dissect.target 3.23.dev36__tar.gz → 3.23.dev38__tar.gz

{dissect_target-3.23.dev36 → dissect_target-3.23.dev38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev36
+Version: 3.23.dev38
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev36 → dissect_target-3.23.dev38}/dissect/target/loaders/hyperv.py

@@ -162,4 +162,9 @@ class HyperVLoader(Loader):
                     try:
                         target.disks.add(container.open(disk_path))
                     except Exception:
-                        target.log.exception("Failed to load VHD: %s", drive)
+                        # In some situations we may have something like a .vhdx extension but a raw disk inside
+                        # Fall back on stream based container detection
+                        try:
+                            target.disks.add(container.open(disk_path.open("rb")))
+                        except Exception:
+                            target.log.exception("Failed to load VHD: %s", drive)

{dissect_target-3.23.dev36 → dissect_target-3.23.dev38}/dissect/target/loaders/vbk.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
 import re
+from itertools import chain
 from typing import TYPE_CHECKING
 
 from dissect.target.exceptions import LoaderError
+from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.filesystems.vbk import VbkFilesystem
 from dissect.target.loader import Loader, find_loader
 from dissect.target.loaders.raw import RawLoader
@@ -18,7 +20,11 @@ RE_RAW_DISK = re.compile(r"(?:[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a
 
 
 class VbkLoader(Loader):
-    """Load Veaam Backup (VBK) files."""
+    """Load Veaam Backup (VBK) files.
+
+    Resources:
+        - https://helpcenter.veeam.com/docs/backup/hyperv/backup_files.html?ver=120
+    """
 
     def __init__(self, path: Path, **kwargs):
         super().__init__(path, **kwargs)
@@ -35,23 +41,34 @@ class VbkLoader(Loader):
         if (base := next(root.glob("*"), None)) is None:
             raise LoaderError("Unexpected empty VBK filesystem")
 
-        if not (candidates := [path for pattern in ("*.vmx", "*.vmcx") if (path := next(base.glob(pattern), None))]):
+        if not (
+            candidates := [path for pattern in ("*.vmx", "Config/*.vmcx") if (path := next(base.glob(pattern), None))]
+        ):
             # Try to look for raw disks
             if not (disks := [path for path in base.iterdir() if RE_RAW_DISK.match(path.name)]):
                 # Dunno, just give up 🤷‍♂️ should've spent extra time staring at summary.xml
-                raise LoaderError("Unsupported VBK structure")
+                raise LoaderError("Unsupported VBK structure, use `-L raw` to manually inspect the VBK")
 
             candidates.append(root.joinpath("+".join(map(str, disks))))
 
         # Try to find a loader
         for candidate in candidates:
+            if candidate.suffix.lower() == ".vmcx":
+                # For VMCX files we need to massage the file layout a bit
+                vfs = VirtualFilesystem()
+                vfs.map_file_entry(candidate.name, candidate)
+
+                for entry in chain(base.glob("Ide*/*"), base.glob("Scsi*/*")):
+                    vfs.map_file_entry(entry.name, entry)
+
+                candidate = vfs.path(candidate.name)
+
             if (loader := find_loader(candidate, fallbacks=[RawLoader])) is not None:
                 ldr = loader(candidate)
                 ldr.map(target)
 
                 # Store a reference to the loader if we successfully mapped
                 self.loader = ldr
-
                 break
         else:
-            raise LoaderError("Unsupported VBK structure")
+            raise LoaderError("Unsupported VBK structure, use `-L raw` to manually inspect the VBK")

{dissect_target-3.23.dev36 → dissect_target-3.23.dev38}/dissect/target/tools/shell.py

@@ -128,7 +128,7 @@ class AnsiColors(StrEnum):
 
 
 # ANSI color escape sequences for readline prompt
-ANSI_COLORS = readline_escape(AnsiColors.as_dict())
+ANSI_COLORS = readline_escape(AnsiColors.as_dict()) if readline else AnsiColors.as_dict()
 
 
 class ExtendedCmd(cmd.Cmd):

