dissect.database 1.2.dev2__py3-none-any.whl → 1.2.dev4__py3-none-any.whl

dissect/database/ese/ese.py

@@ -10,11 +10,13 @@ from typing import TYPE_CHECKING, BinaryIO
 from dissect.database.ese.c_ese import c_ese, pgnoFDPMSO, ulDAEMagic
 from dissect.database.ese.exception import InvalidDatabase
 from dissect.database.ese.page import Page
-from dissect.database.ese.table import Catalog, Table
+from dissect.database.ese.table import Catalog
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
+    from dissect.database.ese.table import Table
+
 
 class ESE:
     """ESE database class.

dissect/database/ese/lcmapstring.py

@@ -1,6 +1,7 @@
 # Based on Wine source
 # https://github.com/wine-mirror/wine/blob/master/dlls/kernelbase/locale.c
 # http://www.flounder.com/localeexplorer.htm
+from __future__ import annotations
 
 from enum import IntEnum, IntFlag
 

dissect/database/ese/ntds/ntds.py

@@ -1,14 +1,25 @@
 from __future__ import annotations
 
 from typing import TYPE_CHECKING, BinaryIO
+from uuid import UUID
 
 from dissect.database.ese.ntds.database import Database
+from dissect.database.ese.ntds.objects.secret import BackupKey
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
-    from dissect.database.ese.ntds.objects import Computer, DomainDNS, Group, GroupPolicyContainer, Object, Server, User
-    from dissect.database.ese.ntds.objects.trusteddomain import TrustedDomain
+    from dissect.database.ese.ntds.objects import (
+        Computer,
+        DomainDNS,
+        Group,
+        GroupPolicyContainer,
+        Object,
+        Secret,
+        Server,
+        TrustedDomain,
+        User,
+    )
     from dissect.database.ese.ntds.pek import PEK
 
 
@@ -93,3 +104,37 @@ class NTDS:
     def group_policies(self) -> Iterator[GroupPolicyContainer]:
         """Get all group policy objects (GPO) objects from the database."""
         yield from self.search(objectClass="groupPolicyContainer")
+
+    def secrets(self) -> Iterator[Secret]:
+        """Get all secret objects from the database."""
+        yield from self.search(objectClass="secret")
+
+    def backup_keys(self) -> Iterator[BackupKey]:
+        """Get all DPAPI backup keys from the database."""
+        if not self.pek.unlocked:
+            raise ValueError("PEK must be unlocked to retrieve backup keys")
+
+        for secret in self.secrets():
+            if secret.is_phantom or not secret.name.startswith("BCKUPKEY_") or secret.name.startswith("BCKUPKEY_P"):
+                continue
+
+            yield BackupKey(secret)
+
+    def preferred_backup_keys(self) -> Iterator[BackupKey]:
+        """Get preferred DPAPI backup keys from the database."""
+        if not self.pek.unlocked:
+            raise ValueError("PEK must be unlocked to retrieve backup keys")
+
+        # We could do this the proper way (lookup the BCKUPKEY_P* secrets and then directly lookup the
+        # corresponding BCKUPKEY_* secrets), but in practice there are only a few backup keys, so just
+        # filter after the fact
+        preferred_guids = []
+        for secret in self.secrets():
+            if secret.is_phantom or not secret.name.startswith("BCKUPKEY_P"):
+                continue
+
+            preferred_guids.append(UUID(bytes_le=secret.current_value))
+
+        for key in self.backup_keys():
+            if key.guid in preferred_guids:
+                yield key

dissect/database/ese/ntds/objects/object.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from functools import cached_property
 from typing import TYPE_CHECKING, Any, ClassVar
 
-from dissect.database.ese.ntds.util import DN, InstanceType, SystemFlags, decode_value
+from dissect.database.ese.ntds.util import InstanceType, decode_value
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -11,6 +11,7 @@ if TYPE_CHECKING:
 
     from dissect.database.ese.ntds.database import Database
     from dissect.database.ese.ntds.sd import SecurityDescriptor
+    from dissect.database.ese.ntds.util import DN, SystemFlags
     from dissect.database.ese.record import Record
 
