# Path: appAux.py
# def loadFile(file_fullpath, max_chunk_size = 0):
#     """Abstracts loading a regular file and a file from within a zip archive.
#     Args:
#         file_fullpath (str): Full path to file to load
#         max_chunk_size (int): maximum number of bytes to be read from the file
#     Returns:
#         file_pointer (StringIO): Data read from fileFullPath
#     """
#     global zipCache
#     global zipCache_hits
#     global zipCache_misses
#     logger.debug("Loading file %s" % file_fullpath)
#     if ".zip/" in file_fullpath:
#         m = re.match(r'^((?:.*)\.zip)[\\/](.*)$', file_fullpath)
#         if m:
#             zip_container = m.group(1)
#             if m.lastindex > 1:
#                 file_fullpath_unprocessed = m.group(2)
#                 if '.zip' in file_fullpath_unprocessed:
#                     m = re.match(r'^(.*)(?:\.zip[\\/](.*))*$', file_fullpath_unprocessed)
#                     if m:
#                         zip_container_relative_path = m.group(1)
#                         if m.lastindex > 1:
#                             file_fullpath_unprocessed = m.group(2)
#                         else:
#                             file_fullpath_unprocessed = None
#                     else:
#                         logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#                 else:
#                     zip_container_relative_path = file_fullpath_unprocessed
# 
#                 # If not in the zipCache we add it
#             if zip_container not in zipCache:
#                 zipCache_misses +=1
#                 if zipfile.is_zipfile(loadFile(zip_container)):
#                     zipCache[zip_container] = zipfile.ZipFile(loadFile(zip_container))
#                 else:
#                     logger.error("Invalid ZIP file found: %s" % file_fullpath)
#                     return None
#             else:
#                 zipCache_hits += 1
#                 # print("ZipCache hits / misses: %d/%d" % (zipCache_hits, zipCache_misses))
# 
#             # Extract file_pointer from zip:
#             file_pointer = StringIO(zipCache[zip_container].read(zip_container_relative_path))
#             if max_chunk_size != 0:
#                 file_pointer = StringIO(file_pointer.read(max_chunk_size))
# 
#         else:
#             logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#     else:
#             # Extract file_pointer:
#             input_file = open(file_fullpath, 'rb')
#             if max_chunk_size == 0:
#                 file_pointer = StringIO(input_file.read())
#             else: file_pointer = StringIO(input_file.read(max_chunk_size))
#     assert(file_pointer is not None)
# 
#     logger.debug("Read %d bytes [%s]" % (getFileSize(file_pointer), toHex(file_pointer.read(20))))
#     # Return file pointer to pos 0
#     file_pointer.seek(0, 0)
# 
#     return file_pointer
# 
# Path: AmCacheParser.py
# def _processAmCacheFile_StringIO(data):
#     regf_file = pyregf.file()
#     regf_file.open_file_object(data, "r")
# 
#     try:
#         ee = parse_execution_entries(regf_file)
#     except NotAnAmcacheHive:
#         logger.error("doesn't appear to be an Amcache.hve hive")
#         return
#     finally:
#         regf_file.close()
# 
#     return ee


import settings
import logging
import struct
import pyregf
import settings
import ntpath
from ingest import Ingest
from appAux import loadFile
from AmCacheParser import _processAmCacheFile_StringIO
        if not settings.__PYREGF__:
            logger.warning("AmCache processing disabled (missing pyregf) skipping file: %s" % file_name_fullpath)
        else: return super(Amcache_miracquisition, self).getHostName(file_name_fullpath)

    def checkMagic(self, file_name_fullpath):
        magic_ok = False
        # Check magic
        magic_id = self.id_filename(file_name_fullpath)
        if 'registry file' in magic_id:
            # Perform a deeper check using pyregf
            file_object = loadFile(file_name_fullpath)
            regf_file = pyregf.file()
            regf_file.open_file_object(file_object, "r")
            magic_key = regf_file.get_key_by_path(r'Root\File')
            if magic_key is None:
                # Check if it's a Windows 10 AmCache hive
                magic_key = regf_file.get_key_by_path(r'Root\InventoryApplicationFile')
            regf_file.close()
            del regf_file
            if magic_key is not None:
                magic_ok = True

