|
# SMB_FIND_FILE_BOTH_DIRECTORY_INFO structure. See [MS-CIFS]: 2.2.8.1.7 and [MS-SMB]: 2.2.8.1.1 |
|
info_format = '<IIQQQQQQIIIBB24s' |
|
info_size = struct.calcsize(info_format) |
|
|
|
data_length = len(data_bytes) |
|
offset = 0 |
|
while offset < data_length: |
|
if offset + info_size > data_length: |
|
return data_bytes[offset:] |
|
|
|
next_offset, _, \ |
|
create_time, last_access_time, last_write_time, last_attr_change_time, \ |
|
file_size, alloc_size, file_attributes, filename_length, ea_size, \ |
|
short_name_length, _, short_name = struct.unpack(info_format, data_bytes[offset:offset+info_size]) |
|
|
|
offset2 = offset + info_size |
|
if offset2 + filename_length > data_length: |
|
return data_bytes[offset:] |
|
|
|
filename = data_bytes[offset2:offset2+filename_length].decode('UTF-16LE') |
|
short_name = short_name[:short_name_length].decode('UTF-16LE') |
|
|
|
accept_result = False |
|
if (file_attributes & 0xff) in ( 0x00, ATTR_NORMAL ): # Only the first 8-bits are compared. We ignore other bits like temp, compressed, encryption, sparse, indexed, etc |
|
accept_result = (search == SMB_FILE_ATTRIBUTE_NORMAL) or (search & SMB_FILE_ATTRIBUTE_INCL_NORMAL) |
|
else: |
|
accept_result = (file_attributes & search) > 0 |
|
if accept_result: |
|
results.append(SharedFile(convertFILETIMEtoEpoch(create_time), convertFILETIMEtoEpoch(last_access_time), |
|
convertFILETIMEtoEpoch(last_write_time), convertFILETIMEtoEpoch(last_attr_change_time), |
|
file_size, alloc_size, file_attributes, short_name, filename)) |