dissect.apfs 1.1__tar.gz → 1.1.dev1__tar.gz

{dissect_apfs-1.1/dissect.apfs.egg-info → dissect_apfs-1.1.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.apfs
-Version: 1.1
+Version: 1.1.dev1
 Summary: A Dissect module implementing a parser for the APFS file system, a commonly used Apple file system
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/dissect/apfs/apfs.py

@@ -1,7 +1,5 @@
 from __future__ import annotations
 
-import logging
-import os
 from typing import TYPE_CHECKING, BinaryIO
 
 from dissect.apfs.c_apfs import c_apfs
@@ -13,9 +11,6 @@ if TYPE_CHECKING:
     from dissect.apfs.objects.fs import FS
     from dissect.apfs.objects.keybag import ContainerKeybag
 
-log = logging.getLogger(__name__)
-log.setLevel(os.getenv("DISSECT_LOG_APFS", "CRITICAL"))
-
 
 class APFS:
     """Container class for APFS operations.
@@ -29,29 +24,8 @@ class APFS:
         self.fh.seek(0)
 
         self.sb = NxSuperblock.from_block(self, 0, self.fh.read(c_apfs.NX_DEFAULT_BLOCK_SIZE))
-        self.sb.check()
-
-        self.sbs = sorted(
-            [obj for obj in self.sb.checkpoint_objects if isinstance(obj, NxSuperblock)],
-            key=lambda obj: obj.xid,
-            reverse=True,
-        )
-
-        # TODO: Do more accurate checkpoint traversal
-        for sb in self.sbs:
-            try:
-                sb.check()
-                sb.compare(self.sb)
-            except Exception as e:
-                log.debug("Skipping superblock xid=%d: %s", sb.xid, e)
-                continue
-
-            if not sb.omap.is_valid():
-                log.debug("Skipping superblock xid=%d: invalid OMAP", sb.xid)
-                continue
-
-            self.sb = sb
-            break
+        self.sbs = [self.sb] + [obj for obj in self.sb.checkpoint_objects if isinstance(obj, NxSuperblock)]
+        self.sb = sorted(self.sbs, key=lambda obj: obj.xid)[-1]
 
     @property
     def block_size(self) -> int:

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/dissect/apfs/objects/fs.py

@@ -792,27 +792,27 @@ class DirectoryEntry:
     @cached_property
     def type(self) -> int:
         """The file type of this directory entry."""
-        return (self.value.flags & c_apfs.DREC_TYPE_MASK) << 12
+        return self.value.flags & c_apfs.DREC_TYPE_MASK << 12
 
     def is_dir(self) -> bool:
         """Return whether this directory entry is a directory."""
-        return stat.S_ISDIR(self.type)
+        return stat.S_ISDIR(self.type << 12)
 
     def is_file(self) -> bool:
         """Return whether this directory entry is a regular file."""
-        return stat.S_ISREG(self.type)
+        return stat.S_ISREG(self.type << 12)
 
     def is_symlink(self) -> bool:
         """Return whether this directory entry is a symbolic link."""
-        return stat.S_ISLNK(self.type)
+        return stat.S_ISLNK(self.type << 12)
 
     def is_block_device(self) -> bool:
         """Return whether this directory entry is a block device."""
-        return stat.S_ISBLK(self.type)
+        return stat.S_ISBLK(self.type << 12)
 
     def is_character_device(self) -> bool:
         """Return whether this directory entry is a character device."""
-        return stat.S_ISCHR(self.type)
+        return stat.S_ISCHR(self.type << 12)
 
     def is_device(self) -> bool:
         """Return whether this directory entry is a device (block or character)."""
@@ -820,15 +820,15 @@ class DirectoryEntry:
 
     def is_fifo(self) -> bool:
         """Return whether this directory entry is a FIFO."""
-        return stat.S_ISFIFO(self.type)
+        return stat.S_ISFIFO(self.type << 12)
 
     def is_socket(self) -> bool:
         """Return whether this directory entry is a socket."""
-        return stat.S_ISSOCK(self.type)
+        return stat.S_ISSOCK(self.type << 12)
 
     def is_whiteout(self) -> bool:
         """Return whether this directory entry is a whiteout."""
-        return stat.S_ISWHT(self.type)
+        return stat.S_ISWHT(self.type << 12)
 
 
 class XAttr:

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/dissect/apfs/objects/nx_superblock.py

@@ -29,16 +29,8 @@ class NxSuperblock(Object):
     __struct__ = c_apfs.nx_superblock
     object: c_apfs.nx_superblock
 
-    def check(self) -> None:
-        """Check the validity of the superblock."""
-        if not self.is_valid():
-            raise Error("Invalid nx_superblock checksum")
-
-        if self.type != c_apfs.OBJECT_TYPE.NX_SUPERBLOCK:
-            raise Error("Invalid nx_superblock type")
-
-        if not self.is_ephemeral:
-            raise Error("Invalid nx_superblock storage type")
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
 
         if self.object.nx_magic.to_bytes(4, "big") != c_apfs.NX_MAGIC:
             raise Error(
@@ -46,24 +38,6 @@ class NxSuperblock(Object):
                 f"(expected {c_apfs.NX_MAGIC!r}, got {self.object.nx_magic.to_bytes(4, 'big')!r})"
             )
 
