dissect.target 3.23.dev47__tar.gz → 3.23.dev49__tar.gz

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev47
+Version: 3.23.dev49
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/dissect/target/plugins/os/unix/linux/proc.py

@@ -490,7 +490,7 @@ class ProcProcess:
             yield Environ(variable, contents)
 
     @property
-    def _boottime(self) -> int:
+    def _boottime(self) -> int | None:
         """Returns the boot time of the system.
 
         Used internally to determine process start- and runtimes.
@@ -555,18 +555,25 @@ class ProcProcess:
         return ProcessStateEnum[self._stat_file.get("state", "N")].value
 
     @property
-    def starttime(self) -> datetime:
+    def starttime(self) -> datetime | None:
         """Returns the start time of the process."""
         # Starttime is saved in clockticks per second from the boot time.
         # we asume a standard of 100 clockticks per second. the actual value can be obtained from `getconf CLK_TCK`
         starttime = self._stat_file.get("starttime", 0) / 100
 
-        return from_unix(self._boottime + starttime)
+        # Check if there is a boottime. If not, we cannot determine the starttime.
+        if boottime := self._boottime:
+            return from_unix(boottime + starttime)
+
+        return None
 
     @property
-    def runtime(self) -> timedelta:
+    def runtime(self) -> timedelta | None:
         """Returns the runtime of a process until the moment of acquisition."""
-        return self.now - self.starttime
+        if starttime := self.starttime:
+            return self.now - starttime
+
+        return None
 
     @property
     def now(self) -> datetime:

