dissect.target 3.17.dev37__py3-none-any.whl → 3.18__py3-none-any.whl

dissect/target/plugins/os/windows/regf/regf.py

@@ -49,6 +49,9 @@ class RegfPlugin(Plugin):
         Yields RegistryKeyRecords and RegistryValueRecords
 
         RegistryKeyRecord fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified time.
@@ -57,6 +60,9 @@ class RegfPlugin(Plugin):
             source (string): The hive file path.
 
         RegistryValueRecord fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified time.

dissect/target/plugins/os/windows/regf/runkeys.py

@@ -61,6 +61,9 @@ class RunKeysPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
 
         Yields RunKeyRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified timestamp.

dissect/target/plugins/os/windows/regf/shellbags.py

@@ -243,8 +243,7 @@ struct EXTENSION_BLOCK_HEADER {
     uint32  signature;
 };
 """
-c_bag = cstruct()
-c_bag.load(bag_def)
+c_bag = cstruct().load(bag_def)
 
 DELEGATE_ITEM_IDENTIFIER = b"\x74\x1a\x59\x5e\x96\xdf\xd3\x48\x8d\x67\x17\x33\xbc\xee\x28\xba"
 
@@ -908,17 +907,20 @@ class EXTENSION_BLOCK_BEEF0004(EXTENSION_BLOCK):  # noqa
             self.file_reference = c_bag.uint64(fh)
             c_bag.uint64(fh)
         if version >= 3:
-            long_len = c_bag.uint16(fh)
+            # Start of strings
+            localized_name_offset = c_bag.uint16(fh)
         if version >= 9:
             c_bag.uint32(fh)
         if version >= 8:
             c_bag.uint32(fh)
         if version >= 3:
             self.long_name = c_bag.wchar[None](fh)
-        if 3 <= version < 7 and long_len > 0:
-            self.localized_name = c_bag.char[long_len](fh)
-        if version >= 7 and long_len > 0:
-            self.localized_name = c_bag.wchar[long_len](fh)
+
+        if 3 <= version < 7 and localized_name_offset > 0:
+            self.localized_name = c_bag.char[None](fh)
+
+        if version >= 7 and localized_name_offset > 0:
+            self.localized_name = c_bag.wchar[None](fh)
 
 
 class EXTENSION_BLOCK_BEEF0005(EXTENSION_BLOCK):  # noqa

dissect/target/plugins/os/windows/regf/shimcache.py

@@ -21,7 +21,7 @@ ShimcacheRecord = TargetRecordDescriptor(
     ],
 )
 
-c_shimdef = """
+shim_def = """
 struct NT61_HEADER {
     uint32 magic;
     uint32 num_entries;
@@ -99,8 +99,7 @@ struct WIN10_ENTRY_DATA {
     uint64 ts;
 };
 """
-c_shim = cstruct()
-c_shim.load(c_shimdef)
+c_shim = cstruct().load(shim_def)
 
 MAGIC_NT61 = 0xBADC0FEE
 MAGIC_NT52 = 0xBADC0FFE
@@ -318,6 +317,9 @@ class ShimcachePlugin(Plugin):
             - https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/
 
         Yields ShimcacheRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             last_modified (datetime): The last modified date.

dissect/target/plugins/os/windows/regf/trusteddocs.py

@@ -61,6 +61,9 @@ class TrustedDocumentsPlugin(Plugin):
 
         Yields records based on the values within the TrustRecords registry keys.
         At least contains the following fields:
+
+        .. code-block:: text
+
             application (string): Application name of the Office product that produced the TrustRecords registry key.
             document_path (path): Path to the document for which a TrustRecords entry is created.
             ts (datetime): The created time of the TrustRecord registry key.

dissect/target/plugins/os/windows/regf/usb.py

@@ -93,6 +93,9 @@ class UsbPlugin(Plugin):
         HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR registry key.
 
         Yields UsbRegistryRecord with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname
             domain (string): The target domain
             type (string): Type of USB device

dissect/target/plugins/os/windows/regf/userassist.py

@@ -1,6 +1,6 @@
 import codecs
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from dissect.util.ts import wintimestamp
 
 from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
@@ -14,13 +14,13 @@ from dissect.target.plugin import Plugin, export
 
 userassist_def = """
 struct VERSION5_ENTRY {
-    char padding[4];
+    char padding0[4];
     uint32 number_of_executions;
     uint32 application_focus_count;
     uint32 application_focus_duration;
-    char padding[44];
+    char padding1[44];
     uint64 timestamp;
-    char padding[4];
+    char padding2[4];
 };
 
 struct VERSION3_ENTRY {
@@ -29,8 +29,7 @@ struct VERSION3_ENTRY {
     uint64  timestamp;
 };
 """
-c_userassist = cstruct.cstruct()
-c_userassist.load(userassist_def)
+c_userassist = cstruct().load(userassist_def)
 
