-
Notifications
You must be signed in to change notification settings - Fork 9
/
epochalypse.py
147 lines (126 loc) · 5.06 KB
/
epochalypse.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#! /usr/bin/python
# -*- coding: iso-8859-15 -*-
#############################################################################
## ##
## Epochalypse.py --- Utility to convert epoch timestamps ##
## ##
## Copyright 2018 Pasquale Stirparo, @pstirparo ##
## New License is: Apache 2.0 ##
## ##
#############################################################################
__description__ = 'Epochalypse - timestamp converter utility'
__author__ = 'Pasquale Stirparo, @pstirparo'
__version__ = '0.5.1'
import sys
import time
from datetime import datetime
import argparse
import binascii
# The number of seconds between January 1, 1904 and Jan 1, 1970.
HFS_OFFSET = 2082844800
# The number of seconds between January 1, 1970 and January 1, 2001.
# Apple Safari also uses Cocoa timestamp
COCOA_OFFSET = 978307200
# The difference between Jan 1, 1601 and Jan 1, 1970 in micro seconds
# WebKit timestamp is used by Google Chrome and Opera
WEBKIT_OFFSET = 11644473600 * 1000000
# The difference between Jan 1, 1601 and Jan 1, 1970 in 100 nano seconds
NTFS_OFFSET = 11644473600 * 10000000
# The difference between Jan 1, 1980 and Jan 1, 1970 in seconds.
FAT_OFFSET = 315532800
# No offset calculation needed for APFS, as represent the number of nano
# seconds since January 1, 1970 (same as standard Unix epoch)
# No offset calculation needed for FireFox timestamp, as represent the number
# of microseconds since January 1, 1970 (same as standard Unix epoch)
def fromEpoch(epoch):
print('Epoch Time input to be converted: %.6f' % epoch)
try:
print('Unix: ' + datetime.utcfromtimestamp(epoch).isoformat(" ") + ' UTC')
except:
print('Unix: -')
try:
print('COCOA: ' + datetime.utcfromtimestamp(
epoch + COCOA_OFFSET).isoformat(" ") + ' UTC')
except:
print('COCOA: -')
try:
print('FAT: ' + datetime.utcfromtimestamp(epoch + FAT_OFFSET).isoformat(
" ") + ' UTC')
except:
print('FAT: -')
try:
print('HFS+: ' + datetime.utcfromtimestamp(epoch - HFS_OFFSET).isoformat(
" ") + ' UTC')
except:
print('HFS+: -')
try:
# Webkit timestamp calculation
wk = datetime.utcfromtimestamp(float(epoch - WEBKIT_OFFSET) / 1000000)
print('WebKit: ' + wk.isoformat(" ") + ' UTC')
except:
print('WebKit: -')
try:
# ntfs time calculation
ntfs = datetime.utcfromtimestamp(float(epoch - NTFS_OFFSET) / 10000000)
print('NTFS: ' + ntfs.isoformat(" ") + ' UTC')
except:
print('NTFS: -')
try:
# APFS time calculation
apfs = datetime.utcfromtimestamp(float(epoch) / 1000000000)
print('APFS: ' + apfs.isoformat(" ") + ' UTC')
except:
print('APFS: -')
try:
# Firefox timestamp, number of microseconds since January 1, 1970 UTC
ff = datetime.utcfromtimestamp(float(epoch) / 1000000)
print('FireFox: ' + ff.isoformat(" ") + ' UTC')
except:
print('FireFox: -')
def fromHex(hextime):
return(float.fromhex(hextime))
def main():
parser = argparse.ArgumentParser()
parser.add_argument('-e', '--epoch', dest='epoch_input', default=False,
help='Epoch time to be converted.', metavar='timestamp')
parser.add_argument('-r', '--revhex', action='store_true', default=False,
help='Reverse hex bytes (for little endian input), use it together with -x.')
parser.add_argument('-x', '--hex', dest='hexadecimal_input', default=False,
help='Hexadecimal timemstamp value to be converted.', metavar='hex_timestamp')
parser.add_argument('-v', '--version', action='version', version= '%(prog)s ' + __version__)
try:
args = parser.parse_args()
if len(sys.argv) == 1:
parser.print_help()
sys.exit(1)
if args.revhex and not args.hexadecimal_input:
print("\nInput parameters Error: Use the -r option together with the hex one, -rx.\n")
parser.print_help()
sys.exit(1)
except Exception as e:
parser.print_help()
sys.exit(1)
print('\n##########################################################')
print('# #')
print('# Epochalypse - Epoch timestamp converter utility #')
print('# by Pasquale Stirparo, @pstirparo #')
print('# #')
print('##########################################################\n')
try:
if args.epoch_input:
fromEpoch(float(args.epoch_input))
print('')
elif args.hexadecimal_input:
hex_text = args.hexadecimal_input.replace(' ', '')
if args.revhex:
hex_text = binascii.hexlify(binascii.unhexlify(hex_text)[::-1]).decode()
epoch = fromHex(hex_text)
fromEpoch(epoch)
print('')
except ValueError as e:
print("[ERROR] Input value not valid.\n")
sys.exit(1)
except:
sys.exit(1)
if __name__ == "__main__":
main()