dissect.target 3.23.2.dev4__tar.gz → 3.23.2.dev8__tar.gz

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev4
+Version: 3.23.2.dev8
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -25,7 +25,7 @@ Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.eventlog<4,>=3
 Requires-Dist: dissect.evidence<4,>=3
-Requires-Dist: dissect.hypervisor<4,>=3.19
+Requires-Dist: dissect.hypervisor<4,>=3.20.dev
 Requires-Dist: dissect.ntfs<4,>=3.15.dev1
 Requires-Dist: dissect.regf<4,>=3.13
 Requires-Dist: dissect.sql<4,>=3.12
@@ -75,7 +75,7 @@ Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.2.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
-Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.19.dev; extra == "dev"
+Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.20.dev; extra == "dev"
 Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.15.dev; extra == "dev"
 Requires-Dist: dissect.qnxfs[dev]<2.0.dev,>=1.1.dev; extra == "dev"

dissect_target-3.23.2.dev8/dissect/target/containers/asif.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import io
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.hypervisor.disk import asif
+
+from dissect.target.container import Container
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+class AsifContainer(Container):
+    __type__ = "asif"
+
+    def __init__(
+        self,
+        fh: BinaryIO | Path,
+        *args,
+        **kwargs,
+    ):
+        self.asif = asif.ASIF(fh.open("rb") if not hasattr(fh, "read") else fh)
+        self.stream = self.asif.open()
+
+        super().__init__(fh, self.asif.size, *args, **kwargs)
+
+    @staticmethod
+    def _detect_fh(fh: BinaryIO, original: list | BinaryIO) -> bool:
+        return fh.read(4) == b"shdw"
+
+    @staticmethod
+    def detect_path(path: Path, original: list | BinaryIO) -> bool:
+        return path.suffix.lower() == ".asif"
+
+    def read(self, length: int) -> bytes:
+        return self.stream.read(length)
+
+    def seek(self, offset: int, whence: int = io.SEEK_SET) -> int:
+        return self.stream.seek(offset, whence)
+
+    def tell(self) -> int:
+        return self.stream.tell()
+
+    def close(self) -> None:
+        self.stream.close()

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect/target/helpers/network.py

@@ -6,7 +6,7 @@ from enum import IntEnum
 class IANAProtocol(IntEnum):
     """Enum of IANA Protocol numbers.
 
-    Resources:
+    References:
         - https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
     """
 

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect/target/plugins/os/unix/linux/fortios/_os.py

@@ -338,6 +338,8 @@ class FortiOSPlugin(LinuxPlugin):
 
 
 class ConfigNode(dict):
+    """Generic configuration node implementation."""
+
     def set(self, path: list[str], value: str) -> None:
         node = self
 
@@ -353,6 +355,8 @@ class ConfigNode(dict):
 
 
 class FortiOSConfig(ConfigNode):
+    """FortiOS configuration parser."""
+
     @classmethod
     def from_fh(cls, fh: TextIO) -> Self:
         root = cls()

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect/target/plugins/os/unix/linux/network.py

@@ -348,7 +348,7 @@ class SystemdNetworkConfigParser(LinuxNetworkConfigParser):
 class DhclientLeaseParser(LinuxNetworkConfigParser):
     """Parse network interfaces from dhclient DHCP ``.leases`` files.
 
-    Resources:
+    References:
         - https://linux.die.net/man/5/dhclient.conf
     """
 

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect/target/plugins/os/unix/log/auth.py

@@ -97,9 +97,15 @@ class SshdService(BaseService):
 
 
 class SystemdLogindService(BaseService):
-    """Class for parsing systemd-logind messages in the auth log."""
+    """Class for parsing systemd-logind messages in the auth log.
 