 

dissect/database/ese/ntds/objects/secret.py

@@ -1,7 +1,17 @@
 from __future__ import annotations
 
+from functools import cached_property
+from typing import TYPE_CHECKING
+from uuid import UUID
+
+from dissect.util.ts import wintimestamp
+
+from dissect.database.ese.ntds.c_ds import c_ds
 from dissect.database.ese.ntds.objects.leaf import Leaf
 
+if TYPE_CHECKING:
+    from datetime import datetime
+
 
 class Secret(Leaf):
     """Represents a secret object in the Active Directory.
@@ -11,3 +21,79 @@ class Secret(Leaf):
     """
 
     __object_class__ = "secret"
+
+    def __repr_body__(self) -> str:
+        return f"name={self.name!r} last_set_time={self.last_set_time} prior_set_time={self.prior_set_time}"
+
+    @property
+    def current_value(self) -> bytes:
+        """Return the current value of the secret."""
+        return self.get("currentValue")
+
+    @property
+    def last_set_time(self) -> datetime | None:
+        """Return the last set time of the secret."""
+        if (ts := self.get("lastSetTime")) is not None:
+            return wintimestamp(ts)
+        return None
+
+    @property
+    def prior_value(self) -> bytes:
+        """Return the prior value of the secret."""
+        return self.get("priorValue")
+
+    @property
+    def prior_set_time(self) -> datetime | None:
+        """Return the prior set time of the secret."""
+        if (ts := self.get("priorSetTime")) is not None:
+            return wintimestamp(ts)
+        return None
+
+
+class BackupKey:
+    """Represents a DPAPI backup key object in the Active Directory."""
+
+    def __init__(self, secret: Secret):
+        self.secret = secret
+
+    def __repr__(self) -> str:
+        return f"<BackupKey guid={self.guid} version={self.version}>"
+
+    @cached_property
+    def guid(self) -> UUID:
+        """The GUID of the backup key."""
+        return UUID(self.secret.name.removeprefix("BCKUPKEY_").removesuffix(" Secret"))
+
+    @cached_property
+    def version(self) -> int:
+        """The version of the backup key."""
+        return c_ds.DWORD(self.secret.current_value)
+
+    @cached_property
+    def is_legacy(self) -> bool:
+        """Whether the backup key is a legacy key (version 1)."""
+        return self.version == 1
+
+    @cached_property
+    def key(self) -> bytes:
+        """The key bytes of the backup key, for legacy keys (version 1)."""
+        if self.version == 1:
+            return self.secret.current_value[4:]
+        raise TypeError(f"Backup key version {self.version} does not have a single key value")
+
+    @cached_property
+    def private_key(self) -> bytes:
+        """The private key bytes of the backup key, for version 2 keys."""
+        if self.version == 2:
+            private_length = c_ds.DWORD(self.secret.current_value[4:8])
+            return self.secret.current_value[12 : 12 + private_length]
+        raise TypeError(f"Backup key version {self.version} does not have a private key value")
+
+    @cached_property
+    def public_key(self) -> bytes:
+        """The public key bytes of the backup key, for version 2 keys."""
+        if self.version == 2:
+            private_length = c_ds.DWORD(self.secret.current_value[4:8])
+            public_length = c_ds.DWORD(self.secret.current_value[8:12])
+            return self.secret.current_value[12 + private_length : 12 + private_length + public_length]
+        raise TypeError(f"Backup key version {self.version} does not have a public key value")

dissect/database/ese/ntds/objects/user.py

@@ -3,13 +3,14 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 from dissect.database.ese.ntds.objects.organizationalperson import OrganizationalPerson
-from dissect.database.ese.ntds.util import SAMAccountType, UserAccountControl
+from dissect.database.ese.ntds.util import UserAccountControl
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
     from dissect.database.ese.ntds.objects.group import Group
     from dissect.database.ese.ntds.objects.object import Object
+    from dissect.database.ese.ntds.util import SAMAccountType
 
 
 class User(OrganizationalPerson):

dissect/database/ese/ntds/schema.py

@@ -198,7 +198,6 @@ class Schema:
         Args:
             db: The database instance to load the schema from.
         """
-
         # Load the schema entries from the DMD object
         # This _should_ have all the attribute and class schema entries
         # We used to perform an index search on objectClass (ATTc0, INDEX_00000000), but apparently

