dissect.target 3.16.dev39__tar.gz → 3.16.dev43__tar.gz

{dissect.target-3.16.dev39/dissect.target.egg-info → dissect.target-3.16.dev43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev39
+Version: 3.16.dev43
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -63,7 +63,7 @@ Requires-Dist: dissect.target[full]; extra == "smb"
 Requires-Dist: impacket==0.10.0; extra == "smb"
 Provides-Extra: cb
 Requires-Dist: dissect.target[full]; extra == "cb"
-Requires-Dist: carbon-black-cloud-sdk-python~=1.4.3; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
 
 # dissect.target
 

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/dissect/target/helpers/fsutil.py

@@ -16,23 +16,23 @@ from typing import Any, BinaryIO, Iterator, Optional, Sequence, TextIO, Union
 try:
     import lzma
 
-    HAVE_XZ = True
+    HAS_XZ = True
 except ImportError:
-    HAVE_XZ = False
+    HAS_XZ = False
 
 try:
     import bz2
 
-    HAVE_BZ2 = True
+    HAS_BZ2 = True
 except ImportError:
-    HAVE_BZ2 = False
+    HAS_BZ2 = False
 
 try:
     import zstandard
 
-    HAVE_ZSTD = True
+    HAS_ZSTD = True
 except ImportError:
-    HAVE_ZSTD = False
+    HAS_ZSTD = False
 
 import dissect.target.filesystem as filesystem
 from dissect.target.exceptions import FileNotFoundError, SymlinkRecursionError
@@ -511,14 +511,14 @@ def open_decompress(
     if magic[:2] == b"\x1f\x8b":
         return gzip.open(file, mode, encoding=encoding, errors=errors, newline=newline)
 
-    if HAVE_XZ and magic[:5] == b"\xfd7zXZ":
+    if HAS_XZ and magic[:5] == b"\xfd7zXZ":
         return lzma.open(file, mode, encoding=encoding, errors=errors, newline=newline)
 
-    if HAVE_BZ2 and magic[:3] == b"BZh" and 0x31 <= magic[3] <= 0x39:
+    if HAS_BZ2 and magic[:3] == b"BZh" and 0x31 <= magic[3] <= 0x39:
         # In a valid bz2 header the 4th byte is in the range b'1' ... b'9'.
         return bz2.open(file, mode, encoding=encoding, errors=errors, newline=newline)
 
-    if HAVE_ZSTD and magic[:4] in [b"\xfd\x2f\xb5\x28", b"\x28\xb5\x2f\xfd"]:
+    if HAS_ZSTD and magic[:4] in [b"\xfd\x2f\xb5\x28", b"\x28\xb5\x2f\xfd"]:
         # stream_reader is not seekable, so we have to resort to the less
         # efficient decompressor which returns bytes.
         return io.BytesIO(zstandard.decompress(file.read()))

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/dissect/target/loaders/dir.py

@@ -34,12 +34,12 @@ def find_entry_path(path: Path) -> str | None:
             return prefix
 
 
-def map_dirs(target: Target, dirs: list[Path], os_type: str, **kwargs) -> None:
+def map_dirs(target: Target, dirs: list[Path | tuple[str, Path]], os_type: str, **kwargs) -> None:
     """Map directories as filesystems into the given target.
 
     Args:
         target: The target to map into.
-        dirs: The directories to map as filesystems.
+        dirs: The directories to map as filesystems. If a list member is a tuple, the first element is the drive letter.
         os_type: The operating system type, used to determine how the filesystem should be mounted.
     """
     alt_separator = ""
@@ -49,6 +49,12 @@ def map_dirs(target: Target, dirs: list[Path], os_type: str, **kwargs) -> None:
         case_sensitive = False
 
     for path in dirs:
+        drive_letter = None
+        if isinstance(path, tuple):
+            drive_letter, path = path
+        elif is_drive_letter_path(path):
+            drive_letter = path.name[0]
+
         if isinstance(path, zipfile.Path):
             dfs = ZipFilesystem(path.root.fp, path.at, alt_separator=alt_separator, case_sensitive=case_sensitive)
         else:
@@ -58,8 +64,8 @@ def map_dirs(target: Target, dirs: list[Path], os_type: str, **kwargs) -> None:
         if os_type == OperatingSystem.WINDOWS:
             loaderutil.add_virtual_ntfs_filesystem(target, dfs, **kwargs)
 
