# Path: utils/utils.py
# def convert_windate(timestamp):
#     try:
#         return datetime.datetime.fromtimestamp(change_to_MKTime(timestamp)).strftime("%Y-%m-%d %H:%M:%S")
#     except:
#         return 0
# 
# def dosdate(_dosdate, _dostime):
#     """
#     _dosdate: 2 bytes, little endian.
#     _dostime: 2 bytes, little endian.
#     returns: datetime.datetime or datetime.datetime.min on error
#     """
#     try:
#         t = ord(_dosdate[1]) << 8
#         t |= ord(_dosdate[0])
#         day = t & 0b0000000000011111
#         month = (t & 0b0000000111100000) >> 5
#         year = (t & 0b1111111000000000) >> 9
#         year += 1980
# 
#         t = ord(_dostime[1]) << 8
#         t |= ord(_dostime[0])
#         sec = t & 0b0000000000011111
#         sec *= 2
#         minute = (t & 0b0000011111100000) >> 5
#         hour = (t & 0b1111100000000000) >> 11
# 
#         return datetime.datetime(year, month, day, hour, minute, sec)
#     except:
#         return datetime.datetime.min
# 
# def get_csv_writer(csvfile):
#     return UnicodeWriter(csvfile, quoting=csv.QUOTE_ALL)
# 
# def get_json_writer(json_file):
#     return UnicodeJsonDumper(json_file)
# 
# def write_list_to_csv(arr_data, csv_writer):
#     """Writes a list"s contents to a CSV file using UTF-8"""
#     csv_writer.writerows(arr_data)
# 
# def write_list_to_json(arr_data, json_writer):
#     """Write list data in json files using UTF-8"""
#     json_writer.list_to_json(arr_data)
# 
# def process_hashes(path):
#     content = open(path, "rb").read()
#     return hashlib.md5(content).hexdigest(), hashlib.sha1(content).hexdigest(), hashlib.sha256(content).hexdigest()
# 
# def record_sha256_logs(fr, fw):
#     with open(fw, "a") as hash_file:
#         m = process_sha256(fr)
#         hash_file.write(fr + "," + m + "\n")
#         hash_file.close()


from Tkinter import Tk
from ctypes import Structure
from ctypes import sizeof, windll, c_long, c_int, POINTER, pointer, c_char, c_void_p, c_uint
from ctypes.wintypes import DWORD, HMODULE, BYTE
from multiprocessing import Process, Queue, forking
from utils.utils import convert_windate, dosdate, get_csv_writer, get_json_writer,write_list_to_csv, write_list_to_json,process_hashes,record_sha256_logs
import os
import sys
import traceback
import psutil
import win32clipboard
import win32api
import win32security
                # We need open a subprocess because get_open_files may hang forever
                q = Queue()
                process = Process(target=timer_open_files, args=(p, q,))
                process.start()
                # We wait for 2 seconds
                process.join(2)
                if process.is_alive():
                    # If the subprocess is still alive, assume it is hanged and kill it
                    q.close()
                    process.terminate()
                else:
                    # Otherwise, continue normal processing
                    opened_files = q.get()
                    if isinstance(opened_files, list):
                        for opened_file in opened_files:
                            list_to_csv.append((self.computer_name, 'processes_opened_files', unicode(pe32.th32ProcessID),
                                         process_name,
                                         opened_file[0]))
            except psutil.AccessDenied:
                self.logger.warn('Could not open handle for PID : ' + unicode(pe32.th32ProcessID))
            except psutil.NoSuchProcess:
                self.logger.warn('Could not open handle for PID : ' + unicode(pe32.th32ProcessID))

            ret = Process32Next(hProcessSnap, pointer(pe32))
        return list_to_csv

    def _csv_all_modules_opened_files(self):
        with open(self.output_dir + self.computer_name + '_processes_opened_files' + self.rand_ext,
                  'wb') as output:
            csv_writer = get_csv_writer(output)

