dissect.target.plugins.child.wsl

Module Contents

Classes

WSLChildTargetPlugin

Child target plugin that yields WSL VHDX file locations.

Functions

find_wsl_installs

dissect.target.plugins.child.wsl.find_wsl_installs(target: dissect.target.target.Target) → Iterator[pathlib.Path]

class dissect.target.plugins.child.wsl.WSLChildTargetPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.ChildTargetPlugin

Child target plugin that yields WSL VHDX file locations.

Windows WSL VHDX conatiners are stored at %AppData%\Local\Packages\$DistFolder\LocalState\ext4.vhdx, where $DistFolder will be substituted with a unix distribution folder.

Sources:

• https://www.osdfcon.org/presentations/2020/Asif-Matadar_Investigating-WSL-Endpoints.pdf

• https://www.sans.org/white-papers/39330/

__type__ = 'wsl'

check_compatible() → bool

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

list_children() → Iterator[dissect.target.helpers.record.ChildTargetRecord]

Yield ChildTargetRecord records of all possible child targets on this target.