-            if is_drive_letter_path(path):
-                target.fs.mount(path.name[0] + ":", dfs)
+            if drive_letter is not None:
+                target.fs.mount(drive_letter.lower() + ":", dfs)
 
 
 def find_and_map_dirs(target: Target, path: Path, **kwargs) -> None:

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/dissect/target/loaders/velociraptor.py

@@ -43,6 +43,8 @@ def find_fs_directories(path: Path) -> tuple[Optional[OperatingSystem], Optional
                 # https://github.com/Velocidex/velociraptor/blob/87368e7cc678144592a1614bb3bbd0a0f900ded9/accessors/ntfs/vss.go#L82
                 if "HarddiskVolumeShadowCopy" in volume.name:
                     vss_volumes.add(volume)
+                elif (drive_letter := extract_drive_letter(volume.name)) is not None:
+                    volumes.add((drive_letter, volume))
                 else:
                     volumes.add(volume)
 
@@ -54,6 +56,12 @@ def find_fs_directories(path: Path) -> tuple[Optional[OperatingSystem], Optional
     return None, None
 
 
+def extract_drive_letter(name: str) -> Optional[str]:
+    # \\.\X: in URL encoding
+    if len(name) == 14 and name.startswith("%5C%5C.%5C") and name.endswith("%3A"):
+        return name[10].lower()
+
+
 class VelociraptorLoader(DirLoader):
     """Load Rapid7 Velociraptor forensic image files.
 

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/dissect/target/tools/reg.py

@@ -3,10 +3,16 @@
 from __future__ import print_function
 
 import argparse
+import itertools
 import logging
 
 from dissect.target import Target
-from dissect.target.exceptions import RegistryError, TargetError
+from dissect.target.exceptions import (
+    RegistryError,
+    RegistryKeyNotFoundError,
+    TargetError,
+)
+from dissect.target.helpers.regutil import RegistryKey
 from dissect.target.tools.utils import (
     catch_sigpipe,
     configure_generic_arguments,
@@ -29,7 +35,8 @@ def main():
     parser.add_argument("targets", metavar="TARGETS", nargs="+", help="Targets to load")
     parser.add_argument("-k", "--key", required=True, help="key to query")
     parser.add_argument("-kv", "--value", help="value to query")
-    parser.add_argument("-d", "--depth", type=int, const=0, nargs="?", default=1)
+    parser.add_argument("-d", "--depth", type=int, const=0, nargs="?", default=1, help="max depth of subkeys to print")
+    parser.add_argument("-l", "--length", type=int, default=100, help="max length of key value to print")
 
     configure_generic_arguments(parser)
     args = parser.parse_args()
@@ -38,34 +45,50 @@ def main():
 
     try:
         for target in Target.open_all(args.targets):
+            if not target.has_function("registry"):
+                target.log.error("Target has no Windows Registry")
+                continue
+
             try:
-                if args.value:
-                    for key in target.registry.keys(args.key):
-                        try:
-                            print(key.value(args.value))
-                        except RegistryError:
-                            continue
-                else:
+                keys = target.registry.keys(args.key)
+                first_key = next(keys)
+
+                print(target)
+
+                for key in itertools.chain([first_key], keys):
                     try:
-                        print(target)
-                        for key in target.registry.keys(args.key):
-                            recursor(key, args.depth, 0)
+                        if args.value:
+                            print(key.value(args.value))
+                        else:
+                            recursor(key, args.depth, 0, args.length)
                     except RegistryError:
                         log.exception("Failed to find registry value")
-            except Exception:
-                log.exception("Failed to iterate key")
+
+            except (RegistryKeyNotFoundError, StopIteration):
+                target.log.error("Key %r does not exist", args.key)
+
+            except Exception as e:
+                target.log.error("Failed to iterate key: %s", e)
+                target.log.debug("", exc_info=e)
     except TargetError as e:
         log.error(e)
         log.debug("", exc_info=e)
         parser.exit(1)
 
