1# Copyright (c) 2017, The MITRE Corporation. All rights reserved. 2# See LICENSE.txt for complete terms. 3 4from mixbox import entities, fields 5 6import cybox.bindings.win_volume_object as win_volume_binding 7from cybox.objects.volume_object import Volume 8from cybox.common import BaseProperty, String 9 10 11class WindowsDrive(BaseProperty): 12 _binding = win_volume_binding 13 _binding_class = win_volume_binding.WindowsDriveType 14 _namespace = "http://cybox.mitre.org/objects#WinVolumeObject-2" 15 16 TYPE_DRIVE_UNKNOWN = "DRIVE_UNKNOWN" 17 TYPE_DRIVE_NO_ROOT_DIR = "DRIVE_NO_ROOT_DIR" 18 TYPE_DRIVE_REMOVABLE = "DRIVE_REMOVABLE" 19 TYPE_DRIVE_FIXED = "DRIVE_FIXED" 20 TYPE_DRIVE_REMOTE = "DRIVE_REMOTE" 21 TYPE_DRIVE_CDROM = "DRIVE_CDROM" 22 TYPE_DRIVE_RAMDISK = "DRIVE_RAMDISK" 23 24 25class WindowsVolumeAttribute(BaseProperty): 26 _binding = win_volume_binding 27 _binding_class = win_volume_binding.WindowsVolumeAttributeType 28 _namespace = "http://cybox.mitre.org/objects#WinVolumeObject-2" 29 30 TYPE_READ_ONLY = "ReadOnly" 31 TYPE_HIDDEN = "Hidden" 32 TYPE_NO_DEFAULT_DRIVE_LETTER = "NoDefaultDriveLetter" 33 TYPE_SHADOW_COPY = "ShadowCopy" 34 35 36class WindowsVolumeAttributesList(entities.EntityList): 37 _binding = win_volume_binding 38 _binding_class = win_volume_binding.WindowsVolumeAttributesListType 39 _namespace = "http://cybox.mitre.org/objects#WinVolumeObject-2" 40 41 attribute = fields.TypedField("Attribute", WindowsVolumeAttribute, multiple=True) 42 43 44class WinVolume(Volume): 45 _binding = win_volume_binding 46 _binding_class = win_volume_binding.WindowsVolumeObjectType 47 _namespace = "http://cybox.mitre.org/objects#WinVolumeObject-2" 48 _XSI_NS = "WinVolumeObj" 49 _XSI_TYPE = "WindowsVolumeObjectType" 50 51 attributes_list = fields.TypedField("Attributes_List", WindowsVolumeAttributesList) 52 drive_letter = fields.TypedField("Drive_Letter", String) 53 drive_type = fields.TypedField("Drive_Type", WindowsDrive) 54