dissect.target 3.23.dev21__tar.gz → 3.23.dev23__tar.gz

{dissect_target-3.23.dev21 → dissect_target-3.23.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev21
+Version: 3.23.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev21 → dissect_target-3.23.dev23}/dissect/target/loader.py

@@ -222,6 +222,7 @@ register("remote", "RemoteLoader")
 register("mqtt", "MqttLoader")
 register("asdf", "AsdfLoader")
 register("tar", "TarLoader")
+register("zip", "ZipLoader")
 register("vmx", "VmxLoader")
 register("vmwarevm", "VmwarevmLoader")
 register("hyperv", "HyperVLoader")

dissect_target-3.23.dev23/dissect/target/loaders/acquire.py

@@ -0,0 +1,117 @@
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING
+
+from dissect.target import filesystem
+from dissect.target.filesystems.tar import TarFilesystemDirectoryEntry, TarFilesystemEntry
+from dissect.target.helpers import fsutil, loaderutil
+from dissect.target.loaders.dir import find_and_map_dirs
+from dissect.target.loaders.tar import TarSubLoader
+from dissect.target.loaders.zip import ZipSubLoader
+
+if TYPE_CHECKING:
+    import tarfile as tf
+    import zipfile as zf
+
+    from dissect.target.target import Target
+
+
+log = logging.getLogger(__name__)
+
+FILESYSTEMS_ROOT = "fs"
+FILESYSTEMS_LEGACY_ROOT = "sysvol"
+
+ANON_FS_RE = re.compile(r"^fs[0-9]+$")
+
+
+class AcquireTarSubLoader(TarSubLoader):
+    """Loader for tar-based Acquire collections."""
+
+    @staticmethod
+    def detect(tarfile: tf.TarFile) -> bool:
+        for member in tarfile.getmembers():
+            if member.name.startswith(
+                (
+                    f"/{FILESYSTEMS_ROOT}/",
+                    f"{FILESYSTEMS_ROOT}/",
+                    f"/{FILESYSTEMS_LEGACY_ROOT}/",
+                    f"{FILESYSTEMS_LEGACY_ROOT}/",
+                )
+            ):
+                return True
+        return False
+
+    def map(self, target: Target) -> None:
+        volumes = {}
+
+        for member in self.tar.getmembers():
+            if member.name == ".":
+                continue
+
+            if member.name.startswith(("/fs/", "fs/")):
+                # Current acquire
+                parts = member.name.replace("fs/", "").split("/")
+                if parts[0] == "":
+                    parts.pop(0)
+            else:
+                # Legacy acquire
+                parts = member.name.lstrip("/").split("/")
+            volume_name = parts[0].lower()
+
+            # NOTE: older versions of acquire would write to "sysvol" instead of a driver letter
+            # Figuring out the sysvol from the drive letters is easier than the drive letter from "sysvol",
+            # so this was swapped in acquire 3.12. Now we map all volumes to a drive letter and let the
+            # Windows OS plugin figure out which is the sysvol
+            # For backwards compatibility we're forced to keep this check, and assume that "c:" is our sysvol
+            if volume_name == "sysvol":
+                volume_name = "c:"
+
+            if volume_name == "$fs$":
+                if len(parts) == 1:
+                    # The fs/$fs$ entry is ignored, only the directories below it are processed.
+                    continue
+                fs_name = parts[1]
+                if ANON_FS_RE.match(fs_name):
+                    parts.pop(0)
+                    volume_name = f"{volume_name}/{fs_name}"
+
+            if volume_name not in volumes:
+                vol = filesystem.VirtualFilesystem(case_sensitive=False)
+                vol.tar = self.tar
+                volumes[volume_name] = vol
+                target.filesystems.add(vol)
+
+            volume = volumes[volume_name]
+            mname = "/".join(parts[1:])
+
+            entry_cls = TarFilesystemDirectoryEntry if member.isdir() else TarFilesystemEntry
+            entry = entry_cls(volume, fsutil.normpath(mname), member)
+            volume.map_file_entry(entry.path, entry)
+
+        for vol_name, vol in volumes.items():
+            loaderutil.add_virtual_ntfs_filesystem(
+                target,
+                vol,
+                usnjrnl_path=[
+                    "$Extend/$Usnjrnl:$J",
+                    "$Extend/$Usnjrnl:J",  # Old versions of acquire used $Usnjrnl:J
+                ],
+            )
+
+            target.fs.mount(vol_name, vol)
+
+
+class AcquireZipSubLoader(ZipSubLoader):
+    """Loader for zip-based Acquire collections."""
+
+    @staticmethod
+    def detect(zipfile: zf.Path) -> bool:
+        return zipfile.joinpath(FILESYSTEMS_ROOT).exists() or zipfile.joinpath(FILESYSTEMS_LEGACY_ROOT).exists()
+
+    def map(self, target: Target) -> None:
+        path = self.zip
+        if path.joinpath(FILESYSTEMS_ROOT).exists():
+            path = path.joinpath(FILESYSTEMS_ROOT)
+        find_and_map_dirs(target, path)

