Difference between revisions of "Truxton C API"
Jump to navigation
Jump to search
| Line 91: | Line 91: | ||
* [[truxton_child_file_get_disk_offset]] - Retrieves the physical disk offset of the first byte of contents | * [[truxton_child_file_get_disk_offset]] - Retrieves the physical disk offset of the first byte of contents | ||
* [[truxton_child_file_get_entropy]] - Retrieves the [https://en.wikipedia.org/wiki/Entropy_(information_theory) entropy] of the file contents | * [[truxton_child_file_get_entropy]] - Retrieves the [https://en.wikipedia.org/wiki/Entropy_(information_theory) entropy] of the file contents | ||
| − | * [[truxton_child_file_create_artifact]] - | + | |
| − | * [[truxton_child_file_create_event]] - | + | Creating things related to this file: |
| − | * [[truxton_child_file_create_exif]] - | + | * [[truxton_child_file_create_artifact]] - Creates and associates an artifact with this file. The artifact be saved to the <code>[[Entity Table | Entity]]</code> table. |
| − | * [[truxton_child_file_create_location]] - | + | * [[truxton_child_file_create_event]] - Creates and associates an event with this file. The event will be saved to the <code>[[Event Table | Event]]</code> table. |
| + | * [[truxton_child_file_create_exif]] - Creates and associates camera information with this file. The data will be saved to the <code>[[EXIF Table | EXIF]]</code> table. | ||
| + | * [[truxton_child_file_create_location]] - Creates and associates a geographic location with this file. The data will be saved to the <code>[[Location Table | Location]]</code> table. | ||
* [[truxton_child_file_create_relation]] - | * [[truxton_child_file_create_relation]] - | ||
* [[truxton_child_file_create_url]] - | * [[truxton_child_file_create_url]] - | ||
Revision as of 13:12, 8 June 2020
Truxton functionality is exposed to the C programming world as a DLL named TruxtonCAPI.dll in the C:\Program Files\Truxton\SDK folder.
This DLL can be called from any programming language that has the ability to make operating system calls.
Contents
- 1 Philosophy
- 2 API Groups
- 2.1 Initialization
- 2.2 Functions
- 2.3 ETL Functions
- 2.4 Child Files
- 2.5 File IO
- 2.6 File Record Fields
- 2.7 Create Objects from File
- 2.8 ETL Creation
- 2.9 Debugging
- 2.10 Message
- 2.11 String Map
- 2.12 File Export
- 2.13 Artifacts
- 2.14 Event
- 2.15 EXIF (Camera Information)
- 2.16 Geographic Location
- 2.17 Website Visit
- 2.18 USB Device
- 2.19 Relation
Philosophy
The API is considered to be "flat" in that only sixty-four bit integers and ASCII character strings are used in the interface. This was chosen to make it easy for other languages to interface to. The coding convention is all lower case names with underscores separating words. Truxton is a member of the east const posse.
API Groups
The API is broken down into the different areas of Truxton.
Initialization
- truxton_start - Initializes Truxton
- truxton_stop - Uninitializes Truxton
Functions
- truxton_create - Creates a Truxton object
- truxton_destroy - Frees a Truxton object
- truxton_get_device_id - Retrieves the Device identifier
- truxton_get_machine_id - Retrieves the machine identifier
- truxton_get_version - Retrieves the version of Truxton
- truxton_start_adding_files - Prepares Truxton to add files to the database
ETL Functions
- truxton_etl_create - Creates a Truxton ETL object
- truxton_etl_destroy - Destroys a Truxton ETL object
- truxton_etl_add_command_line_argument - Adds a command line argument
- truxton_etl_add_desired_file_type - Tells Truxton what types of files you want to process
- truxton_etl_get_description
- truxton_etl_set_description
- truxton_etl_get_message
- truxton_etl_get_stage_number
- truxton_etl_set_stage_number
- truxton_etl_set_application_name
- truxton_etl_set_depot_type
- truxton_etl_set_depot_type_name
- truxton_etl_set_expander_identifier
- truxton_etl_set_expander_version
- truxton_etl_set_queue_name
- truxton_etl_set_thread_safe
- truxton_etl_set_poly_file_expander
- truxton_etl_send_me_file_id - Used during development and debugging
- truxton_etl_send_me_files - Used during development and debugging
- truxton_etl_send_me_hash - Used during development and debugging
- truxton_etl_send_me_local_file - Used during development and debugging
Child Files
A child file is one that you have created and need to save in Truxton.
