msgparse

Documentation

Index

• Constants
• func DumpBinaryAttachment(attachment Attachment)
• func GetEncodingName(s string) (string, error)
• func GetHeaderByName(headers, name string) (string, error)
• func GetPropertyName(intID int64) string
• func GetTimeFromString(s string, propertyID int64) (time.Time, error)
• type Attachment
  • func ExtractAttachments(path string) ([]Attachment, error)
• type EntryProperty
• type Message
  • func ReadMsgFile(filePath string, verbose bool) (*Message, error)
  • func (m Message) GetPropertyByName(name string) string
• type UnknownProperty

Constants

const (
	// other types - https://www.dimastr.com/redemption/utils.htm
	PT_NULL     = "0001" // null value
	PT_SHORT    = "0002" // signed 16 bit value
	PT_LONG     = "0003" // signed or unsigned 32 bit value
	PT_FLOAT    = "0004" // 32 bit floating point
	PT_DOUBLE   = "0005" // 64 bit floating point
	PT_CURRENCY = "0006" // currency (64 bit integer)
	PT_APPTIME  = "0007" // date type
	PT_ERROR    = "000A" // 32 bit error value
	PT_BOOLEAN  = "000B" // boolean
	PT_OBJECT   = "000D" // embedded object
	PT_LONGLONG = "0014" // 64 bit signed integer
	PT_SYSTIME  = "0040" // date type
	OLEGUID     = "0048" // OLE GUID

	// type we've seen
	AsciiEncoding   = "001E" // aka 8 bit string
	UnicodeEncoding = "001F"
	BinaryEncoding  = "0102"
)

const (
	PropertyUnknown = "unknown"
)

Functions

func DumpBinaryAttachment

func DumpBinaryAttachment(attachment Attachment)

bit risky if we don't trust the attachments

func GetEncodingName

func GetEncodingName(s string) (string, error)

GetEncodingName returns a human-readable name for a given encoding/type ID

func GetHeaderByName

func GetHeaderByName(headers, name string) (string, error)

GetHeaderByName extracts a specific header from a raw header string

func GetPropertyName

func GetPropertyName(intID int64) string

TODO: also seen a date in 0x800d, 0x802d, 0x8012 and 0x8019

func GetTimeFromString

func GetTimeFromString(s string, propertyID int64) (time.Time, error)

Tries a few time encodings TODO replace with ParseDate in https://go.dev/src/net/mail/message.go?

Types

type Attachment

type Attachment struct {
	Bytes            []byte
	OtherData        []byte
	Size             int64
	Filename         string
	LongFilename     string
	MimeTag          string
	UnicodeExtension string
	IsInline         bool
}

func ExtractAttachments

func ExtractAttachments(path string) ([]Attachment, error)

type EntryProperty

type EntryProperty struct {
	PropertyType string
	Encoding     string
	Data         interface{}
}

EntryProperty holds the type of data and the data itself

type Message

type Message struct {
	Properties        map[string]string
	UnknownProperties map[int64]UnknownProperty
	Attachments       []Attachment
}

func ReadMsgFile

func ReadMsgFile(filePath string, verbose bool) (*Message, error)

ReadMsgFile reads and parses a .msg file from the given file path

func (Message) GetPropertyByName

func (m Message) GetPropertyByName(name string) string

type UnknownProperty

type UnknownProperty struct {
	PropertyType string
	Encoding     string
	Data         string
}