dissect.target 3.24.dev2__tar.gz → 3.25__tar.gz

dissect_target-3.25/.vscode/launch.json

@@ -0,0 +1,37 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "debugpy",
+            "request": "launch",
+            "name": "target-query",
+            "module": "dissect.target.tools.query",
+            "args": [
+                "${input:target}",
+                "-f",
+                "${input:functions}"
+            ]
+        },
+        {
+            "type": "debugpy",
+            "request": "launch",
+            "name": "target-shell",
+            "module": "dissect.target.tools.shell",
+            "args": [
+                "${input:target}"
+            ]
+        }
+    ],
+    "inputs": [
+        {
+            "type": "promptString",
+            "id": "target",
+            "description": "Path to target file (e.g. /path/to/image.vmdk)"
+        },
+        {
+            "type": "promptString",
+            "id": "functions",
+            "description": "Comma separated target-query function names (e.g. hostname,users)"
+        },
+    ]
+}

dissect_target-3.25/PKG-INFO

@@ -0,0 +1,298 @@
+Metadata-Version: 2.4
+Name: dissect.target
+Version: 3.25
+Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
+Author-email: Dissect Team <dissect@fox-it.com>
+License-Expression: AGPL-3.0-or-later
+Project-URL: homepage, https://dissect.tools
+Project-URL: documentation, https://docs.dissect.tools/en/latest/projects/dissect.target
+Project-URL: repository, https://github.com/fox-it/dissect.target
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: Log Analysis
+Classifier: Topic :: Scientific/Engineering :: Information Analysis
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: COPYRIGHT
+Requires-Dist: defusedxml
+Requires-Dist: dissect.cstruct<5,>=4
+Requires-Dist: dissect.database<2,>=1.1.dev4
+Requires-Dist: dissect.eventlog<4,>=3
+Requires-Dist: dissect.evidence<4,>=3.13.dev3
+Requires-Dist: dissect.hypervisor<4,>=3.21.dev5
+Requires-Dist: dissect.ntfs<4,>=3.16.dev
+Requires-Dist: dissect.regf<4,>=3.13
+Requires-Dist: dissect.util<4,>=3
+Requires-Dist: dissect.volume<4,>=3.17
+Requires-Dist: flow.record~=3.21.0
+Requires-Dist: structlog
+Provides-Extra: full
+Requires-Dist: asn1crypto; extra == "full"
+Requires-Dist: dissect.apfs<2,>=1.0.2.dev; extra == "full"
+Requires-Dist: dissect.archive<2,>=1; extra == "full"
+Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
+Requires-Dist: dissect.cim<4,>=3; extra == "full"
+Requires-Dist: dissect.clfs<2,>=1; extra == "full"
+Requires-Dist: dissect.cramfs<2,>=1; extra == "full"
+Requires-Dist: dissect.etl<4,>=3; extra == "full"
+Requires-Dist: dissect.executable<2,>=1; extra == "full"
+Requires-Dist: dissect.extfs<4,>=3; extra == "full"
+Requires-Dist: dissect.fat<4,>=3; extra == "full"
+Requires-Dist: dissect.ffs<4,>=3; extra == "full"
+Requires-Dist: dissect.fve<5,>=4.5; extra == "full"
+Requires-Dist: dissect.jffs<2,>=1.5; extra == "full"
+Requires-Dist: dissect.ole<4,>=3; extra == "full"
+Requires-Dist: dissect.qnxfs<2,>=1.1; extra == "full"
+Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
+Requires-Dist: dissect.squashfs<2,>=1; extra == "full"
+Requires-Dist: dissect.thumbcache<2,>=1; extra == "full"
+Requires-Dist: dissect.vmfs<4,>=3.12; extra == "full"
+Requires-Dist: dissect.xfs<4,>=3; extra == "full"
+Requires-Dist: ipython; extra == "full"
+Requires-Dist: fusepy; extra == "full"
+Requires-Dist: pycryptodome; extra == "full"
+Requires-Dist: ruamel.yaml; extra == "full"
+Requires-Dist: tomli; python_version < "3.11" and extra == "full"
+Requires-Dist: backports.zstd; python_version < "3.14" and extra == "full"
+Provides-Extra: dev
+Requires-Dist: dissect.target[full,yara]; extra == "dev"
+Requires-Dist: dissect.apfs[dev]<2.0.dev,>=1.0.2.dev; extra == "dev"
+Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cramfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
+Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev8; extra == "dev"
+Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"
+Requires-Dist: dissect.executable[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.5.dev; extra == "dev"
+Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.21.dev3; extra == "dev"
+Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
+Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.16.dev; extra == "dev"
+Requires-Dist: dissect.qnxfs[dev]<2.0.dev,>=1.1.dev; extra == "dev"
+Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.13.dev; extra == "dev"
+Requires-Dist: dissect.shellitem[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.squashfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.thumbcache[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.util<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.vmfs[dev]<4.0.dev,>=3.12.dev; extra == "dev"
+Requires-Dist: dissect.volume[dev]<4.0.dev,>=3.17.dev; extra == "dev"
+Requires-Dist: dissect.xfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Provides-Extra: yara
+Requires-Dist: dissect.target[full]; extra == "yara"
+Requires-Dist: yara-python>=4.3.0; extra == "yara"
+Provides-Extra: smb
+Requires-Dist: dissect.target[full]; extra == "smb"
+Requires-Dist: impacket==0.10.0; extra == "smb"
+Provides-Extra: cb
+Requires-Dist: dissect.target[full]; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
+Provides-Extra: mqtt
+Requires-Dist: dissect.target[full]; extra == "mqtt"
+Requires-Dist: paho-mqtt==1.6.1; extra == "mqtt"
+Dynamic: license-file
+
+# dissect.target
+
+The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which
+allow easy access to various data sources inside disk images or file collections (a.k.a. targets). For more information,
+please see [the documentation](https://docs.dissect.tools/en/latest/projects/dissect.target/index.html).
