forked from Velocidex/velociraptor
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathmarshal.go
79 lines (64 loc) · 1.59 KB
/
marshal.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
package main
import (
"io/ioutil"
"os"
errors "github.com/go-errors/errors"
"www.velocidex.com/golang/velociraptor/json"
"www.velocidex.com/golang/velociraptor/vql/tools"
"www.velocidex.com/golang/vfilter"
"www.velocidex.com/golang/vfilter/marshal"
"www.velocidex.com/golang/vfilter/types"
)
var (
ignoreVars = []string{
"config",
}
)
func loadScopeFromFile(filename string, scope types.Scope) (types.Scope, error) {
fd, err := os.Open(filename)
if err != nil {
// File is missing is not an error - just store it in
// the file at the end.
return scope, nil
}
defer fd.Close()
data, err := ioutil.ReadAll(fd)
if err != nil {
return nil, err
}
// Build an unmarshaller
unmarshaller := vfilter.NewUnmarshaller(ignoreVars)
unmarshaller.RegisterHandler("StarlModule", tools.StarlModule{})
unmarshal_item := &types.MarshalItem{}
err = json.Unmarshal(data, &unmarshal_item)
if err != nil {
return nil, err
}
res, err := unmarshaller.Unmarshal(unmarshaller,
scope, unmarshal_item)
if err != nil {
return nil, err
}
res_scope, ok := res.(types.Scope)
if !ok {
return nil, errors.New("Scope file does not contain a serialized scope")
}
return res_scope, err
}
func storeScopeInFile(filename string, scope types.Scope) error {
intermediate, err := marshal.Marshal(scope, scope)
if err != nil {
return err
}
serialized, err := json.MarshalIndent(intermediate)
if err != nil {
return err
}
fd, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
if err != nil {
return err
}
defer fd.Close()
_, err = fd.Write(serialized)
return err
}