dissect.target 3.22.dev41__tar.gz → 3.22.dev43__tar.gz

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev41
+Version: 3.22.dev43
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect/target/filesystem.py

@@ -1773,4 +1773,5 @@ register("zip", "ZipFilesystem")
 register("tar", "TarFilesystem")
 register("vmtar", "VmtarFilesystem")
 register("cpio", "CpioFilesystem")
+register("vbk", "VbkFilesystem")
 register("ad1", "AD1Filesystem")

dissect_target-3.22.dev43/dissect/target/filesystems/vbk.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+import stat
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.archive import vbk
+
+from dissect.target.exceptions import (
+    FileNotFoundError,
+    FilesystemError,
+    IsADirectoryError,
+    NotADirectoryError,
+    NotASymlinkError,
+)
+from dissect.target.filesystem import (
+    Filesystem,
+    FilesystemEntry,
+)
+from dissect.target.helpers import fsutil
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+class VbkFilesystem(Filesystem):
+    """Filesystem implementation for VBK files."""
+
+    __type__ = "vbk"
+
+    def __init__(self, fh: BinaryIO, *args, **kwargs):
+        super().__init__(fh, *args, **kwargs)
+        self.vbk = vbk.VBK(fh)
+
+    @staticmethod
+    def _detect(fh: BinaryIO) -> bool:
+        try:
+            vbk.VBK(fh)
+        except vbk.VBKError:
+            return False
+        else:
+            return True
+
+    def get(self, path: str) -> FilesystemEntry:
+        return VbkFilesystemEntry(self, path, self._get_node(path))
+
+    def _get_node(self, path: str, node: vbk.DirItem | None = None) -> FilesystemEntry:
+        try:
+            return self.vbk.get(path, node)
+        except vbk.FileNotFoundError as e:
+            raise FileNotFoundError(path) from e
+        except vbk.IsADirectoryError as e:
+            raise IsADirectoryError(path) from e
+        except vbk.NotADirectoryError as e:
+            raise NotADirectoryError(path) from e
+        except vbk.Error as e:
+            raise FilesystemError(path) from e
+
+
+class VbkFilesystemEntry(FilesystemEntry):
+    fs: VbkFilesystem
+    entry: vbk.DirItem
+
+    def get(self, path: str) -> FilesystemEntry:
+        return VbkFilesystemEntry(
+            self.fs,
+            fsutil.join(self.path, path, alt_separator=self.fs.alt_separator),
+            self.fs._get_node(path, self.entry),
+        )
+
+    def open(self) -> None:
+        if self.is_dir():
+            raise IsADirectoryError(self.path)
+        return self.entry.open()
+
+    def iterdir(self) -> Iterator[str]:
+        if not self.is_dir():
+            raise NotADirectoryError(self.path)
+
+        for entry in self.entry.iterdir():
+            yield entry.name
+
+    def scandir(self) -> Iterator[FilesystemEntry]:
+        if not self.is_dir():
+            raise NotADirectoryError(self.path)
+
+        for entry in self.entry.iterdir():
+            yield VbkFilesystemEntry(
+                self.fs,
+                fsutil.join(self.path, entry.name, alt_separator=self.fs.alt_separator),
+                entry,
+            )
+
+    def is_dir(self, follow_symlinks: bool = True) -> bool:
+        return self.entry.is_dir()
+
+    def is_file(self, follow_symlinks: bool = True) -> bool:
+        return self.entry.is_file()
+
+    def is_symlink(self) -> bool:
+        return False
+
+    def readlink(self) -> str:
+        raise NotASymlinkError
+
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
+        return self.lstat()
+
+    def lstat(self) -> fsutil.stat_result:
+        mode = stat.S_IFDIR if self.is_dir() else stat.S_IFREG
+        size = 0 if self.is_dir() else self.entry.size
+
+        # ['mode', 'addr', 'dev', 'nlink', 'uid', 'gid', 'size', 'atime', 'mtime', 'ctime']
+        st_info = [
+            mode | 0o755,
+            fsutil.generate_addr(self.path, alt_separator=self.fs.alt_separator),
+            id(self.fs),
+            1,
+            0,
+            0,
+            size,
+            0,
+            0,
+            0,
+        ]
+
+        return fsutil.stat_result(st_info)

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect/target/loader.py

@@ -22,16 +22,19 @@ __all__ = [
 
 log = logging.getLogger(__name__)
 
-LOADERS: list[Loader] = []
-LOADERS_BY_SCHEME: dict[str, Loader] = {}
-MODULE_PATH = "dissect.target.loaders"
-
 DirLoader: Loader = import_lazy("dissect.target.loaders.dir").DirLoader
 """A lazy loaded :class:`dissect.target.loaders.dir.DirLoader`."""
 