# Path: utils/utils.py
# def convert_windate(timestamp):
#     try:
#         return datetime.datetime.fromtimestamp(change_to_MKTime(timestamp)).strftime("%Y-%m-%d %H:%M:%S")
#     except:
#         return 0
# 
# def dosdate(_dosdate, _dostime):
#     """
#     _dosdate: 2 bytes, little endian.
#     _dostime: 2 bytes, little endian.
#     returns: datetime.datetime or datetime.datetime.min on error
#     """
#     try:
#         t = ord(_dosdate[1]) << 8
#         t |= ord(_dosdate[0])
#         day = t & 0b0000000000011111
#         month = (t & 0b0000000111100000) >> 5
#         year = (t & 0b1111111000000000) >> 9
#         year += 1980
# 
#         t = ord(_dostime[1]) << 8
#         t |= ord(_dostime[0])
#         sec = t & 0b0000000000011111
#         sec *= 2
#         minute = (t & 0b0000011111100000) >> 5
#         hour = (t & 0b1111100000000000) >> 11
# 
#         return datetime.datetime(year, month, day, hour, minute, sec)
#     except:
#         return datetime.datetime.min
# 
# def get_csv_writer(csvfile):
#     return UnicodeWriter(csvfile, quoting=csv.QUOTE_ALL)
# 
# def get_json_writer(json_file):
#     return UnicodeJsonDumper(json_file)
# 
# def write_list_to_csv(arr_data, csv_writer):
#     """Writes a list"s contents to a CSV file using UTF-8"""
#     csv_writer.writerows(arr_data)
# 
# def write_list_to_json(arr_data, json_writer):
#     """Write list data in json files using UTF-8"""
#     json_writer.list_to_json(arr_data)
# 
# def process_hashes(path):
#     content = open(path, "rb").read()
#     return hashlib.md5(content).hexdigest(), hashlib.sha1(content).hexdigest(), hashlib.sha256(content).hexdigest()
# 
# def record_sha256_logs(fr, fw):
#     with open(fw, "a") as hash_file:
#         m = process_sha256(fr)
#         hash_file.write(fr + "," + m + "\n")
#         hash_file.close()


# Path: memory/mem.py
from Tkinter import Tk
from ctypes import Structure
from ctypes import sizeof, windll, c_long, c_int, POINTER, pointer, c_char, c_void_p, c_uint
from ctypes.wintypes import DWORD, HMODULE, BYTE
from multiprocessing import Process, Queue, forking
from utils.utils import convert_windate, dosdate, get_csv_writer, get_json_writer,write_list_to_csv, write_list_to_json,process_hashes,record_sha256_logs
import os
import sys
import traceback
import psutil
import win32clipboard
import win32api
import win32security

                # We need open a subprocess because get_open_files may hang forever
                q = Queue()
                process = Process(target=timer_open_files, args=(p, q,))
                process.start()
                # We wait for 2 seconds
                process.join(2)
                if process.is_alive():
                    # If the subprocess is still alive, assume it is hanged and kill it
                    q.close()
                    process.terminate()
                else:
                    # Otherwise, continue normal processing
                    opened_files = q.get()
                    if isinstance(opened_files, list):
                        for opened_file in opened_files:
                            list_to_csv.append((self.computer_name, 'processes_opened_files', unicode(pe32.th32ProcessID),
                                         process_name,
                                         opened_file[0]))
            except psutil.AccessDenied:
                self.logger.warn('Could not open handle for PID : ' + unicode(pe32.th32ProcessID))
            except psutil.NoSuchProcess:
                self.logger.warn('Could not open handle for PID : ' + unicode(pe32.th32ProcessID))

            ret = Process32Next(hProcessSnap, pointer(pe32))
        return list_to_csv

    def _csv_all_modules_opened_files(self):
        with open(self.output_dir + self.computer_name + '_processes_opened_files' + self.rand_ext,
                  'wb') as output:
            csv_writer = get_csv_writer(output)

            write_list_to_csv(self.__get_all_modules_opened_files(), csv_writer)