dissect.target 3.25.dev14__tar.gz → 3.25.dev20__tar.gz

{dissect_target-3.25.dev14 → dissect_target-3.25.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev14
+Version: 3.25.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -25,7 +25,7 @@ Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.database<2,>=1
 Requires-Dist: dissect.eventlog<4,>=3
-Requires-Dist: dissect.evidence<4,>=3
+Requires-Dist: dissect.evidence<4,>=3.13.dev2
 Requires-Dist: dissect.hypervisor<4,>=3.20
 Requires-Dist: dissect.ntfs<4,>=3.16.dev
 Requires-Dist: dissect.regf<4,>=3.13
@@ -42,6 +42,7 @@ Requires-Dist: dissect.cim<4,>=3; extra == "full"
 Requires-Dist: dissect.clfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cramfs<2,>=1; extra == "full"
 Requires-Dist: dissect.etl<4,>=3; extra == "full"
+Requires-Dist: dissect.executable<2,>=1; extra == "full"
 Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"
 Requires-Dist: dissect.ffs<4,>=3; extra == "full"
@@ -72,7 +73,8 @@ Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
 Requires-Dist: dissect.database[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"
+Requires-Dist: dissect.executable[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"

dissect_target-3.25.dev20/dissect/target/filesystems/ad1.py

@@ -0,0 +1,147 @@
+from __future__ import annotations
+
+import stat
+from pathlib import Path
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.evidence import ad1
+
+from dissect.target.exceptions import (
+    FileNotFoundError,
+    FilesystemError,
+    IsADirectoryError,
+    NotADirectoryError,
+    NotASymlinkError,
+)
+from dissect.target.filesystem import DirEntry, Filesystem, FilesystemEntry
+from dissect.target.helpers import fsutil, keychain
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+class AD1Filesystem(Filesystem):
+    __type__ = "ad1"
+
+    def __init__(self, fh: BinaryIO | list[BinaryIO] | Path | list[Path], *args, **kwargs):
+        super().__init__(fh, *args, **kwargs)
+        self.ad1 = ad1.AD1(fh)
+
+        if self.ad1.is_adcrypt():
+            keys = keychain.get_keys_for_provider(self.__type__) + keychain.get_keys_without_provider()
+
+            if not keys:
+                raise ValueError("Failed to unlock ADCRYPT: no key(s) provided")
+
+            for key in keys:
+                try:
+                    if key.key_type == keychain.KeyType.PASSPHRASE:
+                        self.ad1.unlock(passphrase=key.value)
+                    elif key.key_type == keychain.KeyType.FILE and (path := Path(key.value)).is_file():
+                        self.ad1.unlock(private_key=path)
+                except ValueError:  # noqa: PERF203
+                    pass
+
+            if self.ad1.is_locked():
+                raise ValueError("Failed to unlock ADCRYPT using provided key(s)")
+
+    @staticmethod
+    def _detect(fh: BinaryIO) -> bool:
+        return fh.read(16) == b"ADSEGMENTEDFILE\x00"
+
+    def get(self, path: str) -> FilesystemEntry:
+        return AD1FilesystemEntry(self, path, self._get_entry(path))
+
+    def _get_entry(self, path: str, entry: ad1.FileEntry | None = None) -> ad1.FileEntry:
+        try:
+            return self.ad1.entry(path, entry)
+        except ad1.FileNotFoundError as e:
+            raise FileNotFoundError(path) from e
+        except ad1.NotADirectoryError as e:
+            raise NotADirectoryError(path) from e
+        except ad1.NotASymlinkError as e:
+            raise NotASymlinkError(path) from e
+        except ad1.Error as e:
+            raise FileNotFoundError(path) from e
+
+
+class AD1DirEntry(DirEntry):
+    fs: AD1Filesystem
+    entry: ad1.FileEntry
+
+    def get(self) -> AD1FilesystemEntry:
+        return AD1FilesystemEntry(self.fs, self.path, self.entry)
+
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
+        return self.get().stat(follow_symlinks=follow_symlinks)
+
+
+class AD1FilesystemEntry(FilesystemEntry):
+    fs: AD1Filesystem
+    entry: ad1.FileEntry
+
+    def get(self, path: str) -> FilesystemEntry:
+        entry_path = fsutil.join(self.path, path, alt_separator=self.fs.alt_separator)
+        entry = self.fs._get_entry(path, self.entry)
+        return AD1FilesystemEntry(self.fs, entry_path, entry)
+
+    def open(self) -> BinaryIO:
+        if self.is_dir():
+            raise IsADirectoryError(self.path)
+        return self.entry.open()
+
+    def scandir(self) -> Iterator[AD1DirEntry]:
+        if not self.is_dir():
+            raise NotADirectoryError(self.path)
+
+        for entry in self.entry.iterdir():
+            yield AD1DirEntry(self.fs, self.path, entry.name, entry)
+
+    def is_dir(self, follow_symlinks: bool = True) -> bool:
+        try:
+            return self._resolve(follow_symlinks=follow_symlinks).entry.is_dir()
+        except FilesystemError:
+            return False
+
+    def is_file(self, follow_symlinks: bool = True) -> bool:
+        try:
+            return self._resolve(follow_symlinks=follow_symlinks).entry.is_file()
+        except FilesystemError:
+            return False
+
+    def is_symlink(self) -> bool:
+        return self.entry.is_symlink()
+
+    def readlink(self) -> str:
+        if not self.is_symlink():
+            raise NotASymlinkError(self.path)
+        return self.entry.readlink()
+
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
+        return self._resolve(follow_symlinks=follow_symlinks).lstat()
+
+    def lstat(self) -> fsutil.stat_result:
+        if self.is_symlink():
+            mode = stat.S_IFLNK
+        elif self.is_file():
+            mode = stat.S_IFREG
+        else:
+            mode = stat.S_IFDIR
+
+        st_info = fsutil.stat_result(
+            [
+                mode | 0o777,
+                self.entry.offset,
+                id(self.fs),
+                1,  # nlink
+                0,  # uid
+                0,  # gid
+                self.entry.size,
+                self.entry.atime.timestamp(),
+                self.entry.mtime.timestamp(),
+                self.entry.ctime.timestamp(),
+            ]
+        )
+
+        st_info.st_birthtime = self.entry.btime.timestamp()
+        return st_info

