dissect.target.plugins.os.unix.locate.plocate
#
Module Contents#
Classes#
plocate file parser |
|
Base class for plugins. |
Attributes#
- dissect.target.plugins.os.unix.locate.plocate.HAS_ZSTD = True#
- dissect.target.plugins.os.unix.locate.plocate.plocate_def = Multiline-String#
Show Value
""" #define MAGIC 0x00706c6f63617465 /* b'/x00plocate' */ struct header { uint32_t version; uint32_t hashtable_size; uint32_t extra_ht_slots; uint32_t num_docids; uint64_t hash_table_offset_bytes; uint64_t filename_index_offset_bytes; /* Version 1 and up only. */ uint32_t max_version; uint32_t zstd_dictionary_length_bytes; uint64_t zstd_dictionary_offset_bytes; /* Only if max_version >= 2, and only relevant for updatedb. */ uint64_t directory_data_length_bytes; uint64_t directory_data_offset_bytes; uint64_t next_zstd_dictionary_length_bytes; uint64_t next_zstd_dictionary_offset_bytes; uint64_t conf_block_length_bytes; uint64_t conf_block_offset_bytes; uint8_t check_visibility; char padding[7]; /* padding for alignment */ }; struct file { char path[]; }; """
- dissect.target.plugins.os.unix.locate.plocate.PLocateRecord#
- dissect.target.plugins.os.unix.locate.plocate.c_plocate#
- class dissect.target.plugins.os.unix.locate.plocate.PLocateFile(fh: BinaryIO)#
plocate file parser
The
plocate.db
file contains a hashtable and trigrams to enable quick lookups of filenames.We’ve implemented a few methods to gather those for possible future use, but for the PLocatePlugin we’re only interested in the filepaths stored in the database. Hence we don’t use these methods.
- Roughly speaking, the plocate.db file has the following structure:
header
(0x70 bytes)zstd compressed
filename``s (until start of ``filename_index_offset_bytes
), possibly including a dictionaryhashtables (offset and length in
header
)directory data (offset and length in
header
)possible zstd dictionary (offset and length in
header
)configuration block (offset and length in
header
)
No documentation other than the source code is available on the format of this file.
- Resources:
- HEADER_SIZE = 112#
- NUM_OVERFLOW_SLOTS = 16#
- TRIGRAM_SIZE_BYTES = 16#
- DOCID_SIZE_BYTES = 8#
- __iter__() Iterable[PLocateFile] #
- class dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin(target: dissect.target.Target)#
Bases:
dissect.target.plugins.os.unix.locate.locate.BaseLocatePlugin
Base class for plugins.
Plugins can optionally be namespaced by specifying the
__namespace__
class attribute. Namespacing results in your plugin needing to be prefixed with this namespace when being called. For example, if your plugin has specifiedtest
as namespace and a function calledexample
, you must call your plugin withtest.example
:A
Plugin
class has the following private class attributes:__namespace__
__record_descriptors__
With the following three being assigned in
register()
:__plugin__
__functions__
__exports__
Additionally, the methods and attributes of
Plugin
receive more private attributes by using decorators.The
export()
decorator adds the following private attributes__exported__
__output__
: Set with theexport()
decorator.__record__
: Set with theexport()
decorator.
The
internal()
decorator andInternalPlugin
set the__internal__
attribute. Finally.args()
decorator sets the__args__
attribute.- Parameters:
target – The
Target
object to load the plugin for.
- __namespace__ = 'plocate'#
- path = '/var/lib/plocate/plocate.db'#
- check_compatible() None #
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- locate() PLocateRecord #
Yield file and directory names from the plocate.db.
plocate
is the default package on Ubuntu 22 and newer to locate files. It replacesmlocate
and GNUlocate
.