
    R"hc                     H   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlT dZ	de
fdZde
de
d	ee
         d
ej        e         deeej        e
dz  gedz  f         de
dz  ddfdZde
de
de
de
d	ee
         d
ej        e         deeej        e
dz  gedz  f         de
fdZdS )    N)Callable)*aG  
   _____                 _             ______                       _          
  / ____|               | |           |  ____|                     (_)         
 | (___  _ __  _   _  __| | ___ _ __  | |__ ___  _ __ ___ _ __  ___ _  ___ ___ 
  \___ \| '_ \| | | |/ _` |/ _ \ '__| |  __/ _ \| '__/ _ \ '_ \/ __| |/ __/ __|
  ____) | |_) | |_| | (_| |  __/ |    | | | (_) | | |  __/ | | \__ \ | (__\__ \
 |_____/| .__/ \__, |\__,_|\___|_|    |_|  \___/|_|  \___|_| |_|___/_|\___|___/
        | |     __/ |                                                          
        |_|    |___/ 
program_namec                 $    t           dz   d|  dz   S )N
z
Tor Browser Memory Parser - z
Version: 1.0 Feb, 2025
Author: Spyder Forensics Training
Website: www.spyderforensics.com
Course: Host-Based Dark Web Forensics
)SPIDER_LOGO)r   s    K/home/seanl/mnt/public/Repos/DarkWeb_Forensics/Tor Memory Parsers/shared.pybannerr
      s+     !)! ! !      dump_file_pathoutput_csv_pathcsv_headersregex_patternprocess_matcheroutput_folderreturnc           	         t          j                     }t          dt          j        dt          j        |                     d           |rt	          j        |d           t          j                            |t          j                            |           d          }t          j                            |d          }t	          j        |d           t          |dd	d
          5 }t          j        |          }	|	                    |           t          | d          5 }
t          j        |
                                dt          j                  5 }t!          d |                    |          D                       }|D ]8} ||||          }|r'|	                    |                                           9	 ddd           n# 1 swxY w Y   ddd           n# 1 swxY w Y   ddd           n# 1 swxY w Y   t          j                     }t          dt          j        dt          j        |                                ||z
  }t'          |d          \  }}t'          |d          \  }}t          dt)          |          ddt)          |          dd|d           t          d|            dS )z Reads the entire file using mmapzProcessing started at: z%Y-%m-%d %H:%M:%Sr   T)exist_okz.csvzExtracted FavIconsw zutf-8)newlineencodingrbr   )accessc              3   >   K   | ]}|                                 V  d S )N)start).0matchs     r	   	<genexpr>z!extract_to_csv.<locals>.<genexpr>5   s*      &f&fu{{}}&f&f&f&f&f&fr   Nz
Processing completed at: i  <   zTotal execution time: 02d:z.2fz
Results saved to: )timeprintstrftime	localtimeosmakedirspathjoinbasenameopencsvwriterwriterowmmapfilenoACCESS_READsortedfinditer
to_csv_rowdivmodint)r   r   r   r   r   r   
start_timeextracted_icons_foldercsv_file
csv_writer	dump_filememory_datamatch_offsetsoffsetrowend_timeelapsed_timehours	remainderminutessecondss                        r	   extract_to_csvrG      sa   J	
fDM2Et~V`GaGa$b$b
f
f
fggg 	;
MD1111 ',,}9I9I-9X9X6^6^6^__ "$m=Q!R!R
*T::::	osB	A	A	A >XZ))
K(((.$'' 	>99++--q9IJJJ >k &&f&f-BXBXYdBeBe&f&f&f f f+ > >F)/&+}MMC >"++CNN,<,<===>> > > > > > > > > > > > > > >	> 	> 	> 	> 	> 	> 	> 	> 	> 	> 	> 	> 	> 	> 	>	> > > > > > > > > > > > > > > y{{H	
f6I4>ZbKcKc(d(d
f
fgggj(LlD11E9i,,GW	
T3u::
T
T
TCLL
T
T
Tw
T
T
TUUU	
2
2
233333s[   -:G>'4G'A(GG'GG'GG'G>'G+	+G>.G+	/G>>HHdescription
input_helpoutput_helpc                    t          j        |           }|                    ddt          d|           |                    ddt          d|           |                                }	t          t          |                     t          j        	                    |	j
                  st          d           d S t          |	j
        |	j        ||||           d S )	N)rH   z-iz--inputT)typerequiredhelpz-oz--outputz.The specified memory dump file does not exist.)argparseArgumentParseradd_argumentstr
parse_argsr$   r
   r'   r)   isfileinputrG   output)
rH   rI   rJ   r   r   r   r   r   parserargss
             r	   run_argparserrY   E   s    $===F
icDzRRR
jsTTTTD	&

7>>$*%% l>?????tz4;]O]jkkkkkr   )r'   rO   rer0   r#   r-   typingr   recordsr   rR   r
   listPatternbytesr7   BrowserDatarG   rY    r   r	   <module>rb      s%   				  				   



          	    #43 #4 #44PS9 #4egeopuev #4  JR  TW  Y]  Yb  dg  jn  dn  So  q|  C  qC  SC  JD #4  UX  [_  U_ #4  dh #4 #4 #4 #4Lls l l# lUX lgklogp l  BD  BL  MR  BS l  fn  ps  uy  u~  @C  FJ  @J  oK  MX  [_  M_  o_  f` l  qt l l l l l lr   