Extracts event objects from the cookie.

    Args:
      parser_mediator (ParserMediator): parser mediator.
      cookie_data (bytes): cookie data.
      url (str): URL or path where the cookie got set.
338256
def GetEntries(
      self, parser_mediator, cookie_data=None, url=None, **kwargs):
    
    fields = cookie_data.split('.')
    number_of_fields = len(fields)

    if number_of_fields != 1:
      parser_mediator.ProduceExtractionWarning(
          'unsupported number of fields: {0:d} in cookie: {1:s}'.format(
              number_of_fields, self.COOKIE_NAME))
      return

    try:
      # TODO: fix that we're losing precision here use dfdatetime.
      last_visit_posix_time = int(fields[0], 10) / 10000000
    except ValueError:
      last_visit_posix_time = None

    if last_visit_posix_time is not None:
      date_time = dfdatetime_posix_time.PosixTime(
          timestamp=last_visit_posix_time)
      timestamp_description = definitions.TIME_DESCRIPTION_LAST_VISITED
    else:
      date_time = dfdatetime_semantic_time.SemanticTime('Not set')
      timestamp_description = definitions.TIME_DESCRIPTION_NOT_A_TIME

    event_data = GoogleAnalyticsEventData('utmt')
    event_data.cookie_name = self.COOKIE_NAME
    event_data.url = url

    event = time_events.DateTimeValuesEvent(date_time, timestamp_description)
    parser_mediator.ProduceEventWithEventData(event, event_data)
318307
def ParseFileDownloadedRow(
      self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = ChromeHistoryFileDownloadedEventData()
    event_data.full_path = self._GetRowValue(query_hash, row, 'target_path')
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query
    event_data.received_bytes = self._GetRowValue(
        query_hash, row, 'received_bytes')
    event_data.total_bytes = self._GetRowValue(query_hash, row, 'total_bytes')
    event_data.url = self._GetRowValue(query_hash, row, 'url')

    timestamp = self._GetRowValue(query_hash, row, 'start_time')
    date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_FILE_DOWNLOADED)
    parser_mediator.ProduceEventWithEventData(event, event_data)
870194
def GetEntries(self, parser_mediator, top_level=None, **unused_kwargs):
    
    for root, key, datetime_value in interface.RecurseKey(top_level):
      if not isinstance(datetime_value, datetime.datetime):
        continue

      event_data = plist_event.PlistTimeEventData()
      event_data.key = key
      event_data.root = root

      event = time_events.PythonDatetimeEvent(
          datetime_value, definitions.TIME_DESCRIPTION_WRITTEN)
      parser_mediator.ProduceEventWithEventData(event, event_data)
1325912
def _gather_event_handlers(self):
        
        self._extract_event_handlers_from_container(self)
        for module in self.modules:
            self._extract_event_handlers_from_container(module)
243155
def ParseFileObject(self, parser_mediator, file_object):
    
    olecf_file = pyolecf.file()
    olecf_file.set_ascii_codepage(parser_mediator.codepage)

    try:
      olecf_file.open_file_object(file_object)
    except IOError as exception:
      parser_mediator.ProduceExtractionWarning(
          'unable to open file with error: {0!s}'.format(exception))
      return

    root_item = olecf_file.root_item
    if not root_item:
      return

    # Get a list of all items in the root item from the OLECF file.
    item_names = [item.name for item in root_item.sub_items]

    # Compare the list of available plugin objects.
    # We will try to use every plugin against the file (except
    # the default plugin) and run it. Only if none of the plugins
    # works will we use the default plugin.