 RawLoader: Loader = import_lazy("dissect.target.loaders.raw").RawLoader
 """A lazy loaded :class:`dissect.target.loaders.raw.RawLoader`."""
 
+LOADERS: list[Loader] = []
+LOADERS_BY_SCHEME: dict[str, Loader] = {
+    "dir": DirLoader,
+    "raw": RawLoader,
+}
+MODULE_PATH = "dissect.target.loaders"
+
 
 class Loader:
     """A base class for loading a specific path and coupling it to a :class:`Target <dissect.target.target.Target>`.
@@ -157,8 +160,8 @@ def register(module_name: str, class_name: str, internal: bool = True) -> None:
 
 
 def find_loader(
-    item: Path, parsed_path: urllib.parse.ParseResult | None = None, fallbacks: list[Loader] | None = None
-) -> Loader | None:
+    item: Path, parsed_path: urllib.parse.ParseResult | None = None, fallbacks: list[type[Loader]] | None = None
+) -> type[Loader] | None:
     """Finds a :class:`Loader` class for the specific ``item``.
 
     This searches for a specific :class:`Loader` classs that is able to load a target pointed to by ``item``.
@@ -229,6 +232,7 @@ register("ovf", "OvfLoader")
 register("ova", "OvaLoader")
 register("vbox", "VBoxLoader")
 register("vb", "VBLoader")
+register("vbk", "VbkLoader")
 register("xva", "XvaLoader")
 register("vma", "VmaLoader")
 register("kape", "KapeLoader")

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect/target/loaders/dir.py

@@ -27,7 +27,7 @@ class DirLoader(Loader):
         return find_entry_path(path) is not None
 
     def map(self, target: Target) -> None:
-        path = self.path.joinpath(find_entry_path(self.path))
+        path = self.absolute_path.joinpath(find_entry_path(self.absolute_path))
         find_and_map_dirs(target, path)
 
 
@@ -104,6 +104,7 @@ def find_and_map_dirs(target: Target, path: Path, **kwargs) -> None:
     Args:
         target: The target to map into.
         path: The path to map from.
+            If path is a local path, must be provided as an absolute path in order to work with ``target-mount``.
         **kwargs: Optional arguments for :func:`loaderutil.add_virtual_ntfs_filesystem
             <dissect.target.helpers.loaderutil.add_virtual_ntfs_filesystem>`.
     """

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect/target/loaders/kape.py

@@ -65,7 +65,7 @@ class KapeLoader(DirLoader):
         return False
 
     def map(self, target: Target) -> None:
-        path = self.path if self.path.is_dir() else next(open_vhdx(self.path)).path()
+        path = self.absolute_path if self.absolute_path.is_dir() else next(open_vhdx(self.absolute_path)).path()
 
         find_and_map_dirs(
             target,

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect/target/loaders/tanium.py

@@ -44,7 +44,7 @@ class TaniumLoader(DirLoader):
     def map(self, target: Target) -> None:
         find_and_map_dirs(
             target,
-            self.path.joinpath("file"),
+            self.absolute_path.joinpath("file"),
             sds_path="$Secure_$SDS",
             usnjrnl_path="$Extend/$UsnJrnl_$J",
         )

