dissect.target 3.16.dev41__tar.gz → 3.16.dev43__tar.gz

{dissect.target-3.16.dev41/dissect.target.egg-info → dissect.target-3.16.dev43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev41
+Version: 3.16.dev43
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -63,7 +63,7 @@ Requires-Dist: dissect.target[full]; extra == "smb"
 Requires-Dist: impacket==0.10.0; extra == "smb"
 Provides-Extra: cb
 Requires-Dist: dissect.target[full]; extra == "cb"
-Requires-Dist: carbon-black-cloud-sdk-python~=1.4.3; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
 
 # dissect.target
 

{dissect.target-3.16.dev41 → dissect.target-3.16.dev43}/dissect/target/tools/reg.py

@@ -3,10 +3,16 @@
 from __future__ import print_function
 
 import argparse
+import itertools
 import logging
 
 from dissect.target import Target
-from dissect.target.exceptions import RegistryError, TargetError
+from dissect.target.exceptions import (
+    RegistryError,
+    RegistryKeyNotFoundError,
+    TargetError,
+)
+from dissect.target.helpers.regutil import RegistryKey
 from dissect.target.tools.utils import (
     catch_sigpipe,
     configure_generic_arguments,
@@ -29,7 +35,8 @@ def main():
     parser.add_argument("targets", metavar="TARGETS", nargs="+", help="Targets to load")
     parser.add_argument("-k", "--key", required=True, help="key to query")
     parser.add_argument("-kv", "--value", help="value to query")
-    parser.add_argument("-d", "--depth", type=int, const=0, nargs="?", default=1)
+    parser.add_argument("-d", "--depth", type=int, const=0, nargs="?", default=1, help="max depth of subkeys to print")
+    parser.add_argument("-l", "--length", type=int, default=100, help="max length of key value to print")
 
     configure_generic_arguments(parser)
     args = parser.parse_args()
@@ -38,34 +45,50 @@ def main():
 
     try:
         for target in Target.open_all(args.targets):
+            if not target.has_function("registry"):
+                target.log.error("Target has no Windows Registry")
+                continue
+
             try:
-                if args.value:
-                    for key in target.registry.keys(args.key):
-                        try:
-                            print(key.value(args.value))
-                        except RegistryError:
-                            continue
-                else:
+                keys = target.registry.keys(args.key)
+                first_key = next(keys)
+
+                print(target)
+
+                for key in itertools.chain([first_key], keys):
                     try:
-                        print(target)
-                        for key in target.registry.keys(args.key):
-                            recursor(key, args.depth, 0)
+                        if args.value:
+                            print(key.value(args.value))
+                        else:
+                            recursor(key, args.depth, 0, args.length)
                     except RegistryError:
                         log.exception("Failed to find registry value")
-            except Exception:
-                log.exception("Failed to iterate key")
+
+            except (RegistryKeyNotFoundError, StopIteration):
+                target.log.error("Key %r does not exist", args.key)
+
+            except Exception as e:
+                target.log.error("Failed to iterate key: %s", e)
+                target.log.debug("", exc_info=e)
     except TargetError as e:
         log.error(e)
         log.debug("", exc_info=e)
         parser.exit(1)
 
 
-def recursor(key, depth, indent):
-    print(" " * indent + f"+ {key.name!r} ({key.ts})")
+def recursor(key: RegistryKey, depth: int, indent: int, max_length: int = 100) -> None:
+    class_name = ""
+    if key.class_name:
+        class_name = f" ({key.class_name})"
+
+    print(" " * indent + f"+ {key.name!r} ({key.ts})" + class_name)
 
     for r in key.values():
         try:
-            print(" " * indent + f"  - {r.name!r} {repr(r.value)[:100]}")
+            value = repr(r.value)
+            if len(value) > max_length:
+                value = value[:max_length] + "..."
+            print(" " * indent + f"  - {r.name!r} {value}")
         except NotImplementedError:
             continue
 
@@ -73,7 +96,7 @@ def recursor(key, depth, indent):
         return
 
     for subkey in key.subkeys():
-        recursor(subkey, depth - 1, indent + 2)
+        recursor(subkey, depth - 1, indent + 2, max_length)
 
 
 if __name__ == "__main__":

