diff --git a/BitsParser.py b/BitsParser.py index be70619..7a009cf 100644 --- a/BitsParser.py +++ b/BitsParser.py @@ -1,3 +1,4 @@ +#!/usr/bin/python3 # Copyright 2021 FireEye, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with @@ -330,7 +331,7 @@ def output_jobs(self, file_path, jobs): # If an output file is specified, open it and use it instead of stdout if self.out_file: orig_stdout = sys.stdout - sys.stdout = open(self.out_file, "w") + sys.stdout = open(self.out_file, "a") try: for job in jobs: @@ -551,7 +552,7 @@ def parse(self): self.job_dict[alias] = self.escape(self.job_dict[alias]) # Update the object hash - if type(v) is not 'Dict': + if not isinstance(v, dict): job_hash.update(str(v).encode('utf-8')) self.hash = job_hash.hexdigest() diff --git a/ese/ese.py b/ese/ese.py index a389fdd..7edf35c 100644 --- a/ese/ese.py +++ b/ese/ese.py @@ -641,7 +641,8 @@ def openTable(self, tableName): cursor['CurrentTag'] = 0 # Create a mapping of the long values tree - cursor['LongValues'] = self.__getLongValues(cursor['TableData']['LongValues']['FatherDataPageNumber']) + if 'FatherDataPageNumber' in cursor['TableData']['LongValues']: + cursor['LongValues'] = self.__getLongValues(cursor['TableData']['LongValues']['FatherDataPageNumber']) return cursor