mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-23 22:52:23 +02:00
Mike Auty
29d41470a4
Relented on the strict import of direct objects/classes for the typing module only. Typing module components can be directly imported because it makes the code really painful to read and write otherwise. This is still in-line with the python style guide adopted from Google at http://google.github.io/styleguide/pyguide.html section 2.2.
48 lines
1.3 KiB
Python
48 lines
1.3 KiB
Python
import datetime
|
|
from typing import Union
|
|
|
|
from volatility.framework import interfaces, renderers
|
|
|
|
|
|
def wintime_to_datetime(wintime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
|
|
unix_time = wintime // 10000000
|
|
if unix_time == 0:
|
|
return renderers.NotApplicableValue()
|
|
unix_time = unix_time - 11644473600
|
|
try:
|
|
return datetime.datetime.utcfromtimestamp(unix_time)
|
|
except ValueError:
|
|
return renderers.UnparsableValue()
|
|
|
|
|
|
def unixtime_to_datetime(unixtime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
|
|
ret = renderers.UnparsableValue() # type: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]
|
|
|
|
if unixtime > 0:
|
|
try:
|
|
ret = datetime.datetime.utcfromtimestamp(unixtime)
|
|
except ValueError:
|
|
pass
|
|
|
|
return ret
|
|
|
|
|
|
def round(addr: int, align: int, up: bool = False) -> int:
|
|
"""Round an address up or down based on an alignment.
|
|
|
|
Args:
|
|
addr: the address
|
|
align: the alignment value
|
|
up: Whether to round up or not
|
|
|
|
Returns:
|
|
The aligned address
|
|
"""
|
|
|
|
if addr % align == 0:
|
|
return addr
|
|
else:
|
|
if up:
|
|
return (addr + (align - (addr % align)))
|
|
return (addr - (addr % align))
|