dissect.target.plugins.os.unix.esxi._os

Module Contents

Classes

ESXiPlugin

ESXi OS plugin

Functions

parse_boot_cfg

parse_esx_conf

parse_config_store

mix64

Mixes three 64-bit values reversibly.

esxi_hash

Hashes a variable-length key into a 64-bit value.

nfs_volume_uuid

Generate a UUID for an NFS volume based on the host and path.

Attributes

HAS_ENVELOPE

VirtualMachineRecord

dissect.target.plugins.os.unix.esxi._os.HAS_ENVELOPE = True
dissect.target.plugins.os.unix.esxi._os.VirtualMachineRecord
class dissect.target.plugins.os.unix.esxi._os.ESXiPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.os.unix._os.UnixPlugin

ESXi OS plugin

ESXi partitioning varies between versions. Generally, specific partition numbers have special meaning.

The following is a list of known partition numbers:

1: EFI boot 5: BOOTBANK1 6: BOOTBANK2 7: vmkcore (ESXi 6), OSDATA / LOCKER (ESXi 7) 8: store (ESXi 6), HDD VMFS datastore (ESXi 7) 9: vmkcore (ESXi 6)

classmethod detect(target: dissect.target.target.Target) → dissect.target.filesystem.Filesystem | None

Provide detection of this OSPlugin on a given filesystem.

Parameters:

fs – Filesystem to detect the OS on.

Returns:

The root filesystem / sysvol when found.

classmethod create(target: dissect.target.target.Target, sysvol: dissect.target.filesystem.Filesystem) → typing_extensions.Self

Initiate this OSPlugin with the given target and detected filesystem.

Parameters:

  • target – The Target object.

  • sysvol – The filesystem that was detected in the detect() function.

Returns:

An instantiated version of the OSPlugin.

hostname() → str

Return the target’s hostname.

Returns:

The hostname as string.

domain() → str | None
ips() → list[str]

Return the IP addresses configured in the target.

Returns:

The IPs as list.

version() → str | None

Return the target’s OS version.

Returns:

The OS version as string.

vm_inventory() → collections.abc.Iterator[VirtualMachineRecord]
esxconf(path: str, json: bool) → None
configstore() → dict[str, Any]
os() → str

Return a slug of the target’s OS name.

Returns:

A slug of the OS name, e.g. ‘windows’ or ‘linux’.

dissect.target.plugins.os.unix.esxi._os.parse_boot_cfg(fh: TextIO) → dict[str, str]
dissect.target.plugins.os.unix.esxi._os.parse_esx_conf(fh: TextIO) → dict[str, Any]
dissect.target.plugins.os.unix.esxi._os.parse_config_store(fh: BinaryIO) → dict[str, Any]
dissect.target.plugins.os.unix.esxi._os.mix64(a: int, b: int, c: int) → int

Mixes three 64-bit values reversibly.

dissect.target.plugins.os.unix.esxi._os.esxi_hash(key: bytes, level: int) → int

Hashes a variable-length key into a 64-bit value.

This hash function is used in the ESXi kernel. It is an exact implementation of the hash3 function defined here: http://burtleburtle.net/bob/c/lookup8.c

dissect.target.plugins.os.unix.esxi._os.nfs_volume_uuid(host: str, path: str) → str

Generate a UUID for an NFS volume based on the host and path.

This is used to create a unique identifier for NFS volumes in ESXi.