+
+## Requirements
+
+This project is part of the Dissect framework and requires Python.
+
+Information on the supported Python versions can be found in the Getting Started section of [the documentation](https://docs.dissect.tools/en/latest/index.html#getting-started).
+
+## Installation
+
+`dissect.target` is available on [PyPI](https://pypi.org/project/dissect.target/).
+
+```bash
+pip install dissect.target
+```
+
+This module is also automatically installed if you install the `dissect` package.
+
+If you wish to use the YARA plugin (`target-query -f yara`), you can install `dissect.target[yara]` to automatically 
+install the `yara-python` dependency.
+
+## Tools inside this project
+
+### target-query
+`target-query` is a tool used to query specific data inside one or more targets.
+These queries are available in the form of functions that reside within [plugins](https://docs.dissect.tools/en/latest/advanced/plugins.html).
+Each plugin is focussed on providing specific functionality.
+
+This functionality can range from parsing log sources, such as command history logs (i.e. bash history,
+PowerShell history, etc.), to returning the hostname and operating system version.
+
+The most basic basic usage of `target-query` is to execute a function on a target:
+
+```bash
+target-query -f <FUNCTION_NAME> /example_path/target.vmdk
+```
+
+You can also use basic path expansion to execute functions over multiple targets. For example, to execute a function
+on all ``.vmdk`` files in a directory:
+
+```
+target-query -f <FUNCTION_NAME> /example_path/*.vmdk
+```
+
+Not every target plugin will function on every target, they are OS specific.
+More information on how to use `target-query` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-query.html).
+
+### target-shell
+`target-shell` gives you the ability to access a target using a virtual shell environment. Once a shell is opened
+on a target, type `help` to list the available commands. To see the documentation of each command,
+you can use `help [COMMAND]`.
+
+Opening a shell on a target is straight-forward. You can do so by specifying a path to a target as follows:
+
+```bash
+    target-shell targets/EXAMPLE.vmx
+    WIN-EXAMPLE:/$ help
+
+    Documented commands (type help <topic>):
+    ========================================
+    attr   cls    enter        find     info  man       registry  volumes
+    cat    cyber  exit         hash     less  pwd       save      zcat   
+    cd     debug  file         help     ll    python    stat      zless  
+    clear  disks  filesystems  hexdump  ls    readlink  tree    
+
+    WIN-EXAMPLE:/$ ls
+    $fs$
+    c:
+    efi
+    sysvol
+```
+
+Further interacting with the target can be done using the commands listed above.
+You can exit the shell by running `exit` or by pressing `CTRL+D`.
+
+More information on how to use `target-shell` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-shell.html).
+
+### target-fs
+With `target-fs` you can interact with the filesystem of a target using a set of familiar Unix commands.
+
+The basic structure of a `target-fs` command is as follows:
+
+```bash
+target-fs <path_to_target> <command> <path_for_command>
+```
+
+**NOTE:** As with any shell command, you have to properly escape backlashes and spaces. Unless you use single or double quotes (`'`, `"`).
+
+More information on how to use `target-fs` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-fs.html).
+
+### target-reg
+With `target-reg` you can easily query the registry of Windows targets and print the results in a tree. A `+` symbol indicates that it is a registry key (i.e. may have subkeys). A `-` symbol indicates a registry value.