dissect_target-3.23.dev49/dissect/target/plugins/os/windows/productkey.py

@@ -0,0 +1,164 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.cstruct import cstruct
+
+from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, alias, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+pid_def = """
+struct DigitalProductId {
+    DWORD   uiSize;
+    SHORT   MajorVersion;
+    SHORT   MinorVersion;
+    CHAR    szProductId[24];
+    DWORD   uiKeyIdx;
+    CHAR    szEditionId[16];
+    CHAR    bCDKey[16];
+    DWORD   uiCloneStatus;
+    DWORD   uiTime;
+    DWORD   uiRandom;
+    DWORD   uiLt;
+    DWORD   uiLicenseData[2];
+    CHAR    sOemId[8];
+    DWORD   uiBundleId;
+    CHAR    sHardwareIdStatic[8];
+    DWORD   uiHardwareIdTypeStatic;
+    DWORD   uiBiosChecksumStatic;
+    DWORD   uiVolSerStatic;
+    DWORD   uiTotalRamStatic;
+    DWORD   uiVideoBiosChecksumStatic;
+    CHAR    sHardwareIdDynamic[8];
+    DWORD   uiHardwareIdTypeDynamic;
+    DWORD   uiBiosChecksumDynamic;
+    DWORD   uiVolSerDynamic;
+    DWORD   uiTotalRamDynamic;
+    DWORD   uiVideoBiosChecksumDynamic;
+    DWORD   uiCRC32;
+};
+
+struct DigitalProductId4 {
+    DWORD   uiSize;
+    SHORT   MajorVersion;
+    SHORT   MinorVersion;
+    WCHAR   szAdvancedPid[64];
+    WCHAR   szActivationId[64];
+    WCHAR   szOemID[8];
+    WCHAR   szEditionType[260];
+    BYTE    bIsUpgrade;
+    CHAR    bReserved[7];
+    CHAR    bCDKey[16];
+    CHAR    bCDKey256Hash[32];
+    CHAR    b256Hash[32];
+    WCHAR   szEditionId[64];
+    WCHAR   szKeyType[64];
+    WCHAR   szEULA[64];
+};
+"""
+
+c_pid = cstruct().load(pid_def)
+
+WindowsProductKeyRecord = TargetRecordDescriptor(
+    "windows/product_key",
+    [
+        ("datetime", "ts"),
+        ("string", "name"),
+        ("string", "type"),
+        ("string", "key"),
+        ("path", "source"),
+    ],
+)
+
+
+class WindowsProductKeyPlugin(Plugin):
+    """Windows product key plugin."""
+
+    KEY = "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
+
+    # Try the more detailed DigitalProductId version 4 first
+    VALUES = ("DigitalProductId4", "DigitalProductId")
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("registry") or not any(self.target.registry.values(self.KEY, self.VALUES)):
+            raise UnsupportedPluginError("WindowsProductKeyPlugin plugin requires RegistryPlugin")
+
+    @alias("license")
+    @export(record=WindowsProductKeyRecord)
+    def productkey(self) -> Iterator[WindowsProductKeyRecord]:
+        """Yield Windows product key(s) of the target.
+
+        References:
+            - Reversing ``pidgen.dll`` and ````pidgenx.dll``.
+            - https://www.licenturion.com/xp/fully-licensed-wpa.txt
+            - https://github.com/Endermanch/XPKeygen
+        """
+        seen_keys = set()
+
+        for key in self.target.registry.keys(self.KEY):
+            for value in self.VALUES:
+                try:
+                    pid_value = key.value(value)
+                except RegistryValueNotFoundError:
+                    continue
+
+                try:
+                    s = getattr(c_pid, pid_value.name)(pid_value.value)
+                except EOFError as e:
+                    self.target.log.warning("Unable to decode %s structure: %s", pid_value.name, e)
+                    self.target.log.debug("", exc_info=e)
+                    continue
+
+                if (cd_key := decode_cd_key(s.bCDKey)) in seen_keys:
+                    continue
+
+                seen_keys.add(cd_key)
+
+                edition_type = getattr(s, "szEditionType", "").strip("\00")
+                edition_id = (
+                    s.szEditionId.decode().strip("\00")
+                    if isinstance(s.szEditionId, bytes)
+                    else s.szEditionId.strip("\00")
+                )
+
+                yield WindowsProductKeyRecord(
+                    ts=key.ts,
+                    name=f"{edition_type} {edition_id}".strip(),
+                    type=getattr(s, "szKeyType", "").strip("\00"),
+                    key=cd_key,
+                    source=f"HKLM\\{key.path}\\{value}",
+                    _target=self.target,
+                )
+
+
+def decode_cd_key(input: bytes | bytearray) -> str:
+    """Decode the given bytes to a Windows CD key using a pseudo base24 implementation."""
+    chars = "BCDFGHJKMPQRTVWXY2346789"
+    output = ""
+
+    if not isinstance(input, bytearray):
+        input = bytearray(input)
+
+    if is_win8 := (input[14] // 6) & 1:
+        input[14] = (input[14] & 0xF7) | ((is_win8 & 2) * 4)
+
+    for _ in range(25):
+        c = 0
+        for j in range(14, -1, -1):
+            c = (c << 8) ^ input[j]
+            input[j] = min(int(c / 24), 255)
+            c = c % 24
+        output = chars[c] + output
+
+    if is_win8:
+        if c == 0:
+            output = "N" + output
+        else:
+            part = output[1 : 1 + c]
+            output = output[1:].replace(part, part + "N")
+
+    return "-".join([output[i * 5 : i * 5 + 5] for i in range(5)])

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/dissect/target/plugins/os/windows/registry.py

@@ -316,17 +316,20 @@ class RegistryPlugin(Plugin):
                 pass
 
     @internal
-    def values(self, keys: str | Iterable[str], value: str) -> Iterator[RegistryValue]:
+    def values(self, keys: str | Iterable[str], value: str | Iterable[str]) -> Iterator[RegistryValue]:
         """Yields all values that match the given queries.
 
         Automatically resolves CurrentVersion keys. Also flattens ValueCollections.
         """
 
+        values = [value] if isinstance(value, str) else value
+
         for key in self.keys(keys):
-            try:
-                yield key.value(value)
-            except RegistryValueNotFoundError:  # noqa: PERF203
-                pass
+            for value in values:
+                try:
+                    yield key.value(value)
+                except RegistryValueNotFoundError:  # noqa: PERF203
+                    pass
 
     def _iter_controlset_keypaths(self, keys: Iterable[str]) -> Iterator[str]:
         """Yield the key transformed for the different control sets."""