- truxton_child_file_create - Create a file object to save to Truxton
- truxton_child_file_destroy - Destroys a file object
- truxton_child_file_clear - Returns a file object to an initial state of all zeroes
- truxton_child_file_get_id - Retrieves the GUID of the child file
- truxton_child_file_set_id - Sets the GUID of the child file
- truxton_child_file_get_parent_id - Retrieves the GUID of the parent file
- truxton_child_file_set_parent_id - Sets the GUID of the parent of the child
- truxton_child_file_get_media_id - Retrieves the GUID of the media this child belongs to
- truxton_child_file_set_media_id - Sets the GUID of the media this child belongs to
- truxton_child_file_get_name - Retrieves the name of the file
- truxton_child_file_set_name - Sets the name of the file
- truxton_child_file_get_path - Retrieves the path of the file
- truxton_child_file_set_path - Sets the path of the file
- truxton_child_file_get_hash - Retrieves the MD5 hash (digital fingerprint) of the file's contents
- truxton_child_file_get_number_of_children - Retrieves the number of child files of this file
- truxton_child_file_set_number_of_children - Sets the number of child files of this file
- truxton_child_file_get_created - Retrieves the date and time of when the file was created
- truxton_child_file_set_created - Sets the date and time of when the file was created
- truxton_child_file_get_accessed - Retrieves the date and time of when the file was accessed
- truxton_child_file_set_accessed - Sets the date and time of when the file was accessed
- truxton_child_file_get_modified - Retrieves the date and time of when the file was modified (last written to)
- truxton_child_file_set_modified - Sets the date and time of when the file was modified (last written to)
- truxton_child_file_get_size - Retrieves the size of the file, in bytes, as reported by the operating system
- truxton_child_file_set_size - Sets the size of the file, in bytes, as reported by the operating system
- truxton_child_file_get_origin - Retrieves the origin of the file
- truxton_child_file_set_origin - Sets the origin of the file
- truxton_child_file_get_content_status - Retrieves the status of the contents of the file
- truxton_child_file_set_content_status - Sets the status of the contents of the file
- truxton_child_file_get_truxton - Retrieves the instance of Truxton this child belongs to
- truxton_child_file_begin_write - Prepares Truxton for writing contents to be associated with this file
- truxton_child_file_end_write - Tells Truxton to finish writing contents
- truxton_child_file_write - Gives Truxton bytes to store as the file contents
- truxton_child_file_save - Commits data to the database
- truxton_child_file_set_type - Sets the type of the file
- truxton_child_file_get_type - Retrieves the type of the file
- truxton_child_file_set_attributes - Sets the attributes of the file
- truxton_child_file_get_attributes - Retrieves the attributes of the file
- truxton_child_file_set_disk_offset - Sets the physical disk offset of the first byte of contents
- truxton_child_file_get_disk_offset - Retrieves the physical disk offset of the first byte of contents
- truxton_child_file_get_entropy - Retrieves the entropy of the file contents
Creating things related to this file:
- truxton_child_file_create_artifact - Creates and associates an artifact with this file. The artifact be saved to the
Entitytable. - truxton_child_file_create_event - Creates and associates an event with this file. The event will be saved to the
Eventtable. - truxton_child_file_create_exif - Creates and associates camera information with this file. The data will be saved to the
EXIFtable. - truxton_child_file_create_location - Creates and associates a geographic location with this file. The data will be saved to the
Locationtable. - truxton_child_file_create_relation -
- truxton_child_file_create_url -
- truxton_child_file_create_usb -
- truxton_child_file_tag -
- truxton_child_file_new_child - Creates a child of this file
File IO
- truxton_file_open_id
- truxton_file_open_md5
- truxton_file_close
- truxton_file_free
- truxton_file_tell
- truxton_file_length
- truxton_file_is_closed
- truxton_file_seek
- truxton_file_readline
- truxton_file_read
File Record Fields
- truxton_file_get_id
- truxton_file_get_media_id
- truxton_file_get_parent_id
- truxton_file_get_number_of_children
- truxton_file_get_is_resident
- truxton_file_get_created
- truxton_file_get_accessed
- truxton_file_get_modified
- truxton_file_get_name
- truxton_file_get_attributes
- truxton_file_get_size
- truxton_file_get_origin
- truxton_file_get_content_status
- truxton_file_get_type
- truxton_file_get_hash
- truxton_file_get_entropy
- truxton_file_get_disk_offset
- truxton_file_get_is_eliminated
- truxton_file_get_depot_name
- truxton_file_get_depot_offset
- truxton_file_get_depot_length
- truxton_file_get_details
- truxton_file_get_truxton
Create Objects from File
The following APIs are used to create objects with a file as their parent.
- truxton_file_create_child - For creating a file.
