dissect.target 3.20.1__py3-none-any.whl → 3.20.2.dev11__py3-none-any.whl

Sign up to get free protection for your applications and to get access to all the features.
Files changed (25) hide show
  1. dissect/target/helpers/configutil.py +3 -3
  2. dissect/target/loaders/itunes.py +5 -3
  3. dissect/target/plugins/apps/browser/iexplore.py +7 -3
  4. dissect/target/plugins/general/plugins.py +1 -1
  5. dissect/target/plugins/os/unix/_os.py +1 -1
  6. dissect/target/plugins/os/unix/esxi/_os.py +34 -32
  7. dissect/target/plugins/os/unix/linux/fortios/_keys.py +7919 -1951
  8. dissect/target/plugins/os/unix/linux/fortios/_os.py +109 -22
  9. dissect/target/plugins/os/unix/linux/network_managers.py +1 -1
  10. dissect/target/plugins/os/unix/log/auth.py +6 -37
  11. dissect/target/plugins/os/unix/log/helpers.py +46 -0
  12. dissect/target/plugins/os/unix/log/messages.py +24 -15
  13. dissect/target/plugins/os/windows/activitiescache.py +32 -30
  14. dissect/target/plugins/os/windows/catroot.py +14 -5
  15. dissect/target/plugins/os/windows/lnk.py +13 -7
  16. dissect/target/plugins/os/windows/notifications.py +40 -38
  17. dissect/target/plugins/os/windows/regf/cit.py +20 -7
  18. dissect/target/tools/diff.py +990 -0
  19. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/METADATA +2 -2
  20. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/RECORD +25 -23
  21. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/entry_points.txt +1 -0
  22. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/COPYRIGHT +0 -0
  23. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/LICENSE +0 -0
  24. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/WHEEL +0 -0
  25. {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/top_level.txt +0 -0
@@ -470,9 +470,9 @@ class Toml(ConfigurationParser):
470
470
  class Env(ConfigurationParser):
471
471
  """Parses ``.env`` file contents according to Docker and bash specification.
472
472
 
473
- Does not apply interpolation of substituted values, eg. ``foo=${bar}`` and does not attempt
474
- to parse list or dict strings. Does not support dynamic env files, eg. `` foo=`bar` ``. Also
475
- does not support multi-line key/value assignments (yet).
473
+ Does not apply interpolation of substituted values, e.g. ``foo=${bar}`` and does not attempt to parse list or dict
474
+ strings. Does not support dynamic env files, e.g. ``foo=`bar```. Also does not support multi-line key/value
475
+ assignments (yet).
476
476
 
477
477
  Resources:
478
478
  - https://docs.docker.com/compose/environment-variables/variable-interpolation/#env-file-syntax
@@ -163,8 +163,10 @@ class ITunesBackup:
163
163
 
164
164
  def files(self) -> Iterator[FileInfo]:
165
165
  """Iterate all the files in this backup."""
166
- for row in self.manifest_db.table("Files").rows():
167
- yield FileInfo(self, row.fileID, row.domain, row.relativePath, row.flags, row.file)
166
+
167
+ if table := self.manifest_db.table("Files"):
168
+ for row in table.rows():
169
+ yield FileInfo(self, row.fileID, row.domain, row.relativePath, row.flags, row.file)
168
170
 
169
171
 
170
172
  class FileInfo:
@@ -288,7 +290,7 @@ def translate_file_path(domain: str, relative_path: str) -> str:
288
290
  package_name = ""
289
291
 
290
292
  domain_path = fsutil.join(DOMAIN_TRANSLATION.get(domain, domain), package_name)
291
- return fsutil.join(domain_path, relative_path)
293
+ return fsutil.join(domain_path, relative_path).rstrip("/")
292
294
 
293
295
 
294
296
  def parse_key_bag(buf: bytes) -> tuple[dict[str, bytes, int], dict[str, ClassKey]]:
@@ -36,14 +36,18 @@ class WebCache:
36
36
  All ``ContainerId`` values for the requested container name.
37
37
  """
38
38
  try:
39
- for container_record in self.db.table("Containers").records():
39
+ table = self.db.table("Containers")
40
+
41
+ for container_record in table.records():
40
42
  if record_name := container_record.get("Name"):
41
43
  record_name = record_name.rstrip("\00").lower()
42
44
  if record_name == name.lower():
43
45
  container_id = container_record.get("ContainerId")
44
46
  yield self.db.table(f"Container_{container_id}")
45
- except KeyError:
46
- pass
47
+
48
+ except KeyError as e:
49
+ self.target.log.warning("Exception while parsing EseDB Containers table")
50
+ self.target.log.debug("", exc_info=e)
47
51
 
