#!/usr/bin/python import re import os import sys # [+] File at 955391488 size=2863284 (2.7 MB): JPEG picture # last file has to be recovered by hand # pos, size, type parser = re.compile('\[\+\] File at ([0-9]+) size\=([0-9]+) \([^\)]+\)\: (.*)') file_types = { 'JPEG' : 'jpg', # 'executable' : 'exe', 'AVI' : 'avi', # '7z' : '7z', # 'iTunesDB' : 'db', } src_fd = open(sys.argv[1], 'rb') while 1: line = sys.stdin.readline() if not line: break m = parser.search(line) ## print line ## print m if m: ## print m.groups() fpos, fsize, ftype = m.groups() fpos, fsize = long(fpos), long(fsize) ## print fpos, fsize, ftype if fpos > 0 and fsize > 0: fext = 'bin' for ft_test in file_types.keys(): if ft_test in ftype: fext = file_types[ft_test] break fname = 'file%x.%s' % (fpos, fext) if fext == 'bin': print "SKIPPED", fname, fpos, fsize, ftype continue print "writing", fname, fpos, fsize, ftype dst_fd = open(fname, 'wb') dst_fd.seek(0, os.SEEK_SET) src_fd.seek(fpos, os.SEEK_SET) while fsize > 0: buff = src_fd.read(min(0x10000, fsize)) fsize = fsize - len(buff) while buff: bw = dst_fd.write(buff) if not bw: break buff = buff[bw:] dst_fd.close() src_fd.close()