dissect.target 3.22.dev40__tar.gz → 3.22.dev42__tar.gz

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev40
+Version: 3.22.dev42
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/loaders/dir.py

@@ -27,7 +27,7 @@ class DirLoader(Loader):
         return find_entry_path(path) is not None
 
     def map(self, target: Target) -> None:
-        path = self.path.joinpath(find_entry_path(self.path))
+        path = self.absolute_path.joinpath(find_entry_path(self.absolute_path))
         find_and_map_dirs(target, path)
 
 
@@ -104,6 +104,7 @@ def find_and_map_dirs(target: Target, path: Path, **kwargs) -> None:
     Args:
         target: The target to map into.
         path: The path to map from.
+            If path is a local path, must be provided as an absolute path in order to work with ``target-mount``.
         **kwargs: Optional arguments for :func:`loaderutil.add_virtual_ntfs_filesystem
             <dissect.target.helpers.loaderutil.add_virtual_ntfs_filesystem>`.
     """

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/loaders/kape.py

@@ -65,7 +65,7 @@ class KapeLoader(DirLoader):
         return False
 
     def map(self, target: Target) -> None:
-        path = self.path if self.path.is_dir() else next(open_vhdx(self.path)).path()
+        path = self.absolute_path if self.absolute_path.is_dir() else next(open_vhdx(self.absolute_path)).path()
 
         find_and_map_dirs(
             target,

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/loaders/tanium.py

@@ -44,7 +44,7 @@ class TaniumLoader(DirLoader):
     def map(self, target: Target) -> None:
         find_and_map_dirs(
             target,
-            self.path.joinpath("file"),
+            self.absolute_path.joinpath("file"),
             sds_path="$Secure_$SDS",
             usnjrnl_path="$Extend/$UsnJrnl_$J",
         )

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/plugins/apps/productivity/msoffice.py

@@ -315,8 +315,7 @@ class MSOffice(Plugin):
     def _walk_startup_folder(self, startup_folder: str, user_sid: str | None = None) -> Iterator[OfficeStartupItem]:
         """Resolve the given path and return all statup items."""
 
-        resolved_startup_folder_str = self.target.resolve(startup_folder, user_sid)
-        resolved_startup_folder: Path = self.target.fs.path(resolved_startup_folder_str)
+        resolved_startup_folder: Path = self.target.resolve(startup_folder, user_sid)
         if not resolved_startup_folder.is_dir():
             return
 

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/plugins/apps/webserver/iis.py

@@ -94,8 +94,7 @@ class IISLogsPlugin(WebserverPlugin):
             for log_file_element in xml_data.findall("*/sites/*/logFile"):
                 log_format = log_file_element.get("logFormat") or "W3C"
                 if log_dir := log_file_element.get("directory"):
-                    log_dir = self.target.resolve(log_dir)
-                    log_paths.add((log_format, log_dir))
+                    log_paths.add((log_format, self.target.resolve(log_dir)))
 
         except (ElementTree.ParseError, DissectFileNotFoundError) as e:
             self.target.log.warning("Error while parsing %s:%s", self.config, e)

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/plugins/filesystem/resolver.py

@@ -29,11 +29,11 @@ class ResolverPlugin(Plugin):
     def resolve(self, path: str, user: str | None = None) -> fsutil.TargetPath:
         """Resolve a partial path string to a file or directory present in the target.
 
-        For Windows known file locations are searched, e.g. paths from the %path% variable and common path extentions
-        tried. If a user SID is provided that user's %path% variable is used.
+        For Windows known file locations are searched, e.g. paths from the ``%path%`` variable and common
+        path extensions tried. If a user SID is provided that user's ``%path%`` variable is used.
         """
         if not path:
-            return path
+            return self.target.fs.path(path)
 
         if self.target.os == OperatingSystem.WINDOWS:
             resolved_path = self.resolve_windows(path, user_sid=user)

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/plugins/general/users.py

@@ -72,7 +72,7 @@ class UsersPlugin(InternalPlugin):
         # Resolving the user home can not use the user's environment variables,
         # as those depend on the user's home to be known first. So we resolve
         # without providing the user (s)id.
-        home_path = self.target.fs.path(self.target.resolve(str(user.home))) if user.home else None
+        home_path = self.target.resolve(str(user.home)) if user.home else None
         return UserDetails(user=user, home_path=home_path)
 
     def all(self) -> Iterator[UserDetails]:

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect/target/plugins/os/windows/amcache.py

@@ -193,11 +193,27 @@ ContainerAppcompatRecord = TargetRecordDescriptor(
     ],
 )
 