    item_names = frozenset(item_names)

    try:
      for plugin in self._plugins:
        if parser_mediator.abort:
          break

        if not plugin.REQUIRED_ITEMS.issubset(item_names):
          continue

        try:
          plugin.UpdateChainAndProcess(parser_mediator, root_item=root_item)

        except Exception as exception:  # pylint: disable=broad-except
          parser_mediator.ProduceExtractionWarning((
              'plugin: {0:s} unable to parse OLECF file with error: '
              '{1!s}').format(plugin.NAME, exception))

      if self._default_plugin and not parser_mediator.abort:
        try:
          self._default_plugin.UpdateChainAndProcess(
              parser_mediator, root_item=root_item)

        except Exception as exception:  # pylint: disable=broad-except
          parser_mediator.ProduceExtractionWarning((
              'plugin: {0:s} unable to parse OLECF file with error: '
              '{1!s}').format(self._default_plugin.NAME, exception))

    finally:
      olecf_file.close()
65181
def GetEntries(self, parser_mediator, match=None, **unused_kwargs):
    
    format_version = match.get('WebHistoryFileVersion', None)
    if format_version != 1:
      parser_mediator.ProduceExtractionWarning(
          'unsupported Safari history version: {0!s}'.format(format_version))
      return

    if 'WebHistoryDates' not in match:
      return

    for history_entry in match.get('WebHistoryDates', {}):
      last_visited_date = history_entry.get('lastVisitedDate', None)
      if last_visited_date is None:
        parser_mediator.ProduceExtractionWarning('missing last visited date')
        continue

      try:
        # Last visited date is a string containing a floating point value.
        timestamp = float(last_visited_date)
      except (TypeError, ValueError):
        parser_mediator.ProduceExtractionWarning(
            'unable to convert last visited date {0:s}'.format(
                last_visited_date))
        continue

      display_title = history_entry.get('displayTitle', None)

      event_data = SafariHistoryEventData()
      if display_title != event_data.title:
        event_data.display_title = display_title
      event_data.title = history_entry.get('title', None)
      event_data.url = history_entry.get('', None)
      event_data.visit_count = history_entry.get('visitCount', None)
      event_data.was_http_non_get = history_entry.get(
          'lastVisitWasHTTPNonGet', None)

      # Convert the floating point value to an integer.
      # TODO: add support for the fractional part of the floating point value.
      timestamp = int(timestamp)
      date_time = dfdatetime_cocoa_time.CocoaTime(timestamp=timestamp)
      event = time_events.DateTimeValuesEvent(
          date_time, definitions.TIME_DESCRIPTION_LAST_VISITED)
      parser_mediator.ProduceEventWithEventData(event, event_data)
118364
def ParseFileObject(self, parser_mediator, file_object):
    
    scca_file = pyscca.file()

    try:
      scca_file.open_file_object(file_object)
    except IOError as exception:
      parser_mediator.ProduceExtractionWarning(
          'unable to open file with error: {0!s}'.format(exception))
      return

    format_version = scca_file.format_version
    executable_filename = scca_file.executable_filename
    prefetch_hash = scca_file.prefetch_hash
    run_count = scca_file.run_count
    number_of_volumes = scca_file.number_of_volumes

    volume_serial_numbers = []
    volume_device_paths = []
    path = ''

    for volume_information in iter(scca_file.volumes):
      volume_serial_number = volume_information.serial_number
      volume_device_path = volume_information.device_path

      volume_serial_numbers.append(volume_serial_number)
      volume_device_paths.append(volume_device_path)

      timestamp = volume_information.get_creation_time_as_integer()
      if timestamp:
        event_data = windows_events.WindowsVolumeEventData()
        event_data.device_path = volume_device_path
        event_data.origin = parser_mediator.GetFilename()
        event_data.serial_number = volume_serial_number

        date_time = dfdatetime_filetime.Filetime(timestamp=timestamp)
        event = time_events.DateTimeValuesEvent(
            date_time, definitions.TIME_DESCRIPTION_CREATION)
        parser_mediator.ProduceEventWithEventData(event, event_data)

      for filename in iter(scca_file.filenames):
        if not filename:
          continue

        if (filename.startswith(volume_device_path) and
            filename.endswith(executable_filename)):
          _, _, path = filename.partition(volume_device_path)

