libyal / assorted Goto Github PK

write a script/python module to export attachment from mbox format

Summary:
Exception encountered while parsing WMI artifacts using wmi_repository.py. Possibly due to parsed vs. actual entry counts discrepancy in the mapping file.

Exception:
Reading: /home/calvin/Test/samples/wmi/MAPPING2.MAP
File header data:
00000000: CD AB 00 00 46 D1 92 00 BC 9D 09 00 ....F.......
None
Signature : 0x0000abcd
Format version : 0x0092d146
Number of pages : 630204

Reading mappings at offset: 0x0000000c
Number of entries : 630203
Entries data:
[omitted]

Traceback (most recent call last):
File "wmi_repository.py", line 962, in
if not Main():
File "wmi_repository.py", line 954, in Main
cim_repository.Open(options.source)
File "wmi_repository.py", line 900, in Open
self._GetCurrentMappingFile(path)
File "wmi_repository.py", line 842, in _GetCurrentMappingFile
mapping_file.Open(mapping_file_path)
File "wmi_repository.py", line 674, in Open
self._ReadMappings(mappings_reference=u'data')
File "wmi_repository.py", line 587, in _ReadMappings
entries_data)
File "/usr/local/lib/python2.7/site-packages/construct/core.py", line 188, in parse
return self.parse_stream(BytesIO(data))
File "/usr/local/lib/python2.7/site-packages/construct/core.py", line 198, in parse_stream
return self._parse(stream, Container())
File "/usr/local/lib/python2.7/site-packages/construct/core.py", line 445, in _parse
raise ArrayError("expected %d, found %d" % (count, c), sys.exc_info()[1])
construct.core.ArrayError: ('expected 630203, found 40475', FieldError(FieldError('expected 4, found 0',),))

Artifact Files:
wmi.zip

Hello, I have a compressed package produced by modified bzip2. How can I decompress it? Thank you
the file down link https://we.tl/t-U5VLMnpr16
file is Is an unknown program to modify the bZIP source code, generated by the compressed package