-    RE_SYSTEMD_LOGIND_WATCHING = re.compile(
+    References:
+        - https://github.com/systemd/systemd/blob/main/src/login/logind-session.c
+        - https://github.com/systemd/systemd/blob/main/src/login/logind-session.h
+        - https://github.com/systemd/systemd/blob/main/src/login/logind-seat.c
+    """
+
+    RE_MSG_WATCHING = re.compile(
         r"""
         (?P<action>Watching\ssystem\sbuttons)\s # Action is "Watching system buttons"
         on\s(?P<device>[^\s]+)\s                # The device the button is related to -> /dev/input/event0
@@ -108,32 +114,64 @@ class SystemdLogindService(BaseService):
         re.VERBOSE,
     )
 
+    RE_MSG_SESSION_NEW = re.compile(
+        r"New session (?P<session>\d+) of user (?P<user>\S+)\.",
+    )
+
+    # Reference: https://github.com/systemd/systemd/commit/07b3556510440f7b5f19e19cca1b46d9d581da43
+    RE_MSG_SESSION_NEW_VARIANT = re.compile(
+        r"New session '(?P<session>\d+)' of user '(?P<user>\S+)' with class '(?P<class>\S+)' and type '(?P<type>\S+)'\."
+    )
+
+    RE_MSG_SESSION_LOGGED_OUT = re.compile(
+        r"Session (?P<session>\d+) logged out\.",
+    )
+
+    RE_MSG_SESSION_REMOVED = re.compile(
+        r"Removed session (?P<session>\d+)\.",
+    )
+
+    RE_MSG_SEAT = re.compile(r"(?P<action>New seat|Removed seat) (?P<seat>\S+)\.")
+
     @classmethod
     def parse(cls, message: str) -> dict[str, str]:
         """Parse auth log message from systemd-logind."""
         additional_fields = {}
+
         # Example: Nov 14 07:14:09 ubuntu-1 systemd-logind[4]: Removed session 4.
-        if "Removed" in message:
-            additional_fields["action"] = "removed session"
-            additional_fields["session"] = message.split()[-1].strip(".")
-        elif "Watching" in message and (match := cls.RE_SYSTEMD_LOGIND_WATCHING.search(message)):
+        if "Removed session" in message:
+            if match := cls.RE_MSG_SESSION_REMOVED.search(message):
+                fields = match.groupdict()
+                additional_fields["action"] = "removed session"
+                additional_fields["session"] = int(fields["session"])
+
+        elif "Watching" in message and (match := cls.RE_MSG_WATCHING.search(message)):
             additional_fields.update(match.groupdict())
+
         # Example: New session 4 of user sampleuser.
+        # Example: New session '4' of user 'sampleuser' with class 'SESSION_USER' and type 'SESSION_TTY'.
         elif "New session" in message:
-            parts = message.removeprefix("New session ").split()
-            additional_fields["action"] = "new session"
-            additional_fields["session"] = parts[0]
-            additional_fields["user"] = parts[-1].strip(".")
+            if (match := cls.RE_MSG_SESSION_NEW.search(message)) or (
+                match := cls.RE_MSG_SESSION_NEW_VARIANT.search(message)
+            ):
+                fields = match.groupdict()
+                additional_fields.update(fields)
+                additional_fields["action"] = "new session"
+                additional_fields["session"] = int(fields["session"])
+
         # Example: Session 4 logged out. Waiting for processes to exit.
         elif "logged out" in message:
-            session = message.removeprefix("Session ").split(maxsplit=1)[0]
-            additional_fields["action"] = "logged out session"
-            additional_fields["session"] = session
+            if match := cls.RE_MSG_SESSION_LOGGED_OUT.search(message):
+                fields = match.groupdict()
+                additional_fields["action"] = "logged out session"
+                additional_fields["session"] = int(fields["session"])
+
         # Example: New seat seat0.
-        elif "New seat" in message:
-            seat = message.split()[-1].strip(".")
-            additional_fields["action"] = "new seat"
-            additional_fields["seat"] = seat
+        # Example: Removed seat seat0.
+        elif ("New seat" in message or "Removed seat" in message) and (match := cls.RE_MSG_SEAT.search(message)):
+            fields = match.groupdict()
+            additional_fields.update(fields)
+            additional_fields["action"] = fields["action"].lower()
 
         return additional_fields
 

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect/target/plugins/os/windows/amcache.py

@@ -346,17 +346,15 @@ class AmcachePluginOldMixin:
 class AmcachePlugin(AmcachePluginOldMixin, Plugin):
     """Appcompat plugin for amcache.hve.
 
