Difference between revisions of "Truxton file create artifact"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "This creates an artifact from this file that you can use in the Artifact API. An artifact object is how you add records to the <code>Entity Tab...")
 
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
This creates an artifact from this file that you can use in the [[Truxton C API#Artifacts | Artifact API.]]
 
This creates an artifact from this file that you can use in the [[Truxton C API#Artifacts | Artifact API.]]
−
An artifact object is how you add records to the <code>[[Entity Table | Entity]]</code> table.
+
An artifact object is how you add records to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table.
  
 
=Syntax=
 
=Syntax=
−
<syntaxhighlight lang="C">
+
<source lang="C">
 
uint64_t truxton_file_create_artifact( uint64_t file_handle );
 
uint64_t truxton_file_create_artifact( uint64_t file_handle );
−
</syntaxhighlight>
+
</source>
  
 
=Parameters=
 
=Parameters=
Line 13: Line 13:
 
=Return value=
 
=Return value=
 
A handle to an artifact object.
 
A handle to an artifact object.
 +
 +
=Remarks=
 +
The artifact created by this function will already have the following initialized:
 +
* The [[truxton_artifact_set_file_id|file id]] will be set to this [[truxton_file_get_id|file's id]].
 +
* The [[truxton_artifact_set_media_id|media id]] will be set to this [[truxton_file_get_media_id|file's media id]].
 +
* The [[truxton_artifact_set_object_id|object id]] will be set this [[truxton_file_get_id|file's id]].
 +
* The [[truxton_artifact_set_object_type|object type]] will be set to <code>[[Object Types|OBJECT_TYPE_FILE]]</code>
  
 
=Sample=
 
=Sample=
−
<syntaxhighlight lang="C" highlight="34">
+
<source lang="C" highlight="5">
−
void add_folder(uint64_t truxton, uint64_t parent_file)
+
void process_file( uint64_t truxton )
 
{
 
{
−
  truxton_start_adding_files(truxton);
+
   uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" );
−
 
 
−
   uint64_t child = truxton_child_file_create(truxton);
 
−
 
 
−
  char id[40];
 
−
 
 
−
  truxton_file_get_id(parent_file, id, sizeof(id));
 
−
  truxton_child_file_set_parent_id(child, id);
 
−
  truxton_child_file_set_type(child, Type_Directory);
 
−
  truxton_child_file_set_name(child, "Custom Exploits Folder");
 
−
 
 
−
  FILETIME now;
 
−
 
 
−
  GetSystemTimeAsFileTime(&now);
 
−
 
 
−
  ULARGE_INTEGER ticks;
 
−
 
 
−
  ticks.LowPart = now.dwLowDateTime;
 
−
  ticks.HighPart = now.dwHighDateTime;
 
−
 
 
−
  truxton_child_file_set_created(child, ticks.QuadPart);
 
−
  truxton_child_file_set_accessed(child, ticks.QuadPart);
 
−
  truxton_child_file_set_modified(child, ticks.QuadPart);
 
−
 
 
−
  truxton_child_file_set_origin(child, ORIGIN_GENERATED);
 
−
 
 
−
  if ( truxton_child_file_save(child) == 0 )
 
−
  {
 
−
      printf( "Failed to add child to Truxton\n" );
 
−
  }
 
  
−
   uint64_t artifact = truxton_child_file_create_artifact(child);
+
   uint64_t artifact = truxton_file_create_artifact( file );
  
−
   truxton_artifact_set_type(artifact, ENTITY_TYPE_SERIAL_NUMBER);
+
   truxton_artifact_set_type( artifact, ENTITY_TYPE_SERIAL_NUMBER );
−
   truxton_artifact_set_value(artifact, "1234" );
+
   truxton_artifact_set_value( artifact, "1234" );
−
   truxton_artifact_save(artifact);
+
   truxton_artifact_save( artifact );
−
   truxton_artifact_destroy(artifact);
+
   truxton_artifact_destroy( artifact );
  
−
   truxton_child_file_destroy(child);
+
   truxton_file_free( file );
 
}
 
}
−
</syntaxhighlight>
+
</source>

Latest revision as of 07:02, 10 February 2021

This creates an artifact from this file that you can use in the Artifact API. An artifact object is how you add records to the [Entity] table.

Syntax

uint64_t truxton_file_create_artifact( uint64_t file_handle );

Parameters

file_handle

The handle created by the truxton_file_open_id or truxton_file_open_md5 call.

Return value

A handle to an artifact object.

Remarks

The artifact created by this function will already have the following initialized:

Sample

void process_file( uint64_t truxton )
{
   uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" );

   uint64_t artifact = truxton_file_create_artifact( file );

   truxton_artifact_set_type( artifact, ENTITY_TYPE_SERIAL_NUMBER );
   truxton_artifact_set_value( artifact, "1234" );
   truxton_artifact_save( artifact );
   truxton_artifact_destroy( artifact );

   truxton_file_free( file );
}
Retrieved from "https://truxwiki.com/index.php?title=Truxton_file_create_artifact&oldid=4242"