# Path: appAux.py
# def loadFile(file_fullpath, max_chunk_size = 0):
#     """Abstracts loading a regular file and a file from within a zip archive.
#     Args:
#         file_fullpath (str): Full path to file to load
#         max_chunk_size (int): maximum number of bytes to be read from the file
#     Returns:
#         file_pointer (StringIO): Data read from fileFullPath
#     """
#     global zipCache
#     global zipCache_hits
#     global zipCache_misses
#     logger.debug("Loading file %s" % file_fullpath)
#     if ".zip/" in file_fullpath:
#         m = re.match(r'^((?:.*)\.zip)[\\/](.*)$', file_fullpath)
#         if m:
#             zip_container = m.group(1)
#             if m.lastindex > 1:
#                 file_fullpath_unprocessed = m.group(2)
#                 if '.zip' in file_fullpath_unprocessed:
#                     m = re.match(r'^(.*)(?:\.zip[\\/](.*))*$', file_fullpath_unprocessed)
#                     if m:
#                         zip_container_relative_path = m.group(1)
#                         if m.lastindex > 1:
#                             file_fullpath_unprocessed = m.group(2)
#                         else:
#                             file_fullpath_unprocessed = None
#                     else:
#                         logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#                 else:
#                     zip_container_relative_path = file_fullpath_unprocessed
# 
#                 # If not in the zipCache we add it
#             if zip_container not in zipCache:
#                 zipCache_misses +=1
#                 if zipfile.is_zipfile(loadFile(zip_container)):
#                     zipCache[zip_container] = zipfile.ZipFile(loadFile(zip_container))
#                 else:
#                     logger.error("Invalid ZIP file found: %s" % file_fullpath)
#                     return None
#             else:
#                 zipCache_hits += 1
#                 # print("ZipCache hits / misses: %d/%d" % (zipCache_hits, zipCache_misses))
# 
#             # Extract file_pointer from zip:
#             file_pointer = StringIO(zipCache[zip_container].read(zip_container_relative_path))
#             if max_chunk_size != 0:
#                 file_pointer = StringIO(file_pointer.read(max_chunk_size))
# 
#         else:
#             logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#     else:
#             # Extract file_pointer:
#             input_file = open(file_fullpath, 'rb')
#             if max_chunk_size == 0:
#                 file_pointer = StringIO(input_file.read())
#             else: file_pointer = StringIO(input_file.read(max_chunk_size))
#     assert(file_pointer is not None)
# 
#     logger.debug("Read %d bytes [%s]" % (getFileSize(file_pointer), toHex(file_pointer.read(20))))
#     # Return file pointer to pos 0
#     file_pointer.seek(0, 0)
# 
#     return file_pointer


import settings
import logging
import hashlib
import ntpath
import sys, traceback
import os
    import xml.etree.cElementTree as etree
    import xml.etree.ElementTree as etree
from ingest import Ingest
from appAux import loadFile
from datetime import datetime
        # Recursively process all tags and add them to a tag dictionary
        # We ignore tags that are duplicated in the FileAudit
        ignore_tags = ['FileOwner','FileCreated','FileModified','FileAccessed','FileChanged','md5sum','MagicHeader','SignatureExists','SignatureVerified','SignatureDescription','CertificateSubject','CertificateIssuer']
        for e in element:
            if e.tag not in ignore_tags:
                if len(e) > 0:
                    self._processElement(e, tag_dict, tag_prefix + e.tag + '_')
                else:
                    if tag_prefix + e.tag not in tag_dict:
                        if tag_prefix + e.tag == "FullPath":
                            tag_dict[tag_prefix + 'AppCompatPath'] = e.text
                            continue
                        if tag_prefix + e.tag == "Modified":
                            tag_dict[tag_prefix + 'LastModified'] = e.text
                            continue
                        if tag_prefix + e.tag == "Executed":
                            tag_dict[tag_prefix + 'ExecutionFlag'] = "True" if e.text == "true" else "False" if e.text == "false" else e.text
                        else:
                            tag_dict[tag_prefix + e.tag] = e.text
                    else:
                        # Aggregate some tags when required
                        tag_dict[tag_prefix + e.tag] = tag_dict[tag_prefix + e.tag] + ", " + e.text

    def processFile(self, file_fullpath, hostID, instanceID, rowsData):
        minSQLiteDTS = datetime(1, 1, 1, 0, 0, 0)
        maxSQLiteDTS = datetime(9999, 12, 31, 0, 0, 0)
        rowNumber = 0

        check_tags = ['LastModified', 'AppCompatPath']
        try:

