dissect.target 3.20.2.dev30__tar.gz → 3.20.2.dev32__tar.gz

{dissect_target-3.20.2.dev30/dissect.target.egg-info → dissect_target-3.20.2.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev30
+Version: 3.20.2.dev32
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect/target/loader.py

@@ -61,7 +61,7 @@ class Loader:
     def __init__(self, path: Path, **kwargs):
         self.path = path
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return f"{self.__class__.__name__}('{self.path}')"
 
     @staticmethod

dissect_target-3.20.2.dev32/dissect/target/loaders/vmx.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.hypervisor import vmx
+
+from dissect.target.containers.vmdk import VmdkContainer
+from dissect.target.loader import Loader
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from dissect.target.target import Target
+
+
+class VmxLoader(Loader):
+    """Load VMware virtual machine configuration (VMX) files.
+
+    References:
+        - https://docs.vmware.com/en/VMware-Workstation-Pro/17/com.vmware.ws.using.doc/GUID-A968EF50-BA25-450A-9D1F-F8A9DEE640E7.html  # noqa
+    """
+
+    def __init__(self, path: Path, **kwargs):
+        super().__init__(path.resolve())
+        self.vmx = vmx.VMX.parse(self.path.read_text())
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        return path.suffix.lower() in (".vmx", ".vmtx")
+
+    def map(self, target: Target) -> None:
+        for disk in self.vmx.disks():
+            path = self.path.parent.joinpath(disk)
+
+            if not path.is_file():
+                base, sep, snapshot_id = path.stem.rpartition("-")
+                if sep and len(snapshot_id) == 6 and snapshot_id.isdigit():
+                    # Probably a snapshot, try to load the parent disk
+                    target.log.info(
+                        "Disk not found but seems to be a snapshot, trying previous snapshots: %s", path.name
+                    )
+
+                    snapshot_num = int(snapshot_id)
+                    missing = [path.name]
+                    for i in range(snapshot_num - 1, -1, -1):
+                        snapshot_disk = (
+                            path.with_name(f"{base}{path.suffix}")
+                            if i == 0
+                            else path.with_name(f"{base}-{i:06d}{path.suffix}")
+                        )
+                        target.log.debug("Trying to load snapshot: %s", snapshot_disk.name)
+
+                        if snapshot_disk.is_file():
+                            target.log.warning(
+                                "Missing disk(s) but continuing with found snapshot: %s (missing %s)",
+                                snapshot_disk.name,
+                                ", ".join(missing),
+                            )
+                            path = snapshot_disk
+                            break
+
+                        missing.append(snapshot_disk.name)
+                    else:
+                        target.log.error("Failed to find previous snapshot for disk: %s", path.name)
+                        continue
+                else:
+                    target.log.error("Disk not found: %s", path.name)
+                    continue
+
+            try:
+                target.disks.add(VmdkContainer(path))
+            except Exception:
+                target.log.exception("Failed to load VMDK: %s", disk)

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect/target/plugins/apps/other/env.py

@@ -20,11 +20,11 @@ class EnvironmentFilePlugin(Plugin):
     """Environment file plugin."""
 
     def check_compatible(self) -> None:
-        # `--env-path` is provided at runtime
+        # `--env-path` is required at runtime
         pass
 
     @export(record=EnvironmentFileRecord)
-    @arg("--env-path", help="path to scan environment files in")
+    @arg("--env-path", help="path to scan environment files in", required=True)
     @arg("--extension", help="extension of files to scan", default="env")
     def envfile(self, env_path: str, extension: str = "env") -> Iterator[EnvironmentFileRecord]:
         """Yield environment variables found in ``.env`` files at the provided path."""

