dissect.target.loader

Module Contents

Classes

Loader

A base class for loading a specific path and coupling it to a Target.

Functions

register

Registers a Loader class inside LOADERS.

open

Opens a Loader for a given path.

Attributes

RawLoader

A lazy loaded dissect.target.loaders.raw.RawLoader.
dissect.target.loader.RawLoader: Loader

A lazy loaded dissect.target.loaders.raw.RawLoader.

class dissect.target.loader.Loader(path: pathlib.Path, *, parsed_path: urllib.parse.ParseResult | None = None, resolve: bool = True, **kwargs)

A base class for loading a specific path and coupling it to a Target.

Implementors of this class are responsible for mapping any type of source data to a Target. Whether that’s to map all VMDK files from a VMX or mapping the contents of a zip file to a virtual filesystem, if it’s something that can be translated to a “disk”, “volume” or “filesystem”, you can write a loader that maps it into a target.

You can do anything you want to manipulate the Target object in your map function, but generally you do one of the following:

  • open a Container and add it to target.disks.

  • open a Volume and add it to target.volumes.

  • open a VirtualFilesystem, add your files into it and add it to target.filesystems.

You don’t need to manually parse volumes or filesystems in your loader, just add the highest level object you have (e.g. a Container of a VMDK file) to the target. However, sometimes you need to get creative. Take a look at the ITunesLoader and TarLoader for some creative examples.

Parameters:

  • path – The target path to load.

  • parsed_path – A URI parsed path to use.

path
absolute_path = None
parsed_path = None
parsed_query
__repr__() → str
static detect(path: pathlib.Path) → bool
Abstractmethod:

Detects wether this Loader class can load this specific path.

Parameters:

path – The target path to check.

Returns:

True if the path can be loaded by a Loader instance. False otherwise.

static find_all(path: pathlib.Path, parsed_path: urllib.parse.ParseResult | None = None) → collections.abc.Iterator[str | pathlib.Path]

Finds all targets to load from path.

This can be used to open multiple targets from a target path that doesn’t necessarily map to files on a disk. For example, a wildcard in a hostname a loader that opens targets from an API or Unix socket, such as the Carbon Black loader.

Parameters:

  • path – The location to a target to try and open multiple paths from.

  • parsed_path – A URI parsed path to use.

Returns:

All the target paths found from the source path.

abstract map(target: dissect.target.target.Target) → None

Maps the loaded path into a Target.

Parameters:

target – The target that we’re mapping into.

dissect.target.loader.register(module_name: str, class_name: str, internal: bool = True) → None

Registers a Loader class inside LOADERS.

This function registers a loader using modname relative to the MODULE_PATH. It lazily imports the module, and retrieves the specific class from it.

Parameters:

  • module – The module where to find the loader.

  • class_name – The class to load.

  • internal – Whether it is an internal module or not.

dissect.target.loader.open(path: str | pathlib.Path, *, fallbacks: list[type[Loader]] | None = None, **kwargs) → Loader | None

Opens a Loader for a given path.

This instantiates a Loader for a specific path. The DirLoader is used as the last entry due to how the detection methods function.

Parameters:

path – The target path to load.

Returns:

A Loader instance for the specific target if one is found.