# Path: appAux.py
# def loadFile(file_fullpath, max_chunk_size = 0):
#     """Abstracts loading a regular file and a file from within a zip archive.
#     Args:
#         file_fullpath (str): Full path to file to load
#         max_chunk_size (int): maximum number of bytes to be read from the file
#     Returns:
#         file_pointer (StringIO): Data read from fileFullPath
#     """
#     global zipCache
#     global zipCache_hits
#     global zipCache_misses
#     logger.debug("Loading file %s" % file_fullpath)
#     if ".zip/" in file_fullpath:
#         m = re.match(r'^((?:.*)\.zip)[\\/](.*)$', file_fullpath)
#         if m:
#             zip_container = m.group(1)
#             if m.lastindex > 1:
#                 file_fullpath_unprocessed = m.group(2)
#                 if '.zip' in file_fullpath_unprocessed:
#                     m = re.match(r'^(.*)(?:\.zip[\\/](.*))*$', file_fullpath_unprocessed)
#                     if m:
#                         zip_container_relative_path = m.group(1)
#                         if m.lastindex > 1:
#                             file_fullpath_unprocessed = m.group(2)
#                         else:
#                             file_fullpath_unprocessed = None
#                     else:
#                         logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#                 else:
#                     zip_container_relative_path = file_fullpath_unprocessed
# 
#                 # If not in the zipCache we add it
#             if zip_container not in zipCache:
#                 zipCache_misses +=1
#                 if zipfile.is_zipfile(loadFile(zip_container)):
#                     zipCache[zip_container] = zipfile.ZipFile(loadFile(zip_container))
#                 else:
#                     logger.error("Invalid ZIP file found: %s" % file_fullpath)
#                     return None
#             else:
#                 zipCache_hits += 1
#                 # print("ZipCache hits / misses: %d/%d" % (zipCache_hits, zipCache_misses))
# 
#             # Extract file_pointer from zip:
#             file_pointer = StringIO(zipCache[zip_container].read(zip_container_relative_path))
#             if max_chunk_size != 0:
#                 file_pointer = StringIO(file_pointer.read(max_chunk_size))
# 
#         else:
#             logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#     else:
#             # Extract file_pointer:
#             input_file = open(file_fullpath, 'rb')
#             if max_chunk_size == 0:
#                 file_pointer = StringIO(input_file.read())
#             else: file_pointer = StringIO(input_file.read(max_chunk_size))
#     assert(file_pointer is not None)
# 
#     logger.debug("Read %d bytes [%s]" % (getFileSize(file_pointer), toHex(file_pointer.read(20))))
#     # Return file pointer to pos 0
#     file_pointer.seek(0, 0)
# 
#     return file_pointer


# Path: Ingest/appcompat_mirShimShady_v1.py
import settings
import logging
import hashlib
import ntpath
import sys, traceback
import os
    import xml.etree.cElementTree as etree
    import xml.etree.ElementTree as etree
from ingest import Ingest
from appAux import loadFile
from datetime import datetime

        # Recursively process all tags and add them to a tag dictionary
        # We ignore tags that are duplicated in the FileAudit
        ignore_tags = ['FileOwner','FileCreated','FileModified','FileAccessed','FileChanged','md5sum','MagicHeader','SignatureExists','SignatureVerified','SignatureDescription','CertificateSubject','CertificateIssuer']
        for e in element:
            if e.tag not in ignore_tags:
                if len(e) > 0:
                    self._processElement(e, tag_dict, tag_prefix + e.tag + '_')
                else:
                    if tag_prefix + e.tag not in tag_dict:
                        if tag_prefix + e.tag == "FullPath":
                            tag_dict[tag_prefix + 'AppCompatPath'] = e.text
                            continue
                        if tag_prefix + e.tag == "Modified":
                            tag_dict[tag_prefix + 'LastModified'] = e.text
                            continue
                        if tag_prefix + e.tag == "Executed":
                            tag_dict[tag_prefix + 'ExecutionFlag'] = "True" if e.text == "true" else "False" if e.text == "false" else e.text
                        else:
                            tag_dict[tag_prefix + e.tag] = e.text
                    else:
                        # Aggregate some tags when required
                        tag_dict[tag_prefix + e.tag] = tag_dict[tag_prefix + e.tag] + ", " + e.text

    def processFile(self, file_fullpath, hostID, instanceID, rowsData):
        minSQLiteDTS = datetime(1, 1, 1, 0, 0, 0)
        maxSQLiteDTS = datetime(9999, 12, 31, 0, 0, 0)
        rowNumber = 0

        check_tags = ['LastModified', 'AppCompatPath']
        try:

            xml_data = loadFile(file_fullpath)