ntdsextract2 0.9.2

Display contents of Active Directory database files (ntds.dit)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

use anyhow::{anyhow, bail, Result};

use chrono::{DateTime, Duration, NaiveDate, Utc};
use libesedb::Value;

pub(crate) trait FromValue
where
    Self: Sized,
{
    fn from_value(value: &Value, attribute_name: &str) -> Result<Self> {
        if matches!(value, Value::Null(())) {
            bail!("missing value in '{attribute_name}'");
        } else {
            match Self::from_value_opt(value, attribute_name)? {
                Some(x) => Ok(x),
                None => bail!("value of '{attribute_name}' has no content"),
            }
        }
    }
    fn from_value_opt(value: &Value, attribute_name: &str) -> Result<Option<Self>>;
}

impl FromValue for i32 {
    fn from_value_opt(value: &Value, attribute_name: &str) -> Result<Option<Self>> {
        match value {
            Value::I32(val) => Ok(Some(*val)),
            Value::Null(()) => Ok(None),
            _ => bail!("invalid value detected: {value:?} in attribute '{attribute_name}'"),
        }
    }
}

impl FromValue for u32 {
    fn from_value_opt(value: &Value, attribute_name: &str) -> Result<Option<Self>> {
        match value {
            Value::U8(val) => Ok(Some((*val).into())),
            Value::U16(val) => Ok(Some((*val).into())),
            Value::U32(val) => Ok(Some(*val)),
            Value::I16(val) => Ok(Some((*val).try_into()?)),
            Value::I32(val) => Ok(Some((*val).try_into()?)),
            Value::Null(()) => Ok(None),
            _ => bail!("invalid value detected: {value:?} in attribute '{attribute_name}'"),
        }
    }
}

impl FromValue for String {
    fn from_value_opt(value: &Value, attribute_name: &str) -> Result<Option<Self>> {
        match value {
            Value::Text(val) => Ok(Some(val.to_owned())),
            Value::LargeText(val) => Ok(Some(val.to_owned())),
            Value::Binary(val) | Value::LargeBinary(val) => Ok(Some(hex::encode(val))),
            Value::Null(()) => Ok(None),
            _ => bail!("invalid value detected: {value:?} in field {attribute_name}"),
        }
    }
}

pub(crate) type UtcDatetime = DateTime<Utc>;
impl FromValue for UtcDatetime {
    fn from_value_opt(value: &Value, attrib_name: &str) -> Result<Option<Self>> {
        match value {
            Value::Currency(val) => Ok(Some(currency_to_datetime(*val))),
            Value::Null(()) => Ok(None),
            _ => Err(anyhow!(
                "invalid value detected: {:?} in field {}",
                value,
                attrib_name
            )),
        }
    }
}

fn currency_to_datetime(val: i64) -> DateTime<Utc> {
    let dt_base = DateTime::<Utc>::from_utc(NaiveDate::from_ymd(1601, 1, 1).and_hms(0, 0, 0), Utc);
    let duration = Duration::microseconds(val / 10);
    dt_base + duration
}