ydkhatri / mac_apt

macOS (& ios) Artifact Parsing Tool
https://swiftforensics.com
MIT License
779 stars 100 forks source link

FSEVENTS plugin - PrintAll() takes 1 positional argument but 2 were given #80

Closed Ektoplasma closed 2 years ago

Ektoplasma commented 2 years ago

There is a bug in the fsevents.py plugin where the function PrintAll is not properly called: https://github.com/ydkhatri/mac_apt/blob/master/plugins/fsevents.py#L313

Example error:


MAIN-INFO-Started macOS Artifact Parsing Tool - Artifact Only mode, version [1.4.3.dev](http://1.4.3.dev/) (20210904)
MAIN-INFO-Dates and times are in UTC unless the specific artifact being parsed saves it as local time!
MAIN-INFO---------------------------------------------------
MAIN-INFO-Running plugin FSEVENTS
MAIN-INFO---------------------------------------------------
MAIN.FSEVENTS-INFO-Module Started as standalone
MAIN-ERROR-An exception occurred while running plugin - FSEVENTS
Traceback (most recent call last):
File "C:\github\mac_apt\mac_apt_artifact_only_[compiled.py](http://compiled.py/)", line 239, in 
File "plugins\[fsevents.py](http://fsevents.py/)", line 313, in Plugin_Start_Standalone
TypeError: PrintAll() takes 1 positional argument but 2 were given
MAIN-INFO---------------------------------------------------
MAIN-INFO-Finished in time = 00:00:01
MAIN-INFO-Review the Log file and report any ERRORs or EXCEPTIONS to the developers
ydkhatri commented 2 years ago

Just fixed this, try now with the latest code.

Ektoplasma commented 2 years ago

Thanks

neuroklinik commented 2 years ago

It seems this change isn't yet incorporated into the provided Windows binaries. I'm still getting: TypeError: PrintAll() takes 1 positional argument but 2 were given when using mac_apt_artifact_only.exe version 1.4.3.dev (20210904) Could newer binaries be posted that incorporate this change? Thank you!

ydkhatri commented 2 years ago

It seems this change isn't yet incorporated into the provided Windows binaries. I'm still getting: TypeError: PrintAll() takes 1 positional argument but 2 were given when using mac_apt_artifact_only.exe version 1.4.3.dev (20210904) Could newer binaries be posted that incorporate this change? Thank you!

I will update the binary later today.