dissect.target 3.20.2.dev35__tar.gz → 3.20.2.dev37__tar.gz

{dissect_target-3.20.2.dev35/dissect.target.egg-info → dissect_target-3.20.2.dev37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev35
+Version: 3.20.2.dev37
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev35 → dissect_target-3.20.2.dev37}/dissect/target/containers/fortifw.py

@@ -84,7 +84,7 @@ class FortiFirmwareFile(AlignedStream):
             if dec.unused_data:
                 self.trailer_offset = self.fh.seek(-len(dec.unused_data), io.SEEK_END)
                 self.trailer_data = self.fh.read()
-                log.info("Found trailer offset: %d, data: %r", self.trailer_offset, self.trailer_data)
+                log.debug("Found trailer offset: %d, data: %r", self.trailer_offset, self.trailer_data)
                 self.fh = RangeStream(self.fh, 0, self.trailer_offset)
 
             self.fh.seek(0)

{dissect_target-3.20.2.dev35 → dissect_target-3.20.2.dev37}/dissect/target/plugins/apps/productivity/msoffice.py

@@ -19,13 +19,13 @@ from dissect.target.plugin import Plugin, export
 from dissect.target.target import Target
 
 OfficeStartupItem = TargetRecordDescriptor(
-    "productivity/msoffice/startup_item",
+    "application/productivity/msoffice/startup_item",
     [("path", "path"), ("datetime", "creation_time"), ("datetime", "modification_time")],
 )
 
 # Web add-in
 OfficeWebAddinRecord = TargetRecordDescriptor(
-    "productivity/msoffice/web_addin",
+    "application/productivity/msoffice/web_addin",
     [
         ("path", "manifest"),
         ("datetime", "modification_time"),
@@ -38,7 +38,7 @@ OfficeWebAddinRecord = TargetRecordDescriptor(
 
 # COM and VSTO add-ins
 OfficeNativeAddinRecord = TargetRecordDescriptor(
-    "productivity/msoffice/native_addin",
+    "application/productivity/msoffice/native_addin",
     [
         ("path", "manifest"),
         ("datetime", "modification_time"),

dissect_target-3.20.2.dev35/dissect/target/plugins/os/windows/regf/7zip.py → dissect_target-3.20.2.dev37/dissect/target/plugins/apps/productivity/sevenzip.py

@@ -1,55 +1,54 @@
 from __future__ import annotations
 
-from typing import Iterator
+from typing import Iterator, Union
 
 from dissect.target.exceptions import RegistryError, UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export
+from dissect.target.helpers.regutil import RegistryKey
+from dissect.target.plugin import Plugin, alias, export
 
 PanelPathRecord = TargetRecordDescriptor(
-    "windows/registry/sevenzip/panelpath",
+    "application/productivity/sevenzip/panelpath",
     [
         ("datetime", "ts"),
         ("path", "path"),
     ],
 )
 
-
 ArcHistoryRecord = TargetRecordDescriptor(
-    "windows/registry/sevenzip/archistory",
+    "application/productivity/sevenzip/archistory",
     [
         ("datetime", "ts"),
         ("path", "path"),
     ],
 )
 
-
 PathHistoryRecord = TargetRecordDescriptor(
-    "windows/registry/sevenzip/pathhistory",
+    "application/productivity/sevenzip/pathhistory",
     [
         ("datetime", "ts"),
         ("path", "path"),
     ],
 )
 
-
 CopyHistoryRecord = TargetRecordDescriptor(
-    "windows/registry/sevenzip/copyhistory",
+    "application/productivity/sevenzip/copyhistory",
     [
         ("datetime", "ts"),
         ("path", "path"),
     ],
 )
 
-
 FolderHistoryRecord = TargetRecordDescriptor(
-    "windows/registry/sevenzip/folderhistory",
+    "application/productivity/sevenzip/folderhistory",
     [
         ("datetime", "ts"),
         ("path", "path"),
     ],
 )
 