{dissect.target-3.16.dev41 → dissect.target-3.16.dev43/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev41
+Version: 3.16.dev43
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -63,7 +63,7 @@ Requires-Dist: dissect.target[full]; extra == "smb"
 Requires-Dist: impacket==0.10.0; extra == "smb"
 Provides-Extra: cb
 Requires-Dist: dissect.target[full]; extra == "cb"
-Requires-Dist: carbon-black-cloud-sdk-python~=1.4.3; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
 
 # dissect.target
 

{dissect.target-3.16.dev41 → dissect.target-3.16.dev43}/dissect.target.egg-info/SOURCES.txt

@@ -560,6 +560,7 @@ tests/tools/test_dump.py
 tests/tools/test_fs.py
 tests/tools/test_mount.py
 tests/tools/test_query.py
+tests/tools/test_reg.py
 tests/tools/test_shell.py
 tests/tools/test_utils.py
 tests/volumes/__init__.py

{dissect.target-3.16.dev41 → dissect.target-3.16.dev43}/dissect.target.egg-info/requires.txt

@@ -12,7 +12,7 @@ structlog
 
 [cb]
 dissect.target[full]
-carbon-black-cloud-sdk-python~=1.4.3
+carbon-black-cloud-sdk~=1.4.3
 
 [full]
 asn1crypto

{dissect.target-3.16.dev41 → dissect.target-3.16.dev43}/pyproject.toml

@@ -88,7 +88,7 @@ smb = [
 cb = [
     # Grab the dependencies for dissect.target
     "dissect.target[full]",
-    "carbon-black-cloud-sdk-python~=1.4.3"
+    "carbon-black-cloud-sdk~=1.4.3"
 ]
 
 [project.scripts]

dissect.target-3.16.dev43/tests/tools/test_reg.py

@@ -0,0 +1,81 @@
+from typing import Iterator
+from unittest.mock import patch
+
+import pytest
+from _pytest.fixtures import FixtureRequest
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.windows.registry import RegistryPlugin
+from dissect.target.tools.reg import main as target_reg
+from tests._utils import absolute_path
+
+
+@pytest.fixture
+def target_win_reg(target_win: Target, fs_win: VirtualFilesystem) -> Iterator[Target]:
+    fs_win.map_file("Windows/System32/config/SYSTEM", absolute_path("_data/tools/reg/SYSTEM.gz"), "gzip")
+    target_win.apply()
+    target_win.add_plugin(RegistryPlugin)
+    yield target_win
+
+
+@pytest.mark.parametrize(
+    "provided_target, provided_key, arg_depth, arg_length, expected_output",
+    [
+        # test invalid target
+        ("target_default", "FOOBAR", 1, 100, "has no Windows Registry"),
+        # test invalid key feedback
+        ("target_win_reg", "FOOBAR", 1, 100, "Key 'FOOBAR' does not exist"),
+        (
+            "target_win_reg",
+            "HKEY_LOCAL_MACHINE\\FOOBAR",
+            1,
+            100,
+            "Key 'HKEY_LOCAL_MACHINE\\\\FOOBAR' does not exist",
+        ),
+        # test key value abbrevation
+        (
+            "target_win_reg",
+            "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName",
+            1,
+            100,
+            "- 'ComputerName' 'DESKTOP-M3OSHQU'",
+        ),
+        (
+            "target_win_reg",
+            "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName",
+            1,
+            10,
+            "- 'ComputerName' 'DESKTOP-M...",
+        ),
+        # test class name printing
+        (
+            "target_win_reg",
+            "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\Data",
+            1,
+            100,
+            "+ 'Data' (2022-06-23 01:25:23.729778+00:00) (a282942c)",
+        ),
+    ],
+)
+def test_reg_output(
+    provided_target: Target,
+    provided_key: str,
+    expected_output: str,
+    arg_depth: int,
+    arg_length: int,
+    capsys: pytest.CaptureFixture,
+    monkeypatch: pytest.MonkeyPatch,
+    request: FixtureRequest,
+) -> None:
+    provided_target = request.getfixturevalue(provided_target)
+    with patch("dissect.target.Target.open_all", return_value=[provided_target]):
+        with monkeypatch.context() as m:
+            m.setattr(
+                "sys.argv",
+                ["target-reg", "foo", "--depth", str(arg_depth), "--length", str(arg_length), "--key", provided_key],
+            )
+            target_reg()
+            out, err = capsys.readouterr()
+            print(out, err)
+            assert expected_output in out or expected_output in err