Difference between revisions of "Truxton artifact get value"
Jump to navigation
Jump to search
(Created page with "This retrieves the value of the artifact. =Syntax= <source lang="C"> void truxton_artifact_get_value( uint64_t artifact_handle, char * destination_string, size_t max_size );...") |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 9: | Line 9: | ||
=Parameters= | =Parameters= | ||
==<code>artifact_handle</code>== | ==<code>artifact_handle</code>== | ||
| − | The handle to an artifact created by the [[truxton_artifact_create]] call. | + | The handle to an artifact created by the <code>[[truxton_artifact_create]]()</code> call. |
==<code>destination_string</code>== | ==<code>destination_string</code>== | ||
| Line 20: | Line 20: | ||
<source lang="C" highlight="17"> | <source lang="C" highlight="17"> | ||
| − | void dump_artifact(uint64_t artifact_handle) | + | void dump_artifact( uint64_t artifact_handle ) |
{ | { | ||
char guid_string[ 40 ]; | char guid_string[ 40 ]; | ||
| Line 55: | Line 55: | ||
} | } | ||
</source> | </source> | ||
| + | |||
| + | The <code>PRIu64</code> in the sample code above is a standard way of [https://en.wikipedia.org/wiki/C_data_types#Printf_and_scanf_format_specifiers formatting] a 64-bit unsigned integer in C. | ||
| + | Over the years, different compilers on different operating systems used different format specifiers for things, these <code>PRI</code> macros, along with some tricky string concatenation the compilers perform for you, allow you to maintain a single code base without a bunch of macro magic. | ||
Latest revision as of 11:16, 10 February 2021
This retrieves the value of the artifact.
Syntax
void truxton_artifact_get_value( uint64_t artifact_handle, char * destination_string, size_t max_size );
Parameters
artifact_handle
The handle to an artifact created by the truxton_artifact_create() call.
destination_string
The string to be written to.
max_size
The maximum number of characters that can be written to destination_string.
Sample
void dump_artifact( uint64_t artifact_handle )
{
char guid_string[ 40 ];
truxton_artifact_get_file_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "File ID is %s\n", guid_string );
truxton_artifact_get_media_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "Media ID is %s\n", guid_string );
truxton_artifact_get_object_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "Object ID is %s\n", guid_string );
truxton_artifact_get_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "Artifact ID is %s\n", guid_string );
truxton_artifact_get_value( artifact_handle, guid_string, sizeof(guid_string) );
printf( "Artifact value is %s\n", guid_string );
uint64_t value = truxton_artifact_get_object_type( artifact_handle );
printf( "Object type is %" PRIu64 "\n", value );
value = truxton_artifact_get_data_type( artifact_handle );
printf( "Data type is %" PRIu64 "\n", value );
value = truxton_artifact_get_offset( artifact_handle );
printf( "Offset is %" PRIu64 "\n", value );
value = truxton_artifact_get_length( artifact_handle );
printf( "Length is %" PRIu64 "\n", value );
value = truxton_artifact_get_type( artifact_handle );
printf( "Type is %" PRIu64 "\n", value );
}
The PRIu64 in the sample code above is a standard way of formatting a 64-bit unsigned integer in C.
Over the years, different compilers on different operating systems used different format specifiers for things, these PRI macros, along with some tricky string concatenation the compilers perform for you, allow you to maintain a single code base without a bunch of macro magic.