+
+```bash
+user@dissect~$ target-reg targets/EXAMPLE.E01 -k "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft"
++ 'Microsoft' (last-modified-date-shows-here)
+    + '.NETFramework' (last-modified-date-shows-here)
+    - 'Enable64Bit' value-shows-here
+[...]
+```
+
+More information on how to use `target-reg` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-reg.html).
+
+### target-dump
+With `target-dump` you can export records of a specific `function` used in target-query to a file.
+
+The basic structure of a `target-dump` command is as follows:
+
+```bash
+target-dump -f <comma_seperated_functions> <path_to_target>
+```
+
+Futhermore, the tool can apply certain compression algorithms to the dump, to create small archives of the output.
+
+More information on how to use `target-dump` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-dump.html).
+
+### target-dd
+With `target-dd` you can export (a part of) a target to a file or to stdout. At the moment, `target-dd` can be used for targets that have only one disk.
+
+The basic structure of a `target-dd` command is as follows:
+
+```bash
+target-dd --write <output_file> --offset <offset_on_target_in_bytes> --bytes <nr_of_bytes_to_read> <path_to_target>
+```
+
+More information on how to use `target-dd` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-dd.html).
+
+### target-mount
+With `target-mount` you can mount the filesystem of a target to any arbitrary directory on your analysis machine, similar to the `mount` command on Unix systems.
+To perform this function, we use `fusepy` to mount a filesystem in linux and mac.
+This interacts with `fuselib` to mount disk images in linux userspace, so no administrative access is required.
+
+`target-mount` has two required positional arguments:
+
+* `TARGET` - Target to mount
+* `MOUNT` - Directory to mount the target's filesystem on
+
+
+The following example command can be used to mount a target to the directory ``mnt``:
+
+```bash
+user@dissect~$ target-mount targets/EXAMPLE.vmx ~/mnt/EXAMPLE
+user@dissect~$ ls ~/mnt/EXAMPLE/
+disks   fs   volumes
+```
+
+When mounting a target using `target-mount` the process is kept in the foreground. This will occupy your current
+terminal session. It is recommended to either open a second terminal, let this command run in the background by
+appending `&` to the command or use a terminal multiplexer like `tmux` to start a second session. Using one
+of these methods enables you to interact with the mountpoint.
+
+More information on how to use `target-mount` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-mount.html).
+
+## Build and test instructions
+
+This project uses `tox` to build source and wheel distributions. Run the following command from the root folder to build
+these:
+
+```bash
+tox -e build
+```
+
+The build artifacts can be found in the `dist/` directory.
+
+`tox` is also used to run linting and unit tests in a self-contained environment. To run both linting and unit tests
+using the default installed Python version, run:
+
+```bash
+tox
+```
+
+For a more elaborate explanation on how to build and test the project, please see [the
+documentation](https://docs.dissect.tools/en/latest/contributing/tooling.html).
+
+## Contributing
+
+The Dissect project encourages any contribution to the codebase. To make your contribution fit into the project, please
+refer to [the development guide](https://docs.dissect.tools/en/latest/contributing/developing.html).
+
+## Copyright and license
+
+Dissect is released as open source by Fox-IT (<https://www.fox-it.com>) part of NCC Group Plc
+(<https://www.nccgroup.com>).
+
+Developed by the Dissect Team (<dissect@fox-it.com>) and made available at <https://github.com/fox-it/dissect>.
+
+License terms: AGPL3 (<https://www.gnu.org/licenses/agpl-3.0.html>). For more information, see the LICENSE file.

dissect_target-3.25/dissect/target/container.py

@@ -0,0 +1,260 @@
+from __future__ import annotations
+
+import io
+from pathlib import Path
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.target.exceptions import ContainerError
+from dissect.target.helpers.lazy import import_lazy
+from dissect.target.helpers.logging import get_logger
+from dissect.target.helpers.utils import readinto
+
+if TYPE_CHECKING:
+    from dissect.target.volume import VolumeSystem
+
+CONTAINERS: list[type[Container]] = []
+MODULE_PATH = "dissect.target.containers"
+
+RawContainer = import_lazy("dissect.target.containers.raw").RawContainer
+"""A lazy import of :mod:`dissect.target.containers.raw`."""
+
+log = get_logger(__name__)
+
+
+class Container(io.IOBase):
+    """Base class that acts as a file-like object wrapper around anything that can behave like a "raw disk".
+
+    Containers are anything from raw disk images and virtual disks, to evidence containers and made-up binary formats.
+    Consumers of the ``Container`` class only need to implement ``seek``, ``tell`` and ``read``.
