dissect.target 3.22.dev57__tar.gz → 3.22.dev59__tar.gz

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev57
+Version: 3.22.dev59
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/dissect/target/plugins/os/windows/datetime.py

@@ -76,6 +76,9 @@ def parse_systemtime_transition(systemtime: c_tz._SYSTEMTIME, year: int) -> date
     Reference:
         - https://docs.microsoft.com/en-us/windows/win32/api/timezoneapi/ns-timezoneapi-time_zone_information
     """
+    if not (1 <= systemtime.wDay <= 5):
+        raise ValueError("systemtime.wDay should be between 1 and 5")
+
     month = SundayFirstCalendar.monthdayscalendar(year, systemtime.wMonth)
     occurrences = [week[systemtime.wDayOfWeek] for week in month if week[systemtime.wDayOfWeek]]
     target_occurrence = -1 if systemtime.wDay == 5 and len(occurrences) < 5 else systemtime.wDay - 1
@@ -155,6 +158,10 @@ class WindowsTimezone(tzinfo):
         assert dt.tzinfo is self
 
         tzi = self.dynamic_dst.get(dt.year, self.tzi)
+        # If the time zone does not support daylight saving time the wMonth member is zero
+        if tzi.daylight_date.wMonth == 0 or tzi.standard_date.wMonth == 0:
+            return False
+
         start, end = get_dst_range(tzi, dt.year)
 
         # DST is flipped in some regions

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/dissect/target/plugins/os/windows/network.py

@@ -244,9 +244,13 @@ def _get_config_value(key: RegistryKey, name: str, sep: str | None = None) -> se
 
 def _construct_interface(key: RegistryKey, ip_key: str, subnet_key: str) -> set[str]:
     interface = ""
+
     if ip := _get_config_value(key, ip_key):
         interface = next(iter(ip))
 
+    if not interface:
+        return set()
+
     if subnet := _get_config_value(key, subnet_key):
         interface = f"{interface}/{next(iter(subnet))}"
 

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev57
+Version: 3.22.dev59
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/tests/conftest.py

@@ -464,6 +464,13 @@ def target_win_tzinfo(hive_hklm: VirtualHive, target_win: Target) -> Target:
     east_tzi = bytes.fromhex("6801000000000000c4ffffff0000040006000100160000000000000000000900060001001600000000000000")
     east_tz_data.add_value("TZI", east_tzi)
 
+    utc_tz_data_path = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UTC"
+    utc_tz_data = VirtualKey(hive_hklm, utc_tz_data_path)
+    utc_tz_data.add_value("Display", "(UTC) Coordinated Universal Time")
+    utc_tz_data.add_value("Dlt", "Coordinated Universal Time")
+    utc_tz_data.add_value("Std", "Coordinated Universal Time")
+    utc_tz_data.add_value("TZI", b"\x00" * 44)
+
     dynamic_dst = VirtualKey(hive_hklm, east_tz_data_path + "\\Dynamic DST")
     dynamic_dst.add_value("FirstEntry", 2019)
     dynamic_dst.add_value("LastEntry", 2019)
@@ -474,6 +481,7 @@ def target_win_tzinfo(hive_hklm: VirtualHive, target_win: Target) -> Target:
     hive_hklm.map_key(tz_info_path, tz_info)
     hive_hklm.map_key(eu_tz_data_path, eu_tz_data)
     hive_hklm.map_key(east_tz_data_path, east_tz_data)
+    hive_hklm.map_key(utc_tz_data_path, utc_tz_data)
 
     return target_win
 

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/tests/plugins/os/windows/test_datetime.py

@@ -3,8 +3,10 @@ from __future__ import annotations
 import datetime
 from typing import TYPE_CHECKING
 
