dissect.target 3.9.dev36__tar.gz → 3.9.dev38__tar.gz

{dissect.target-3.9.dev36/dissect.target.egg-info → dissect.target-3.9.dev38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev36
+Version: 3.9.dev38
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/dissect/target/plugin.py

@@ -13,7 +13,7 @@ import logging
 import os
 import sys
 import traceback
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Callable, Iterator, Optional, Type
 
@@ -811,13 +811,13 @@ class InternalPlugin(Plugin):
         return cls
 
 
-@dataclass
+@dataclass(frozen=True, eq=True)
 class PluginFunction:
     name: str
     output_type: str
     class_object: str
     method_name: str
-    plugin_desc: dict
+    plugin_desc: dict = field(hash=False)
 
 
 def plugin_function_index(target: Target) -> tuple[dict[str, Any], set[str]]:
@@ -831,7 +831,9 @@ def plugin_function_index(target: Target) -> tuple[dict[str, Any], set[str]]:
     rootset = set()
 
     def all_plugins():
-        yield from plugins()
+        # Filter out plugins based on the target os
+        os_type = type(target._os) if target._os else None
+        yield from plugins(os_type)
         yield from os_plugins()
         yield from child_plugins()  # Doesn't export anything but added for completeness.
 
@@ -885,33 +887,34 @@ def find_plugin_functions(target: Target, patterns: str, compatibility: bool = F
             pattern += "*"
 
         if wildcard or treematch:
-            for index_name, func in functions.items():
-                if fnmatch.fnmatch(index_name, pattern):
-                    method_name = index_name.split(".")[-1]
-                    loaded_plugin_object = load(func)
+            for index_name in fnmatch.filter(functions.keys(), pattern):
+                func = functions[index_name]
 
-                    # Skip plugins that don't want to be found by wildcards
-                    if not loaded_plugin_object.__findable__:
-                        continue
+                method_name = index_name.split(".")[-1]
+                loaded_plugin_object = load(func)
+
+                # Skip plugins that don't want to be found by wildcards
+                if not loaded_plugin_object.__findable__:
+                    continue
 
-                    fobject = inspect.getattr_static(loaded_plugin_object, method_name)
+                fobject = inspect.getattr_static(loaded_plugin_object, method_name)
 
-                    if compatibility:
-                        try:
-                            if not loaded_plugin_object(target).is_compatible():
-                                continue
-                        except Exception:
+                if compatibility:
+                    try:
+                        if not loaded_plugin_object(target).is_compatible():
                             continue
+                    except Exception:
+                        continue
 
-                    result.append(
-                        PluginFunction(
-                            name=index_name,
-                            class_object=loaded_plugin_object,
-                            method_name=method_name,
-                            output_type=getattr(fobject, "__output__", "text"),
-                            plugin_desc=func,
-                        )
+                result.append(
+                    PluginFunction(
+                        name=index_name,
+                        class_object=loaded_plugin_object,
+                        method_name=method_name,
+                        output_type=getattr(fobject, "__output__", "text"),
+                        plugin_desc=func,
                     )
+                )
         else:
             # otherwise match using ~ classic style
             if pattern.find(".") > -1:
@@ -920,15 +923,15 @@ def find_plugin_functions(target: Target, patterns: str, compatibility: bool = F
                 funcname = pattern
                 namespace = None
 
-            plugindesc = None
-            for index_name, func in functions.items():
+            plugin_descriptions = []
+            for _, func in functions.items():
                 nsmatch = namespace and func["namespace"] == namespace and funcname in func["exports"]
                 fmatch = not namespace and not func["namespace"] and funcname in func["exports"]
                 if nsmatch or fmatch:
-                    plugindesc = func
+                    plugin_descriptions.append(func)
 
-            if plugindesc:
-                loaded_plugin_object = load(plugindesc)
+            for description in plugin_descriptions:
+                loaded_plugin_object = load(description)
                 fobject = inspect.getattr_static(loaded_plugin_object, funcname)
 
                 if compatibility and not loaded_plugin_object(target).is_compatible():
@@ -936,11 +939,12 @@ def find_plugin_functions(target: Target, patterns: str, compatibility: bool = F
 
                 result.append(
                     PluginFunction(
-                        name=f"{plugindesc['module']}.{pattern}",
+                        name=f"{description['module']}.{pattern}",
                         class_object=loaded_plugin_object,
                         method_name=funcname,
                         output_type=getattr(fobject, "__output__", "text"),
-                        plugin_desc=plugindesc,
+                        plugin_desc=description,
                     )
                 )
-    return result
+
+    return list(set(result))

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/dissect/target/tools/query.py

@@ -202,10 +202,16 @@ def main():
         basic_entries = []
         yield_entries = []
 
+        # Keep a set of plugins that were already executed on the target.
+        executed_plugins = set()
+
         first_seen_output_type = default_output_type
         cli_params_unparsed = rest
 
