Difference between revisions of "Truxton artifact set offset"
Jump to navigation
Jump to search
(Created page with "This records the offset into the object where the artifact was found. This corresponds to the <code>[Offset]</code> column of the <code><nowiki>[</nowiki>Entity Table|Entity...") |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | This records | + | This records the artifact was found. |
This corresponds to the <code>[Offset]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. | This corresponds to the <code>[Offset]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. | ||
=Syntax= | =Syntax= | ||
| Line 18: | Line 18: | ||
<source lang="C" highlight="24"> | <source lang="C" highlight="24"> | ||
| − | void expand_file(uint64_t file_handle) | + | void expand_file( uint64_t file_handle ) |
{ | { | ||
char pin_code[5]; | char pin_code[5]; | ||
| Line 32: | Line 32: | ||
if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 ) | if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 ) | ||
{ | { | ||
| − | if ( isdigit(pin_code[0]) && | + | if ( isdigit( pin_code[0] ) && |
| − | isdigit(pin_code[1]) && | + | isdigit( pin_code[1] ) && |
| − | isdigit(pin_code[2]) && | + | isdigit( pin_code[2] ) && |
| − | isdigit(pin_code[3]) ) | + | isdigit( pin_code[3] ) ) |
{ | { | ||
| − | uint64_t artifact = truxton_file_create_artifact(file_handle); | + | uint64_t artifact = truxton_file_create_artifact( file_handle ); |
truxton_artifact_set_name( artifact, "PIN Code" ); | truxton_artifact_set_name( artifact, "PIN Code" ); | ||
Latest revision as of 11:15, 10 February 2021
This records the artifact was found.
This corresponds to the [Offset] column of the [Entity] table.
Syntax
void truxton_artifact_set_offset( uint64_t artifact_handle, uint64_t offset );
Parameters
artifact_handle
The artifact instance.
This handle comes from calling truxton_artifact_create().
offset
The offset into the parent object where this artifact began.
Sample
This sample supposes you are a file expander that knows a user's pin code is optionally stored at a fixed location in the file.
void expand_file( uint64_t file_handle )
{
char pin_code[5];
pin_code[0] = ' ';
pin_code[1] = ' ';
pin_code[2] = ' ';
pin_code[3] = ' ';
pin_code[4] = 0x00;
truxton_file_seek( file_handle, 3772, SEEK_SET );
if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 )
{
if ( isdigit( pin_code[0] ) &&
isdigit( pin_code[1] ) &&
isdigit( pin_code[2] ) &&
isdigit( pin_code[3] ) )
{
uint64_t artifact = truxton_file_create_artifact( file_handle );
truxton_artifact_set_name( artifact, "PIN Code" );
truxton_artifact_set_data_type( artifact, DATA_TYPE_ASCII );
truxton_artifact_set_offset( artifact, 3772 );
truxton_artifact_set_length( artifact, 4 );
truxton_artifact_set_value( artifact, pin_code );
truxton_artifact_set_type( artifact, ENTITY_TYPE_PASSWORD );
if ( truxton_artifact_save( artifact ) != 0 )
{
char id[ 50 ];
truxton_artifact_get_id( artifact, id, sizeof( id ) );
printf( "Artifact saved as ID %s\n", id );
}
else
{
printf( "Could not save artifact\n" );
{
truxton_artifact_destroy( artifact );
}
}
}
