diff --git a/unblob/handlers/archive/sevenzip.py b/unblob/handlers/archive/sevenzip.py index 511e8a350f..9b7717cc4a 100644 --- a/unblob/handlers/archive/sevenzip.py +++ b/unblob/handlers/archive/sevenzip.py @@ -18,8 +18,9 @@ https://py7zr.readthedocs.io/en/latest/archive_format.html """ import binascii -from typing import Optional +from typing import Dict, Optional +from dissect.cstruct import Instance from structlog import get_logger from unblob.extractors import Command @@ -57,6 +58,9 @@ class SevenZipHandler(StructHandler): HEADER_STRUCT = "sevenzip_header_t" EXTRACTOR = Command("7z", "x", "-p", "-y", "{inpath}", "-o{outdir}") + def get_metadata(self, header: Instance) -> Dict: + return {"version_maj": header.version_maj, "version_min": header.version_min} + def calculate_chunk(self, file: File, start_offset: int) -> Optional[ValidChunk]: header = self.parse_header(file) @@ -67,9 +71,10 @@ def calculate_chunk(self, file: File, start_offset: int) -> Optional[ValidChunk] logger.debug("Invalid header CRC", _verbosity=2) return None + metadata = self.get_metadata(header) # We read the signature header here to get the offset to the header database first_db_header = start_offset + len(header) + header.next_header_offset end_offset = first_db_header + header.next_header_size return ValidChunk( - start_offset=start_offset, end_offset=end_offset, metadata=header + start_offset=start_offset, end_offset=end_offset, metadata=metadata )