 UserAssistRecordDescriptor = create_extended_descriptor(
     [
@@ -72,6 +71,9 @@ class UserAssistPlugin(Plugin):
             - https://www.aldeid.com/wiki/Windows-userassist-keys
 
         Yields UserAssistRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The entry timestamp.

dissect/target/plugins/os/windows/sam.py

@@ -9,14 +9,14 @@ try:
 except ImportError:
     HAS_CRYPTO = False
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from dissect.util import ts
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 
-c_sam_def = """
+sam_def = """
 struct user_F {
   char      unknown1[8];
   uint64    t_last_login;           /* Time of last login */
@@ -166,7 +166,7 @@ struct DOMAIN_ACCOUNT_F {
   uint16 min_password_length;               /* 0x50 */
   uint16 password_history_length;           /* 0x52 */
   uint16 lockout_threshold;                 /* 0x54 */
-  uint16 unknown1_1;                        /* 0x56 */
+  uint16 unknown1_3;                        /* 0x56 */
   uint32 server_state;                      /* 0x58 */
   uint16 server_role;                       /* 0x5c */
   uint16 uas_compability_required;          /* 0x5e */
@@ -207,8 +207,7 @@ struct SAM_HASH_AES {  /* size: >=24 */
 };
 """
 
-c_sam = cstruct.cstruct()
-c_sam.load(c_sam_def)
+c_sam = cstruct().load(sam_def)
 
 SamRecord = TargetRecordDescriptor(
     "windows/registry/sam",
@@ -356,6 +355,9 @@ class SamPlugin(Plugin):
             - https://en.wikipedia.org/wiki/Security_Account_Manager
 
         Yields SamRecords with fields:
+
+        .. code-block:: text
+
             rid (uint32): The RID.
             fullname (string): Parsed fullname.
             username (string): Parsed username.

dissect/target/plugins/os/windows/services.py

@@ -72,6 +72,9 @@ class ServicesPlugin(Plugin):
             - https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html
 
         Yields ServiceRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datatime): The last modified timestamp of the registry key.

dissect/target/plugins/os/windows/task_helpers/tasks_job.py

@@ -2,7 +2,7 @@ import datetime
 import warnings
 from typing import Iterator, Optional
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from flow.record import GroupedRecord
 
 from dissect.target.exceptions import InvalidTaskError
@@ -135,8 +135,7 @@ struct ATJOB_DATA {
 //      uint8       job_signature[64 * s_ver * c_ver];  /*      - calculated job signature. */
 };
 """
-atjob = cstruct.cstruct()
-atjob.load(atjob_def)
+c_atjob = cstruct().load(atjob_def)
 
 
 class AtTask:
@@ -149,7 +148,7 @@ class AtTask:
 
     def __init__(self, job_file: TargetPath, target: Target):
         try:
-            self.at_data = atjob.ATJOB_DATA(job_file.open())
+            self.at_data = c_atjob.ATJOB_DATA(job_file.open())
         except Exception as e:
             raise InvalidTaskError(e)
 

dissect/target/plugins/os/windows/wer.py

@@ -155,6 +155,9 @@ class WindowsErrorReportingPlugin(Plugin):
 
         Yields dynamically created records based on the fields in the files. A record at least contains the following
         fields:
+
+        .. code-block:: text
+
             ts (datetime): The moment in time when the error event took place.
             version (string): WER file version.
             event_type (string): WER file event type.

dissect/target/target.py

@@ -14,6 +14,7 @@ from dissect.target.exceptions import (
     PluginError,
     PluginNotFoundError,
     TargetError,
+    TargetPathNotFoundError,
     UnsupportedPluginError,
     VolumeSystemError,
 )
@@ -284,7 +285,11 @@ class Target:
                     try:
                         ldr = loader_cls(sub_entry, parsed_path=parsed_path)
                     except Exception as e:
-                        getlogger(sub_entry).error("Failed to initiate loader: %s", e)
+                        message = "Failed to initiate loader: %s"
+                        if isinstance(e, TargetPathNotFoundError):
+                            message = "%s"
+
+                        getlogger(sub_entry).error(message, e)
                         getlogger(sub_entry).debug("", exc_info=e)
                         continue
 

dissect/target/tools/shell.py

@@ -113,6 +113,7 @@ class TargetCmd(cmd.Cmd):
     def __init__(self, target: Target):
         cmd.Cmd.__init__(self)
         self.target = target
+        self.debug = False
 
     def __getattr__(self, attr: str) -> Any:
         if attr.startswith("help_"):
@@ -179,25 +180,22 @@ class TargetCmd(cmd.Cmd):
             lexer.whitespace_split = True
             argparts = list(lexer)
 
