unpackers

Documentation

Index

• type MSCFB
  • func (m *MSCFB) UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, ...) (err error)
• type OLE10Native
  • func (o *OLE10Native) UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, ...) (err error)
• type OfficeZip
  • func (o *OfficeZip) UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, ...) (err error)
• type Unpacker

Types

type MSCFB

type MSCFB struct{}

The MSCFB implementation of Unpacker uses a 3rd-party library to parse MS-CFB (OLE v2) files.

func (*MSCFB) UnpackStream

func (m *MSCFB) UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, queue *list.List) (err error)

This unpacker extracts all enclosed objects, and enqueues them for further examination.

type OLE10Native

type OLE10Native struct{}

func (*OLE10Native) UnpackStream

func (o *OLE10Native) UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, queue *list.List) (err error)

type OfficeZip

type OfficeZip struct{}

This implementation of the Unpacker interface uses archive/zip to extract all members from the Office document.

func (*OfficeZip) UnpackStream

func (o *OfficeZip) UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, queue *list.List) (err error)

Unpack all the archive members and queue them up for parsing.

type Unpacker

type Unpacker interface {
	// UnpackStream extracts members from the archive stream:
	//
	//	Args:
	//		inpath (string):		Path to original file on disk. Used to construct the output directory.
	//		stream (io.ReaderAt):	This is the data stream we will extract archive members from.
	//		size (int64):		This is the total size of the archive file conveyed over `stream`.
	//		results (*models.Results)	This is the object we use to track overall results of the extraction.
	//		queue (*list.List)		The implementation adds extracted files to the queue for recursive processing.
	//
	//	Returns:
	//		err (error)
	UnpackStream(inpath string, stream io.ReaderAt, size int64, results *models.Results, queue *list.List) (err error)
}

An Unpacker is a component that reads an archive and extracts the enclosed objects.

This interface describes how the unpackers in this software project should work. Generally, an unpacker works like this:

• Create a new directory for all member files to be extracted to (${inpath}-members/)
• Load the abstraction specific to the data stream we are trying to unpack (archive/zip, for instance)
• For each enclosed file, write the contents to a new file under the ${inpath}-members/ directory.
• The naming of the file is left up to the implementation, and should take care to avoid collisions.