Shadyred75 / wombatforensics

Automatically exported from code.google.com/p/wombatforensics
0 stars 0 forks source link

hex viewer display functionality paradigm #118

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Hex viewer is the only viewer in the main window. there is no switching to 
anything else. any other viewer's are toggle buttons which open in a new window 
that can be moved around and resized.  This would fix all the elements of the 
main application window, and better standardize the toolbar buttons.

Original issue reported on code.google.com by pjrina...@gmail.com on 25 Jul 2014 at 6:12

GoogleCodeExporter commented 9 years ago
Might be worth figuring out if there is a way to have only the image hex, but 
highlight the hex for specific files in the image hex.rather than loading the 
respective hex for each file. All I would need to do is to determine the 
offsets for each fragment of a file and then I could mark them somehow and not 
have to load each hex content data for every piece

Original comment by pjrina...@gmail.com on 5 Sep 2014 at 4:26

GoogleCodeExporter commented 9 years ago
lfhex calls gotooffset(off_t offset) { hexEditor->setOffset(offset); 
hexEditor->seeCursor(); emit offsetChanged(offset) -> calls 
setOffsetLabel(offset) {  QString label;
  char    buffer[64];
#if _LARGEFILE_SOURCE
  sprintf(buffer,"0x%lx",pos);
#else
  sprintf(buffer,"0x%x",pos);
#endif
  label = buffer;
  offsetLineEdit->setText(label);

Original comment by pjrina...@gmail.com on 5 Sep 2014 at 2:06

GoogleCodeExporter commented 9 years ago
working on the highlighting hex of selected rather than only displaying it.

need to reference functions in istat to determine the blocks for each file. 
then reference blkcat functions to get the data.

Original comment by pjrina...@gmail.com on 29 Sep 2014 at 4:06

GoogleCodeExporter commented 9 years ago
tsk_fs_file_walk() is used to get the "direct blocks" from ext2fs.c istat 
function. this uses the callback function print_addr_act to print the actual 
block address.

i would need to call this information on a file to determine the blocks to 
store in the property database.

Original comment by pjrina...@gmail.com on 16 Oct 2014 at 4:34

GoogleCodeExporter commented 9 years ago
initial test for ext2fs in getting the address blocks was successful for output 
to qdebug. need to figure out how to write this information to the db variables 
or the db for the specific file.

Original comment by pjrina...@gmail.com on 17 Oct 2014 at 12:57

GoogleCodeExporter commented 9 years ago
i can write the block address to the db. pull it when i need it. Now I need to 
work on highlighting, resolving the qdebug loop which is repeating itself twice 
and then i need to set the proper page when a file is selected in the treeview.

Original comment by pjrina...@gmail.com on 6 Nov 2014 at 12:56

GoogleCodeExporter commented 9 years ago
got the offset to go to the first block address for the file, now i need to 
implement highlighting functionality and verify what happens if i click without 
moving the cursor.

Original comment by pjrina...@gmail.com on 6 Nov 2014 at 10:01

GoogleCodeExporter commented 9 years ago
it crashes when scrolling up when you click on a file and the new offset is set 
as the topleft. it appears as if the overall page count is changed, or size is 
different, so i'll have to figure out when that change takes place and remove 
it so it doesn't crash anymore.

Original comment by pjrina...@gmail.com on 6 Nov 2014 at 10:20

GoogleCodeExporter commented 9 years ago
the current hex viewer is too complicated. I need to rewrite this one and 
simplify the design and implementation.

Original comment by pjrina...@gmail.com on 10 Nov 2014 at 11:15

GoogleCodeExporter commented 9 years ago
working on rewrite of the hexviewer. lfhex base is too complex to follow, which 
makes it near impossible to modify.

currently have the new base working for hexdisplay, ascii hex labels, and ascii 
text representation for the hex.

Now i need to work on the following:

0. minor visual cleanup of how the data is displayed.
1. read tsk_img_data to a QByteArray().
2. build the paging system to open large files by loading only a portion of the 
data
3. once the paging is complete, highlight the respective block address.

Original comment by pjrina...@gmail.com on 10 Nov 2014 at 10:16

GoogleCodeExporter commented 9 years ago
1. need to work on loading and unloading data when the user scrolls...
2. need to work on resizing the data width to 32.