-AppLaunchAppcompatRecord = TargetRecordDescriptor(
-    "windows/appcompat/AppLaunch",
+PcaAppLaunchAppcompatRecord = TargetRecordDescriptor(
+    "windows/appcompat/pca/AppLaunch",
     [
         ("datetime", "ts"),
         ("path", "path"),
+        ("path", "source"),
+    ],
+)
+
+PcaGeneralAppcompatRecord = TargetRecordDescriptor(
+    "windows/appcompat/pca/General",
+    [
+        ("datetime", "ts"),
+        ("path", "path"),
+        ("varint", "type"),
+        ("string", "name"),
+        ("string", "copyright"),
+        ("string", "version"),
+        ("string", "program_id"),
+        ("string", "exit_code"),
+        ("path", "source"),
     ],
 )
 
@@ -345,11 +361,8 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
         if fpath.exists():
             self.amcache.add(regutil.RegfHive(fpath))
 
-        if self.target.fs.path("sysvol/windows/appcompat/pca/PcaAppLaunchDic.txt").exists():
-            self.amcache_applaunch = True
-
     def check_compatible(self) -> None:
-        if not len(self.amcache) > 0 and not self.amcache_applaunch:
+        if not self.amcache and not next(self.target.fs.path("sysvol/windows/appcompat/pca").glob("Pca*.txt"), None):
             raise UnsupportedPluginError("Could not load amcache.hve or find AppLaunchDic")
 
     def read_key_subkeys(self, key: str) -> Iterator[regutil.RegistryKey]:
@@ -621,25 +634,64 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
         if self.amcache:
             yield from self.parse_inventory_device_container()
 
-    @export(record=AppLaunchAppcompatRecord)
-    def applaunches(self) -> Iterator[AppLaunchAppcompatRecord]:
-        """Return AppLaunchAppcompatRecord records from Amcache applaunch files (Windows 11 22H2 or later).
+    @export(record=PcaAppLaunchAppcompatRecord)
+    def applaunches(self) -> Iterator[PcaAppLaunchAppcompatRecord]:
+        """Return PcaAppLaunchAppcompatRecord records from Amcache PCA AppLaunch files (Windows 11 22H2 or later).
 
-        TODO: Research C:\\Windows\\appcompat\\pca\\PcaGeneralDb0.txt and
-              C:\\Windows\\appcompat\\pca\\PcaGeneralDb1.txt files.
+        References:
+            - https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/
+        """
+
+        if (path := self.target.fs.path("sysvol/windows/appcompat/pca/PcaAppLaunchDic.txt")).exists():
+            for line in path.open("rt"):
+                if not (line := line.strip()):
+                    continue
+
+                parts = line.split("|")
+                if len(parts) != 2:
+                    self.target.log.warning("Invalid line in PcaAppLaunchDic.txt, ignoring: %s", line)
+                    continue
+
+                app_path, ts = parts
+
+                yield PcaAppLaunchAppcompatRecord(
+                    ts=datetime.strptime(ts, "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
+                    path=self.target.fs.path(app_path),
+                    source=path,
+                    _target=self.target,
+                )
+
+    @export(record=PcaGeneralAppcompatRecord)
+    def general(self) -> Iterator[PcaGeneralAppcompatRecord]:
+        """Return PcaGeneralAppcompatRecord records from Amcache PCA General files (Windows 11 22H2 or later).
 
         References:
             - https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/
+            - https://www.sygnia.co/blog/new-windows-11-pca-artifact/
         """
 
-        if (fh := self.target.fs.path("sysvol/windows/appcompat/pca/PcaAppLaunchDic.txt")).exists():
-            for line in fh.open("rt"):
-                if line.startswith("#") or line.strip() == "":
+        for path in self.target.fs.path("sysvol/windows/appcompat/pca").glob("PcaGeneralDb*.txt"):
+            for line in path.open("rt", encoding="utf-16-le"):
+                if not (line := line.strip()):
                     continue
-                parts = line.rstrip().split("|")
-                yield AppLaunchAppcompatRecord(
-                    ts=datetime.strptime(parts[-1], "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
-                    path=self.target.fs.path(parts[0]),
+
+                parts = line.split("|")
+                if len(parts) != 8:
+                    self.target.log.warning("Invalid line in %s, ignoring: %s", path.name, line)
+                    continue
+
+                ts, type_, app_path, name, copyright, version, program_id, exit_code = parts
+
+                yield PcaGeneralAppcompatRecord(
+                    ts=datetime.strptime(ts, "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
+                    path=self.target.resolve(app_path),
+                    type=int(type_),
+                    name=name,
+                    copyright=copyright,
+                    version=version,
+                    program_id=program_id,
+                    exit_code=exit_code,
+                    source=path,
                     _target=self.target,
                 )
 