-    Supported registry keys:
-
-        for old version of Amcache:
+    Supported registry keys for old version of Amcache:
         * File
         * Programs
 
-        for new version of Amcache:
-        • InventoryDriverBinary
-        • InventoryDeviceContainer
-        • InventoryApplication
-        • InventoryApplicationFile
+    Supported registry keys for new version of Amcache:
+        * InventoryDriverBinary
+        * InventoryDeviceContainer
+        * InventoryApplication
+        * InventoryApplicationFile
         * InventoryApplicationShortcut
 
     References:

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect/target/plugins/os/windows/regf/applications.py

@@ -50,7 +50,7 @@ class WindowsApplicationsPlugin(Plugin):
         .. code-block:: text
 
             ts_modified  (datetime): timestamp when the installation was modified according to the registry
-            ts_installed (datetime): timestamp when the application was installed according to the application
+            ts_installed (datetime): the date when the application was installed according to the application
             name         (string):   name of the application
             version      (string):   version of the application
             author       (string):   author of the application

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev4
+Version: 3.23.2.dev8
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -25,7 +25,7 @@ Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.eventlog<4,>=3
 Requires-Dist: dissect.evidence<4,>=3
-Requires-Dist: dissect.hypervisor<4,>=3.19
+Requires-Dist: dissect.hypervisor<4,>=3.20.dev
 Requires-Dist: dissect.ntfs<4,>=3.15.dev1
 Requires-Dist: dissect.regf<4,>=3.13
 Requires-Dist: dissect.sql<4,>=3.12
@@ -75,7 +75,7 @@ Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.2.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
-Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.19.dev; extra == "dev"
+Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.20.dev; extra == "dev"
 Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.15.dev; extra == "dev"
 Requires-Dist: dissect.qnxfs[dev]<2.0.dev,>=1.1.dev; extra == "dev"

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect.target.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ dissect/target/target.py
 dissect/target/volume.py
 dissect/target/containers/__init__.py
 dissect/target/containers/asdf.py
+dissect/target/containers/asif.py
 dissect/target/containers/ewf.py
 dissect/target/containers/fortifw.py
 dissect/target/containers/hdd.py

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/dissect.target.egg-info/requires.txt

@@ -2,7 +2,7 @@ defusedxml
 dissect.cstruct<5,>=4
 dissect.eventlog<4,>=3
 dissect.evidence<4,>=3
-dissect.hypervisor<4,>=3.19
+dissect.hypervisor<4,>=3.20.dev
 dissect.ntfs<4,>=3.15.dev1
 dissect.regf<4,>=3.13
 dissect.sql<4,>=3.12
@@ -29,7 +29,7 @@ dissect.evidence[dev]<4.0.dev,>=3.0.dev
 dissect.extfs[dev]<4.0.dev,>=3.0.dev
 dissect.fat[dev]<4.0.dev,>=3.0.dev
 dissect.ffs[dev]<4.0.dev,>=3.0.dev
-dissect.hypervisor[dev]<4.0.dev,>=3.19.dev
+dissect.hypervisor[dev]<4.0.dev,>=3.20.dev
 dissect.jffs[dev]<2.0.dev,>=1.5.dev
 dissect.ntfs[dev]<4.0.dev,>=3.15.dev
 dissect.qnxfs[dev]<2.0.dev,>=1.1.dev

