Difference between revisions of "Truxton artifact set offset"
Jump to navigation
Jump to search
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | This records | + | This records the artifact was found. |
| − | + | This corresponds to the <code>[Offset]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. | |
=Syntax= | =Syntax= | ||
<source lang="C"> | <source lang="C"> | ||
| − | void | + | void truxton_artifact_set_offset( uint64_t artifact_handle, uint64_t offset ); |
</source> | </source> | ||
| Line 11: | Line 11: | ||
This handle comes from calling <code>[[truxton_artifact_create]]()</code>. | This handle comes from calling <code>[[truxton_artifact_create]]()</code>. | ||
| − | ==<code> | + | ==<code>offset</code>== |
| − | The | + | The offset into the parent object where this artifact began. |
=Sample= | =Sample= | ||
This sample supposes you are a file expander that knows a user's pin code is optionally stored at a fixed location in the file. | This sample supposes you are a file expander that knows a user's pin code is optionally stored at a fixed location in the file. | ||
| − | <source lang="C" | + | <source lang="C" highlight="24"> |
| − | void expand_file(uint64_t file_handle) | + | void expand_file( uint64_t file_handle ) |
{ | { | ||
char pin_code[5]; | char pin_code[5]; | ||
| Line 32: | Line 32: | ||
if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 ) | if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 ) | ||
{ | { | ||
| − | if ( isdigit(pin_code[0]) && | + | if ( isdigit( pin_code[0] ) && |
| − | isdigit(pin_code[1]) && | + | isdigit( pin_code[1] ) && |
| − | isdigit(pin_code[2]) && | + | isdigit( pin_code[2] ) && |
| − | isdigit(pin_code[3]) ) | + | isdigit( pin_code[3] ) ) |
{ | { | ||
| − | uint64_t artifact = truxton_file_create_artifact(file_handle); | + | uint64_t artifact = truxton_file_create_artifact( file_handle ); |
truxton_artifact_set_name( artifact, "PIN Code" ); | truxton_artifact_set_name( artifact, "PIN Code" ); | ||
Latest revision as of 11:15, 10 February 2021
This records the artifact was found.
This corresponds to the [Offset] column of the [Entity] table.
Syntax
void truxton_artifact_set_offset( uint64_t artifact_handle, uint64_t offset );
Parameters
artifact_handle
The artifact instance.
This handle comes from calling truxton_artifact_create().
offset
The offset into the parent object where this artifact began.
Sample
This sample supposes you are a file expander that knows a user's pin code is optionally stored at a fixed location in the file.
void expand_file( uint64_t file_handle )
{
char pin_code[5];
pin_code[0] = ' ';
pin_code[1] = ' ';
pin_code[2] = ' ';
pin_code[3] = ' ';
pin_code[4] = 0x00;
truxton_file_seek( file_handle, 3772, SEEK_SET );
if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 )
{
if ( isdigit( pin_code[0] ) &&
isdigit( pin_code[1] ) &&
isdigit( pin_code[2] ) &&
isdigit( pin_code[3] ) )
{
uint64_t artifact = truxton_file_create_artifact( file_handle );
truxton_artifact_set_name( artifact, "PIN Code" );
truxton_artifact_set_data_type( artifact, DATA_TYPE_ASCII );
truxton_artifact_set_offset( artifact, 3772 );
truxton_artifact_set_length( artifact, 4 );
truxton_artifact_set_value( artifact, pin_code );
truxton_artifact_set_type( artifact, ENTITY_TYPE_PASSWORD );
if ( truxton_artifact_save( artifact ) != 0 )
{
char id[ 50 ];
truxton_artifact_get_id( artifact, id, sizeof( id ) );
printf( "Artifact saved as ID %s\n", id );
}
else
{
printf( "Could not save artifact\n" );
{
truxton_artifact_destroy( artifact );
}
}
}