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect/target/plugins/filesystem/ntfs/usnjrnl.py

@@ -2,6 +2,7 @@ from typing import Iterator
 
 from dissect.ntfs.c_ntfs import segment_reference
 
+from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 from dissect.target.plugins.filesystem.ntfs.utils import get_drive_letter
@@ -27,7 +28,8 @@ class UsnjrnlPlugin(Plugin):
     """NFTS UsnJrnl plugin."""
 
     def check_compatible(self) -> None:
-        pass
+        if not any(fs for fs in self.target.filesystems if fs.__type__ == "ntfs"):
+            raise UnsupportedPluginError("No NTFS filesystem(s) found on target")
 
     @export(record=UsnjrnlRecord)
     def usnjrnl(self) -> Iterator[UsnjrnlRecord]:

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect/target/plugins/filesystem/walkfs.py

@@ -37,6 +37,17 @@ class WalkFSPlugin(Plugin):
     @arg("--walkfs-path", default="/", help="path to recursively walk")
     def walkfs(self, walkfs_path: str = "/") -> Iterator[FilesystemRecord]:
         """Walk a target's filesystem and return all filesystem entries."""
+
+        path = self.target.fs.path(walkfs_path)
+
+        if not path.exists():
+            self.target.log.error("No such directory: '%s'", walkfs_path)
+            return
+
+        if not path.is_dir():
+            self.target.log.error("Not a directory: '%s'", walkfs_path)
+            return
+
         for entry in self.target.fs.recurse(walkfs_path):
             try:
                 yield generate_record(self.target, entry)

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect/target/plugins/general/osinfo.py

@@ -3,6 +3,7 @@ from typing import Callable, Generator, Iterator, Union
 from flow.record import GroupedRecord
 
 from dissect.target import plugin
+from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 
 OSInfoRecord = TargetRecordDescriptor(
@@ -18,7 +19,8 @@ class OSInfoPlugin(plugin.Plugin):
     """Convenience plugin that wraps _os.* functions in records."""
 
     def check_compatible(self) -> None:
-        pass
+        if not self.target._os_plugin:
+            raise UnsupportedPluginError("No operating system detected on target")
 
     @plugin.export(record=OSInfoRecord)
     def osinfo(self) -> Iterator[Union[OSInfoRecord, GroupedRecord]]:

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect/target/plugins/os/windows/env.py

@@ -3,13 +3,13 @@ from collections import OrderedDict, namedtuple
 from typing import Iterator, List, Optional, Set
 
 from dissect.target import Target
-from dissect.target.exceptions import RegistryError
+from dissect.target.exceptions import RegistryError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.record import (
     TargetRecordDescriptor,
     create_extended_descriptor,
 )
-from dissect.target.plugin import Plugin, export, internal
+from dissect.target.plugin import OperatingSystem, Plugin, export, internal
 
 EnvironmentRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
     "windows/environment",
@@ -303,7 +303,8 @@ class EnvironmentVariablePlugin(Plugin):
         return env_vars
 
     def check_compatible(self) -> None:
-        pass
+        if self.target.os != OperatingSystem.WINDOWS:
+            raise UnsupportedPluginError("Target operating system is not Windows")
 
     @internal
     def expand_env(self, path: str, user_sid: Optional[str] = None) -> str:

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev30
+Version: 3.20.2.dev32
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/dissect.target.egg-info/SOURCES.txt

@@ -475,6 +475,7 @@ tests/loaders/test_utm.py
 tests/loaders/test_vbox.py
 tests/loaders/test_velociraptor.py
 tests/loaders/test_vmwarevm.py
+tests/loaders/test_vmx.py
 tests/plugins/__init__.py
 tests/plugins/apps/__init__.py
 tests/plugins/apps/av/__init__.py

{dissect_target-3.20.2.dev30 → dissect_target-3.20.2.dev32}/tests/loaders/test_vmwarevm.py

@@ -6,22 +6,23 @@ from dissect.hypervisor.descriptor.vmx import VMX
 from dissect.target.containers.vmdk import VmdkContainer
 from dissect.target.loaders.vmwarevm import VmwarevmLoader
 from dissect.target.target import Target
-from tests._utils import mkdirs
 
 
 @patch("dissect.target.loaders.vmx.VmdkContainer")
 @patch("dissect.target.loaders.vmx.vmx.VMX")
-def test_vmwarevm_loader(VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path):
-    root = tmp_path
-    mkdirs(root, ["Test.vmwarevm"])
-    (root / "Test.vmwarevm" / "Test.vmx").touch()
+def test_vmwarevm_loader(VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path) -> None:
+    root = tmp_path.resolve()
+    vm_path = root / "Test.vmwarevm"
+    vm_path.mkdir()
+    (vm_path / "Test.vmx").touch()
+    (vm_path / "mock.vmdk").touch()
 