{dissect_target-3.23.dev21 → dissect_target-3.23.dev23}/dissect/target/loaders/tar.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import logging
-import re
 import tarfile as tf
 from io import BytesIO
 from typing import TYPE_CHECKING
@@ -57,8 +56,6 @@ TAR_MAGIC_COMP = (
 )
 TAR_MAGIC = (tf.GNU_MAGIC, tf.POSIX_MAGIC)
 
-ANON_FS_RE = re.compile(r"^fs[0-9]+$")
-
 WINDOWS_MEMBERS = (
     "windows/system32",
     "/windows/system32",
@@ -85,10 +82,7 @@ class TarSubLoader(SubLoader[tf.TarFile]):
 
 
 class GenericTarSubLoader(TarSubLoader):
-    """Generic tar sub loader.
-
-    Recognises acquire tar files and regular tar files. Attempts to map sysvol and c: volume names.
-    """
+    """Generic tar sub loader."""
 
     @staticmethod
     def detect(tarfile: tf.TarFile) -> bool:
@@ -108,52 +102,14 @@ class GenericTarSubLoader(TarSubLoader):
                     # Root filesystem was already added
                     volumes["/"].case_sensitive = False
 
-            if not member.name.startswith(("/fs/", "fs/", "/sysvol/", "sysvol/")):
-                # Not an acquire tar
-                if "/" not in volumes:
-                    vol = filesystem.VirtualFilesystem(case_sensitive=not windows_found)
-                    vol.tar = self.tar
-                    volumes["/"] = vol
-                    target.filesystems.add(vol)
-
-                volume = volumes["/"]
-                mname = member.name
-            else:
-                if member.name.startswith(("/fs/", "fs/")):
-                    # Current acquire
-                    parts = member.name.replace("fs/", "").split("/")
-                    if parts[0] == "":
-                        parts.pop(0)
-                else:
-                    # Legacy acquire
-                    parts = member.name.lstrip("/").split("/")
-                volume_name = parts[0].lower()
-
-                # NOTE: older versions of acquire would write to "sysvol" instead of a driver letter
-                # Figuring out the sysvol from the drive letters is easier than the drive letter from "sysvol",
-                # so this was swapped in acquire 3.12. Now we map all volumes to a drive letter and let the
-                # Windows OS plugin figure out which is the sysvol
-                # For backwards compatibility we're forced to keep this check, and assume that "c:" is our sysvol
-                if volume_name == "sysvol":
-                    volume_name = "c:"
-
-                if volume_name == "$fs$":
-                    if len(parts) == 1:
-                        # The fs/$fs$ entry is ignored, only the directories below it are processed.
-                        continue
-                    fs_name = parts[1]
-                    if ANON_FS_RE.match(fs_name):
-                        parts.pop(0)
-                        volume_name = f"{volume_name}/{fs_name}"
-
-                if volume_name not in volumes:
-                    vol = filesystem.VirtualFilesystem(case_sensitive=False)
-                    vol.tar = self.tar
-                    volumes[volume_name] = vol
-                    target.filesystems.add(vol)
-
-                volume = volumes[volume_name]
-                mname = "/".join(parts[1:])
+            if "/" not in volumes:
+                vol = filesystem.VirtualFilesystem(case_sensitive=not windows_found)
+                vol.tar = self.tar
+                volumes["/"] = vol
+                target.filesystems.add(vol)
+
+            volume = volumes["/"]
+            mname = member.name
 
             entry_cls = TarFilesystemDirectoryEntry if member.isdir() else TarFilesystemEntry
             entry = entry_cls(volume, fsutil.normpath(mname), member)
@@ -177,6 +133,7 @@ class TarLoader(Loader):
 
