-
Notifications
You must be signed in to change notification settings - Fork 172
/
Copy pathbiomeBacklight.py
63 lines (51 loc) · 2.24 KB
/
biomeBacklight.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
__artifacts_v2__ = {
"get_biomeBacklight": {
"name": "Biome Backlight",
"description": "Parses backlight entries from biomes",
"author": "@JohnHyla",
"version": "0.0.2",
"date": "2024-10-17",
"requirements": "none",
"category": "Biome Backlight",
"notes": "",
"paths": ('*/Biome/streams/public/Backlight/local/*'),
"output_types": "standard"
}
}
import os
from datetime import timezone
import blackboxprotobuf
from scripts.ccl_segb.ccl_segb import read_segb_file
from scripts.ccl_segb.ccl_segb_common import EntryState
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv, convert_utc_human_to_timezone
@artifact_processor
def get_biomeBacklight(files_found, report_folder, seeker, wrap_text, timezone_offset):
typess = {'1': {'type': 'double', 'name': ''}, '2': {'type': 'int', 'name': ''}}
data_list = []
report_file = 'Unknown'
for file_found in files_found:
file_found = str(file_found)
filename = os.path.basename(file_found)
if filename.startswith('.'):
continue
if os.path.isfile(file_found):
if 'tombstone' in file_found:
continue
else:
report_file = os.path.dirname(file_found)
else:
continue
for record in read_segb_file(file_found):
ts = record.timestamp1
ts = ts.replace(tzinfo=timezone.utc)
if record.state == EntryState.Written:
protostuff, types = blackboxprotobuf.decode_message(record.data, typess)
timestart = (webkit_timestampsconv(protostuff['1']))
timestart = convert_utc_human_to_timezone(timestart, timezone_offset)
state = (protostuff['2'])
data_list.append((ts, timestart, record.state.name, state, filename, record.data_start_offset))
elif record.state == EntryState.Deleted:
data_list.append((ts, None, record.state.name, None, filename, record.data_start_offset))
data_headers = (('SEGB Timestamp', 'datetime'), ('Timestamp', 'datetime'), 'SEGB State', 'State', 'Filename',
'Offset')
return data_headers, data_list, report_file