dissect/database/ese/table.py

@@ -14,7 +14,7 @@ from dissect.database.ese.c_ese import (
 from dissect.database.ese.cursor import RawCursor
 from dissect.database.ese.index import Index
 from dissect.database.ese.record import Record
-from dissect.database.ese.util import COLUMN_TYPE_MAP, ColumnType, RecordValue
+from dissect.database.ese.util import COLUMN_TYPE_MAP
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -22,6 +22,7 @@ if TYPE_CHECKING:
     from dissect.database.ese.cursor import Cursor
     from dissect.database.ese.ese import ESE
     from dissect.database.ese.page import Page
+    from dissect.database.ese.util import ColumnType, RecordValue
 
 
 class Table:

dissect/database/ese/tools/sru.py

@@ -9,11 +9,12 @@ from dissect.util.sid import read_sid
 from dissect.util.ts import oatimestamp, wintimestamp
 
 from dissect.database.ese.ese import ESE
-from dissect.database.ese.record import Record, serialise_record_column_values
+from dissect.database.ese.record import serialise_record_column_values
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
+    from dissect.database.ese.record import Record
     from dissect.database.ese.table import Table
     from dissect.database.ese.util import RecordValue
 

dissect/database/ese/tools/ual.py

@@ -1,17 +1,22 @@
+from __future__ import annotations
+
 import argparse
 import datetime
 import ipaddress
 import json
-from collections.abc import Iterator
 from pathlib import Path
-from typing import BinaryIO
+from typing import TYPE_CHECKING, BinaryIO
 
 from dissect.util.ts import wintimestamp
 
 from dissect.database.ese.ese import ESE
-from dissect.database.ese.table import Table
 from dissect.database.ese.util import RecordValue
 
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.database.ese.table import Table
+
 UalValue = RecordValue | ipaddress.IPv4Address | ipaddress.IPv6Interface | tuple[datetime.datetime]
 
 SKIP_TABLES = [

dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py

@@ -178,7 +178,6 @@ class SQLCipherStream(AlignedStream):
 
     def _read(self, offset: int, length: int) -> bytes:
         """Calculates which pages to read from based on the given offset and length. Returns decrypted bytes."""
-
         start_page = offset // self.align
         num_pages = length // self.align
         return b"".join(
@@ -191,7 +190,6 @@ class SQLCipherStream(AlignedStream):
         References:
             - https://github.com/sqlcipher/sqlcipher-tools/blob/master/decrypt.c
         """
-
         if page_num < 1:
             raise ValueError("The first page number is 1")
 
@@ -294,7 +292,6 @@ class SQLCipher1(SQLCipher):
 
 def derive_key(passphrase: bytes, salt: bytes, kdf_iter: int, kdf_algo: str | None) -> bytes:
     """Derive the database key as SQLCipher would using PBKDF2."""
-
     if not kdf_iter or not kdf_algo:
         return passphrase
 

dissect/database/sqlite3/sqlite3.py

@@ -15,7 +15,7 @@ from dissect.database.sqlite3.exception import (
     NoCellData,
 )
 from dissect.database.sqlite3.util import parse_table_columns_constraints
-from dissect.database.sqlite3.wal import WAL, Checkpoint
+from dissect.database.sqlite3.wal import WAL
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -23,6 +23,8 @@ if TYPE_CHECKING:
 
     from typing_extensions import Self
 
+    from dissect.database.sqlite3.wal import Checkpoint
+
 ENCODING = {
     1: "utf-8",
     2: "utf-16-le",
@@ -259,7 +261,7 @@ class Column:
         self.default_value = self._parse_default_value_from_description(description)
 
     def _parse_default_value_from_description(self, description: str) -> bool | str | int | float | None:
-        """Find the default from the description string"""
+        """Find the default from the description string."""
         if "DEFAULT" not in description.upper():
             return None
 
@@ -275,14 +277,13 @@ class Column:
         return [x for x in tokens if x and x != " "]
 
     def _get_default_value(self, tokens: list[str]) -> str:
-        """Retrieve the default from the tokens"""
-
+        """Retrieve the default from the tokens."""
         # The +1 is to account for the space after the default
         value_index = [x.upper() for x in tokens].index("DEFAULT") + 1
         return tokens[value_index]
 
     def _parse_default_value(self, value: str) -> bool | str | int | float | None:
-        """Parses the default value
+        """Parses the default value.
 