-        for func_def in funcs:
+        for func_def in find_plugin_functions(target, args.function, False):
+            if func_def.method_name in executed_plugins:
+                continue
+
             try:
                 output_type, result, cli_params_unparsed = execute_function_on_target(
                     target, func_def, cli_params_unparsed
@@ -213,17 +219,17 @@ def main():
             except UnsupportedPluginError as e:
                 target.log.error(
                     "Unsupported plugin for `%s`: %s",
-                    func,
+                    func_def,
                     e.root_cause_str(),
                 )
 
                 target.log.debug("", exc_info=e)
                 continue
             except PluginNotFoundError:
-                target.log.error("Cannot find plugin `%s`", func)
+                target.log.error("Cannot find plugin `%s`", func_def)
                 continue
             except Exception:
-                target.log.error("Exception while executing function `%s`", func, exc_info=True)
+                target.log.error("Exception while executing function `%s`", func_def, exc_info=True)
                 continue
 
             if first_seen_output_type and output_type != first_seen_output_type:
@@ -236,7 +242,7 @@ def main():
                         "does not match first seen output `%s`."
                     ),
                     output_type,
-                    func,
+                    func_def,
                     first_seen_output_type,
                 )
                 parser.exit()
@@ -244,12 +250,14 @@ def main():
             if not first_seen_output_type:
                 first_seen_output_type = output_type
 
+            executed_plugins.add(func_def.method_name)
+
             if output_type == "record":
                 record_entries.append(result)
             elif output_type == "yield":
                 yield_entries.append(result)
             elif output_type == "none":
-                target.log.info("No result for function `%s` (output type is set to 'none')", func)
+                target.log.info("No result for function `%s` (output type is set to 'none')", func_def)
                 continue
             else:
                 basic_entries.append(result)

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/dissect/target/tools/utils.py

@@ -3,7 +3,7 @@ import inspect
 import json
 from datetime import datetime
 from pathlib import Path
-from typing import Any, Callable, Dict, List, Optional, Tuple, Type
+from typing import Any, Callable, Dict, Iterator, List, Optional, Tuple, Type, Union
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
@@ -129,13 +129,16 @@ def generate_argparse_for_plugin(
     return generate_argparse_for_plugin_class(plugin_instance.__class__, usage_tmpl=usage_tmpl)
 
 
-def plugin_factory(target: Target, plugin_class: type, funcname: str) -> tuple[Plugin, str]:
+def plugin_factory(target: Target, plugin: Union[type, object], funcname: str) -> tuple[Plugin, str]:
     if TargetdLoader.instance:
         return target.get_function(funcname)
+
+    if isinstance(plugin, type):
+        plugin_obj = plugin(target)
+        target_attr = getattr(plugin_obj, funcname)
+        return plugin_obj, target_attr
     else:
-        plugin_obj = plugin_class(target)
-    target_attr = getattr(plugin_obj, funcname)
-    return plugin_obj, target_attr
+        return plugin, getattr(plugin, funcname)
 
 
 def execute_function_on_target(
@@ -149,9 +152,40 @@ def execute_function_on_target(
 
     cli_params = cli_params or []
 
-    plugin_class = func.class_object
+    target_attr = get_target_attribute(target, func)
+    plugin_method, parser = plugin_function_with_argparser(target_attr)
+
+    if parser:
+        parsed_params, cli_params = parser.parse_known_args(cli_params)
+        method_kwargs = vars(parsed_params)
+        value = plugin_method(**method_kwargs)
+    else:
+        value = target_attr
+
+    output_type = getattr(plugin_method, "__output__", "default") if plugin_method else "default"
+    return (output_type, value, cli_params)
+
+
+def get_target_attribute(target: Target, func: PluginFunction) -> Union[Plugin, Callable]:
+    """Retrieves the function attribute from the target.
+
+    If the function does not exist yet, it will attempt to load it into the target.
+
+    Args:
+        target: The target we wish to run the function on.
+        func: The function to run on the target.
 
-    if issubclass(plugin_class, OSPlugin):
+    Returns:
+        The function, either plugin or a callable to execute.
+
+    Raises:
+        UnsupportedPluginError: When the function was incompatible with the target.
+    """
+    plugin_class = func.class_object
+    if target.has_function(func.method_name):
+        # If the function is already attached, use the one inside the target.
+        plugin_class, _ = target.get_function(func.method_name)
+    elif issubclass(plugin_class, OSPlugin):
         # OS plugin does not need to be added
         plugin_class = target._os_plugin
     else:
@@ -162,7 +196,14 @@ def execute_function_on_target(
                 f"Unsupported function `{func.method_name}` for target with plugin {func.class_object}", cause=e
             )
 
-    plugin_obj, target_attr = plugin_factory(target, plugin_class, func.method_name)
+    _, target_attr = plugin_factory(target, plugin_class, func.method_name)
+    return target_attr
+
+
+def plugin_function_with_argparser(
+    target_attr: Union[Plugin, Callable]
+) -> tuple[Optional[Iterator], Optional[argparse.ArgumentParser]]:
+    """Resolves which plugin function to execute, and creates the argument parser for said plugin."""
     plugin_method = None
     parser = None
 