-        try:
-            if "|" in argparts:
-                pipeidx = argparts.index("|")
-                argparts, pipeparts = argparts[:pipeidx], argparts[pipeidx + 1 :]
-                try:
-                    with build_pipe_stdout(pipeparts) as pipe_stdin:
-                        return func(argparts, pipe_stdin)
-                except OSError as e:
-                    # in case of a failure in a subprocess
-                    print(e)
-            else:
-                ctx = contextlib.nullcontext()
-                if self.target.props.get("cyber") and not no_cyber:
-                    ctx = cyber.cyber(color=None, run_at_end=True)
+        if "|" in argparts:
+            pipeidx = argparts.index("|")
+            argparts, pipeparts = argparts[:pipeidx], argparts[pipeidx + 1 :]
+            try:
+                with build_pipe_stdout(pipeparts) as pipe_stdin:
+                    return func(argparts, pipe_stdin)
+            except OSError as e:
+                # in case of a failure in a subprocess
+                print(e)
+        else:
+            ctx = contextlib.nullcontext()
+            if self.target.props.get("cyber") and not no_cyber:
+                ctx = cyber.cyber(color=None, run_at_end=True)
 
-                with ctx:
-                    return func(argparts, sys.stdout)
-        except IOError:
-            pass
+            with ctx:
+                return func(argparts, sys.stdout)
 
     def _exec_command(self, command: str, command_args_str: str) -> Optional[bool]:
         """Command execution helper for ``cmd_`` commands."""
@@ -279,6 +277,14 @@ class TargetCmd(cmd.Cmd):
         """exit shell"""
         return True
 
+    def do_debug(self, line: str) -> Optional[bool]:
+        """toggle debug mode"""
+        self.debug = not self.debug
+        if self.debug:
+            print("Debug mode on")
+        else:
+            print("Debug mode off")
+
 
 class TargetHubCli(cmd.Cmd):
     """Hub Cli for interacting with multiple targets."""
@@ -1241,7 +1247,12 @@ def run_cli(cli: cmd.Cmd) -> None:
             print()
             pass
         except Exception as e:
-            log.exception(e)
+            if cli.debug:
+                log.exception(e)
+            else:
+                log.info(e)
+                print(f"*** Unhandled error: {e}")
+                print("If you wish to see the full debug trace, enable debug mode.")
             pass
 
 

{dissect.target-3.17.dev37.dist-info → dissect.target-3.18.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.17.dev37
+Version: 3.18
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -23,36 +23,61 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
-Requires-Dist: dissect.cstruct <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.eventlog <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.evidence <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.hypervisor <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.ntfs <4.0.dev,>=3.4.dev
-Requires-Dist: dissect.regf <4.0.dev,>=3.3.dev
-Requires-Dist: dissect.util <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.volume <4.0.dev,>=3.0.dev
+Requires-Dist: dissect.cstruct <5,>=4
+Requires-Dist: dissect.eventlog <4,>=3
+Requires-Dist: dissect.evidence <4,>=3
+Requires-Dist: dissect.hypervisor <4,>=3
+Requires-Dist: dissect.ntfs <4,>=3.4
+Requires-Dist: dissect.regf <4,>=3.3
+Requires-Dist: dissect.util <4,>=3
+Requires-Dist: dissect.volume <4,>=2
 Requires-Dist: flow.record ~=3.15.0
 Requires-Dist: structlog
 Provides-Extra: cb
 Requires-Dist: dissect.target[full] ; extra == 'cb'
 Requires-Dist: carbon-black-cloud-sdk ~=1.4.3 ; extra == 'cb'
+Provides-Extra: dev
+Requires-Dist: dissect.target[full,mqtt,yara] ; extra == 'dev'
+Requires-Dist: dissect.btrfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.cim[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.clfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.cstruct <5.0.dev,>=4.0.dev ; extra == 'dev'
+Requires-Dist: dissect.esedb[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.etl[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.eventlog[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.evidence[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.extfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.fat[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.ffs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.hypervisor[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.jffs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.ntfs[dev] <4.0.dev,>=3.4.dev ; extra == 'dev'
+Requires-Dist: dissect.regf[dev] <4.0.dev,>=3.3.dev ; extra == 'dev'
+Requires-Dist: dissect.shellitem[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.sql[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.squashfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.thumbcache[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.util <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.vmfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.volume[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.xfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
 Provides-Extra: full
 Requires-Dist: asn1crypto ; extra == 'full'
-Requires-Dist: dissect.btrfs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.cim <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.clfs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.esedb <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.etl <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.extfs <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.fat <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.ffs <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.jffs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.shellitem <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.squashfs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.sql <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.thumbcache <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.vmfs <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.xfs <4.0.dev,>=3.0.dev ; extra == 'full'
+Requires-Dist: dissect.btrfs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.cim <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.clfs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.esedb <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.etl <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.extfs <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.fat <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.ffs <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.jffs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.shellitem <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.squashfs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.sql <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.thumbcache <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.vmfs <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.xfs <4,>=3 ; extra == 'full'
 Requires-Dist: ipython ; extra == 'full'
 Requires-Dist: fusepy ; extra == 'full'
 Requires-Dist: pycryptodome ; extra == 'full'