-    def compare(self, other: NxSuperblock) -> None:
-        """Compare this superblock to another superblock."""
-        if self.header.o_xid < other.header.o_xid:
-            raise Error("Lower xid than other superblock")
-
-        for attr in (
-            "nx_uuid",
-            "nx_fusion_uuid",
-            "nx_block_size",
-            "nx_block_count",
-            "nx_xp_desc_blocks",
-            "nx_xp_data_blocks",
-            "nx_xp_desc_base",
-            "nx_xp_data_base",
-        ):
-            if getattr(self.object, attr) != getattr(other.object, attr):
-                raise Error(f"Mismatch on {attr}")
-
     @cached_property
     def block_size(self) -> int:
         """The block size of the container."""
@@ -92,20 +66,14 @@ class NxSuperblock(Object):
     @cached_property
     def checkpoint_objects(self) -> list[CheckpointMap | NxSuperblock]:
         """All checkpoint objects in the container."""
-        # TODO: Rework this a bit to be more accurate
-        return list(
-            _read_checkpoint_objects(self.container, self.object.nx_xp_desc_base, self.object.nx_xp_desc_blocks)
-        )
+        return list(_read_checkpoint_objects(self.container, self.object.nx_xp_desc_base, self.object.nx_xp_desc_len))
 
     @cached_property
     def ephemeral_objects(self) -> dict[int, Object]:
         """All ephemeral objects in the container."""
-        # TODO: I don't think this is correct
         return {
             obj.oid: obj
-            for obj in _read_checkpoint_objects(
-                self.container, self.object.nx_xp_data_base, self.object.nx_xp_data_blocks
-            )
+            for obj in _read_checkpoint_objects(self.container, self.object.nx_xp_data_base, self.object.nx_xp_data_len)
         }
 
     @cached_property

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/dissect/apfs/objects/omap.py

@@ -20,15 +20,6 @@ class ObjectMap(Object):
 
         self.lookup = lru_cache(128)(self.lookup)
 
-    def is_valid(self) -> bool:
-        return (
-            super().is_valid()
-            and self.type == c_apfs.OBJECT_TYPE.OMAP
-            and self.subtype == 0
-            and self.is_physical
-            and self.oid == self.address
-        )
-
     @cached_property
     def btree(self) -> BTree:
         """The B-tree of the object map."""

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1/dissect.apfs.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.apfs
-Version: 1.1
+Version: 1.1.dev1
 Summary: A Dissect module implementing a parser for the APFS file system, a commonly used Apple file system
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/dissect.apfs.egg-info/SOURCES.txt

@@ -49,7 +49,6 @@ tests/_data/case_insensitive.bin.gz
 tests/_data/case_insensitive_beta.bin.gz
 tests/_data/case_sensitive.bin.gz
 tests/_data/case_sensitive_beta.bin.gz
-tests/_data/corrupt.bin.gz
 tests/_data/encrypted.bin.gz
 tests/_data/jhfs_converted.bin.gz
 tests/_data/jhfs_encrypted.bin.gz

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/pyproject.toml

@@ -122,3 +122,4 @@ known-third-party = ["dissect"]
 include = ["dissect.*"]
 
 [tool.setuptools_scm]
+local_scheme = "no-local-version"

{dissect_apfs-1.1 → dissect_apfs-1.1.dev1}/tests/test_apfs.py

@@ -6,7 +6,7 @@ from typing import TYPE_CHECKING
 
 import pytest
 
-from dissect.apfs.apfs import APFS, log
+from dissect.apfs.apfs import APFS
 from dissect.apfs.c_apfs import c_apfs
 from tests.conftest import absolute_path
 
@@ -36,11 +36,6 @@ def _assert_apfs_content(volume: FS, beta: bool) -> None:
         ]
     )
 
-    # Test direntry parsing
-    assert node.listdir()["dir"].is_dir()
-    assert node.listdir()["hardlink"].is_file()
-    assert node.listdir()["symlink-dir"].is_symlink()
-
     # Empty file
     node = volume.get("empty")
     assert node.name == "empty"
@@ -245,9 +240,6 @@ def _assert_apfs_content(volume: FS, beta: bool) -> None:
 
     if ".HFS+ Private Directory Data\r" not in volume.get("/").listdir() and not beta:
         # Special files
-        dirents = volume.get("dir").listdir()
-        assert dirents["blockdev"].is_block_device()
-
         node = volume.get("dir/blockdev")
         assert node.name == "blockdev"
         assert node.is_block_device()
@@ -271,8 +263,6 @@ def _assert_apfs_content(volume: FS, beta: bool) -> None:
             "chardev-svr4",
             "chardev-ultrix",
         ]:
-            assert dirents[name].is_character_device()
-
             node = volume.get(f"dir/{name}")
             assert node.name == name
             assert node.is_character_device()
@@ -367,15 +357,3 @@ def test_snapshots() -> None:
         for i, snapshot in enumerate(volume.snapshots):
             assert snapshot.name == f"Snapshot {i}"
             assert snapshot.open().get("file").open().read() == f"Snapshot {i}\n".encode()
-
-
-def test_corrupt_checkpoints(caplog: pytest.LogCaptureFixture) -> None:
-    """Test APFS volumes with corrupt checkpoints."""
-    with gzip.open(absolute_path("_data/corrupt.bin.gz"), "rb") as fh, caplog.at_level("DEBUG", log.name):
-        container = APFS(fh)
-
-        assert container.sb.xid == 302
-        assert len(container.volumes) == 1
-
-    assert caplog.messages[0] == "Skipping superblock xid=304: invalid OMAP"
-    assert caplog.messages[1] == "Skipping superblock xid=303: Invalid nx_superblock checksum"