 
-def recursor(key, depth, indent):
-    print(" " * indent + f"+ {key.name!r} ({key.ts})")
+def recursor(key: RegistryKey, depth: int, indent: int, max_length: int = 100) -> None:
+    class_name = ""
+    if key.class_name:
+        class_name = f" ({key.class_name})"
+
+    print(" " * indent + f"+ {key.name!r} ({key.ts})" + class_name)
 
     for r in key.values():
         try:
-            print(" " * indent + f"  - {r.name!r} {repr(r.value)[:100]}")
+            value = repr(r.value)
+            if len(value) > max_length:
+                value = value[:max_length] + "..."
+            print(" " * indent + f"  - {r.name!r} {value}")
         except NotImplementedError:
             continue
 
@@ -73,7 +96,7 @@ def recursor(key, depth, indent):
         return
 
     for subkey in key.subkeys():
-        recursor(subkey, depth - 1, indent + 2)
+        recursor(subkey, depth - 1, indent + 2, max_length)
 
 
 if __name__ == "__main__":

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev39
+Version: 3.16.dev43
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -63,7 +63,7 @@ Requires-Dist: dissect.target[full]; extra == "smb"
 Requires-Dist: impacket==0.10.0; extra == "smb"
 Provides-Extra: cb
 Requires-Dist: dissect.target[full]; extra == "cb"
-Requires-Dist: carbon-black-cloud-sdk-python~=1.4.3; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
 
 # dissect.target
 

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/dissect.target.egg-info/SOURCES.txt

@@ -560,6 +560,7 @@ tests/tools/test_dump.py
 tests/tools/test_fs.py
 tests/tools/test_mount.py
 tests/tools/test_query.py
+tests/tools/test_reg.py
 tests/tools/test_shell.py
 tests/tools/test_utils.py
 tests/volumes/__init__.py

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/dissect.target.egg-info/requires.txt

@@ -12,7 +12,7 @@ structlog
 
 [cb]
 dissect.target[full]
-carbon-black-cloud-sdk-python~=1.4.3
+carbon-black-cloud-sdk~=1.4.3
 
 [full]
 asn1crypto

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/pyproject.toml

@@ -88,7 +88,7 @@ smb = [
 cb = [
     # Grab the dependencies for dissect.target
     "dissect.target[full]",
-    "carbon-black-cloud-sdk-python~=1.4.3"
+    "carbon-black-cloud-sdk~=1.4.3"
 ]
 
 [project.scripts]

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/tests/loaders/test_kape.py

@@ -25,8 +25,15 @@ def test_kape_loader(target_bare, tmp_path):
 
     loader = KapeLoader(root)
     loader.map(target_bare)
+    target_bare.apply()
+
+    assert "sysvol" in target_bare.fs.mounts
+    assert "c:" in target_bare.fs.mounts
+    assert "d:" in target_bare.fs.mounts
+    assert "e:" in target_bare.fs.mounts
 
     # The 3 found drive letter directories + the fake NTFS filesystem
     assert len(target_bare.filesystems) == 4
-    assert len(target_bare.fs.mounts) == 3
-    assert len(list(target_bare.fs.mounts["C:"].ntfs.usnjrnl.records())) == 1
+    # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$
+    assert len(target_bare.fs.mounts) == 5
+    assert len(list(target_bare.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/tests/loaders/test_tanium.py

@@ -25,8 +25,15 @@ def test_tanium_loader(target_bare, tmp_path):
 
     loader = TaniumLoader(root)
     loader.map(target_bare)
+    target_bare.apply()
+
+    assert "sysvol" in target_bare.fs.mounts
+    assert "c:" in target_bare.fs.mounts
+    assert "d:" in target_bare.fs.mounts
+    assert "e:" in target_bare.fs.mounts
 
