47.             print "\tChild Message[" + str(count+1) + "]:  " + str(filetime)
  48.             count += 1
  49.     else:
  50.         pass
  51.  
  52.  
  53. def main():
  54.     parser = argparse.ArgumentParser()
  55.     parser.add_argument("value", nargs=1, help='Thread-Index value')
  56.  
  57.     args = parser.parse_args()
  58.     value = str(args.value)
  59.     convertFiletime(value)
  60.  
  61.  
  62. if __name__ == '__main__':
  63.  
  64.     main()
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top