         The value can hold an expression surrounded by ().
         This can be a literal, so these values get stripped.
@@ -293,7 +294,7 @@ class Column:
             return None
 
     def _parse_literal(self, value: str) -> bool | str | int | float:
-        """Tries to convert a literal from a string to any type
+        """Tries to convert a literal from a string to any type.
 
         CURRENT_(TIME|DATE|TIMESTAMP) isn't being taken into account.
         """
@@ -385,7 +386,6 @@ class Row:
         If there are any cell values with unknown column names
         they get added to the unknown list.
         """
-
         row_values = {}
         unknowns = []
 

dissect/database/sqlite3/util.py

@@ -109,7 +109,6 @@ def parse_table_columns_constraints(sql: str) -> tuple[str | None, list[str], li
 
 def split_column_def(sql: str, column_def: str) -> tuple[str, str]:
     """Splits the column definition to name and constraint."""
-
     column_parts = column_def.split(maxsplit=1)
     if not column_parts:
         raise InvalidSQL(f"Not a valid CREATE TABLE definition: empty column definition in {sql!r}")

{dissect_database-1.2.dev2.dist-info → dissect_database-1.2.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.database
-Version: 1.2.dev2
+Version: 1.2.dev4
 Summary: A Dissect module implementing parsers for various database formats, including Berkeley DB, Microsofts Extensible Storage Engine (ESE) and SQLite3
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: Apache-2.0

{dissect_database-1.2.dev2.dist-info → dissect_database-1.2.dev4.dist-info}/RECORD