     # The 3 found drive letter directories + the fake NTFS filesystem
     assert len(target_bare.filesystems) == 4
-    assert len(target_bare.fs.mounts) == 3
-    assert len(list(target_bare.fs.mounts["C:"].ntfs.usnjrnl.records())) == 1
+    # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$
+    assert len(target_bare.fs.mounts) == 5
+    assert len(list(target_bare.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/tests/loaders/test_velociraptor.py

@@ -55,6 +55,9 @@ def test_velociraptor_loader_windows_ntfs(sub_dir: str, target_bare: Target, tmp
     loader.map(target_bare)
     target_bare.apply()
 
+    assert "sysvol" in target_bare.fs.mounts
+    assert "c:" in target_bare.fs.mounts
+
     usnjrnl_records = 0
     for fs in target_bare.filesystems:
         if isinstance(fs, NtfsFilesystem):
@@ -80,6 +83,9 @@ def test_velociraptor_loader_windows_ntfs_zip(sub_dir: str, target_bare: Target,
     loader.map(target_bare)
     target_bare.apply()
 
+    assert "sysvol" in target_bare.fs.mounts
+    assert "c:" in target_bare.fs.mounts
+
     usnjrnl_records = 0
     for fs in target_bare.filesystems:
         if isinstance(fs, NtfsFilesystem):

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/tests/plugins/os/windows/test_sam.py

@@ -8,15 +8,15 @@ try:
 
     from dissect.target.plugins.os.windows.sam import SamPlugin
 
-    HAVE_CRYPTO = True
+    HAS_CRYPTO = True
 except ImportError:
-    HAVE_CRYPTO = False
+    HAS_CRYPTO = False
 
 SAM_KEY_PATH = "SAM\\SAM\\Domains\\Account"
 SYSTEM_KEY_PATH = "SYSTEM\\ControlSet001\\Control\\LSA"
 
 
-@pytest.mark.skipif(not HAVE_CRYPTO, reason="requires pycryptodome")
+@pytest.mark.skipif(not HAS_CRYPTO, reason="requires pycryptodome")
 def test_sam_plugin_rev1(target_win_users, hive_hklm):
     sam_key = VirtualKey(hive_hklm, SAM_KEY_PATH)
     sam_key.add_value(
@@ -143,7 +143,7 @@ def test_sam_plugin_rev1(target_win_users, hive_hklm):
     assert results[2].nt == MD4.new("L0ngLiv3LM!".encode("utf-16-le")).digest().hex()
 
 
-@pytest.mark.skipif(not HAVE_CRYPTO, reason="requires pycryptodome")
+@pytest.mark.skipif(not HAS_CRYPTO, reason="requires pycryptodome")
 def test_sam_plugin_rev2(target_win_users, hive_hklm):
     sam_key = VirtualKey(hive_hklm, SAM_KEY_PATH)
     sam_key.add_value(