    mapped_files = []
    for entry_index, file_metrics in enumerate(scca_file.file_metrics_entries):
      mapped_file_string = file_metrics.filename
      if not mapped_file_string:
        parser_mediator.ProduceExtractionWarning(
            'missing filename for file metrics entry: {0:d}'.format(
                entry_index))
        continue

      file_reference = file_metrics.file_reference
      if file_reference:
        mapped_file_string = (
            '{0:s} [MFT entry: {1:d}, sequence: {2:d}]').format(
                mapped_file_string, file_reference & 0xffffffffffff,
                file_reference >> 48)

      mapped_files.append(mapped_file_string)

    event_data = WinPrefetchExecutionEventData()
    event_data.executable = executable_filename
    event_data.mapped_files = mapped_files
    event_data.number_of_volumes = number_of_volumes
    event_data.path = path
    event_data.prefetch_hash = prefetch_hash
    event_data.run_count = run_count
    event_data.version = format_version
    event_data.volume_device_paths = volume_device_paths
    event_data.volume_serial_numbers = volume_serial_numbers

    timestamp = scca_file.get_last_run_time_as_integer(0)
    if not timestamp:
      parser_mediator.ProduceExtractionWarning('missing last run time')
      date_time = dfdatetime_semantic_time.SemanticTime('Not set')
    else:
      date_time = dfdatetime_filetime.Filetime(timestamp=timestamp)

    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_LAST_RUN)
    parser_mediator.ProduceEventWithEventData(event, event_data)

    # Check for the 7 older last run time values available since
    # format version 26.
    if format_version >= 26:
      for last_run_time_index in range(1, 8):
        timestamp = scca_file.get_last_run_time_as_integer(last_run_time_index)
        if not timestamp:
          continue

        date_time = dfdatetime_filetime.Filetime(timestamp=timestamp)
        date_time_description = 'Previous {0:s}'.format(
            definitions.TIME_DESCRIPTION_LAST_RUN)
        event = time_events.DateTimeValuesEvent(
            date_time, date_time_description)
        parser_mediator.ProduceEventWithEventData(event, event_data)

    scca_file.close()
333906
def parse_session_cookie(cookie_to_cook):
    
    #print("cookie_to_cook: %s"%str(cookie_to_cook))
    session_value = None
    tokens = cookie_to_cook.split(";")
    for tok in tokens:
        if 'remi_session=' in tok:
            #print("found session id: %s"%str(tok))
            try:
                session_value = int(tok.replace('remi_session=', ''))
            except:
                pass
    return session_value
337830
def cookie_get(self, name):
		
		if not hasattr(self, 'cookies'):
			return None
		if self.cookies.get(name):
			return self.cookies.get(name).value
		return None
922624
def ParsePageVisitRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)
    was_http_non_get = self._GetRowValue(query_hash, row, 'http_non_get')

    event_data = SafariHistoryPageVisitedEventData()
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query
    event_data.title = self._GetRowValue(query_hash, row, 'title')
    event_data.url = self._GetRowValue(query_hash, row, 'url')
    event_data.visit_count = self._GetRowValue(query_hash, row, 'visit_count')
    event_data.was_http_non_get = bool(was_http_non_get)

    timestamp = self._GetRowValue(query_hash, row, 'visit_time')
    date_time = dfdatetime_cocoa_time.CocoaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_LAST_VISITED)
    parser_mediator.ProduceEventWithEventData(event, event_data)
1092364
def ParseFileObject(self, parser_mediator, file_object):
    
    regf_file = pyregf.file() # pylint: disable=no-member
    try:
      regf_file.open_file_object(file_object)
    except IOError:
      # The error is currently ignored -> see TODO above related to the
      # fixing of handling multiple parsers for the same file format.
      return

    root_key = regf_file.get_root_key()
    if root_key is None:
      regf_file.close()
      return