@@ -13,14 +13,14 @@ dissect/database/ese/c_ese.py,sha256=kcn2GHTQ_fijY1CEX4gtNAUeTvu5feR-ya4C2_BzTpk
 dissect/database/ese/c_ese.pyi,sha256=v-h3If5kUxS8HN8G23m6AHbIQUoGHQ2XZih4zurxWTM,18874
 dissect/database/ese/compression.py,sha256=lLrriyvVjUuDEibUl_ECYVfvqmeU9ijKIaBnx38m98Q,2027
 dissect/database/ese/cursor.py,sha256=ju-mUewhW22bVW0MMdsaKolKCiKnztRcyU0nJw5bNOg,14346
-dissect/database/ese/ese.py,sha256=cFW2KYXoZ6ca6S-XzziwHEjXN22aP9VWtG2EaIgssFI,3500
+dissect/database/ese/ese.py,sha256=CAObzKZSbMR47Lub8Fh6u9aG-MZqTSaX-m4S2UWrhX4,3543
 dissect/database/ese/exception.py,sha256=09xbltclWIBsGbk8Ry8RlKG-OwGSQvyLKsgj0d98T0k,210
 dissect/database/ese/index.py,sha256=dYngAWmmX7X8lkP2_q3vgBm1woXYfwtTIOsWORmM2Q0,9859
-dissect/database/ese/lcmapstring.py,sha256=ni_S4xXGCsJg9AIRVTyVWK0JoZbVzL8ocZ1eacnl9cQ,7004
+dissect/database/ese/lcmapstring.py,sha256=sI0jnSHnuCYwXS3YqBruGixlHXm44L3au5llR2Ash4s,7039
 dissect/database/ese/page.py,sha256=TbR_pGBKCaYag1SBAYtcQp8EnGOw3QRp3tLMNeuVdCM,8325
 dissect/database/ese/record.py,sha256=DKBwkyuszsuUaBgu3iD41cidmw4GEpaoNNKPhI0Tnxg,19723
 dissect/database/ese/sorting_table.py,sha256=NsBchm4-XxyDKZrdt2M_wMuGELUQed5osKbv1RxmIbk,819383
-dissect/database/ese/table.py,sha256=kIgUp2VuUOO_irmpGpP9uepgYdmoL2agfeClnYNpk0Q,13311
+dissect/database/ese/table.py,sha256=BpaI2WHXvXnoe46bumkZn5_HyGqtl0jAnyinrqo81zA,13352
 dissect/database/ese/util.py,sha256=5ZWurLGHahG4LL4iXpYCK9kbMLr53dVh18f1Ox9YHlA,3044
 dissect/database/ese/ntds/__init__.py,sha256=Fu6_i_7fAlDfJoOgbpsVlPxM4CXpDCNtXmgzNzkmesY,264
 dissect/database/ese/ntds/c_ds.py,sha256=ZaWdEcpJPJrRjiJFhi1s5KlOIVj0yoix4XAh-D31uLU,3055
@@ -30,10 +30,10 @@ dissect/database/ese/ntds/c_pek.pyi,sha256=lHfhvHWABT1vLmknu66phOXsylgwzGIWVdbqD
 dissect/database/ese/ntds/c_sd.py,sha256=DYICZsWCBzj0OtvhO6vhzzVjK9YP6tzBCsgKgr0pc-k,4294
 dissect/database/ese/ntds/c_sd.pyi,sha256=7717Y0EBVu37Liu26rqsDWkLIdSCqWn9KK9svtniLqY,5279
 dissect/database/ese/ntds/database.py,sha256=rKHdbQObLp9vSV2gquGZ_RBnIY5Y-2hACIe_atTvxbY,16189
-dissect/database/ese/ntds/ntds.py,sha256=UKJnfHrnqEoHnO_HS-ircUtjkjpO9vmLmLjRMW9u6Tk,3548
+dissect/database/ese/ntds/ntds.py,sha256=qvyDsjHs1WyGbDccOtO5XXcvlKH6rkMnaW6KRxd9264,5080
 dissect/database/ese/ntds/pek.py,sha256=BEmxO175T8QkGVvFQLN9MI9uDCcK4jztuZetbwbbYqU,4154
 dissect/database/ese/ntds/query.py,sha256=orTuXH5jXYUVUVL6PtD9rOcdfCKHjOS-D8RzUMEl0sk,7972
-dissect/database/ese/ntds/schema.py,sha256=EbJYKvixpw7rUZgUxxNFjCvzYLufkwNVVGWI-qSGT1A,16660
+dissect/database/ese/ntds/schema.py,sha256=1M0t5qDAcDOdY4MzAE5cLz4klDCTxrxa0Z9hIDFUCvw,16659
 dissect/database/ese/ntds/sd.py,sha256=Y-oYnJPcLMDB_4X8TLEGtt-n_nC4HLA0WqIS8qYAwAs,5995
 dissect/database/ese/ntds/util.py,sha256=mx_b-_mIINR1Mn01rH7bR4CeY0gl0gnkD2gjeMeiAU8,18348
 dissect/database/ese/ntds/objects/__init__.py,sha256=3lI4f0SwILAY4zJRDVtJpe9YaxKspR-1kHXnhpw91e4,10739
@@ -115,7 +115,7 @@ dissect/database/ese/ntds/objects/ntdsdsa.py,sha256=HJRbkL8vGeM0sjADYzxsUcfKCram
 dissect/database/ese/ntds/objects/ntdsservice.py,sha256=mTdpd2tzm8OOiGm6rJN35_dyeWtvzPYI_rVDBZz0gNc,326