+    Override ``__init__`` for any opening that you may need to do, but don't forget to initialize the super class.
+
+    Args:
+        fh: The source file-like object of the container or a ``Path`` object to the file.
+        size: The size of the container.
+        vs: An optional shorthand to set the underlying volume system, usually set later.
+    """
+
+    # Due to lazy importing we generally can't use isinstance(), so we add a short identifying string to each class
+    # This has the added benefit of having a readily available "pretty name" for each implementation
+    __type__: str = None
+    """A short string identifying the type of container."""
+
+    def __init__(self, fh: BinaryIO | Path, size: int, vs: VolumeSystem | None = None):
+        self.fh = fh
+        self.size = size
+
+        # Shorthand access to vs
+        self.vs = vs
+
+        if self.__type__ is None:
+            raise NotImplementedError(f"{self.__class__.__name__} must define __type__")
+
+    def __repr__(self) -> str:
+        return f"<Container type={self.__type__} size={self.size} vs={self.vs.__type__ if self.vs else None}>"
+
+    @classmethod
+    def detect(cls, item: list | BinaryIO | Path) -> bool:
+        """Detect if this ``Container`` can handle this file format.
+
+        Args:
+            item: The object we want to see if it can be handled by this ``Container``.
+
+        Returns:
+            ``True`` if this ``Container`` can be used, ``False`` otherwise.
+        """
+        i = item[0] if isinstance(item, list) else item
+        if hasattr(i, "read"):
+            return cls.detect_fh(i, item)
+        if cls.detect_path(i, item):
+            return True
+        if i.exists():
+            with i.open("rb") as fh:
+                return cls.detect_fh(fh, item)
+
+        return False
+
+    @classmethod
+    def detect_fh(cls, fh: BinaryIO, original: list | BinaryIO) -> bool:
+        """Detect if this ``Container`` can be used to open the file-like object ``fh``.
+
+        The function checks whether the raw data contains any magic information that corresponds to this
+        specific container.
+
+        Args:
+            fh: A file-like object that we want to open a ``Container`` on.
+            original: The original argument passed to ``detect()``.
+
+        Returns:
+            ``True`` if this ``Container`` can be used for this file-like object, ``False`` otherwise.
+        """
+        offset = fh.tell()
+        try:
+            fh.seek(0)
+            return cls._detect_fh(fh, original)
+        except NotImplementedError:
+            raise
+        except Exception as e:
+            log.warning("Failed to detect %s container", cls.__name__)
+            log.debug("", exc_info=e)
+        finally:
+            fh.seek(offset)
+
+        return False
+
+    @staticmethod
+    def _detect_fh(fh: BinaryIO, original: list | BinaryIO) -> bool:
+        """Detect if this ``Container`` can be used to open the file-like object ``fh``.
+
+        This method should be implemented by subclasses. The position of ``fh`` is guaranteed to be ``0``.
+
+        Args:
+            fh: A file-like object that we want to open a ``Container`` on.
+            original: The original argument passed to ``detect()``.
+
+        Returns:
+            ``True`` if this ``Container`` can be used for this file-like object, ``False`` otherwise.
+        """
+        raise NotImplementedError
+
+    @staticmethod
+    def detect_path(path: Path, original: list | Path) -> bool:
+        """Detect if this ``Container`` can be used to open ``path``.
+
+        The function checks wether file inside ``path`` is formatted in such a way that
+        this ``Container`` can be used to read it. For example, it validates against the
+        file extension.
+
+        Args:
+            path: A location to a file.
+            original: The original argument passed to ``detect()``.
+
+        Returns:
+            ``True`` if this ``Container`` can be used for this path, ``False`` otherwise.
+        """
+        raise NotImplementedError
+
+    def read(self, length: int = -1) -> bytes:
+        """Read a ``length`` of bytes from this ``Container``."""
+        raise NotImplementedError
+
+    def readinto(self, b: bytearray) -> int:
+        """Uses :func:`dissect.target.helpers.utils.readinto`."""
+        return readinto(buffer=b, fh=self)
+
+    def seek(self, offset: int, whence: int = io.SEEK_SET) -> int:
+        """Change the stream position to ``offset``.
+
+        ``whence`` determines where to seek from:
+
+        * ``io.SEEK_SET`` (``0``):: absolute offset in the stream.
+        * ``io.SEEK_CUR`` (``1``):: current position in the stream.
+        * ``io.SEEK_END`` (``2``):: end of stream.
+
+        Args:
+            offset: The offset relative to the position indicated by ``whence``.
+            whence: Where to start the seek from.