+SevenZipRecord = Union[PanelPathRecord, ArcHistoryRecord, PathHistoryRecord, CopyHistoryRecord, FolderHistoryRecord]
+
 
 class SevenZipPlugin(Plugin):
     """Windows 7-Zip GUI plugin."""
@@ -57,10 +56,12 @@ class SevenZipPlugin(Plugin):
     KEY = "HKCU\\Software\\7-Zip"
 
     def check_compatible(self) -> None:
-        if not len(list(self.target.registry.keys(self.KEY))) > 0:
+        if not self.target.has_function("registry") or not list(self.target.registry.keys(self.KEY)):
             raise UnsupportedPluginError("7-Zip registry key not found")
 
-    def parse_key(self, key, keyname, valuename, record):
+    def parse_key(
+        self, key: RegistryKey, keyname: str, valuename: str, record: TargetRecordDescriptor
+    ) -> Iterator[TargetRecordDescriptor]:
         try:
             subkey = key.subkey(keyname)
             value = subkey.value(valuename).value
@@ -76,15 +77,14 @@ class SevenZipPlugin(Plugin):
         except RegistryError:
             pass
 
-    @export(record=[PanelPathRecord, ArcHistoryRecord, PathHistoryRecord, CopyHistoryRecord, FolderHistoryRecord])
-    def sevenzip(
-        self,
-    ) -> Iterator[PanelPathRecord | ArcHistoryRecord | PathHistoryRecord | CopyHistoryRecord | FolderHistoryRecord]:
-        """Return 7-Zip history information from the registry.
+    @export(record=SevenZipRecord)
+    @alias("7zip")
+    def sevenzip(self) -> Iterator[SevenZipRecord]:
+        """Return 7-Zip GUI history information from the registry.
 
         7-Zip is an open source file archiver. If the HKCU\\Software\\7-Zip registry key exists, it checks for
         additional registry keys, such as ArcHistory and FolderHistory. This might provide insight in which files have
-        been archived by 7-Zip.
+        been archived by the 7-Zip GUI.
 
         References:
             - https://www.7-zip.org/
@@ -102,14 +102,7 @@ class SevenZipPlugin(Plugin):
             except RegistryError:
                 pass
 
-            for record in self.parse_key(key, "Compression", "ArcHistory", ArcHistoryRecord):
-                yield record
-
-            for record in self.parse_key(key, "Extraction", "PathHistory", PathHistoryRecord):
-                yield record
-
-            for record in self.parse_key(key, "FM", "CopyHistory", CopyHistoryRecord):
-                yield record
-
-            for record in self.parse_key(key, "FM", "FolderHistory", FolderHistoryRecord):
-                yield record
+            yield from self.parse_key(key, "Compression", "ArcHistory", ArcHistoryRecord)
+            yield from self.parse_key(key, "Extraction", "PathHistory", PathHistoryRecord)
+            yield from self.parse_key(key, "FM", "CopyHistory", CopyHistoryRecord)
+            yield from self.parse_key(key, "FM", "FolderHistory", FolderHistoryRecord)

dissect_target-3.20.2.dev37/dissect/target/plugins/apps/productivity/winrar.py

@@ -0,0 +1,44 @@
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.os.windows.generic import UserRegistryRecordDescriptor
+
+WinRarRecord = UserRegistryRecordDescriptor(
+    "application/productivity/winrar",
+    [
+        ("datetime", "ts"),
+        ("path", "path"),
+    ],
+)
+
+
+class WinRarPlugin(Plugin):
+    """Windows WinRAR GUI plugin."""
+
+    BASE_KEY = "HKEY_CURRENT_USER\\Software\\WinRAR"
+
+    def check_compatible(self):
+        if not self.target.has_function("registry") or not list(self.target.registry.keys(self.BASE_KEY)):
+            raise UnsupportedPluginError("No WinRAR registry keys found on target")
+
+    @export(record=WinRarRecord)
+    def winrar(self) -> Iterator[WinRarRecord]:
+        """Return all available WinRAR history registry key values."""
+        keys = [
+            "ArcHistory",
+            "DialogEditHistory\\ArcName",
+            "DialogEditHistory\\ExtrPath",
+        ]
+
+        for key in keys:
+            for r in self.target.registry.keys(f"{self.BASE_KEY}\\{key}"):
+                user = self.target.registry.get_user(r)
+                for v in r.values():
+                    yield WinRarRecord(
+                        ts=r.ts,
+                        path=self.target.fs.path(v.value),
+                        _key=r,
+                        _user=user,
+                        _target=self.target,
+                    )