dissect.target-3.16.dev43/tests/tools/test_reg.py

@@ -0,0 +1,81 @@
+from typing import Iterator
+from unittest.mock import patch
+
+import pytest
+from _pytest.fixtures import FixtureRequest
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.windows.registry import RegistryPlugin
+from dissect.target.tools.reg import main as target_reg
+from tests._utils import absolute_path
+
+
+@pytest.fixture
+def target_win_reg(target_win: Target, fs_win: VirtualFilesystem) -> Iterator[Target]:
+    fs_win.map_file("Windows/System32/config/SYSTEM", absolute_path("_data/tools/reg/SYSTEM.gz"), "gzip")
+    target_win.apply()
+    target_win.add_plugin(RegistryPlugin)
+    yield target_win
+
+
+@pytest.mark.parametrize(
+    "provided_target, provided_key, arg_depth, arg_length, expected_output",
+    [
+        # test invalid target
+        ("target_default", "FOOBAR", 1, 100, "has no Windows Registry"),
+        # test invalid key feedback
+        ("target_win_reg", "FOOBAR", 1, 100, "Key 'FOOBAR' does not exist"),
+        (
+            "target_win_reg",
+            "HKEY_LOCAL_MACHINE\\FOOBAR",
+            1,
+            100,
+            "Key 'HKEY_LOCAL_MACHINE\\\\FOOBAR' does not exist",
+        ),
+        # test key value abbrevation
+        (
+            "target_win_reg",
+            "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName",
+            1,
+            100,
+            "- 'ComputerName' 'DESKTOP-M3OSHQU'",
+        ),
+        (
+            "target_win_reg",
+            "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName",
+            1,
+            10,
+            "- 'ComputerName' 'DESKTOP-M...",
+        ),
+        # test class name printing
+        (
+            "target_win_reg",
+            "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\Data",
+            1,
+            100,
+            "+ 'Data' (2022-06-23 01:25:23.729778+00:00) (a282942c)",
+        ),
+    ],
+)
+def test_reg_output(
+    provided_target: Target,
+    provided_key: str,
+    expected_output: str,
+    arg_depth: int,
+    arg_length: int,
+    capsys: pytest.CaptureFixture,
+    monkeypatch: pytest.MonkeyPatch,
+    request: FixtureRequest,
+) -> None:
+    provided_target = request.getfixturevalue(provided_target)
+    with patch("dissect.target.Target.open_all", return_value=[provided_target]):
+        with monkeypatch.context() as m:
+            m.setattr(
+                "sys.argv",
+                ["target-reg", "foo", "--depth", str(arg_depth), "--length", str(arg_length), "--key", provided_key],
+            )
+            target_reg()
+            out, err = capsys.readouterr()
+            print(out, err)
+            assert expected_output in out or expected_output in err

{dissect.target-3.16.dev39 → dissect.target-3.16.dev43}/tests/volumes/test_bde.py

@@ -6,9 +6,9 @@ from dissect.target.helpers import keychain
 try:
     from dissect.target.volumes.bde import BitlockerVolumeSystem
 
-    HAVE_DISSECT_FVE = True
+    HAS_DISSECT_FVE = True
 except ModuleNotFoundError:
-    HAVE_DISSECT_FVE = False
+    HAS_DISSECT_FVE = False
 
 
 from tests._utils import absolute_path
@@ -21,7 +21,7 @@ def encrypted_volume():
         yield f
 
 
-@pytest.mark.skipif(not HAVE_DISSECT_FVE, reason="requires dissect.fve")
+@pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
 def test_bde_volume_failure(target_win, encrypted_volume):
     enc_vol = volume.Volume(encrypted_volume, 1, 0, None, None, None, disk=encrypted_volume)
     target_win.volumes.add(enc_vol)
@@ -31,7 +31,7 @@ def test_bde_volume_failure(target_win, encrypted_volume):
     assert enc_vol in target_win.volumes
 
 
-@pytest.mark.skipif(not HAVE_DISSECT_FVE, reason="requires dissect.fve")
+@pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
 def test_bde_volume_with_recovery_key(target_win, encrypted_volume):
     recovery_key = "272316-265804-640728-713570-509047-503305-045837-324731"
 
@@ -58,7 +58,7 @@ def test_bde_volume_with_recovery_key(target_win, encrypted_volume):
     assert target_win.fs.path("e:/test-folder/test-file-2.txt").exists()
 
 
-@pytest.mark.skipif(not HAVE_DISSECT_FVE, reason="requires dissect.fve")
+@pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
 def test_bde_volume_with_passphrase(target_win, encrypted_volume):
     identifier = "B6AD258A-2725-4A42-93C6-844478BF7A90"
     passphrase = "Password1234"
@@ -86,7 +86,7 @@ def test_bde_volume_with_passphrase(target_win, encrypted_volume):
     assert target_win.fs.path("e:/test-folder/test-file-2.txt").exists()
 
 
-@pytest.mark.skipif(not HAVE_DISSECT_FVE, reason="requires dissect.fve")
+@pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
 def test_bde_volume_with_wildcard_key(target_win, encrypted_volume):
     keychain.register_wildcard_value("Password1234")