 dissect/database/ese/ntds/objects/ntdssitesettings.py,sha256=VNlke-Vgxjh0fzd5o2X-4fwCBrkEI1coR4oto5OenPo,709
 dissect/database/ese/ntds/objects/ntfrssettings.py,sha256=PwIKT6t_zRxfdacWuvzMfq_mIhj_wyIhHzORNcF2eOU,745
-dissect/database/ese/ntds/objects/object.py,sha256=aZ9HpARfPS9q4yP2uU96HYJPIkfGzehjFsGAkpZeBIQ,9951
+dissect/database/ese/ntds/objects/object.py,sha256=MQpHca7ev0oGsEC03DYbGptJUoVNK9sDIMBmUDjrDms,9997
 dissect/database/ese/ntds/objects/organizationalperson.py,sha256=X4QHT9AeGU7mDtIPlZbkhs1v2ZCPEarehFyn5EFszdY,559
 dissect/database/ese/ntds/objects/organizationalunit.py,sha256=H_VHrUgN92cXgGoV3ngiV4HjSaDndSUkQSjcNmb7WFs,715
 dissect/database/ese/ntds/objects/person.py,sha256=s67VHtsyN5t8icU9adPTLGcrIMH14yrEY1VqUqSw3Do,304
@@ -128,7 +128,7 @@ dissect/database/ese/ntds/objects/ridset.py,sha256=xpmfNsqKwSIL4D9bNvaOokbz-95bc
 dissect/database/ese/ntds/objects/rpccontainer.py,sha256=DWbV0h3te72VhxZHPX3kk52u0omOUwUzzjy0Q1th4sY,311
 dissect/database/ese/ntds/objects/rrasadministrationdictionary.py,sha256=dzS3xagmCx612jk5hg4YggJRPkpSYw85Z2Vhn0F1N10,390
 dissect/database/ese/ntds/objects/samserver.py,sha256=q32pI-Pjd1TOQle_LuR53rjZlDjCY2U2aAYCWjLEaDg,348
-dissect/database/ese/ntds/objects/secret.py,sha256=sQtKTPHHiGgaKnugdlkDzhRfISUePkOoPrd-AeQ2FFs,307
+dissect/database/ese/ntds/objects/secret.py,sha256=0278o0wpy3n5JmhYKFpNDy1MgNcHBbjX0aUYXxeCUlQ,3392
 dissect/database/ese/ntds/objects/securityobject.py,sha256=hR0a0wjyrLFtSMtRZOwPCYXpfuOCtNMhozK4bkzly-A,330
 dissect/database/ese/ntds/objects/server.py,sha256=oCbwfzW7TQm3nSWD4KuWVzhOYnZXFyq6NZ2KuVB2-Wc,652
 dissect/database/ese/ntds/objects/serverscontainer.py,sha256=NnJ0M23RO-hsKd2vWcvViOMRV8psGJkwiaRC-ghmrk0,345
@@ -139,29 +139,29 @@ dissect/database/ese/ntds/objects/subnetcontainer.py,sha256=IEwSBFxoPXBIKuH-V7rK
 dissect/database/ese/ntds/objects/subschema.py,sha256=-vE76P_Yhj-Ny6ZAYnTTPMS0dtLNFZRUgyh9IXIm5Po,317
 dissect/database/ese/ntds/objects/top.py,sha256=1oPtivWGki1lfElWMs57zZ05g6dbWSa77A77ytf7hWs,527
 dissect/database/ese/ntds/objects/trusteddomain.py,sha256=J-besYk7tF3vxbJC3PogDk3iduBp_86A2SHA0LJQFb8,336
-dissect/database/ese/ntds/objects/user.py,sha256=RVpOJs4qxCd9x_T9PclZu6P4Yv-XS0n7ETehXsoS8po,2569
+dissect/database/ese/ntds/objects/user.py,sha256=wuCViCevxboNXdkojQuKzaqWYnEz7k7Y017LisdAFOQ,2615
 dissect/database/ese/ntds/tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/database/ese/ntds/tools/ntds.py,sha256=6hgpoSr-QKgbz8ABkYsM-MZf6kkH_nlJbz_BCqbrGzE,861
 dissect/database/ese/tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/database/ese/tools/certlog.py,sha256=7ZHq9b1_WLzUtgZf9XIoIc-9Jogx_VAoY1ha1FL696Q,5918
 dissect/database/ese/tools/impacket.py,sha256=SfMJoq7EcA8DxjD3zyNin0at9_jSlgzAQFgcywBTVZ4,2354
-dissect/database/ese/tools/sru.py,sha256=gp21wajecjZY3-jFHXoBKrQA_j46uCW5jc_Ube97ln4,6247
-dissect/database/ese/tools/ual.py,sha256=2KyVTC4wvqsNUGrJ3GCZGOMgMksw0nL7oB3aHyIv_FY,3310
+dissect/database/ese/tools/sru.py,sha256=qWhYoTuEL7Rzj427PcyvbqAn8uhpaEPnW6TJeJTVoh4,6290