+        """
+        raise NotImplementedError
+
+    def seekable(self) -> bool:
+        """Returns whether ``seek`` can be used by this ``Container``. Always ``True``."""
+        return True
+
+    def tell(self) -> int:
+        """Returns the current seek position of the ``Container``."""
+        raise NotImplementedError
+
+    def close(self) -> None:
+        """Close the container.
+
+        Override this if you need to clean-up anything.
+        """
+
+
+def register(module: str, class_name: str, internal: bool = True) -> None:
+    """Register a container implementation to use when opening a container.
+
+    This function registers a container using ``module`` relative to the ``MODULE_PATH``.
+    It lazily imports the module, and retrieves the specific class from it.
+
+    Args:
+        module: The module where to find the container.
+        class_name: The class to load.
+        internal: Whether it is an internal module or not.
+    """
+
+    if internal:
+        module = f"{MODULE_PATH}.{module}"
+
+    CONTAINERS.append(getattr(import_lazy(module), class_name))
+
+
+def open(item: list | str | BinaryIO | Path, *args, **kwargs) -> Container:
+    """Open a :class:`Container` from the given object.
+
+    All currently supported containers are checked to find a compatible one.
+    :class:`RawContainer <dissect.target.containers.raw.RawContainer>` must always be checked last
+    since it always succeeds!
+
+    Args:
+        item: The object we want to open a :class`Container` from.
+
+    Raises:
+        ContainerError: When a compatible :class`Container` was found but it failed to open.
+        ContainerError: When no compatible :class`Container` implementations were found.
+    """
+    if isinstance(item, list):
+        item = [Path(entry) if isinstance(entry, str) else entry for entry in item]
+    elif isinstance(item, str):
+        item = Path(item)
+
+    first = item[0] if isinstance(item, list) else item
+    first_fh = None
+    first_fh_opened = False
+    first_fh_offset = None
+    first_path = None
+
+    if hasattr(first, "read"):
+        first_fh = first
+    else:
+        first_path = first
+        if first_path.is_file():
+            first_fh = first.open("rb")
+            first_fh_opened = True
+
+    if first_fh:
+        first_fh_offset = first_fh.tell()
+        first_fh.seek(0)
+
+    try:
+        for container in [*CONTAINERS, RawContainer]:
+            try:
+                # Path must be leading for things like SplitContainer, but fall back to fh if we have one
+                if (first_path and container.detect_path(first_path, item)) or (
+                    first_fh and container.detect_fh(first_fh, item)
+                ):
+                    return container(item, *args, **kwargs)
+            except ImportError as e:  # noqa: PERF203
+                log.info("Failed to import %s", container)
+                log.debug("", exc_info=e)
+            except Exception as e:
+                raise ContainerError(f"Failed to open container {item}") from e
+    finally:
+        if first_fh_opened:
+            first_fh.close()
+        elif first_fh:
+            first_fh.seek(first_fh_offset)
+
+    raise ContainerError(f"Failed to detect container for {item}")
+
+
+register("ewf", "EwfContainer")
+register("vmdk", "VmdkContainer")
+register("vhdx", "VhdxContainer")
+register("vhd", "VhdContainer")
+register("qcow2", "QCow2Container")
+register("vdi", "VdiContainer")
+register("hdd", "HddContainer")
+register("hds", "HdsContainer")
+register("split", "SplitContainer")
+register("fortifw", "FortiFirmwareContainer")

dissect_target-3.25/dissect/target/containers/asif.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import io
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.hypervisor.disk import asif
+
+from dissect.target.container import Container
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+class AsifContainer(Container):
+    __type__ = "asif"
+
+    def __init__(
+        self,
+        fh: BinaryIO | Path,
+        *args,
+        **kwargs,
+    ):
+        self.asif = asif.ASIF(fh.open("rb") if not hasattr(fh, "read") else fh)
+        self.stream = self.asif.open()
+
+        super().__init__(fh, self.asif.size, *args, **kwargs)
+
+    @staticmethod
+    def _detect_fh(fh: BinaryIO, original: list | BinaryIO) -> bool:
+        return fh.read(4) == b"shdw"
+
+    @staticmethod
+    def detect_path(path: Path, original: list | BinaryIO) -> bool:
+        return path.suffix.lower() == ".asif"
+
+    def read(self, length: int) -> bytes:
+        return self.stream.read(length)
+
+    def seek(self, offset: int, whence: int = io.SEEK_SET) -> int:
+        return self.stream.seek(offset, whence)
+
+    def tell(self) -> int:
+        return self.stream.tell()
+
+    def close(self) -> None:
+        self.stream.close()