            # Need to close these or the memory will never get freed:
            file_object.close()
            del file_object

        return magic_ok

    def calculateID(self, file_name_fullpath):
        instanceID = None

# Path: appAux.py
# def loadFile(file_fullpath, max_chunk_size = 0):
#     """Abstracts loading a regular file and a file from within a zip archive.
#     Args:
#         file_fullpath (str): Full path to file to load
#         max_chunk_size (int): maximum number of bytes to be read from the file
#     Returns:
#         file_pointer (StringIO): Data read from fileFullPath
#     """
#     global zipCache
#     global zipCache_hits
#     global zipCache_misses
#     logger.debug("Loading file %s" % file_fullpath)
#     if ".zip/" in file_fullpath:
#         m = re.match(r'^((?:.*)\.zip)[\\/](.*)$', file_fullpath)
#         if m:
#             zip_container = m.group(1)
#             if m.lastindex > 1:
#                 file_fullpath_unprocessed = m.group(2)
#                 if '.zip' in file_fullpath_unprocessed:
#                     m = re.match(r'^(.*)(?:\.zip[\\/](.*))*$', file_fullpath_unprocessed)
#                     if m:
#                         zip_container_relative_path = m.group(1)
#                         if m.lastindex > 1:
#                             file_fullpath_unprocessed = m.group(2)
#                         else:
#                             file_fullpath_unprocessed = None
#                     else:
#                         logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#                 else:
#                     zip_container_relative_path = file_fullpath_unprocessed
# 
#                 # If not in the zipCache we add it
#             if zip_container not in zipCache:
#                 zipCache_misses +=1
#                 if zipfile.is_zipfile(loadFile(zip_container)):
#                     zipCache[zip_container] = zipfile.ZipFile(loadFile(zip_container))
#                 else:
#                     logger.error("Invalid ZIP file found: %s" % file_fullpath)
#                     return None
#             else:
#                 zipCache_hits += 1
#                 # print("ZipCache hits / misses: %d/%d" % (zipCache_hits, zipCache_misses))
# 
#             # Extract file_pointer from zip:
#             file_pointer = StringIO(zipCache[zip_container].read(zip_container_relative_path))
#             if max_chunk_size != 0:
#                 file_pointer = StringIO(file_pointer.read(max_chunk_size))
# 
#         else:
#             logger.error("Issue extracting container and relative path from ZIP file: %s" % file_fullpath)
#     else:
#             # Extract file_pointer:
#             input_file = open(file_fullpath, 'rb')
#             if max_chunk_size == 0:
#                 file_pointer = StringIO(input_file.read())
#             else: file_pointer = StringIO(input_file.read(max_chunk_size))
#     assert(file_pointer is not None)
# 
#     logger.debug("Read %d bytes [%s]" % (getFileSize(file_pointer), toHex(file_pointer.read(20))))
#     # Return file pointer to pos 0
#     file_pointer.seek(0, 0)
# 
#     return file_pointer
# 
# Path: AmCacheParser.py
# def _processAmCacheFile_StringIO(data):
#     regf_file = pyregf.file()
#     regf_file.open_file_object(data, "r")
# 
#     try:
#         ee = parse_execution_entries(regf_file)
#     except NotAnAmcacheHive:
#         logger.error("doesn't appear to be an Amcache.hve hive")
#         return
#     finally:
#         regf_file.close()
# 
#     return ee


# Path: Ingest/amcache_miracquisition.py
import settings
import logging
import struct
import pyregf
import settings
import ntpath
from ingest import Ingest
from appAux import loadFile
from AmCacheParser import _processAmCacheFile_StringIO

        if not settings.__PYREGF__:
            logger.warning("AmCache processing disabled (missing pyregf) skipping file: %s" % file_name_fullpath)
        else: return super(Amcache_miracquisition, self).getHostName(file_name_fullpath)

    def checkMagic(self, file_name_fullpath):
        magic_ok = False
        # Check magic
        magic_id = self.id_filename(file_name_fullpath)
        if 'registry file' in magic_id:
            # Perform a deeper check using pyregf
            file_object = loadFile(file_name_fullpath)
            regf_file = pyregf.file()
            regf_file.open_file_object(file_object, "r")
            magic_key = regf_file.get_key_by_path(r'Root\File')
            if magic_key is None:
                # Check if it's a Windows 10 AmCache hive
                magic_key = regf_file.get_key_by_path(r'Root\InventoryApplicationFile')
            regf_file.close()
            del regf_file
            if magic_key is not None:
                magic_ok = True

            # Need to close these or the memory will never get freed:
            file_object.close()
            del file_object

        return magic_ok

    def calculateID(self, file_name_fullpath):
        instanceID = None

        file_object = loadFile(file_name_fullpath)