{dissect_target-3.23.dev36 → dissect_target-3.23.dev38}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev36
+Version: 3.23.dev38
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.23.dev38/tests/loaders/test_vbk.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+from io import BytesIO
+from typing import TYPE_CHECKING
+from unittest.mock import Mock, patch
+
+import pytest
+
+from dissect.target.exceptions import LoaderError
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.loaders.hyperv import HyperVLoader
+from dissect.target.loaders.raw import RawLoader
+from dissect.target.loaders.vbk import VbkLoader
+from dissect.target.loaders.vmx import VmxLoader
+
+if TYPE_CHECKING:
+    from dissect.target.target import Target
+
+
+@patch("dissect.target.loaders.vbk.VbkFilesystem")
+def test_vbk_loader_mock_raw(VbkFilesystem: Mock, target_default: Target) -> None:
+    """Test the VBK loader on a raw disk backup layout."""
+    vfs = VirtualFilesystem()
+    VbkFilesystem.return_value = vfs
+
+    loader = VbkLoader(Mock())
+    with pytest.raises(LoaderError, match="Unexpected empty VBK filesystem"):
+        loader.map(target_default)
+
+    vfs.makedirs("guid")
+
+    with pytest.raises(LoaderError, match="Unsupported VBK structure"):
+        loader.map(target_default)
+
+    vfs.map_file_fh("guid/DEV__dummy", BytesIO("🍖👑".encode()))
+    vfs.map_file_fh("guid/summary.xml", BytesIO(b""))
+
+    loader.map(target_default)
+    assert isinstance(loader.loader, RawLoader)
+    assert len(target_default.disks) == 1
+
+    target_default.disks[0].seek(0)
+    assert target_default.disks[0].read().decode() == "🍖👑"
+
+
+@patch("dissect.target.loaders.vbk.VbkFilesystem")
+def test_vbk_loader_mock_vmx(VbkFilesystem: Mock, target_default: Target) -> None:
+    """Test the VBK loader on a VMware backup layout."""
+    vfs = VirtualFilesystem()
+    VbkFilesystem.return_value = vfs
+
+    loader = VbkLoader(Mock())
+
+    vfs.map_file_fh("guid/summary.xml", BytesIO(b""))
+    vfs.map_file_fh("guid/candidate.vmx", BytesIO(b'scsi0:0.fileName = "candidate.vmdk"'))
+    vfs.map_file_fh(
+        "guid/candidate.vmdk",
+        BytesIO(b'# Disk DescriptorFile\nparentCID=ffffffff\nRW 16777216 VMFS "candidate-flat.vmdk"'),
+    )
+    vfs.map_file_fh("guid/candidate-flat.vmdk", BytesIO("🍖👑".encode()))
+
+    loader.map(target_default)
+    assert isinstance(loader.loader, VmxLoader)
+    assert len(target_default.disks) == 1
+
+    target_default.disks[0].seek(0)
+    assert target_default.disks[0].read(-1).decode() == "🍖👑"
+
+
+@patch("dissect.target.loaders.hyperv.hyperv.HyperVFile")
+@patch("dissect.target.loaders.vbk.VbkFilesystem")
+def test_vbk_loader_mock_vmcx(VbkFilesystem: Mock, HyperVFile: Mock, target_default: Target) -> None:
+    """Test the VBK loader on a Hyper-V backup layout."""
+    vfs = VirtualFilesystem()
+    VbkFilesystem.return_value = vfs
+
+    HyperVFile.return_value = HyperVFile
+    HyperVFile.as_dict.return_value = {
+        "configuration": {
+            "manifest": {
+                "vdev0": {
+                    "device": "83f8638b-8dca-4152-9eda-2ca8b33039b4",
+                    "instance": "83f8638b-8dca-4152-9eda-2ca8b33039b4",
+                },
+                "vdev1": {
+                    "device": "d422512d-2bf2-4752-809d-7b82b5fcb1b4",
+                    "instance": "d422512d-2bf2-4752-809d-7b82b5fcb1b4",
+                },
+            },
+            "_83f8638b-8dca-4152-9eda-2ca8b33039b4_": {
+                "controller0": {"drive0": {"type": "VHD", "pathname": "C:\\Fake\\Path\\ide.vhdx"}},
+            },
+            "_d422512d-2bf2-4752-809d-7b82b5fcb1b4_": {
+                "controller0": {"drive0": {"type": "VHD", "pathname": "C:\\Fake\\Path\\scsi.vhdx"}},
+            },
+        }
+    }
+
+    loader = VbkLoader(Mock())
+
+    vfs.map_file_fh("guid/summary.xml", BytesIO(b""))
+    vfs.map_file_fh("guid/Config/candidate.vmcx", BytesIO(b""))
+    vfs.map_file_fh("guid/Ide0-0/ide.vhdx", BytesIO("🐌".encode()))
+    vfs.map_file_fh("guid/Scsi0-0/scsi.vhdx", BytesIO("🏃🏃".encode()))
+
+    loader.map(target_default)
+    assert isinstance(loader.loader, HyperVLoader)
+    assert len(target_default.disks) == 2
+
+    disks = sorted(target_default.disks, key=lambda d: d.size)
+
+    disks[0].seek(0)
+    assert disks[0].read(-1).decode() == "🐌"
+
+    disks[1].seek(0)
+    assert disks[1].read(-1).decode() == "🏃🏃"

dissect_target-3.23.dev36/tests/loaders/test_vbk.py

@@ -1,35 +0,0 @@
-from io import BytesIO
-from unittest.mock import Mock, patch
-
-import pytest
-
-from dissect.target.exceptions import LoaderError
-from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.loaders.raw import RawLoader
-from dissect.target.loaders.vbk import VbkLoader
-from dissect.target.target import Target
-
-
-@patch("dissect.target.loaders.vbk.VbkFilesystem")
-def test_vbk_loader(VbkFilesystem: Mock, target_default: Target) -> None:
-    """Test the VBK loader."""
-    vfs = VirtualFilesystem()
-    VbkFilesystem.return_value = vfs
-
-    loader = VbkLoader(Mock())
-    with pytest.raises(LoaderError, match="Unexpected empty VBK filesystem"):
-        loader.map(target_default)
-
-    vfs.makedirs("a")
-
-    with pytest.raises(LoaderError, match="Unsupported VBK structure"):
-        loader.map(target_default)
-
-    vfs.map_file_fh("a/DEV__dummy", BytesIO("🍖👑".encode()))
-    vfs.map_file_fh("a/summary.xml", BytesIO(b""))
-
-    loader.map(target_default)
-    assert isinstance(loader.loader, RawLoader)
-    assert len(target_default.disks) == 1
-    target_default.disks[0].seek(0)
-    assert target_default.disks[0].read().decode() == "🍖👑"