Python Sample Identification ETL - Revision history

Sam: /* Source Code */

2024-09-11T20:55:45Z

Source Code

Sam: /* Source Code */

2024-09-11T20:38:24Z

Source Code

Sam: /* Source Code No Comments */

2024-09-11T20:37:37Z

Source Code No Comments

Sam at 11:25, 24 January 2024

2024-01-24T11:25:33Z

Sam: /* Source Code No Comments */

2023-08-17T23:54:16Z

Source Code No Comments

Sam: /* Source Code */

2023-08-17T23:54:05Z

Source Code

Sam: /* Code Walkthrough */

2023-05-25T09:40:26Z

Code Walkthrough

Sam at 12:18, 10 May 2022

2022-05-10T12:18:56Z

Sam at 18:42, 9 May 2022

2022-05-09T18:42:13Z

Sam at 13:31, 14 May 2021

2021-05-14T13:31:25Z

@@ Line 23: / Line 23: @@
 # An Acme File begins with 0x88 0x77 0x66 0x55 0x00 and is at least 16 bytes long
-def main():
+def main() -> None:
    etl = truxton.etl()

@@ Line 50: / Line 50: @@
        # There are enough bytes to attempt identification and the first four bytes match
        # We will now open the file contents
-       file_in_truxton = message.file()
+       with message.file() as file_in_truxton:
-      # Since the first four bytes were already checked, let's read the fifth byte
+        # Since the first four bytes were already checked, let's read the fifth byte
-      file_in_truxton.seek(4)
+        file_in_truxton.seek(4)
-      next_byte = file_in_truxton.read(1)
+        next_byte = file_in_truxton.read(1)
-      if next_byte[0] == 0:
+        if next_byte[0] == 0:
-        # Yes! This is an Acme file. Change the database record
+          # Yes! This is an Acme file. Change the database record
-        file_in_truxton.changetype(11000)
+          file_in_truxton.changetype(11000)
-        # We changed the database, now we need to send this file to any ETL
+          # We changed the database, now we need to send this file to any ETL
-        # exploitation processes that registered to receive Acme files
+          # exploitation processes that registered to receive Acme files
-        # First, change the file type in the message
+          # First, change the file type in the message
-        message.filetype = 11000
+          message.filetype = 11000
-        # Now send this message to those ETL processes
+          # Now send this message to those ETL processes
-        message.route()
+          message.route()
      # Pause here until we get another message from the "acme" message queue

@@ Line 120: / Line 120: @@
    while message is not None:
      if message.depotlength >= 16 and message.signature == 0x88776655:
-       file_in_truxton = message.file()
+       with message.file() as file_in_truxton:
-      file_in_truxton.seek(4)
+        file_in_truxton.seek(4)
-      next_byte = file_in_truxton.read(1)
+        next_byte = file_in_truxton.read(1)
-      if next_byte[0] == 0:
+        if next_byte[0] == 0:
-        file_in_truxton.changetype(11000)
+          file_in_truxton.changetype(11000)
-        message.filetype = 11000
+          message.filetype = 11000
-        message.route()
+          message.route()
      message = etl.getmessage()

@@ Line 2: / Line 2: @@
 You can see this same sample implemented in [[C Sample Identification ETL|C]].
 After identifying the file type, you will next need to [[Python Sample Exploitation ETL|exploit]] it.
 =Sample File Format=

@@ Line 132: / Line 132: @@
 if __name__ == "__main__":
-     main()
+     sys.exit(main())
 </source>

@@ Line 78: / Line 78: @@
 Lines 10-22 setup the ETL.
-The message queue name will be "acme", we are an early stage and want to receive <code>[[Type_Unknown]]</code> files.
+The message queue name will be "acme", we are an early [[ETL Stages|stage]] and want to receive <code>[[Type_Unknown]]</code> files.
 Line 25 starts the ETL logic and waits until a message arrives on the "acme" queue.

← Older revision		Revision as of 12:18, 10 May 2022
Line 100:		Line 100:

	Line 54 completes the loop by getting another message from the acme message queue.		Line 54 completes the loop by getting another message from the acme message queue.
		+
		+	=Source Code No Comments=
		+	<source lang="python">
		+	import sys
		+	sys.path.append('C:/Program Files/Truxton/SDK')
		+	import truxton
		+
		+	def main():
		+	etl = truxton.etl()
		+	etl.name = "Acme Identifier"
		+	etl.description = "This ETL identifies files using the Acme method"
		+	etl.queue = "acme"
		+	etl.stage = 2
		+	etl.addtype(truxton.Type_Unknown)
		+
		+	message = etl.getmessage()
		+
		+	while message is not None:
		+	if message.depotlength >= 16 and message.signature == 0x88776655:
		+	file_in_truxton = message.file()
		+	file_in_truxton.seek(4)
		+	next_byte = file_in_truxton.read(1)
		+
		+	if next_byte[0] == 0:
		+	file_in_truxton.changetype(11000)
		+
		+	message.filetype = 11000
		+	message.route()
		+
		+	message = etl.getmessage()
		+
		+	if __name__ == "__main__":
		+	main()
		+	</source>

← Older revision		Revision as of 13:31, 14 May 2021
Line 1:		Line 1:
	This sample shows the steps needed to implement a byte identifier ETL in Python.		This sample shows the steps needed to implement a byte identifier ETL in Python.
		+	You can see this same sample implemented in [[C Sample Identification ETL\|C]].

	=Sample File Format=		=Sample File Format=