+dissect/database/ese/tools/ual.py,sha256=YHI4hJjtCP9OugSe6DkTz7zWibPKZkUMBPei4eKzvEs,3389
 dissect/database/sqlite3/__init__.py,sha256=LIQQsLcZUMHAGzt_6rPDd1HSDXA6qcFyyvpufqdQLQA,492
 dissect/database/sqlite3/c_sqlite3.py,sha256=rFUlUi0ZfUq4kKEyOLB6-E9SxWwIU4I8-pMCNTdR7l0,1883
 dissect/database/sqlite3/c_sqlite3.pyi,sha256=49_sw1wNaNF3aqSRS_13SAk0i-9X6Eis1szb9oN7Wsk,5699
 dissect/database/sqlite3/exception.py,sha256=xYdpjNV8i5KsjliEveB7gcg3DRJlSYCYhK3kOuN2wtE,319
-dissect/database/sqlite3/sqlite3.py,sha256=_KqVVgKUN-tyQ3QpYJtvZEBVjNQgFvCNt-0qIMWgwB0,21970
-dissect/database/sqlite3/util.py,sha256=rWS1qgfqbiynUkxs81SHZT6HtOrgJpbROOAgZR095S0,5009
+dissect/database/sqlite3/sqlite3.py,sha256=M3dhEMWlg2W8elzw9IZR1BJWD2cM9Q7GAT9VteZ2-po,22017
+dissect/database/sqlite3/util.py,sha256=Xif-MfjReWZSsOzMC_2KI-4a0iVVTwmF_eObdIoEBHM,5008
 dissect/database/sqlite3/wal.py,sha256=HilseiVoKauqiDQ00wpcOFKB69YMNFzXS9Va9dDRMj0,6227
 dissect/database/sqlite3/encryption/__init__.py,sha256=kJdFWXD9Z_O_QipC-_A9dlVfR6AOPSOoT8WBhpFbSsE,238
 dissect/database/sqlite3/encryption/sqlcipher/__init__.py,sha256=kJdFWXD9Z_O_QipC-_A9dlVfR6AOPSOoT8WBhpFbSsE,238
 dissect/database/sqlite3/encryption/sqlcipher/exception.py,sha256=GKNtzcnAKlWkvjLluruA8LfzCwjRRWubibbH8WM9l2o,121
-dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py,sha256=YK6pTzbRl_c7ura5nY_vUAdM28s7KhNj6LMxCR-AkAY,11220
-dissect_database-1.2.dev2.dist-info/licenses/COPYRIGHT,sha256=pFH-OBYz6Xj23UB0Odz5IhoTR8nsTbJQNlCRV_wMaiE,317
-dissect_database-1.2.dev2.dist-info/licenses/LICENSE,sha256=PhUqiw6jAh2KbBdVRPBq_hfAvfcTBin7nZ3CK7NQbTM,11341
-dissect_database-1.2.dev2.dist-info/METADATA,sha256=tv1ywwLkuTmIaWFVJCymTIPYDDeUe7AqXi_H-LjFW5k,5540
-dissect_database-1.2.dev2.dist-info/WHEEL,sha256=YCfwYGOYMi5Jhw2fU4yNgwErybb2IX5PEwBKV4ZbdBo,91
-dissect_database-1.2.dev2.dist-info/entry_points.txt,sha256=ZVVKj3Nzjkgm1kBXGWyGNVUJzTbmVgivv9lgFcuLkpk,343
-dissect_database-1.2.dev2.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect_database-1.2.dev2.dist-info/RECORD,,
+dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py,sha256=y_oJRKZqoJBeOQaBbniesZKm1sVTFvXZ466rJYZj2xE,11217
+dissect_database-1.2.dev4.dist-info/licenses/COPYRIGHT,sha256=pFH-OBYz6Xj23UB0Odz5IhoTR8nsTbJQNlCRV_wMaiE,317
+dissect_database-1.2.dev4.dist-info/licenses/LICENSE,sha256=PhUqiw6jAh2KbBdVRPBq_hfAvfcTBin7nZ3CK7NQbTM,11341
+dissect_database-1.2.dev4.dist-info/METADATA,sha256=6voYg3J9Spss_LphuTB00X7TrRUnZl2xkMA_GKlP0Uk,5540
+dissect_database-1.2.dev4.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+dissect_database-1.2.dev4.dist-info/entry_points.txt,sha256=ZVVKj3Nzjkgm1kBXGWyGNVUJzTbmVgivv9lgFcuLkpk,343
+dissect_database-1.2.dev4.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect_database-1.2.dev4.dist-info/RECORD,,

{dissect_database-1.2.dev2.dist-info → dissect_database-1.2.dev4.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (82.0.0)
+Generator: setuptools (82.0.1)
 Root-Is-Purelib: true
 Tag: py3-none-any