     __subloaders__ = (
         import_lazy("dissect.target.loaders.containerimage").ContainerImageTarSubLoader,
+        import_lazy("dissect.target.loaders.acquire").AcquireTarSubLoader,
         GenericTarSubLoader,  # should be last
     )
 

dissect_target-3.23.dev23/dissect/target/loaders/zip.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import zipfile as zf
+from typing import TYPE_CHECKING
+
+from dissect.target.helpers.lazy import import_lazy
+from dissect.target.loader import Loader, SubLoader
+from dissect.target.loaders.dir import find_and_map_dirs
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from dissect.target import target
+
+
+ZIP_EXT = (".zip",)
+
+
+class ZipSubLoader(SubLoader[zf.Path]):
+    """Zip implementation of a :class:`SubLoader`."""
+
+    def __init__(self, zipfile: zf.Path, *args, **kwargs):
+        super().__init__(zipfile, *args, **kwargs)
+        self.zip = zipfile
+
+    @staticmethod
+    def detect(zipfile: zf.Path) -> bool:
+        """Only to be called internally by :class:`ZipLoader`."""
+        raise NotImplementedError
+
+    def map(self, target: target.Target) -> None:
+        """Only to be called internally by :class:`ZipLoader`."""
+        raise NotImplementedError
+
+
+class GenericZipSubLoader(ZipSubLoader):
+    """Generic zip sub loader."""
+
+    @staticmethod
+    def detect(zipfile: zf.Path) -> bool:
+        return True
+
+    def map(self, target: target.Target) -> None:
+        find_and_map_dirs(target, self.zip)
+
+
+class ZipLoader(Loader):
+    """Load zip files."""
+
+    __subloaders__ = (
+        import_lazy("dissect.target.loaders.acquire").AcquireZipSubLoader,
+        GenericZipSubLoader,  # should be last
+    )
+
+    def __init__(self, path: Path, **kwargs):
+        super().__init__(path, **kwargs)
+
+        self.fh = path.open("rb")
+        self.zip = zf.Path(self.fh)
+        self.subloader = None
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        return path.name.lower().endswith(ZIP_EXT)
+
+    def map(self, target: target.Target) -> None:
+        for candidate in self.__subloaders__:
+            if candidate.detect(self.zip):
+                self.subloader = candidate(self.zip)
+                self.subloader.map(target)
+                break

{dissect_target-3.23.dev21 → dissect_target-3.23.dev23}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev21
+Version: 3.23.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev21 → dissect_target-3.23.dev23}/dissect.target.egg-info/SOURCES.txt

@@ -104,6 +104,7 @@ dissect/target/helpers/sunrpc/serializer.py
 dissect/target/helpers/sunrpc/sunrpc.py
 dissect/target/loaders/__init__.py
 dissect/target/loaders/ab.py
+dissect/target/loaders/acquire.py
 dissect/target/loaders/asdf.py
 dissect/target/loaders/cb.py
 dissect/target/loaders/cellebrite.py
@@ -143,6 +144,7 @@ dissect/target/loaders/vma.py
 dissect/target/loaders/vmwarevm.py
 dissect/target/loaders/vmx.py
 dissect/target/loaders/xva.py
+dissect/target/loaders/zip.py
 dissect/target/plugins/__init__.py
 dissect/target/plugins/apps/__init__.py
 dissect/target/plugins/apps/av/__init__.py
@@ -499,6 +501,7 @@ tests/helpers/sunrpc/__init__.py
 tests/helpers/sunrpc/test_client.py
 tests/loaders/__init__.py
 tests/loaders/test_ab.py
+tests/loaders/test_acquire.py
 tests/loaders/test_asdf.py
 tests/loaders/test_cb.py
 tests/loaders/test_cellebrite.py

