dissect.target.plugins.os.unix.locate.plocate

Module Contents

Classes

PLocateFile

Parser for plocate files.

PLocatePlugin

Unix plocate plugin.

Attributes

HAS_ZSTD

plocate_def

PLocateRecord

c_plocate

dissect.target.plugins.os.unix.locate.plocate.HAS_ZSTD = True
dissect.target.plugins.os.unix.locate.plocate.plocate_def = Multiline-String
Show Value
"""
#define MAGIC 0x00706c6f63617465             /* b'/x00plocate' */

struct header {
    uint32_t version;
    uint32_t hashtable_size;
    uint32_t extra_ht_slots;
    uint32_t num_docids;
    uint64_t hash_table_offset_bytes;
    uint64_t filename_index_offset_bytes;

    /* Version 1 and up only. */
    uint32_t max_version;   // Nominally 1 or 2, but can be increased if more features are added in a backward-compatible way.
    uint32_t zstd_dictionary_length_bytes;
    uint64_t zstd_dictionary_offset_bytes;

    /* Only if max_version >= 2, and only relevant for updatedb. */
    uint64_t directory_data_length_bytes;
    uint64_t directory_data_offset_bytes;
    uint64_t next_zstd_dictionary_length_bytes;
    uint64_t next_zstd_dictionary_offset_bytes;
    uint64_t conf_block_length_bytes;
    uint64_t conf_block_offset_bytes;

    // Only if max_version >= 2.
    uint8_t check_visibility;
    char padding[7];                         /* padding for alignment */
};

struct file {
    char path[];
};
"""
dissect.target.plugins.os.unix.locate.plocate.PLocateRecord
dissect.target.plugins.os.unix.locate.plocate.c_plocate
class dissect.target.plugins.os.unix.locate.plocate.PLocateFile(fh: BinaryIO)

Parser for plocate files.

The plocate.db file contains a hashtable and trigrams to enable quick lookups of filenames.

We’ve implemented a few methods to gather those for possible future use, but for the PLocatePlugin we’re only interested in the filepaths stored in the database. Hence we don’t use these methods.

Roughly speaking, the plocate.db file has the following structure:

  • header (0x70 bytes)

  • zstd compressed filename``s (until start of ``filename_index_offset_bytes), possibly including a dictionary

  • hashtables (offset and length in header)

  • directory data (offset and length in header)

  • possible zstd dictionary (offset and length in header)

  • configuration block (offset and length in header)

No documentation other than the source code is available on the format of this file.

References

HEADER_SIZE = 112
NUM_OVERFLOW_SLOTS = 16
TRIGRAM_SIZE_BYTES = 16
DOCID_SIZE_BYTES = 8
fh
header
dict_data = None
compressed_length_bytes
ctx
buf
__iter__() → collections.abc.Iterator[PLocateFile]
filename_index() → bytes

Return the filename index of the plocate.db file.

hashtable() → bytes

Return the hashtable of the plocate.db file.

class dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.os.unix.locate.locate.BaseLocatePlugin

Unix plocate plugin.

__namespace__ = 'plocate'

Defines the plugin namespace.

path = '/var/lib/plocate/plocate.db'
check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

locate() → collections.abc.Iterator[PLocateRecord]

Yield file and directory names from the plocate.db.

plocate is the default package on Ubuntu 22 and newer to locate files. It replaces mlocate and GNU locate.

References