dissect.target 3.18.dev14__tar.gz → 3.18.dev16__tar.gz

{dissect_target-3.18.dev14/dissect.target.egg-info → dissect_target-3.18.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.18.dev14
+Version: 3.18.dev16
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.18.dev14 → dissect_target-3.18.dev16}/dissect/target/plugins/os/windows/_os.py

@@ -247,13 +247,21 @@ class WindowsPlugin(OSPlugin):
         if any(map(lambda value: value is not None, version_parts.values())):
             version = []
 
+            nt_version = _part_str(version_parts, "CurrentVersion")
+            build_version = _part_str(version_parts, "CurrentBuildNumber")
             prodcut_name = _part_str(version_parts, "ProductName")
-            version.append(prodcut_name)
 
-            nt_version = _part_str(version_parts, "CurrentVersion")
+            # CurrentBuildNumber >= 22000 on NT 10.0 indicates Windows 11.
+            # https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
+            try:
+                if nt_version == "10.0" and int(build_version) >= 22_000:
+                    prodcut_name = prodcut_name.replace("Windows 10", "Windows 11")
+            except ValueError:
+                pass
+
+            version.append(prodcut_name)
             version.append(f"(NT {nt_version})")
 
-            build_version = _part_str(version_parts, "CurrentBuildNumber")
             ubr = version_parts["UBR"]
             if ubr:
                 build_version = f"{build_version}.{ubr}"

{dissect_target-3.18.dev14 → dissect_target-3.18.dev16}/dissect/target/plugins/os/windows/regf/shellbags.py

@@ -907,17 +907,20 @@ class EXTENSION_BLOCK_BEEF0004(EXTENSION_BLOCK):  # noqa
             self.file_reference = c_bag.uint64(fh)
             c_bag.uint64(fh)
         if version >= 3:
-            long_len = c_bag.uint16(fh)
+            # Start of strings
+            localized_name_offset = c_bag.uint16(fh)
         if version >= 9:
             c_bag.uint32(fh)
         if version >= 8:
             c_bag.uint32(fh)
         if version >= 3:
             self.long_name = c_bag.wchar[None](fh)
-        if 3 <= version < 7 and long_len > 0:
-            self.localized_name = c_bag.char[long_len](fh)
-        if version >= 7 and long_len > 0:
-            self.localized_name = c_bag.wchar[long_len](fh)
+
+        if 3 <= version < 7 and localized_name_offset > 0:
+            self.localized_name = c_bag.char[None](fh)
+
+        if version >= 7 and localized_name_offset > 0:
+            self.localized_name = c_bag.wchar[None](fh)
 
 
 class EXTENSION_BLOCK_BEEF0005(EXTENSION_BLOCK):  # noqa

{dissect_target-3.18.dev14 → dissect_target-3.18.dev16/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.18.dev14
+Version: 3.18.dev16
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.18.dev14 → dissect_target-3.18.dev16}/dissect.target.egg-info/SOURCES.txt

@@ -574,6 +574,7 @@ tests/plugins/os/windows/regf/test_appxdebugkeys.py
 tests/plugins/os/windows/regf/test_cit.py
 tests/plugins/os/windows/regf/test_clsid.py
 tests/plugins/os/windows/regf/test_muicache.py
+tests/plugins/os/windows/regf/test_shellbags.py
 tests/plugins/os/windows/regf/test_trusteddocs.py
 tests/plugins/os/windows/regf/test_userassist.py
 tests/tools/__init__.py

dissect_target-3.18.dev16/tests/plugins/os/windows/regf/test_shellbags.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import datetime
+
+import pytest
+
+from dissect.target.plugins.os.windows.regf.shellbags import parse_shell_item_list
+
+
+@pytest.mark.parametrize(
+    "shellbag, name, modification_time, localized_name",
+    [
+        (
+            (
+                b"X\x001\x00\x00\x00\x00\x00WX\xc1I\x11\x00MENUST~1\x00\x00@\x00\x03\x00\x04\x00\xef\xbeWXZBWXZB\x14"
+                b"\x00*\x00M\x00e\x00n\x00u\x00 \x00S\x00t\x00a\x00r\x00t\x00\x00\x00@shell32.dll,-21786\x00\x18\x00"
+                b"\x00\x00"
+            ),
+            "Menu Start",
+            datetime.datetime(2024, 2, 23, 9, 14, 2),
+            b"@shell32.dll,-21786",
+        ),
+        (
+            (
+                b"x\x001\x00\x00\x00\x00\x00\x17W\x0bk\x11\x00Users\x00d\x00\t\x00\x04\x00\xef\xbe\xa7T,*\x91X\xe6R."
+                b"\x00\x00\x00\n\x08\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00:\x00\x00\x00\x00\x00A"
+                b"\x06\x85\x00U\x00s\x00e\x00r\x00s\x00\x00\x00@\x00s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l"
+                b"\x00l\x00,\x00-\x002\x001\x008\x001\x003\x00\x00\x00\x14\x00\x00\x00"
+            ),
+            "Users",
+            datetime.datetime(2023, 8, 23, 13, 24, 22),
+            "@shell32.dll,-21813",
+        ),
+    ],
+    ids=["char", "wchar"],
+)
+def test_parse_shell_item_list(
+    shellbag: bytes, name: str, modification_time: datetime.datetime, localized_name: str | bytes
+) -> None:
+    bag = next(parse_shell_item_list(shellbag))
+
+    assert bag.name == name
+    assert bag.modification_time == modification_time
+
+    extension = bag.extensions[0]
+
+    assert extension.long_name == name
+    assert extension.localized_name == localized_name

{dissect_target-3.18.dev14 → dissect_target-3.18.dev16}/tests/plugins/os/windows/test__os.py

@@ -202,6 +202,26 @@ def test_windowsplugin__nt_version(
             ],
             "<Unknown ProductName> (NT <Unknown CurrentVersion>) <Unknown CurrentBuildNumber> 5678",
         ),
+        (
+            [
+                ("ProductName", "Windows 10 Pro"),
+                ("CurrentMajorVersionNumber", 10),
+                ("CurrentMinorVersionNumber", 0),
+                ("CurrentBuildNumber", 19_045),
+                ("UBR", 1234),
+            ],
+            "Windows 10 Pro (NT 10.0) 19045.1234",
+        ),
+        (
+            [
+                ("ProductName", "Windows 10 Enterprise"),
+                ("CurrentMajorVersionNumber", 10),
+                ("CurrentMinorVersionNumber", 0),
+                ("CurrentBuildNumber", 22_000),
+                ("UBR", 1234),
+            ],
+            "Windows 11 Enterprise (NT 10.0) 22000.1234",
+        ),
     ],
 )
 def test_windowsplugin_version(