/*
* Copyright 2006 Bradley Schatz. All rights reserved.
*
* This file is part of pasco2, the next generation Internet Explorer cache
* and history record parser.
*
* pasco2 is free software; you can redistribute it and/or modify
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version.
*
* pasco2 is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with pasco2; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*/
package isi.pasco2.parser;
import isi.pasco2.handler.DefaultHandler;
import isi.pasco2.handler.HistoryAccessHandler;
import isi.pasco2.io.IndexFile;
import isi.pasco2.parser.time.DOSTime;
import isi.pasco2.parser.time.FileTime;
import isi.pasco2.util.StructConverter;
import java.io.IOException;
import java.util.TimeZone;
/**
* A parser of index.dat files produced by MS Internet Explorer. This specific class
* parses the history specific elements.
*
* Offsets:
* (+0x00) record start
* (+0x08) FILETIME created time
* (+0x10) FILETIME created time
* (+0x50) 16-bit dos date corresponding to last visit
* (+0x52) 16-bit dos time (UTC) corresponding to last visit
* (+0x54) 32-bit int times visited
* (+0x58) ASCII null terminated string URL
* (+0xBC) Unicode string Page Title
*
* Based on:
* * Keith J. Jones's implementation in pasco (http://odessa.sourceforge.net/)
* * Louis K. Thomas' documentated reverse engineering efforts (http://www.latenighthacking.com/projects/2003/reIndexDat/)
*
* @author Bradley Schatz
*
*/
public class IEHistoryFileParser extends IEIndexFileParser {
{
// the dos times used in this file are based on UTC
DOSTime.setTimeZone(TimeZone.getTimeZone("UTC"));
}
public IEHistoryFileParser(String fileName, IndexFile file,
DefaultHandler handler) {
super(fileName, file, handler);
}
public IEHistoryFileParser(String fileName, IndexFile file) {
super(fileName, file);
}
protected void parseRecord(IndexFile file, int currrecoff,
DefaultHandler handler) throws IOException {
file.seek(currrecoff);
byte[] rec;
HistoryAccessHandler cacheHandler = (HistoryAccessHandler) handler;
file.seek(currrecoff);
byte[] type = new byte[4];
file.read(type, 0, 4);
String typeStr = new String(type);
try {
if (typeStr.equals("REDR")) {
parseREDRRecord(file, currrecoff, cacheHandler);
} else if (typeStr.startsWith("URL") || typeStr.equals("LEAK")) {
parseURLLEAKRecord(typeStr, file, currrecoff, cacheHandler);
} else {
int i = StructConverter.bytesIntoInt(type, 0);
if (i == 0x0badf00d) {
// this pattern most likely indicates uninitalized memory as allocated
// by
// a memory allocator. This is probably a mmaped file.
handler.unusedRecord(currrecoff);
} else {
rec = new byte[BLOCK_SIZE];
file.read(rec, 0, BLOCK_SIZE);
handler.record(currrecoff, rec);
handler.unknownRecord(typeStr, currrecoff, rec);
}
}
} catch (IOException ex) {
handler.invalidRecord(currrecoff);
}
}
public void parseURLLEAKRecord(String type, IndexFile fr, long currrecoff,
DefaultHandler handler) throws IOException {
int reclen = indexFile.readIntAtOffset(currrecoff + 4) * BLOCK_SIZE;
byte[] rec = new byte[reclen];
fr.read(rec, 0, reclen);
handler.record((int) currrecoff, rec);
long low = indexFile.readUIntAtOffset(currrecoff + 8);
long high = fr.readLittleEndianUInt();
FileTime modTime = new FileTime(low, high);
low = indexFile.readUIntAtOffset(currrecoff + 16);
high = fr.readLittleEndianUInt();
FileTime accessTime = new FileTime(low, high);
int date = indexFile.readShortAtOffset(currrecoff + 0x50);
int time = indexFile.readShortAtOffset(currrecoff + 0x52);
DOSTime lastAccessTime = new DOSTime(date, time);
int numberOfAccesses = indexFile.readIntAtOffset(currrecoff + 0x54);
StringBuffer url = readURL(fr, currrecoff);
//StringBuffer filename = readFileName(fr, currrecoff);
//String dirname = readDirName(fr, currrecoff);
//StringBuffer httpheaders = readHTTPHeaders(fr, currrecoff, reclen);
HistoryAccessHandler h = (HistoryAccessHandler) handler;
if (type.startsWith("URL")) {
h.URLRecord(lastAccessTime, accessTime, modTime, url.toString(),
numberOfAccesses);
}
// TODO I havent seen a History file with a LEAK record in it yet... but should
// handle this gracefully
/*else {
handler.LEAKRecord(accessTime, modTime, url.toString(), makePrintable(
filename).toString(), dirname, makePrintable(httpheaders).toString());
}
*/
}
}