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev47
+Version: 3.23.dev49
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/dissect.target.egg-info/SOURCES.txt

@@ -354,6 +354,7 @@ dissect/target/plugins/os/windows/locale.py
 dissect/target/plugins/os/windows/network.py
 dissect/target/plugins/os/windows/notifications.py
 dissect/target/plugins/os/windows/prefetch.py
+dissect/target/plugins/os/windows/productkey.py
 dissect/target/plugins/os/windows/rdpcache.py
 dissect/target/plugins/os/windows/recyclebin.py
 dissect/target/plugins/os/windows/registry.py
@@ -725,6 +726,7 @@ tests/plugins/os/windows/test_mru.py
 tests/plugins/os/windows/test_network.py
 tests/plugins/os/windows/test_notifications.py
 tests/plugins/os/windows/test_prefetch.py
+tests/plugins/os/windows/test_productkey.py
 tests/plugins/os/windows/test_rdpcache.py
 tests/plugins/os/windows/test_recyclebin.py
 tests/plugins/os/windows/test_registry.py

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/tests/plugins/os/unix/linux/test_proc.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from typing import TYPE_CHECKING
+from unittest.mock import PropertyMock, patch
 
 import pytest
 
@@ -52,6 +53,24 @@ def test_processes(target_linux_users: Target, fs_linux_proc: VirtualFilesystem)
             assert env.contents == "1"
 
 
+def test_processes_without_boottime(target_linux_users: Target, fs_linux_proc: VirtualFilesystem) -> None:
+    target_linux_users.add_plugin(ProcPlugin)
+
+    with patch.object(ProcProcess, "_boottime", new_callable=PropertyMock) as mock_boottime:
+        mock_boottime.return_value = None
+
+        for process in target_linux_users.proc.processes():
+            assert process.pid in (1, 2, 3, 1337)
+            assert process.state in ("Sleeping", "Waking", "Running", "Wakekill")
+            assert process.name in ("systemd", "kthread", "acquire", "sshd")
+            assert process.starttime is None
+            assert process.runtime is None
+
+            for env in process.environ():
+                assert env.variable == "VAR"
+                assert env.contents == "1"
+
+
 def test_proc_plugin_incompatible(target_linux_users: Target, fs_linux: VirtualFilesystem) -> None:
     with pytest.raises(UnsupportedPluginError, match="No /proc directory found"):
         target_linux_users.add_plugin(ProcPlugin)

dissect_target-3.23.dev49/tests/plugins/os/windows/test_productkey.py

@@ -0,0 +1,88 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey
+from dissect.target.plugins.os.windows.productkey import WindowsProductKeyPlugin, decode_cd_key
+
+if TYPE_CHECKING:
+    from dissect.target.target import Target
+
+
+@pytest.mark.parametrize(
+    ("encoded_key", "decoded_key"),
+    [
+        pytest.param(
+            "ec0c00000000a8d27b6e89814f6d0900",
+            "VK7JG-NPHTM-C97JM-9MPGT-3V66T",
+            id="windows-11-24h2-eval-unregistered",
+        ),
+        pytest.param(
+            "d71000000000288b1b9eaf44f3d70800",
+            "J4WNC-H9BG3-6XRX4-3XD8K-Y7XRX",
+            id="windows-server-2019-eval-unregistered",
+        ),
+    ],
+)
+def test_windows_product_key_base24_decode(encoded_key: str, decoded_key: str) -> None:
+    """Test if we decode cd keys correctly."""
+    assert decode_cd_key(bytes.fromhex(encoded_key)) == decoded_key
+
+
+def test_windows_product_key_plugin(target_win: Target, hive_hklm: VirtualHive) -> None:
+    """Test the Windows Product Key plugin on discovery of ProductId values from a Windows 11 24H2 VM."""
+
+    key_name = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
+    key = VirtualKey(hive_hklm, key_name)
+    key.add_value(
+        "DigitalProductId4",
+        bytes.fromhex(
+            "f804000004000000300033003600310032002d00300033003300300038002d003000300030002d00300030003000300030003000"
+            "2d00300030002d0031003000330033002d00320036003100300030002e0030003000300030002d00310031003800320030003200"
+            "3500000000000000000000000000000000000000000000000000000000000000340064006500370063006200360035002d006300"
+            "6400660031002d0034006400650039002d0038006100650038002d00650033006300630065003200370062003900660032006300"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "0000000000000000000000000000000000000000500072006f00660065007300730069006f006e0061006c000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000ec0c00000000a8d27b6e89814f6d090058ed3820fbf01d2c"
+            "f44d615860ce274a3cf5af8470d167f54b2113f4a7dfc119fe24621376018d3ff2ba9520a3c013777e49f7afb55bfb494131b337"
+            "47b925b85b00540048005d005800310039002d003900380038003400310000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000520065007400610069006c00000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "520065007400610069006c0000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "000000000000000000000000000000000000000000000000"
+        ),
+    )
+    key.add_value(
+        "DigitalProductId",
+        bytes.fromhex(
+            "a40000000300000030303333302d38303030302d30303030302d414139363500ec0c00005b54485d5831392d3938383431000000"
+            "ec0c00000000a8d27b6e89814f6d0900000000004d700f685d032237000000000000000000000000000000000000000000000000"
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+            "00000000d7b3eb3a"
+        ),
+    )
+    hive_hklm.map_key(key_name, key)
+
+    target_win.add_plugin(WindowsProductKeyPlugin)
+
+    records = list(target_win.license())
+
+    assert len(records) == 1
+    assert records[0].key == "VK7JG-NPHTM-C97JM-9MPGT-3V66T"
+    assert records[0].name == "Professional [TH]X19-98841"
+    assert records[0].type == "Retail"
+    assert records[0].source == "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DigitalProductId4"