dissect_target-3.22.dev43/dissect/target/loaders/vbk.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import LoaderError
+from dissect.target.filesystems.vbk import VbkFilesystem
+from dissect.target.loader import Loader, find_loader
+from dissect.target.loaders.raw import RawLoader
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from dissect.target.target import Target
+
+
+RE_RAW_DISK = re.compile(r"(?:[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})|(?:DEV__.+)")
+
+
+class VbkLoader(Loader):
+    """Load Veaam Backup (VBK) files."""
+
+    def __init__(self, path: Path, **kwargs):
+        super().__init__(path, **kwargs)
+        self.vbkfs = VbkFilesystem(path.open("rb"))
+        self.loader = None
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        return path.suffix.lower() == ".vbk"
+
+    def map(self, target: Target) -> None:
+        # We haven't really researched any of the VBK metadata yet, so just try some common formats
+        root = self.vbkfs.path("/")
+        if (base := next(root.glob("*"), None)) is None:
+            raise LoaderError("Unexpected empty VBK filesystem")
+
+        if not (candidates := [path for pattern in ("*.vmx", "*.vmcx") if (path := next(base.glob(pattern), None))]):
+            # Try to look for raw disks
+            if not (disks := [path for path in base.iterdir() if RE_RAW_DISK.match(path.name)]):
+                # Dunno, just give up 🤷‍♂️ should've spent extra time staring at summary.xml
+                raise LoaderError("Unsupported VBK structure")
+
+            candidates.append(root.joinpath("+".join(map(str, disks))))
+
+        # Try to find a loader
+        for candidate in candidates:
+            if (loader := find_loader(candidate, fallbacks=[RawLoader])) is not None:
+                ldr = loader(candidate)
+                ldr.map(target)
+
+                # Store a reference to the loader if we successfully mapped
+                self.loader = ldr
+
+                break
+        else:
+            raise LoaderError("Unsupported VBK structure")

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev41
+Version: 3.22.dev43
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev41 → dissect_target-3.22.dev43}/dissect.target.egg-info/SOURCES.txt

@@ -53,6 +53,7 @@ dissect/target/filesystems/qnxfs.py
 dissect/target/filesystems/smb.py
 dissect/target/filesystems/squashfs.py
 dissect/target/filesystems/tar.py
+dissect/target/filesystems/vbk.py
 dissect/target/filesystems/vmfs.py
 dissect/target/filesystems/vmtar.py
 dissect/target/filesystems/xfs.py
@@ -134,6 +135,7 @@ dissect/target/loaders/tar.py
 dissect/target/loaders/target.py
 dissect/target/loaders/utm.py
 dissect/target/loaders/vb.py
+dissect/target/loaders/vbk.py
 dissect/target/loaders/vbox.py
 dissect/target/loaders/velociraptor.py
 dissect/target/loaders/vma.py
@@ -516,6 +518,7 @@ tests/loaders/test_smb.py
 tests/loaders/test_tanium.py
 tests/loaders/test_tar.py
 tests/loaders/test_utm.py
+tests/loaders/test_vbk.py
 tests/loaders/test_vbox.py
 tests/loaders/test_velociraptor.py
 tests/loaders/test_vmwarevm.py

dissect_target-3.22.dev43/tests/loaders/test_vbk.py

@@ -0,0 +1,35 @@
+from io import BytesIO
+from unittest.mock import Mock, patch
+
+import pytest
+
+from dissect.target.exceptions import LoaderError
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.loaders.raw import RawLoader
+from dissect.target.loaders.vbk import VbkLoader
+from dissect.target.target import Target
+
+
+@patch("dissect.target.loaders.vbk.VbkFilesystem")
+def test_vbk_loader(VbkFilesystem: Mock, target_default: Target) -> None:
+    """Test the VBK loader."""
+    vfs = VirtualFilesystem()
+    VbkFilesystem.return_value = vfs
+
+    loader = VbkLoader(Mock())
+    with pytest.raises(LoaderError, match="Unexpected empty VBK filesystem"):
+        loader.map(target_default)
+
+    vfs.makedirs("a")
+
+    with pytest.raises(LoaderError, match="Unsupported VBK structure"):
+        loader.map(target_default)
+
+    vfs.map_file_fh("a/DEV__dummy", BytesIO("🍖👑".encode()))
+    vfs.map_file_fh("a/summary.xml", BytesIO(b""))
+
+    loader.map(target_default)
+    assert isinstance(loader.loader, RawLoader)
+    assert len(target_default.disks) == 1
+    target_default.disks[0].seek(0)
+    assert target_default.disks[0].read().decode() == "🍖👑"