     VMX.parse.return_value = VMX
     VMX.disks.return_value = ["mock.vmdk"]
     VmdkContainer.return_value = VmdkContainer
 
-    vmwarevm_loader = VmwarevmLoader(root / "Test.vmwarevm")
-    vmwarevm_loader.map(target_bare)
+    assert VmwarevmLoader.detect(vm_path)
 
+    VmwarevmLoader(vm_path).map(target_bare)
     assert len(target_bare.disks) == 1
-    assert VmdkContainer.mock_calls == [call(root.resolve() / "Test.vmwarevm" / "mock.vmdk")]
+    assert VmdkContainer.mock_calls == [call(vm_path / "mock.vmdk")]

dissect_target-3.20.2.dev32/tests/loaders/test_vmx.py

@@ -0,0 +1,138 @@
+import logging
+from pathlib import Path
+from unittest.mock import call, patch
+
+import pytest
+from dissect.hypervisor.descriptor.vmx import VMX
+
+from dissect.target.containers.vmdk import VmdkContainer
+from dissect.target.loaders.vmx import VmxLoader
+from dissect.target.target import Target
+
+
+@patch("dissect.target.loaders.vmx.VmdkContainer")
+@patch("dissect.target.loaders.vmx.vmx.VMX")
+def test_vmx_loader(VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path) -> None:
+    root = tmp_path.resolve()
+    vm_path = root / "Test.vmwarevm"
+    vm_path.mkdir()
+    vmx_path = vm_path / "Test.vmx"
+    vmx_path.touch()
+    (vm_path / "mock.vmdk").touch()
+
+    VMX.parse.return_value = VMX
+    VMX.disks.return_value = ["mock.vmdk"]
+    VmdkContainer.return_value = VmdkContainer
+
+    assert VmxLoader.detect(vmx_path)
+
+    VmxLoader(vmx_path).map(target_bare)
+    assert len(target_bare.disks) == 1
+    assert VmdkContainer.mock_calls == [call(vm_path / "mock.vmdk")]
+
+
+@patch("dissect.target.loaders.vmx.VmdkContainer")
+@patch("dissect.target.loaders.vmx.vmx.VMX")
+def test_vmx_loader_missing_disk(
+    VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path, caplog: pytest.LogCaptureFixture
+) -> None:
+    root = tmp_path.resolve()
+    vm_path = root / "Test.vmwarevm"
+    vm_path.mkdir()
+    vmx_path = vm_path / "Test.vmx"
+    vmx_path.touch()
+
+    VMX.parse.return_value = VMX
+    VMX.disks.return_value = ["mock.vmdk"]
+    VmdkContainer.return_value = VmdkContainer
+
+    assert VmxLoader.detect(vmx_path)
+
+    VmxLoader(vmx_path).map(target_bare)
+    assert len(target_bare.disks) == 0
+
+    assert "Disk not found: mock.vmdk" in caplog.text
+
+
+@patch("dissect.target.loaders.vmx.VmdkContainer")
+@patch("dissect.target.loaders.vmx.vmx.VMX")
+def test_vmx_loader_missing_snapshots(
+    VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path, caplog: pytest.LogCaptureFixture
+) -> None:
+    root = tmp_path
+    vm_path = root / "Test.vmwarevm"
+    vm_path.mkdir()
+    vmx_path = vm_path / "Test.vmx"
+    vmx_path.touch()
+    (vm_path / "mock.vmdk").touch()
+    (vm_path / "mock-000001.vmdk").touch()
+
+    VMX.parse.return_value = VMX
+    VMX.disks.return_value = ["mock-000002.vmdk"]
+    VmdkContainer.return_value = VmdkContainer
+
+    caplog.set_level(logging.DEBUG)
+
+    VmxLoader(vmx_path).map(target_bare)
+    assert len(target_bare.disks) == 1
+    assert VmdkContainer.mock_calls == [call(vm_path / "mock-000001.vmdk")]
+
+    assert "Disk not found but seems to be a snapshot, trying previous snapshots: mock-000002.vmdk" in caplog.text