48
52
  def _iter_records(self, name: str) -> Iterator[record.Record]:
49
53
  """Yield records from a Webcache container.
@@ -169,7 +169,7 @@ class PluginListPlugin(Plugin):
169
169
 
170
170
 
171
171
  def generate_plugins_json(plugins: list[Plugin]) -> Iterator[dict]:
172
- """Generates JSON output of a list of :class:`Plugin`s."""
172
+ """Generates JSON output of a list of :class:`Plugin`."""
173
173
 
174
174
  for p in plugins:
175
175
  func = getattr(p.class_object, p.method_name)
@@ -182,7 +182,7 @@ class UnixPlugin(OSPlugin):
182
182
  paths (list): list of paths
183
183
  """
184
184
  redhat_legacy_path = "/etc/sysconfig/network"
185
- paths = paths or ["/etc/hostname", "/etc/HOSTNAME", redhat_legacy_path]
185
+ paths = paths or ["/etc/hostname", "/etc/HOSTNAME", "/proc/sys/kernel/hostname", redhat_legacy_path]
186
186
  hostname_dict = {"hostname": None, "domain": None}
187
187
 
188
188
  for path in paths:
@@ -472,37 +472,39 @@ def parse_config_store(fh: BinaryIO) -> dict[str, Any]:
472
472
  db = sqlite3.SQLite3(fh)
473
473
 
474
474
  store = {}
475
- for row in db.table("Config").rows():
476
- component_name = row.Component
477
- config_group_name = row.ConfigGroup
478
- value_group_name = row.Name
479
- identifier_name = row.Identifier
480
-
481
- if component_name not in store:
482
- store[component_name] = {}
483
- component = store[component_name]
484
-
485
- if config_group_name not in component:
486
- component[config_group_name] = {}
487
- config_group = component[config_group_name]
488
-
489
- if value_group_name not in config_group:
490
- config_group[value_group_name] = {}
491
- value_group = config_group[value_group_name]
492
-
493
- if identifier_name not in value_group:
494
- value_group[identifier_name] = {}
495
- identifier = value_group[identifier_name]
496
-
497
- identifier["modified_time"] = row.ModifiedTime
498
- identifier["creation_time"] = row.CreationTime
499
- identifier["version"] = row.Version
500
- identifier["success"] = row.Success
501
- identifier["auto_conf_value"] = json.loads(row.AutoConfValue) if row.AutoConfValue else None
502
- identifier["user_value"] = json.loads(row.UserValue) if row.UserValue else None
503
- identifier["vital_value"] = json.loads(row.VitalValue) if row.VitalValue else None
504
- identifier["cached_value"] = json.loads(row.CachedValue) if row.CachedValue else None
505
- identifier["desired_value"] = json.loads(row.DesiredValue) if row.DesiredValue else None
506
- identifier["revision"] = row.Revision
475
+
476
+ if table := db.table("Config"):
477
+ for row in table.rows():
478
+ component_name = row.Component
479
+ config_group_name = row.ConfigGroup
480
+ value_group_name = row.Name
481
+ identifier_name = row.Identifier
482
+
483
+ if component_name not in store:
484
+ store[component_name] = {}
485
+ component = store[component_name]
486
+
487
+ if config_group_name not in component:
488
+ component[config_group_name] = {}
489
+ config_group = component[config_group_name]
490
+
491
+ if value_group_name not in config_group:
492
+ config_group[value_group_name] = {}
493
+ value_group = config_group[value_group_name]
494
+
495
+ if identifier_name not in value_group:
496
+ value_group[identifier_name] = {}
497
+ identifier = value_group[identifier_name]
498
+
499
+ identifier["modified_time"] = row.ModifiedTime
500
+ identifier["creation_time"] = row.CreationTime
501
+ identifier["version"] = row.Version
502
+ identifier["success"] = row.Success
503
+ identifier["auto_conf_value"] = json.loads(row.AutoConfValue) if row.AutoConfValue else None
504
+ identifier["user_value"] = json.loads(row.UserValue) if row.UserValue else None
505
+ identifier["vital_value"] = json.loads(row.VitalValue) if row.VitalValue else None
506
+ identifier["cached_value"] = json.loads(row.CachedValue) if row.CachedValue else None
507
+ identifier["desired_value"] = json.loads(row.DesiredValue) if row.DesiredValue else None
508
+ identifier["revision"] = row.Revision
507
509
 
508
510
  return store