dissect_target-3.23.dev23/tests/loaders/test_acquire.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+import pytest
+
+from dissect.target.loader import Loader
+from dissect.target.loaders.tar import TarLoader
+from dissect.target.loaders.zip import ZipLoader
+from dissect.target.plugins.os.windows._os import WindowsPlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from pytest_benchmark.fixture import BenchmarkFixture
+
+    from dissect.target.loader import Loader
+
+
+def test_case_sensitive_drive_letter(target_bare: Target) -> None:
+    tar_file = absolute_path("_data/loaders/acquire/uppercase_driveletter.tar")
+
+    loader = TarLoader(tar_file)
+    loader.map(target_bare)
+
+    # mounts = / and c:
+    assert sorted(target_bare.fs.mounts.keys()) == ["c:", "fs"]
+    assert "C:" not in target_bare.fs.mounts
+
+    # Initialize our own WindowsPlugin to override the detection
+    target_bare._os_plugin = WindowsPlugin.create(target_bare, target_bare.fs.mounts["c:"])
+    target_bare._init_os()
+
+    # sysvol is now added
+    assert sorted(target_bare.fs.mounts.keys()) == ["c:", "fs", "sysvol"]
+
+    # WindowsPlugin sets the case sensitivity to False
+    assert target_bare.fs.get("C:/test.file").open().read() == b"hello_world"
+    assert target_bare.fs.get("c:/test.file").open().read() == b"hello_world"
+
+
+@pytest.mark.parametrize(
+    ("archive", "expected_drive_letter"),
+    [
+        ("_data/loaders/acquire/test-windows-sysvol-absolute.tar", "c:"),  # C: due to backwards compatibility
+        ("_data/loaders/acquire/test-windows-sysvol-relative.tar", "c:"),  # C: due to backwards compatibility
+        ("_data/loaders/acquire/test-windows-fs-c-relative.tar", "c:"),
+        ("_data/loaders/acquire/test-windows-fs-c-absolute.tar", "c:"),
+        ("_data/loaders/acquire/test-windows-fs-x.tar", "x:"),
+    ],
+)
+def test_windows_sysvol_formats(target_default: Target, archive: str, expected_drive_letter: str) -> None:
+    path = Path(absolute_path(archive))
+    assert TarLoader.detect(path)
+
+    loader = TarLoader(path)
+    loader.map(target_default)
+
+    assert WindowsPlugin.detect(target_default)
+    # NOTE: for the sysvol archives, this also tests the backwards compatibility
+    assert sorted(target_default.fs.mounts.keys()) == [expected_drive_letter]
+    assert target_default.fs.get(f"{expected_drive_letter}/Windows/System32/foo.txt")
+
+
+def test_windows_sysvol_formats_zip(target_default: Target) -> None:
+    path = Path(absolute_path("_data/loaders/acquire/test-windows-fs-c.zip"))
+    assert ZipLoader.detect(path)
+
+    loader = ZipLoader(path)
+    loader.map(target_default)
+
+    assert WindowsPlugin.detect(target_default)
+    # NOTE: for the sysvol archives, this also tests the backwards compatibility
+    assert sorted(target_default.fs.mounts.keys()) == ["c:"]
+    assert target_default.fs.get("c:/Windows/System32/foo.txt")
+
+
+def test_anonymous_filesystems(target_default: Target) -> None:
+    tar_file = Path(absolute_path("_data/loaders/acquire/test-anon-filesystems.tar"))
+    assert TarLoader.detect(tar_file)
+
+    loader = TarLoader(tar_file)
+    loader.map(target_default)
+
+    assert target_default.fs.get("$fs$/fs0/foo").open().read() == b"hello world\n"
+    assert target_default.fs.get("$fs$/fs1/bar").open().read() == b"hello world\n"
+
+
+@pytest.mark.parametrize(
+    ("archive", "loader"),
+    [
+        ("_data/loaders/acquire/test-windows-fs-c-relative.tar", TarLoader),
+        ("_data/loaders/acquire/test-windows-fs-c.zip", ZipLoader),
+    ],
+)
+@pytest.mark.benchmark
+def test_benchmark(benchmark: BenchmarkFixture, archive: str, loader: type[Loader]) -> None:
+    file = absolute_path(archive)
+
+    benchmark(lambda: loader(file).map(Target()))