dissect_target-3.25.dev20/dissect/target/helpers/magic/__init__.py

@@ -0,0 +1,12 @@
+from __future__ import annotations
+
+from dissect.target.helpers.magic.magic import Magic, from_buffer, from_descriptor, from_entry, from_fh, from_file
+
+__all__ = [
+    "Magic",
+    "from_buffer",
+    "from_descriptor",
+    "from_entry",
+    "from_fh",
+    "from_file",
+]

dissect_target-3.25.dev20/dissect/target/helpers/magic/magic.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from io import BytesIO
+from pathlib import Path
+from typing import BinaryIO, TypeAlias
+
+from dissect.target.filesystem import FilesystemEntry
+from dissect.target.helpers.magic import mimetypes
+
+MagicSignature: TypeAlias = tuple[str, str, bytes]
+MagicResult: TypeAlias = str | None
+
+
+class Magic:
+    """Magic is a helper class for identifying files to a file type by magic bytes.
+
+    This class mimics ``python-magic`` behaviour, however this implementation does
+    not depend on the ``libmagic`` C-library system package. Instead a precompiled
+    XML document of FreeDesktop's shared-mime-info project is used to identify files.
+
+    Falls back to file extensions (where applicable) if no magic header is detected
+    in the provided buffer.
+
+    The underlying implementation currently does not support nested magic definitions
+    and logical AND/OR matches, which somewhat limits the supported FreeDesktop XML
+    magic signature set.
+
+    .. code-block:: python
+
+        from dissect.target.helpers import magic
+
+        >>> magic.from_buffer(b"SQLite format 3\x00FILE DATA\x4d\x3c\xb2\xa1")
+        "SQLite3 database"
+
+        >>> magic.from_file(target.fs.path("file.jpg"), mime=True)
+        "image/jpg"
+
+    Currently does not implement ``python-magic`` :class:`Magic` invocation behaviour.
+
+    Resources:
+        - https://github.com/ahupp/python-magic/blob/master/magic/__init__.py
+        - https://github.com/file/file/tree/master/magic
+        - https://freedesktop.org/wiki/Specifications/shared-mime-info-spec/
+        - https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in
+    """
+
+    @staticmethod
+    def detect(buf: BinaryIO, suffix: str | None = None, *, mime: bool = False) -> MagicResult:
+        """Searches ``mimetypes.MAP`` for the given bytes."""
+        if suffix is not None and not isinstance(suffix, str):
+            raise TypeError("Provided suffix is not a string")
+
+        res_attr = "type" if mime else "name"
+        for index, offset, magic in mimetypes.MAP:
+            buf.seek(offset)
+            if buf.read(len(magic)) == magic:
+                return mimetypes.TYPES[index][res_attr]
+
+        if suffix:
+            for index, patterns in mimetypes.PATTERNS:
+                if suffix.endswith(patterns):
+                    return mimetypes.TYPES[index][res_attr]
+
+        return None
+
+
+def from_file(path: Path, *, mime: bool = False) -> MagicResult:
+    """Detect file type from a :class:`Path` instance."""
+
+    if not isinstance(path, Path):