{dissect_target-3.23.dev47 → dissect_target-3.23.dev49}/tests/plugins/os/windows/test_registry.py

@@ -7,10 +7,13 @@ from unittest.mock import patch
 
 import pytest
 
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
 from dissect.target.plugins.os.windows.registry import RegistryPlugin
 from dissect.target.target import Target
 
 if TYPE_CHECKING:
+    from collections.abc import Iterable
+
     from dissect.target.filesystem import VirtualFilesystem
 
 
@@ -153,3 +156,56 @@ def test_registry_plugin_root_none(target_win_users: Target) -> None:
 
     assert plugin.key()
     assert plugin.key("")
+
+
+@pytest.mark.parametrize(
+    ("keys", "values", "expected_output"),
+    [
+        pytest.param(
+            "HKLM\\SOFTWARE\\SomePath",
+            "Foo",
+            ["FooValue"],
+            id="single-key-single-value",
+        ),
+        pytest.param(
+            "HKLM\\SOFTWARE\\SomePath",
+            ("Foo", "Bar"),
+            ["FooValue", "BarValue"],
+            id="single-key-multi-value",
+        ),
+        pytest.param(
+            ("HKLM\\SOFTWARE\\SomePath", "HKLM\\SOFTWARE\\AnotherPath"),
+            "Foo",
+            ["FooValue", "AnotherFooValue"],
+            id="multi-key-single-value",
+        ),
+        pytest.param(
+            ("HKLM\\SOFTWARE\\SomePath", "HKLM\\SOFTWARE\\AnotherPath"),
+            ("Foo", "Bar"),
+            ["FooValue", "BarValue", "AnotherFooValue", "AnotherBarValue"],
+            id="multi-key-multi-value",
+        ),
+    ],
+)
+def test_registry_plugin_values_keys(
+    target_win_users: Target,
+    hive_hklm: VirtualHive,
+    keys: str | Iterable[str] | None,
+    values: str | Iterable[str] | None,
+    expected_output: list[str],
+) -> None:
+    """Test if we can handle different input values for :meth:`RegistryPlugin.values`."""
+
+    key_path = "SOFTWARE\\SomePath"
+    key = VirtualKey(hive_hklm, key_path)
+    key.add_value("Foo", VirtualValue(hive_hklm, "Foo", "FooValue"))
+    key.add_value("Bar", VirtualValue(hive_hklm, "Bar", "BarValue"))
+    hive_hklm.map_key(key_path, key)
+
+    key_path = "SOFTWARE\\AnotherPath"
+    key = VirtualKey(hive_hklm, key_path)
+    key.add_value("Foo", VirtualValue(hive_hklm, "Foo", "AnotherFooValue"))
+    key.add_value("Bar", VirtualValue(hive_hklm, "Bar", "AnotherBarValue"))
+    hive_hklm.map_key(key_path, key)
+
+    assert [v.value for v in target_win_users.registry.values(keys, values)] == expected_output