{dissect_target-3.23.dev21 → dissect_target-3.23.dev23}/tests/loaders/test_tar.py

@@ -31,28 +31,6 @@ def test_tar_loader_compressed_tar_file(target_win: Target) -> None:
     assert test_file.open().read() == b"test-value\n"
 
 
-def test_tar_sensitive_drive_letter(target_bare: Target) -> None:
-    tar_file = absolute_path("_data/loaders/tar/uppercase_driveletter.tar")
-
-    loader = TarLoader(tar_file)
-    loader.map(target_bare)
-
-    # mounts = / and c:
-    assert sorted(target_bare.fs.mounts.keys()) == ["/", "c:"]
-    assert "C:" not in target_bare.fs.mounts
-
-    # Initialize our own WindowsPlugin to override the detection
-    target_bare._os_plugin = WindowsPlugin.create(target_bare, target_bare.fs.mounts["c:"])
-    target_bare._init_os()
-
-    # sysvol is now added
-    assert sorted(target_bare.fs.mounts.keys()) == ["/", "c:", "sysvol"]
-
-    # WindowsPlugin sets the case sensitivity to False
-    assert target_bare.fs.get("C:/test.file").open().read() == b"hello_world"
-    assert target_bare.fs.get("c:/test.file").open().read() == b"hello_world"
-
-
 def test_tar_loader_compressed_tar_file_with_empty_dir(target_unix: Target) -> None:
     archive_path = absolute_path("_data/loaders/tar/test-archive-empty-folder.tgz")
     loader = TarLoader(archive_path)
@@ -68,25 +46,6 @@ def test_tar_loader_compressed_tar_file_with_empty_dir(target_unix: Target) -> N
     assert empty_folder.is_dir()
 
 
-@pytest.mark.parametrize(
-    ("archive", "expected_drive_letter"),
-    [
-        ("_data/loaders/tar/test-windows-sysvol-absolute.tar", "c:"),  # C: due to backwards compatibility
-        ("_data/loaders/tar/test-windows-sysvol-relative.tar", "c:"),  # C: due to backwards compatibility
-        ("_data/loaders/tar/test-windows-fs-c-relative.tar", "c:"),
-        ("_data/loaders/tar/test-windows-fs-c-absolute.tar", "c:"),
-        ("_data/loaders/tar/test-windows-fs-x.tar", "x:"),
-    ],
-)
-def test_tar_loader_windows_sysvol_formats(target_default: Target, archive: str, expected_drive_letter: str) -> None:
-    loader = TarLoader(absolute_path(archive))
-    loader.map(target_default)
-
-    assert WindowsPlugin.detect(target_default)
-    # NOTE: for the sysvol archives, this also tests the backwards compatibility
-    assert sorted(target_default.fs.mounts.keys()) == [expected_drive_letter]
-
-
 def test_tar_loader_windows_case_sensitivity(target_default: Target, tmp_path: pathlib.Path) -> None:
     """Test if we correctly map a tar with Windows folder structure as a case-insensitive filesystem."""
 
@@ -113,21 +72,6 @@ def test_tar_loader_windows_case_sensitivity(target_default: Target, tmp_path: p
     assert target_default.filesystems[1].case_sensitive
 
 
-def test_tar_anonymous_filesystems(target_default: Target) -> None:
-    tar_file = absolute_path("_data/loaders/tar/test-anon-filesystems.tar")
-
-    loader = TarLoader(tar_file)
-    loader.map(target_default)
-
-    # mounts = $fs$/fs0, $fs$/fs1 and /
-    assert len(target_default.fs.mounts) == 3
-    assert "$fs$/fs0" in target_default.fs.mounts
-    assert "$fs$/fs1" in target_default.fs.mounts
-    assert "/" in target_default.fs.mounts
-    assert target_default.fs.get("$fs$/fs0/foo").open().read() == b"hello world\n"
-    assert target_default.fs.get("$fs$/fs1/bar").open().read() == b"hello world\n"
-
-
 @pytest.mark.parametrize(
     ("should_detect", "filename", "buffer"),
     [