- truxton_file_create_artifact
- truxton_file_create_event
- truxton_file_create_exif
- truxton_file_create_location
- truxton_file_create_relation
- truxton_file_create_url
- truxton_file_create_usb
ETL Creation
The following APIs are used to extend Truxton by creating an exploitation process.
- truxton_etl_add_command_line_argument
- truxton_etl_add_desired_file_type
- truxton_etl_create
- truxton_etl_destroy
- truxton_etl_get_description
- truxton_etl_get_message
- truxton_etl_get_stage_number
- truxton_etl_set_application_name
- truxton_etl_set_depot_type
- truxton_etl_set_depot_type_name
- truxton_etl_set_description
- truxton_etl_set_expander_identifier
- truxton_etl_set_expander_version
- truxton_etl_set_queue_name
- truxton_etl_set_stage_number
- truxton_etl_set_thread_safe
- truxton_etl_set_poly_file_expander
Debugging
- truxton_etl_send_me_file_id
- truxton_etl_send_me_files
- truxton_etl_send_me_hash
- truxton_etl_send_me_local_file
Message
- truxton_message_create
- truxton_message_destroy
- truxton_message_get_queue_is_empty
- truxton_message_set_queue_is_empty
- truxton_message_get_route_id
- truxton_message_set_route_id
- truxton_message_get_priority
- truxton_message_set_priority
- truxton_message_get_file_id
- truxton_message_set_file_id
- truxton_message_get_parent_id
- truxton_message_set_parent_id
- truxton_message_get_media_id
- truxton_message_set_media_id
- truxton_message_get_depot_id
- truxton_message_set_depot_id
- truxton_message_get_depot_offset
- truxton_message_set_depot_offset
- truxton_message_get_depot_length
- truxton_message_set_depot_length
- truxton_message_get_hash
- truxton_message_set_hash
- truxton_message_get_signature
- truxton_message_set_signature
- truxton_message_get_file_type
- truxton_message_set_file_type
- truxton_message_get_depot_filename
- truxton_message_set_depot_filename
- truxton_message_get_dont_route
- truxton_message_set_dont_route
- truxton_message_get_truxton
- truxton_message_set_truxton
String Map
- truxton_string_map_create
- truxton_string_map_destroy
- truxton_string_map_set
- truxton_string_map_get
- truxton_string_map_copy
- truxton_string_map_clone
- truxton_string_map_size
File Export
- truxton_file_export_create
- truxton_file_export_destroy
- truxton_file_export_set_option
- truxton_file_export_get_where_clause
- truxton_file_export_add_string_criteria
- truxton_file_export_add_integer_criteria
- truxton_file_export_set_truxton
- truxton_file_export_where_clause
Artifacts
- truxton_artifact_create
- truxton_artifact_destroy
- truxton_artifact_save
- truxton_artifact_get_data_type
- truxton_artifact_set_data_type
- truxton_artifact_get_file_id
- truxton_artifact_set_file_id
- truxton_artifact_get_id
- truxton_artifact_get_length
- truxton_artifact_set_length
- truxton_artifact_get_media_id
- truxton_artifact_set_media_id
- truxton_artifact_get_object_id
- truxton_artifact_set_object_id
- truxton_artifact_get_object_type
- truxton_artifact_set_object_type
- truxton_artifact_get_offset
- truxton_artifact_set_offset
- truxton_artifact_get_value
- truxton_artifact_set_value
Event
- truxton_event_create
- truxton_event_destroy
- truxton_event_save
- truxton_event_get_id
- truxton_event_set_title
- truxton_event_get_title
- truxton_event_set_description
- truxton_event_get_description
- truxton_event_get_start
- truxton_event_set_start
- truxton_event_get_end
- truxton_event_set_end
- truxton_event_get_type
- truxton_event_set_type
- truxton_event_get_media_id
- truxton_event_set_media_id
- truxton_event_get_file_id
- truxton_event_set_file_id
EXIF (Camera Information)
- truxton_exif_create
- truxton_exif_destroy
- truxton_exif_save
- truxton_exif_get_id
- truxton_exif_get_file_id
- truxton_exif_set_file_id
- truxton_exif_get_media_id
- truxton_exif_set_media_id
- truxton_exif_get_gps_time
- truxton_exif_set_gps_time
- truxton_exif_get_gps_time_offset
- truxton_exif_set_gps_time_offset
- truxton_exif_get_device_time
- truxton_exif_set_device_time
- truxton_exif_get_device_time_offset
- truxton_exif_set_device_time_offset