Original comment by pjrina...@gmail.com on 12 Nov 2014 at 6:30

GoogleCodeExporter commented 9 years ago
the scrollarea doesn't care what happens with my settings, it just adjusts the 
scroll bars to be the length of the shown data, so i need to do a separate 
scroll bar and have it work independently of the hexviewer.

on to the switch from the scrollarea to the scrollbar.

Original comment by pjrina...@gmail.com on 14 Nov 2014 at 3:58

GoogleCodeExporter commented 9 years ago
went back to the original hexviewer, using a modified lfhex. i implemented a 
feature where it'll change the font color when it's w/in the block and not when 
it's not a block of the file.

it works pretty well, a few bytes aren't highlighted if they cross and are on 
the line for a non-block page.

I may need to switch to checking the offset or some finer grained detail. but 
for now its pretty damn good.

Original comment by pjrina...@gmail.com on 23 Nov 2014 at 11:09

GoogleCodeExporter commented 9 years ago
I need to abstract the reader from the hex viewer. Remove all old unused code, 
and then load my respective tsk data in separate readers and then simple set 
the reader for each hex viewer. Then I will have to dissect the text drawing, 
to ensure it accounts for the full file size coloring and not missing data or 
respective blocks. Slack as well.

Original comment by pjrina...@gmail.com on 25 Nov 2014 at 5:12

GoogleCodeExporter commented 9 years ago
got the reader abstracted until it craps out at reader::readimage. Need to 
figure out how to lay out the abstraction code further to replace this issue.

Original comment by pjrina...@gmail.com on 19 Dec 2014 at 12:09

GoogleCodeExporter commented 9 years ago
when the cursor goes off the screen, I should call set top left using the 
current top left position instead of the cursor. Byte offset. I'll have to try 
that tomorrow.

Original comment by pjrina...@gmail.com on 4 Jan 2015 at 6:45

GoogleCodeExporter commented 9 years ago
I got the imageviewer and fileviewer working properly. The only thing left to 
implement is:

1. the file highlighting and slack space highlighting in the imageviewer
2. the slack space highlighting in the fileviewer
3. why the imageviewer resets the zero offset to the file start instead of just 
going to the file's block offset.

Otherwise a huge jump in functionality implementation since i started the 
abstraction months ago.

Original comment by pjrina...@gmail.com on 4 Jan 2015 at 9:51

GoogleCodeExporter commented 9 years ago
I got this slack space highlighting in the file viewer complete. I am working 
on trying to get the image viewer to stop resetting the zero offset.possibly 
try implementing some of the function calls where the object type equals one 
such as the open image call and the set data and set reader calls.

Original comment by pjrina...@gmail.com on 5 Jan 2015 at 2:38

GoogleCodeExporter commented 9 years ago
should try switching to 1 byte per word rather than 2 and see if it provides 
finer grain control over the byte highlighting.

Original comment by pjrina...@gmail.com on 5 Jan 2015 at 11:19

GoogleCodeExporter commented 9 years ago
switching to 1 byte per word allowed for finer grain control over the byte 
highlighting. This allowed the slack space highlighting in the file viewer to 
be implemented correctly. All that is left to fix is the following:

1. imageviewer resetting the zero offset to the file start rather just going to 
the block's offset.
2. file content highlighting and slack space highlighting in the imageviewer.

Original comment by pjrina...@gmail.com on 5 Jan 2015 at 12:47

GoogleCodeExporter commented 9 years ago
implemented the imageviewer file selection and going to that offset. also 
implemented the file content highlighting and slack space highlighting in the 
imageviewer. implemented the updated fileviewer and its functionality to 
properly display the file contents and slack highlighting.

this issue is marked complete until further testing and verification.

Original comment by pjrina...@gmail.com on 6 Jan 2015 at 3:31

GoogleCodeExporter commented 9 years ago
when the file size is less than 1 block, the imageviewer will highlight the 
whole block as red rather than blue for the file size and red for the file 
slack. the fileviewer shows everything correctly, so i can compare if need be 
to figure out the if/else statement errors.

Original comment by pjrina...@gmail.com on 13 Jan 2015 at 2:58

GoogleCodeExporter commented 9 years ago
fixed it by adding the i value into the if statement

Original comment by pjrina...@gmail.com on 15 Jan 2015 at 2:03