Difference between revisions of "Truxton artifact set value"

From truxwiki.com
Jump to navigation Jump to search
Line 18: Line 18:
  
 
<source lang="C" line highlight="26">
 
<source lang="C" line highlight="26">
void expand_file(uint64_t file_handle)
+
void expand_file( uint64_t file_handle )
 
{
 
{
 
   char pin_code[5];
 
   char pin_code[5];
Line 32: Line 32:
 
   if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 )
 
   if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 )
 
   {
 
   {
       if ( isdigit(pin_code[0]) &&
+
       if ( isdigit( pin_code[0] ) &&
           isdigit(pin_code[1]) &&
+
           isdigit( pin_code[1] ) &&
           isdigit(pin_code[2]) &&
+
           isdigit( pin_code[2] ) &&
           isdigit(pin_code[3]) )
+
           isdigit( pin_code[3] ) )
 
       {
 
       {
         uint64_t artifact = truxton_file_create_artifact(file_handle);
+
         uint64_t artifact = truxton_file_create_artifact( file_handle );
  
 
         truxton_artifact_set_name( artifact, "PIN Code" );
 
         truxton_artifact_set_name( artifact, "PIN Code" );

Revision as of 11:17, 10 February 2021

This records the offset into the object where the artifact was found.

Syntax

void truxton_artifact_set_value( uint64_t artifact_handle, char const * value );

Parameters

artifact_handle

The artifact instance. This handle comes from calling truxton_artifact_create().

value

The string representation of the artifact.

Sample

This sample supposes you are a file expander that knows a user's pin code is optionally stored at a fixed location in the file.

 1 void expand_file( uint64_t file_handle )
 2 {
 3    char pin_code[5];
 4 
 5    pin_code[0] = ' ';
 6    pin_code[1] = ' ';
 7    pin_code[2] = ' ';
 8    pin_code[3] = ' ';
 9    pin_code[4] = 0x00;
10 
11    truxton_file_seek( file_handle, 3772, SEEK_SET );
12 
13    if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 )
14    {
15       if ( isdigit( pin_code[0] ) &&
16            isdigit( pin_code[1] ) &&
17            isdigit( pin_code[2] ) &&
18            isdigit( pin_code[3] ) )
19       {
20          uint64_t artifact = truxton_file_create_artifact( file_handle );
21 
22          truxton_artifact_set_name( artifact, "PIN Code" );
23          truxton_artifact_set_data_type( artifact, DATA_TYPE_ASCII );
24          truxton_artifact_set_offset( artifact, 3772 );
25          truxton_artifact_set_length( artifact, 4 );
26          truxton_artifact_set_value( artifact, pin_code );
27          truxton_artifact_set_type( artifact, ENTITY_TYPE_PASSWORD );
28 
29          if ( truxton_artifact_save( artifact ) != 0 )
30          {
31              char id[ 50 ];
32 
33              truxton_artifact_get_id( artifact, id, sizeof( id ) );
34 
35              printf( "Artifact saved as ID %s\n", id );
36          }
37          else
38          {
39              printf( "Could not save artifact\n" );
40          {
41 
42          truxton_artifact_destroy( artifact );
43       }
44    }
45 }