dissect.target 3.8.dev32__tar.gz → 3.8.dev34__tar.gz

{dissect.target-3.8.dev32/dissect.target.egg-info → dissect.target-3.8.dev34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.8.dev32
+Version: 3.8.dev34
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.8.dev32 → dissect.target-3.8.dev34}/dissect/target/loaders/velociraptor.py

@@ -14,17 +14,21 @@ FILESYSTEMS_ROOT = "uploads"
 
 def find_fs_directories(path: Path) -> tuple[Optional[OperatingSystem], Optional[list[Path]]]:
     # As of Velociraptor version 0.6.7 the structure of the Velociraptor Offline Collector varies by operating system
-    # Generic.Collectors.File (Unix, OS-X) root filesystem is 'uploads/'
+    # Generic.Collectors.File (Linux and OS-X) root filesystem is 'uploads/file/'
     # Generic.Collectors.File (Windows) and Windows.KapeFiles.Targets (Windows) root filesystem is
     # 'uploads/<file-accessor>/<drive-name>/'
     fs_root = path.joinpath(FILESYSTEMS_ROOT)
-    os_type, dirs = find_dirs(fs_root)
-    if os_type in [OperatingSystem.LINUX, OperatingSystem.OSX]:
-        return os_type, [dirs[0]]
+
+    # Linux and OS-X
+    file_root = fs_root.joinpath("file")
+    if file_root.exists():
+        os_type, dirs = find_dirs(file_root)
+        if os_type in [OperatingSystem.LINUX, OperatingSystem.OSX]:
+            return os_type, [dirs[0]]
 
     # This suppports usage of the ntfs accessor 'uploads/mft/%5C%5C.%5CC%3A' not the accessors lazy_ntfs or auto
     mft_root = fs_root.joinpath("mft")
-    if not os_type and mft_root.exists():
+    if mft_root.exists():
         # If the `mft` directory exists, assume all the subdirectories are volumes
         return OperatingSystem.WINDOWS, list(mft_root.iterdir())
 

{dissect.target-3.8.dev32 → dissect.target-3.8.dev34}/dissect/target/tools/shell.py

@@ -143,6 +143,15 @@ class TargetCmd(cmd.Cmd):
 
         return cmd.Cmd.default(self, line)
 
+    def emptyline(self):
+        """This function forces Python's cmd.Cmd module to behave like a regular shell.
+
+        When entering an empty command, the cmd module will by default repeat the previous command.
+        By defining an empty ``emptyline`` function we make sure no command is executed instead.
+        See https://stackoverflow.com/a/16479030
+        """
+        pass
+
     def _exec(self, func, command_args_str):
         """
         Command execution helper that chains initial command and piped
@@ -720,6 +729,20 @@ class TargetCli(TargetCmd):
             shutil.copyfileobj(fh, stdout)
             stdout.flush()
 
+    @arg("path")
+    def cmd_zcat(self, args, stdout):
+        """print file content from compressed files"""
+        paths = self.resolveglobpath(args.path)
+        stdout = stdout.buffer
+        for path in paths:
+            path = self.checkfile(path)
+            if not path:
+                continue
+
+            fh = fsutil.open_decompress(path)
+            shutil.copyfileobj(fh, stdout)
+            stdout.flush()
+
     @arg("path")
     def cmd_hexdump(self, args, stdout):
         """print a hexdump of the first X bytes"""
@@ -748,6 +771,15 @@ class TargetCli(TargetCmd):
 
         pydoc.pager(path.open("rt", errors="ignore").read(10 * 1024 * 1024))
 
+    @arg("path")
+    def cmd_zless(self, args, stdout):
+        """open the first 10 MB of a compressed file with zless"""
+        path = self.checkfile(args.path)
+        if not path:
+            return
+
+        pydoc.pager(fsutil.open_decompress(path, "rt").read(10 * 1024 * 1024))
+
     @arg("path", nargs="+")
     def cmd_readlink(self, args, stdout):
         """print resolved symbolic links or canonical file names"""

{dissect.target-3.8.dev32 → dissect.target-3.8.dev34/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.8.dev32
+Version: 3.8.dev34
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.8.dev32 → dissect.target-3.8.dev34}/tests/test_loaders_velociraptor.py

@@ -32,7 +32,7 @@ def test_velociraptor_loader_windows_ntfs(mock_target, tmpdir_name):
 
 def test_dir_loader_linux(mock_target, tmpdir_name):
     root = Path(tmpdir_name)
-    mkdirs(root, ["uploads.json", "uploads/etc", "uploads/var"])
+    mkdirs(root, ["uploads.json", "uploads/file/etc", "uploads/file/var"])
 
     assert VelociraptorLoader.detect(root) is True
 
@@ -44,7 +44,7 @@ def test_dir_loader_linux(mock_target, tmpdir_name):
 
 def test_dir_loader_macos(mock_target, tmpdir_name):
     root = Path(tmpdir_name)
-    mkdirs(root, ["uploads.json", "uploads/Library"])
+    mkdirs(root, ["uploads.json", "uploads/file/Library"])
 
     assert VelociraptorLoader.detect(root) is True