+import pytest
+
 from dissect.target.helpers.regutil import RegistryHive, VirtualKey, VirtualValue
-from dissect.target.plugins.os.windows.datetime import WindowsDateTimePlugin
+from dissect.target.plugins.os.windows.datetime import WindowsDateTimePlugin, c_tz, parse_systemtime_transition
 from dissect.target.plugins.os.windows.locale import WindowsLocalePlugin
 
 if TYPE_CHECKING:
@@ -59,6 +61,10 @@ def test_windows_datetime(target_win_tzinfo: Target) -> None:
     assert not eu_tzinfo.is_dst(datetime.datetime(2022, 3, 27, 2, 0, 0, tzinfo=eu_tzinfo))
     assert eu_tzinfo.is_dst(datetime.datetime(2022, 3, 27, 3, 0, 0, tzinfo=eu_tzinfo))
 
+    # Test utc tzinfo is_dst
+    utc_tzinfo = target_win_tzinfo.datetime.tz("UTC")
+    assert not utc_tzinfo.is_dst(datetime.datetime(2022, 3, 27, 2, 0, 0, tzinfo=utc_tzinfo))
+
 
 def test_windows_timezone_legacy(target_win_tzinfo_legacy: Target) -> None:
     # Older Windows version (prior to Windows 7) use localized time zone ids like "Paaseiland"
@@ -118,3 +124,24 @@ def test_windows_datetime_foreign(target_win_users: Target, hive_hku: RegistryHi
 
     target_win_users.add_plugin(WindowsLocalePlugin)
     assert target_win_users.timezone == "America/Los_Angeles"
+
+
+def test_parse_systemtime_transition() -> None:
+    # Test behaviour where not all week days are defined in every week for that month
+    systemtime = c_tz._SYSTEMTIME(wDay=5, wMonth=10)
+    output = parse_systemtime_transition(systemtime, 2025)
+    assert output == datetime.datetime(2025, 10, 26, tzinfo=None)  # noqa
+
+    # Test behaviour where a weekday of the month occurs 5 times during that month
+    systemtime = c_tz._SYSTEMTIME(wDay=5, wMonth=10, wDayOfWeek=4)
+    output = parse_systemtime_transition(systemtime, 2025)
+    assert output == datetime.datetime(2025, 10, 30, tzinfo=None)  # noqa
+
+    # wDay in this case should only go between 1-5, so this should crash
+    systemtime = c_tz._SYSTEMTIME(wDay=6)
+    with pytest.raises(ValueError, match="systemtime.wDay should be between 1 and 5"):
+        parse_systemtime_transition(systemtime, 2025)
+
+    systemtime = c_tz._SYSTEMTIME(wDay=0)
+    with pytest.raises(ValueError, match="systemtime.wDay should be between 1 and 5"):
+        parse_systemtime_transition(systemtime, 2025)

{dissect_target-3.22.dev57 → dissect_target-3.22.dev59}/tests/plugins/os/windows/test_network.py

@@ -130,6 +130,20 @@ REGISTRY_KEY_CONNECTION = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Network\\{4
             },
             id="OTHER empty",
         ),
+        pytest.param(
+            {
+                "NetCfgInstanceId": "TESTINGINSTANCEID",
+                "EnableDHCP": 1,
+                "DhcpIPAddress": "0.0.0.0",
+                "DhcpSubnetMask": "255.255.255.0",
+            },
+            {
+                "_NO_INTERFACES": True,
+                "enabled": True,
+                "cidr": {},  # and not {'/255.255.255.0'}
+            },
+            id="invalid cidr",
+        ),
     ],
 )
 def test_windows_network(
@@ -167,6 +181,11 @@ def test_windows_network(
         assert network.gateways() == expected_values.get("gateway", [])
         assert network.macs() == expected_values.get("mac", [])
 
+        if expected_values.get("_NO_INTERFACES"):
+            with pytest.raises(StopIteration):
+                next(iter(network.interfaces()))
+            return
+
         network_interface = next(iter(network.interfaces()))
         assert network_interface.name == expected_values.get("name")
         assert network_interface.type == expected_values.get("type")