    root_file_key = root_key.get_sub_key_by_path(self._AMCACHE_ROOT_FILE_KEY)
    if root_file_key is None:
      regf_file.close()
      return

    for volume_key in root_file_key.sub_keys:
      for am_entry in volume_key.sub_keys:
        self._ProcessAMCacheFileKey(am_entry, parser_mediator)

    root_program_key = root_key.get_sub_key_by_path(
        self._AMCACHE_ROOT_PROGRAM_KEY)
    if root_program_key is None:
      regf_file.close()
      return

    for am_entry in root_program_key.sub_keys:
      self._ProcessAMCacheProgramKey(am_entry, parser_mediator)

    regf_file.close()
617424
def ParseMessageRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    event_data = KikIOSMessageEventData()
    event_data.body = self._GetRowValue(query_hash, row, 'ZBODY')
    event_data.displayname = self._GetRowValue(query_hash, row, 'ZDISPLAYNAME')
    event_data.message_status = self._GetRowValue(query_hash, row, 'ZSTATE')
    event_data.message_type = self._GetRowValue(query_hash, row, 'ZTYPE')
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query
    event_data.username = self._GetRowValue(query_hash, row, 'ZUSERNAME')

    timestamp = self._GetRowValue(query_hash, row, 'ZRECEIVEDTIMESTAMP')
    # Convert the floating point value to an integer.
    timestamp = int(timestamp)
    date_time = dfdatetime_cocoa_time.CocoaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_CREATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)
392292
private static Map<String, String> extractDataFromCookie(String cookieValue) {
		HashMap<String, String> data = new HashMap<String, String>();
		String[] fields = cookieValue.split("\\&");
		for (String field : fields) {
			String[] keyValue = field.split("\\=");
			try {
				data.put(keyValue[0], URLDecoder.decode(keyValue[1], "UTF-8"));
			} catch (UnsupportedEncodingException wontHappen) {
			}
		}
		return data;
	}
510342
def ParseSmsRow(self, parser_mediator, query, row, **unused_kwargs):
    
    query_hash = hash(query)

    sms_read = self._GetRowValue(query_hash, row, 'read')
    sms_type = self._GetRowValue(query_hash, row, 'type')

    event_data = AndroidSMSEventData()
    event_data.address = self._GetRowValue(query_hash, row, 'address')
    event_data.body = self._GetRowValue(query_hash, row, 'body')
    event_data.offset = self._GetRowValue(query_hash, row, 'id')
    event_data.query = query
    event_data.sms_read = self.SMS_READ.get(sms_read, 'UNKNOWN')
    event_data.sms_type = self.SMS_TYPE.get(sms_type, 'UNKNOWN')

    timestamp = self._GetRowValue(query_hash, row, 'date')
    date_time = dfdatetime_java_time.JavaTime(timestamp=timestamp)
    event = time_events.DateTimeValuesEvent(
        date_time, definitions.TIME_DESCRIPTION_CREATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)
799530
def from_response(cls, header_data, ignore_bad_cookies=False,
                      ignore_bad_attributes=True):
        ""
        cookies = cls()
        cookies.parse_response(
            header_data,
            ignore_bad_cookies=ignore_bad_cookies,
            ignore_bad_attributes=ignore_bad_attributes)
        return cookies
574257
def response_cookies(self):
        
        try:
            ret = {}
            for cookie_base_uris in self.response.cookies._cookies.values():
                for cookies in cookie_base_uris.values():
                    for cookie in cookies.keys():
                        ret[cookie] = cookies[cookie].value
            return ret
        except Exception as e:
            self.error = ApiError(
                "Exception in making Request with:: %s\n%s" % (
                    e_, traceback.format_exc()))
            raise Exception(self.error)
712472
def get_events(params = nil, paging = nil)
      response = @client.get(construct_url(paging), params)
      extract_paging(response)
      response
    end