+        raise TypeError("Provided path is not a Path instance")
+
+    with path.open("rb") as fh:
+        return from_descriptor(fh, path.suffix, mime=mime)
+
+
+def from_entry(entry: FilesystemEntry, *, mime: bool = False) -> MagicResult:
+    """Detect file type from a :class:`FilesystemEntry` instance."""
+
+    if not isinstance(entry, FilesystemEntry):
+        raise TypeError("Provided entry is not a FilesystemEntry instance")
+
+    with entry.open() as fh:
+        return from_descriptor(fh, Path(entry.name).suffix, mime=mime)
+
+
+def from_descriptor(fh: BinaryIO, suffix: str | None = None, *, mime: bool = False) -> MagicResult:
+    """Detect file type from a file descriptor or handle."""
+
+    if not hasattr(fh, "read") or not hasattr(fh, "seek"):
+        raise TypeError("Provided fh does not have a read or seek method")
+
+    return Magic().detect(fh, suffix, mime=mime)
+    return from_buffer(fh, suffix, mime=mime)
+
+
+# Convenience alias, not present in python-magic.
+from_fh = from_descriptor
+
+
+def from_buffer(buf: bytes, suffix: str | None = None, *, mime: bool = False) -> MagicResult:
+    """Detect file type from provided bytes or buffer of bytes."""
+
+    if not isinstance(buf, bytes):
+        raise TypeError("Provided buf is not bytes")
+
+    return from_descriptor(BytesIO(buf), suffix, mime=mime)

dissect_target-3.25.dev20/dissect/target/helpers/magic/mimetypes/__init__.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+import importlib
+from pathlib import Path
+
+TYPES = []
+MAP = set()
+PATTERNS: set[tuple[int, tuple[str]]] = set()
+
+files = [
+    Path(__file__).parent.joinpath("freedesktop.py").resolve(),
+    *[p for p in Path(__file__).parent.glob("*.py") if p.stem not in ("__init__", "freedesktop", "overrides")],
+    Path(__file__).parent.joinpath("overrides.py").resolve(),
+]
+
+for file in files:
+    obj = importlib.import_module(f"dissect.target.helpers.magic.mimetypes.{file.stem}")
+
+    if not hasattr(obj, "TYPES"):
+        raise ValueError(f"Module {obj!s} does not have a TYPES attribute.")
+
+    if not isinstance(obj.TYPES, list):
+        raise TypeError(f"Attribute {obj!s}.TYPES is not a list.")
+
+    TYPES += obj.TYPES
+
+for i, definition in enumerate(TYPES):
+    if "type" not in definition:
+        raise ValueError(f"Magic definition missing type: {definition}")
+
+    if "name" not in definition:
+        raise ValueError(f"Magic definition missing name: {definition}")
+
+    if "magic" not in definition and "pattern" not in definition:
+        raise ValueError(f"Magic definition missing magic or pattern: {definition}")
+
+    if "pattern" in definition:
+        # We only support patterns like `*.foo`, not `foo.*` or `foo*bar`
+        PATTERNS.add((i, tuple([p.replace("*", "") for p in definition.get("pattern", [])])))
+
+    for magic in definition.get("magic", []):
+        if "value" not in magic:
+            raise ValueError(f"Magic definition missing value in {definition}")
+
+        MAP.add((i, magic.get("offset", 0), magic["value"]))