:py:mod:`dissect.target.loaders.res` ==================================== .. py:module:: dissect.target.loaders.res Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.target.loaders.res.ResLoader dissect.target.loaders.res.ResFile dissect.target.loaders.res.ResOSPlugin dissect.target.loaders.res.UPR dissect.target.loaders.res.UPF dissect.target.loaders.res.File dissect.target.loaders.res.Folder Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.target.loaders.res.find_pwr_dir dissect.target.loaders.res.reverse_search Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.target.loaders.res.EXTENSIONS dissect.target.loaders.res.PATH_REPLACEMENTS .. py:data:: EXTENSIONS :value: ('upr', 'upf', 'upr.zip', 'upf.zip') .. py:data:: PATH_REPLACEMENTS .. py:function:: find_pwr_dir(path: pathlib.Path) -> pathlib.Path | None .. py:class:: ResLoader(path: pathlib.Path, *, parsed_path: urllib.parse.ParseResult | None = None, resolve: bool = True, **kwargs) Bases: :py:obj:`dissect.target.loader.Loader` A base class for loading a specific path and coupling it to a :class:`Target `. Implementors of this class are responsible for mapping any type of source data to a :class:`Target `. Whether that's to map all VMDK files from a VMX or mapping the contents of a zip file to a virtual filesystem, if it's something that can be translated to a "disk", "volume" or "filesystem", you can write a loader that maps it into a target. You can do anything you want to manipulate the :class:`Target ` object in your ``map`` function, but generally you do one of the following: * open a :class:`Container ` and add it to ``target.disks``. * open a :class:`Volume ` and add it to ``target.volumes``. * open a :class:`VirtualFilesystem `, add your files into it and add it to ``target.filesystems``. You don't need to manually parse volumes or filesystems in your loader, just add the highest level object you have (e.g. a :class:`Container ` of a VMDK file) to the target. However, sometimes you need to get creative. Take a look at the :class:`ITunesLoader ` and :class:`TarLoader ` for some creative examples. :param path: The target path to load. :param parsed_path: A URI parsed path to use. .. py:method:: detect(path: pathlib.Path) -> bool :staticmethod: Detects wether this ``Loader`` class can load this specific ``path``. :param path: The target path to check. :returns: ``True`` if the ``path`` can be loaded by a ``Loader`` instance. ``False`` otherwise. .. py:method:: map(target: dissect.target.target.Target) -> None Maps the loaded path into a ``Target``. :param target: The target that we're mapping into. .. py:class:: ResFile(fs: dissect.target.filesystem.VirtualFilesystem, path: str, entry: File, **kwargs) Bases: :py:obj:`dissect.target.filesystem.VirtualFile` Virtual file backed by a file-like object. .. py:attribute:: entry :type: File .. py:method:: stat() -> dissect.target.helpers.fsutil.stat_result Determine the stat information of this entry. If the entry is a symlink and ``follow_symlinks`` is ``True``, it gets resolved, attempting to stat the path where it points to. :param follow_symlinks: Whether to resolve the symbolic link if this entry is a symbolic link. :returns: The stat information of this entry. .. py:method:: lstat() -> dissect.target.helpers.fsutil.stat_result Determine the stat information of this entry, **without** resolving the symlinks. When it detects a symlink, it will stat the information of the symlink, not the path it points to. :returns: The stat information of this entry. .. py:method:: open() -> BinaryIO Open this filesystem entry. :returns: A file-like object. Resolves symlinks when possible .. py:class:: ResOSPlugin(target: dissect.target.target.Target) Bases: :py:obj:`dissect.target.plugin.OSPlugin` Base class for OS plugins. This provides a base class for certain common functions of OS's, which each OS plugin has to implement separately. For example, it provides an interface for retrieving the hostname and users of a target. All derived classes MUST implement ALL the classmethods and exported methods with the same ``@classmethod`` or ``@export(...)`` annotation. .. py:method:: detect(target: dissect.target.target.Target) -> bool :classmethod: Provide detection of this OSPlugin on a given filesystem. :param fs: :class:`~dissect.target.filesystem.Filesystem` to detect the OS on. :returns: The root filesystem / sysvol when found. .. py:method:: create(target: dissect.target.target.Target, sysvol: dissect.target.filesystem.Filesystem) -> Self :classmethod: Initiate this OSPlugin with the given target and detected filesystem. :param target: The :class:`~dissect.target.target.Target` object. :param sysvol: The filesystem that was detected in the ``detect()`` function. :returns: An instantiated version of the OSPlugin. .. py:method:: hostname() -> str Return the target's hostname. :returns: The hostname as string. .. py:method:: ips() -> list[str] Return the IP addresses configured in the target. :returns: The IPs as list. .. py:method:: version() -> None Return the target's OS version. :returns: The OS version as string. .. py:method:: users() -> collections.abc.Iterator[dissect.target.helpers.record.WindowsUserRecord] Return the users available in the target. :returns: A list of user records. .. py:method:: os() -> str Return a slug of the target's OS name. :returns: A slug of the OS name, e.g. 'windows' or 'linux'. .. py:class:: UPR(fh: BinaryIO) .. py:attribute:: fh .. py:attribute:: buf .. py:method:: open() -> io.StringIO .. py:class:: UPF(fh: BinaryIO) .. py:attribute:: fh .. py:attribute:: metadata .. py:method:: folders() -> list[Folder] .. py:method:: files() -> list[File] .. py:class:: File(upf: UPF, elem: xml.etree.ElementTree.Element) .. py:attribute:: upf .. py:attribute:: name .. py:attribute:: size .. py:attribute:: offset .. py:attribute:: packed_size .. py:attribute:: compressed .. py:attribute:: timestamps .. py:attribute:: guid .. py:attribute:: folder .. py:method:: __repr__() -> str .. py:property:: path :type: str .. py:method:: open() -> io.BytesIO .. py:class:: Folder(upf: UPF, elem: xml.etree.ElementTree.Element, parent: Folder | None = None) .. py:attribute:: upf .. py:attribute:: name .. py:attribute:: guid .. py:attribute:: parent :value: None .. py:method:: __repr__() -> str .. py:property:: path :type: str .. py:function:: reverse_search(fh: BinaryIO, needle: bytes) -> int