+    assert "Trying to load snapshot: mock-000001.vmdk" in caplog.text
+    assert (
+        "Missing disk(s) but continuing with found snapshot: mock-000001.vmdk (missing mock-000002.vmdk)" in caplog.text
+    )
+
+
+@patch("dissect.target.loaders.vmx.VmdkContainer")
+@patch("dissect.target.loaders.vmx.vmx.VMX")
+def test_vmx_loader_missing_snapshots_base(
+    VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path, caplog: pytest.LogCaptureFixture
+) -> None:
+    root = tmp_path
+    vm_path = root / "Test.vmwarevm"
+    vm_path.mkdir()
+    vmx_path = vm_path / "Test.vmx"
+    vmx_path.touch()
+    (vm_path / "mock.vmdk").touch()
+
+    VMX.parse.return_value = VMX
+    VMX.disks.return_value = ["mock-000002.vmdk"]
+    VmdkContainer.return_value = VmdkContainer
+
+    caplog.set_level(logging.DEBUG)
+
+    VmxLoader(vmx_path).map(target_bare)
+    assert len(target_bare.disks) == 1
+    assert VmdkContainer.mock_calls == [call(vm_path / "mock.vmdk")]
+
+    assert "Disk not found but seems to be a snapshot, trying previous snapshots: mock-000002.vmdk" in caplog.text
+    assert "Trying to load snapshot: mock-000001.vmdk" in caplog.text
+    assert "Trying to load snapshot: mock.vmdk" in caplog.text
+    assert (
+        "Missing disk(s) but continuing with found snapshot: mock.vmdk (missing mock-000002.vmdk, mock-000001.vmdk)"
+        in caplog.text
+    )
+
+
+@patch("dissect.target.loaders.vmx.VmdkContainer")
+@patch("dissect.target.loaders.vmx.vmx.VMX")
+def test_vmx_loader_missing_all_snapshots(
+    VMX: VMX, VmdkContainer: VmdkContainer, target_bare: Target, tmp_path: Path, caplog: pytest.LogCaptureFixture
+) -> None:
+    root = tmp_path
+    vm_path = root / "Test.vmwarevm"
+    vm_path.mkdir()
+    vmx_path = vm_path / "Test.vmx"
+    vmx_path.touch()
+
+    VMX.parse.return_value = VMX
+    VMX.disks.return_value = ["mock-000001.vmdk"]
+    VmdkContainer.return_value = VmdkContainer
+
+    caplog.set_level(logging.DEBUG)
+
+    VmxLoader(vmx_path).map(target_bare)
+    assert len(target_bare.disks) == 0
+
+    assert "Failed to find previous snapshot for disk: mock-000001.vmdk" in caplog.text

dissect_target-3.20.2.dev30/dissect/target/loaders/vmx.py

@@ -1,31 +0,0 @@
-from dissect.hypervisor import vmx
-
-from dissect.target.containers.vmdk import VmdkContainer
-from dissect.target.loader import Loader
-
-
-class VmxLoader(Loader):
-    """Load VMware virtual machine configuration (VMX) files.
-
-    References:
-        - https://docs.vmware.com/en/VMware-Workstation-Pro/17/com.vmware.ws.using.doc/GUID-A968EF50-BA25-450A-9D1F-F8A9DEE640E7.html  # noqa
-    """
-
-    def __init__(self, path, **kwargs):
-        path = path.resolve()
-
-        super().__init__(path)
-        self.vmx = vmx.VMX.parse(path.read_text())
-        self.base_dir = path.parent
-
-    @staticmethod
-    def detect(path):
-        return path.suffix.lower() in (".vmx", ".vmtx")
-
-    def map(self, target):
-        for disk in self.vmx.disks():
-            path = self.base_dir.joinpath(disk)
-            try:
-                target.disks.add(VmdkContainer(path))
-            except Exception:
-                target.log.exception("Failed to load VMDK: %s", disk)