#!/usr/bin/env python # This file is part of creddump. # # creddump is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # creddump is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with creddump. If not, see . # pylint: disable=invalid-name,missing-docstring """ @author: Brendan Dolan-Gavitt @license: GNU General Public License 2.0 or later @contact: bdolangavitt@wesleyan.edu """ import sys from framework.win32.domcachedump import dump_file_hashes def showUsage(): print("usage: %s " % sys.argv[0]) print("\nExample (Windows Vista/7):") print("%s /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true" % sys.argv[0]) print("\nExample (Windows XP):") print("%s /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false" % sys.argv[0]) if len(sys.argv) < 4: showUsage() sys.exit(1) if sys.argv[3].lower() not in ["true", "false"]: showUsage() sys.exit(1) vista = sys.argv[3].lower() == "true" dump_file_hashes(sys.argv[1], sys.argv[2], sys.argv[3])