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "dissect.cstruct>=4,<5",
     "dissect.eventlog>=3,<4",
     "dissect.evidence>=3,<4",
-    "dissect.hypervisor>=3.19,<4",
+    "dissect.hypervisor>=3.20.dev,<4",  # TODO: update on release
     "dissect.ntfs>=3.15.dev1,<4",  # TODO: update on release
     "dissect.regf>=3.13,<4",
     "dissect.sql>=3.12,<4",
@@ -89,7 +89,7 @@ dev = [
     "dissect.fat[dev]>=3.0.dev,<4.0.dev",
     "dissect.ffs[dev]>=3.0.dev,<4.0.dev",
     "dissect.fve[dev]>=4.2.dev,<5.0.dev; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",
-    "dissect.hypervisor[dev]>=3.19.dev,<4.0.dev",
+    "dissect.hypervisor[dev]>=3.20.dev,<4.0.dev",
     "dissect.jffs[dev]>=1.5.dev,<2.0.dev",
     "dissect.ntfs[dev]>=3.15.dev,<4.0.dev",
     "dissect.qnxfs[dev]>=1.1.dev,<2.0.dev",

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/tests/plugins/os/unix/log/test_auth.py

@@ -232,6 +232,60 @@ def test_auth_year_rollover(target_unix: Target, fs_unix: VirtualFilesystem) ->
             },
             id="systemd-logind: new seat",
         ),
+        pytest.param(
+            "Mar 27 13:06:56 ubuntu-1 systemd-logind[1118]: Removed seat seat0.",
+            {
+                "service": "systemd-logind",
+                "pid": 1118,
+                "action": "removed seat",
+                "seat": "seat0",
+            },
+            id="systemd-logind: removed seat",
+        ),
+        pytest.param(
+            "Dec  1 13:37:37 hostname systemd-logind[1337]: New session 12345 of user root.",
+            {
+                "service": "systemd-logind",
+                "pid": 1337,
+                "action": "new session",
+                "session": 12345,
+                "user": "root",
+            },
+            id="systemd-logind: new session",
+        ),
+        pytest.param(
+            "Dec 31 13:37:37 hostname systemd-logind[1337]: New session '12345' of user 'root' with class 'SESSION_USER' and type 'SESSION_TTY'.",  # noqa: E501
+            {
+                "service": "systemd-logind",
+                "pid": 1337,
+                "action": "new session",
+                "session": 12345,
+                "user": "root",
+                "class": "SESSION_USER",
+                "type": "SESSION_TTY",
+            },
+            id="systemd-logind: new session variant",
+        ),
+        pytest.param(
+            "Dec 31 13:37:37 hostname systemd-logind[1337]: Removed session 12345.",
+            {
+                "service": "systemd-logind",
+                "pid": 1337,
+                "action": "removed session",
+                "session": 12345,
+            },
+            id="systemd-logind: removed session",
+        ),
+        pytest.param(
+            "Dec 31 13:37:37 hostname systemd-logind[1337]: Session 12345 logged out. Waiting for processes to exit.",
+            {
+                "service": "systemd-logind",
+                "pid": 1337,
+                "action": "logged out session",
+                "session": 12345,
+            },
+            id="systemd-logind: session logged out",
+        ),
         pytest.param(
             "Mar 27 13:10:08 ubuntu-1 sudo:   ubuntu : TTY=pts/0 ; PWD=/home/test_user ; "
             "USER=root ; COMMAND=/usr/bin/apt-key add -",

{dissect_target-3.23.2.dev4 → dissect_target-3.23.2.dev8}/tests/test_plugin.py

@@ -1907,7 +1907,7 @@ def test_namespace_class_usage(descriptor: PluginDescriptor) -> None:
     If you want to expose plugin functions under a shared name, e.g. ``foo.bar`` and ``foo.baz``,
     you should use :class:`Plugin` with ``Plugin.__namespace__ = "foo"`` instead.
 
-    Resources:
+    References:
         - https://github.com/fox-it/dissect.target/issues/1180
     """