- truxton_exif_get_latitude
- truxton_exif_set_latitude
- truxton_exif_get_latitude_offset
- truxton_exif_set_latitude_offset
- truxton_exif_get_longitude
- truxton_exif_set_longitude
- truxton_exif_get_longitude_offset
- truxton_exif_set_longitude_offset
- truxton_exif_get_altitude
- truxton_exif_set_altitude
- truxton_exif_get_altitude_offset
- truxton_exif_set_altitude_offset
- truxton_exif_get_heading
- truxton_exif_set_heading
- truxton_exif_get_heading_offset
- truxton_exif_set_heading_offset
- truxton_exif_get_focal_length
- truxton_exif_set_focal_length
- truxton_exif_get_focal_length_offset
- truxton_exif_set_focal_length_offset
- truxton_exif_get_shutter_count
- truxton_exif_set_shutter_count
- truxton_exif_get_shutter_count_offset
- truxton_exif_set_shutter_count_offset
- truxton_exif_get_thumbnail_offset
- truxton_exif_set_thumbnail_offset
- truxton_exif_get_thumbnail_offset_offset
- truxton_exif_set_thumbnail_offset_offset
- truxton_exif_get_thumbnail_length
- truxton_exif_set_thumbnail_length
- truxton_exif_get_thumbnail_length_offset
- truxton_exif_set_thumbnail_length_offset
- truxton_exif_get_make
- truxton_exif_set_make
- truxton_exif_get_make_offset
- truxton_exif_set_make_offset
- truxton_exif_get_model
- truxton_exif_set_model
- truxton_exif_get_model_offset
- truxton_exif_set_model_offset
- truxton_exif_get_body_serial_number
- truxton_exif_set_body_serial_number
- truxton_exif_get_body_serial_number_offset
- truxton_exif_set_body_serial_number_offset
- truxton_exif_get_lens_serial_number
- truxton_exif_set_lens_serial_number
- truxton_exif_get_lens_serial_number_offset
- truxton_exif_set_lens_serial_number_offset
Geographic Location
- truxton_location_create
- truxton_location_destroy
- truxton_location_save
- truxton_location_get_id
- truxton_location_get_file_id
- truxton_location_set_file_id
- truxton_location_get_media_id
- truxton_location_set_media_id
- truxton_location_get_altitude
- truxton_location_set_altitude
- truxton_location_get_label
- truxton_location_set_label
- truxton_location_get_latitude
- truxton_location_set_latitude
- truxton_location_get_longitude
- truxton_location_set_longitude
- truxton_location_get_type
- truxton_location_set_type
- truxton_location_get_when
- truxton_location_set_when
Website Visit
- truxton_url_create
- truxton_url_destroy
- truxton_url_save
- truxton_url_get_account
- truxton_url_set_account
- truxton_url_get_account_offset
- truxton_url_set_account_offset
- truxton_url_get_file_id
- truxton_url_set_file_id
- truxton_url_get_format
- truxton_url_set_format
- truxton_url_get_id
- truxton_url_get_local_filename
- truxton_url_set_local_filename
- truxton_url_get_media_id
- truxton_url_set_media_id
- truxton_url_get_method
- truxton_url_set_method
- truxton_url_get_type
- truxton_url_set_type
- truxton_url_set_url
- truxton_url_get_url
- truxton_url_get_url_offset
- truxton_url_set_url_offset
- truxton_url_get_when
- truxton_url_set_when
USB Device
- truxton_usb_create
- truxton_usb_destroy
- truxton_usb_save
- truxton_usb_get_id
- truxton_usb_get_file_id
- truxton_usb_set_file_id
- truxton_usb_get_media_id
- truxton_usb_set_media_id
- truxton_usb_get_device_id
- truxton_usb_set_device_id
- truxton_usb_get_device_type
- truxton_usb_set_device_type
- truxton_usb_get_file_offset
- truxton_usb_set_file_offset
- truxton_usb_get_product_id
- truxton_usb_set_product_id
- truxton_usb_get_revision
- truxton_usb_set_revision
- truxton_usb_get_when
- truxton_usb_set_when
- truxton_usb_get_vendor_id
- truxton_usb_set_vendor_id
Relation
- truxton_relation_create
- truxton_relation_destroy
- truxton_relation_save
- truxton_relation_get_a_id
- truxton_relation_set_a_id
- truxton_relation_get_b_id
- truxton_relation_set_b_id
- truxton_relation_get_source_id
- truxton_relation_set_source_id
- truxton_relation_get_a_type
- truxton_relation_set_a_type
- truxton_relation_get_b_type
- truxton_relation_set_b_type
- truxton_relation_get_source_type
- truxton_relation_set_source_type
- truxton_relation_get_relation
- truxton_relation_set_relation