@@ -178,16 +219,7 @@ def execute_function_on_target(
     elif callable(target_attr):
         plugin_method = target_attr
         parser = generate_argparse_for_bound_method(target_attr)
-
-    if parser:
-        parsed_params, cli_params = parser.parse_known_args(cli_params)
-        method_kwargs = vars(parsed_params)
-        value = plugin_method(**method_kwargs)
-    else:
-        value = target_attr
-
-    output_type = getattr(plugin_method, "__output__", "default") if plugin_method else "default"
-    return (output_type, value, cli_params)
+    return plugin_method, parser
 
 
 def persist_execution_report(output_dir: Path, report_data: Dict, timestamp: datetime) -> Path:

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev36
+Version: 3.9.dev38
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/dissect.target.egg-info/requires.txt

@@ -7,7 +7,7 @@ dissect.ntfs<4.0.dev,>=3.4.dev
 dissect.regf<4.0.dev,>=3.3.dev
 dissect.util<4.0.dev,>=3.0.dev
 dissect.volume<4.0.dev,>=3.0.dev
-flow.record~=3.9
+flow.record~=3.10
 structlog
 
 [full]

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "dissect.regf>=3.3.dev,<4.0.dev",
     "dissect.util>=3.0.dev,<4.0.dev",
     "dissect.volume>=3.0.dev,<4.0.dev",
-    "flow.record~=3.9",
+    "flow.record~=3.10",
     "structlog",
 ]
 dynamic = ["version"]

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/tests/test_plugin.py

@@ -104,3 +104,17 @@ def test_find_plugin_functions(plugin_loader, target, os_plugins, plugins, searc
     target._os.__class__.__name__ = "warp"
     found = find_plugin_functions(target, search)
     assert len(found) == assert_num_found
+
+
+def test_find_plugin_function_windows(target_win):
+    found = find_plugin_functions(target_win, "services")
+
+    assert len(found) == 1
+    assert found[0].name == "os.windows.services.services"
+
+
+def test_find_plugin_function_unix(target_unix):
+    found = find_plugin_functions(target_unix, "services")
+
+    assert len(found) == 1
+    assert found[0].name == "os.unix.services.services"

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/tests/test_plugins_apps_shell_powershell.py

@@ -11,7 +11,7 @@ from ._utils import absolute_path
         (
             "target_win_users",
             "fs_win",
-            "users/John/AppData/Roaming/Microsoft/Windows/PowerShell/psreadline/ConsoleHost_history.txt",
+            "users\\John\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\psreadline\\ConsoleHost_history.txt",
         ),
         ("target_unix_users", "fs_unix", "/root/.local/share/powershell/PSReadLine/ConsoleHost_history.txt"),
     ],
@@ -23,8 +23,8 @@ def test_plugins_os_windows_powershell(target, fs, target_file, request):
     history_file = absolute_path("data/plugins/os/windows/powershell/ConsoleHost_history.txt")
     fs.map_file(target_file, history_file)
 
-    if target_file.startswith("users/"):
-        target_file = target_file.replace("users/", "C:/Users/")
+    if target_file.startswith("users\\"):
+        target_file = target_file.replace("users\\", "C:\\Users\\")
 
     target.add_plugin(PowerShellHistoryPlugin)
 

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/tests/test_plugins_child_hyperv.py

@@ -34,5 +34,5 @@ def test_plugins_child_wsl(target_win, fs_win):
     )
     assert (
         str(children[4].path)
-        == "/sysvol/ProgramData/Microsoft/Windows/Hyper-V/Virtual Machines/B90AC31B-C6F8-479F-9B91-07B894A6A3F6.xml"
+        == "\\sysvol\\ProgramData\\Microsoft\\Windows\\Hyper-V\\Virtual Machines\\B90AC31B-C6F8-479F-9B91-07B894A6A3F6.xml"  # noqa E501
     )

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/tests/test_plugins_child_wsl.py

@@ -16,5 +16,5 @@ def test_plugins_child_wsl(target_win_users, fs_win):
     assert children[0].type == "wsl"
     assert (
         str(children[0].path)
-        == "C:/Users/John/AppData/Local/Packages/CanonicalGroupLimited.Ubuntu22.04LTS_79rhkp1fndgsc/LocalState/ext4.vhdx"  # noqa E501
+        == "C:\\Users\\John\\AppData\\Local\\Packages\\CanonicalGroupLimited.Ubuntu22.04LTS_79rhkp1fndgsc\\LocalState\\ext4.vhdx"  # noqa E501
     )

{dissect.target-3.9.dev36 → dissect.target-3.9.dev38}/tests/test_plugins_os_windows_lnk.py

@@ -18,7 +18,7 @@ def test_lnk(target_win, fs_win):
     record = records[0]
 
     assert isinstance(record, type(LnkRecord()))
-    assert str(record.lnk_path) == "sysvol/users/pestudio.lnk"
+    assert str(record.lnk_path) == "sysvol\\users\\pestudio.lnk"
     assert record.lnk_name is None
     assert str(record.lnk_relativepath) == "pestudio.exe"
     assert str(record.lnk_workdir) == "C:\\Program Files\\pestudio"