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev40
+Version: 3.22.dev42
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/tests/plugins/filesystem/test_resolver.py

@@ -41,7 +41,7 @@ def test_resolve(target_win: Target, target_unix: Target, test_target: str, reso
 
 def test_resolve_no_path(target_win: Target) -> None:
     path = ""
-    assert target_win.resolve(path) is path
+    assert target_win.resolve(path) == target_win.fs.path(path)
 
 
 def mock_expand_env(path: str, user_sid: str | None = None) -> str:

{dissect_target-3.22.dev40 → dissect_target-3.22.dev42}/tests/plugins/os/windows/log/test_amcache.py

@@ -1,12 +1,14 @@
 from __future__ import annotations
 
 import datetime
+from io import BytesIO
 from pathlib import Path
 from typing import TYPE_CHECKING
 from unittest.mock import Mock, patch
 
 import pytest
 
+from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.plugins.os.windows.amcache import AmcachePlugin
 from dissect.target.plugins.os.windows.log.amcache import AmcacheInstallPlugin
 from tests._utils import absolute_path
@@ -67,7 +69,9 @@ def test_amcache_old_format(target_win: Target, fs_win: VirtualFilesystem) -> No
 
 
 def test_amcache_windows_11_applaunches(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    applaunch_file = absolute_path("_data/plugins/os/windows/amcache/PcaAppLaunchDic.txt")
+    # Test file taken from https://github.com/AndrewRathbun/DFIRArtifactMuseum/blob/main/Windows/Amcache/Win11/RathbunVM/PcaAppLaunchDic.txt
+    # Licensed under the MIT License, Copyright (c) 2022 DFIR Artifact Museum
+    applaunch_file = absolute_path("_data/plugins/os/windows/amcache/pca/PcaAppLaunchDic.txt")
     fs_win.map_file("windows/appcompat/pca/PcaAppLaunchDic.txt", applaunch_file)
 
     target_win.add_plugin(AmcachePlugin)
@@ -78,6 +82,37 @@ def test_amcache_windows_11_applaunches(target_win: Target, fs_win: VirtualFiles
     assert applaunches[0].path == "C:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate1.dir\\su-setup32.exe"
 
 
+def test_amcache_windows_11_general(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    # Test files taken from https://github.com/AndrewRathbun/DFIRArtifactMuseum/blob/main/Windows/Amcache/Win11/RathbunVM/PcaGeneralDb0.txt
+    # and https://github.com/AndrewRathbun/DFIRArtifactMuseum/blob/main/Windows/Amcache/Win11/RathbunVM/PcaGeneralDb1.txt
+    # Licensed under the MIT License, Copyright (c) 2022 DFIR Artifact Museum
+    db0_file = absolute_path("_data/plugins/os/windows/amcache/pca/PcaGeneralDb0.txt")
+    db1_file = absolute_path("_data/plugins/os/windows/amcache/pca/PcaGeneralDb1.txt")
+    fs_win.map_file("windows/appcompat/pca/PcaGeneralDb0.txt", db0_file)
+    fs_win.map_file("windows/appcompat/pca/PcaGeneralDb1.txt", db1_file)
+
+    # To test path resolving
+    fs_win.map_file_fh("C:\\Program Files\\freefilesync\\bin\\freefilesync_x64.exe", BytesIO(b""))
+
+    target_win.add_plugin(AmcachePlugin)
+
+    with patch(
+        "dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin._get_system_env_vars",
+        return_value={"%programfiles%": "C:\\Program Files"},
+    ):
+        records = list(target_win.amcache.general())
+
+        assert len(records) == 176
+        assert records[0].ts == datetime.datetime(2022, 5, 12, 19, 48, 9, 548000, tzinfo=datetime.timezone.utc)
+        assert records[0].path == "C:\\Program Files\\freefilesync\\freefilesync.exe"
+        assert records[0].type == 2
+        assert records[0].name == "freefilesync"
+        assert records[0].copyright == "freefilesync.org"
+        assert records[0].version == "11.20"
+        assert records[0].program_id == "000617915288ba535b4198ae58be4d9e2a4200000904"
+        assert records[0].exit_code == "Abnormal process exit with code 0x2"
+
+
 def mock_read_key_subkeys(self: AmcachePlugin, key: str) -> Iterator[Mock]:
     base_values = {
         "AppxPackageFullName": "Microsoft.Microsoft3DViewer_7.2105.4012.0_x64__8wekyb3d8bbwe",