From e28ad45badeafe8864daa39b01d438259a654d31 Mon Sep 17 00:00:00 2001 From: Christoph Schulz Date: Wed, 8 Nov 2023 18:20:36 +0100 Subject: [PATCH 1/2] Search in binary string --- src/parse_mnesia.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/parse_mnesia.py b/src/parse_mnesia.py index ec1bda4..28241d7 100644 --- a/src/parse_mnesia.py +++ b/src/parse_mnesia.py @@ -48,19 +48,18 @@ def convert_hex(string): def extractString(data, hexString, byteLengthHex): - hexdata=convert_hex(data) - dataPos=hexdata.find(hexString.upper()) + dataPos = data.find(bytes.fromhex(hexString)) if dataPos == -1: found=False unescapedData='' endPosition = -1 else: found=True - startofMatch=round(dataPos/2) + startofMatch=round(dataPos) recordSize = data[startofMatch+byteLengthHex:startofMatch+byteLengthHex+2] - rdqEntryLength = int(convert_hex(recordSize), 16) + rdqEntryLength = int.from_bytes(recordSize, "big") dataMessage = data[startofMatch+byteLengthHex+2: startofMatch+byteLengthHex+2+rdqEntryLength] - unescapedData = dataMessage.decode('ascii', 'ignore') + unescapedData = dataMessage.decode('utf-8', 'strict') endPosition = startofMatch+byteLengthHex+2+rdqEntryLength return {"string": unescapedData, "endpos": endPosition, 'found':found} From 937cb77fca43016ec7d0633b7b4cec25aaf11dcb Mon Sep 17 00:00:00 2001 From: Christoph Schulz Date: Wed, 8 Nov 2023 18:25:03 +0100 Subject: [PATCH 2/2] more args --- src/parse_mnesia.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/parse_mnesia.py b/src/parse_mnesia.py index 28241d7..360d760 100644 --- a/src/parse_mnesia.py +++ b/src/parse_mnesia.py @@ -15,6 +15,9 @@ parser.add_argument('-file', help='choose file to parse', default='no file') parser.add_argument('-chunk', help='byte count for each file chunk to read (default=1028)', default=1028) parser.add_argument('-o', help='filename (no extension) for file; print for print to terminal', default='print') +parser.add_argument('-be', help='byte endianess for lenght, e.g. big, little', default="big") +parser.add_argument("-e", help="encoding, e.g. utf-8, ascii", default="utf-8") +parser.add_argument("-ee", help="encoding errors, e.g. strict, ignore", default="strict") args = parser.parse_args() if args.file == 'no file': @@ -32,6 +35,10 @@ fileName = args.file +endianness = args.be +encoding = args.e +encoding_errors = args.ee + #fileName='/usr/local/var/lib/rabbitmq/mnesia/rabbit/msg_stores/vhosts/2KVL28AS0JEHD0UYQNDTX3QIO/queues/7NJWTXU5MSR21TJGJEOA2NPC2/0.idx' print('Reading file: ' + fileName) @@ -57,9 +64,9 @@ def extractString(data, hexString, byteLengthHex): found=True startofMatch=round(dataPos) recordSize = data[startofMatch+byteLengthHex:startofMatch+byteLengthHex+2] - rdqEntryLength = int.from_bytes(recordSize, "big") + rdqEntryLength = int.from_bytes(recordSize, endianness) dataMessage = data[startofMatch+byteLengthHex+2: startofMatch+byteLengthHex+2+rdqEntryLength] - unescapedData = dataMessage.decode('utf-8', 'strict') + unescapedData = dataMessage.decode(encoding, encoding_errors) endPosition = startofMatch+byteLengthHex+2+rdqEntryLength return {"string": unescapedData, "endpos": endPosition, 'found':found}