TruxtonETL

This class provides capability to participate in Truxton's ETL pipeline.

Attributes and Methods

addarg(argument: str) -> None

This is used to build the command line arguments for the process. Truxton will automatically parse the command line for you but this allows you to programmatically force command line options.

addtype(file_type: int) -> None

This is how you programmatically tell Truxton what types of files you want to process. It will cause Truxton to write records to the [ETLRoute] table. A new record will be added (if one does not already exist) with the [ETLQueueName] column set to this ETL's queue name and the [FileTypeID] column set to the file type specified in this function call.

The file_type parameter should be the type of file you'd like to process.

depot: str

This property is used in generating the depot filename.

description: str

This is a longer form description of what your ETL does.

dtype: int

The type of depot you will be writing to. It should be one of the values stored in the [ID] column of the [DepotType] table in the database.

expanderid: int

This is an arbitrary value you choose to uniquely identify your ETL process. This should be a fixed value that you never change. It will be written to the [Expander] column of the [ExpandedFile] table.

getmessage() -> TruxtonMessage

This function halts the execution of your process until a message arrives on your message queue.

mode: int

The mode your ETL will operate in. This is a bit flag field constructed by bitwise-or'ing the ETL application mode flags together.

name: str

This gives your ETL a human friendly name.

poly: int

This property tells Truxton that your ETL handles data that resides in multiple files all of which must be processed as a single unit. A Poly expander resides in the Semi-Chaotic stage of an exploitation effort. By default, Truxton assumes that ETL processes are single-file. A poly-file expander is a process that requires multiple files in order to successfully expand. An example of this situation is a spanned zip file where all of the pieces of the zip archive must be gathered before unzipping it.

queue: str

This tells Truxton which message queue to wait for messages for this ETL. This name will be normalized to all lower case letters with spaces removed. "My Queue" will be normalized to "myqueue"

sendmefileid(file_id: int) -> None

This is used during the development of your exploitation program. It will go to Truxton, find the file and place it into your message queue.

sendmefiles(file_type: int, count: int) -> None

This is used during the development of your exploitation program. It will go to Truxton, find the files that meet your criteria and place them into your message queue. file_type is the type of file you would like to process. count is the maximum number of files that will be put into your message queue. If you specify zero as the count then ALL files of that type in Truxton will be sent to your queue.

sendmehash(hash: object) -> None

This is used during the development of your exploitation program. It will go to Truxton, find the file with the given hash and place it into your message queue. The hash value is a string representation of an MD5 hash.

sendmelocalfile(file_name: str, file_type: int, calculate_hash: int) -> None

This is used during the development of your exploitation program. It will open the file and put a message into your message queue. file_name is the path the file on your system that you want to process. file_type is the type of file you would like associated with this file's contents. calculate_hash controls how the hash value associated with this file is calculated. By default, Truxton will calculate the MD5 hash of the file's contents before sending it to you. However, this can take some time if you are dealing with large files. If you don't care about the hash value, set calculate_hash to zero and the calculation of the hash will be skipped and a random value sent as the hash.

WARNING This API should be used to test the logic of your code for handling the contents of the file, not routing it. The following identifiers of the incoming message will be filled with random and invalid data:

• depotid
• fileid
• mediaid - The last field of the identifier will be 202053656E644D65 which spells out " SendMe" in ASCII
• parentid

Using these identifiers in other APIs should result in failure.

sendmemessage(message: TruxtonMessage) -> None

This will put the message into your queue.

stage: int

The stage number tells Truxton how your ETL fits into the overall exploitation process.

version: str

The optional version number of your ETL process. It will be written to the [Version] column of the [ExpandedFile] table. If you do not set the version number, Truxton will use a packed version number based on the information in the version resource of your executable.

Sample

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():
  etl = truxton.etl()
  etl.name = "My New ETL"
  etl.description = "This ETL processes files in the Truxton system"
  etl.queue = "anewetl"
  etl.stage = 40
  etl.expanderid = 0x05fc0bf6a57726a0
  etl.version = 0
  etl.depot = "thumbnail"
  etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
  etl.poly = 0

  etl.addarg("--verbose")
  etl.addarg("Yes")

  etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
  etl.sendmehash("baa51f0cc8361660df911e06e7637485")
  etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
  etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
  etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )

  # Pause here until we get a message from the "anewetl" message queue
  message = etl.getmessage()

  while message is not None:
    file_in_truxton = message.file()

    # YOUR FORENSIC CODE GOES HERE

    line_of_text = file_in_truxton.readline()

    if "[SetupAPI" in line_of_text:
      child = file_in_truxton.newchild()
      child.name = "Child file from New ETL"
      child.write("This is the file you were looking for.")
      child.save()

    # Pause here until we get another message from the "anewetl" message queue
    message = etl.getmessage()

if __name__ == "__main__":
  sys.exit(main())