-
Notifications
You must be signed in to change notification settings - Fork 54
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add --resolve to target-query #485
Conversation
dissect/target/filesystem.py
Outdated
return hashutil.custom(fd, algos) | ||
return hashutil.common(fd) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Where is fd
coming from?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
from a debug artifact that I didn't revert correctly
dissect/target/filesystem.py
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can't comment on it, but could you maybe also replace all instances of List
in this file with list
?
@@ -67,7 +67,7 @@ def firewall(self): | |||
data[fname] = value | |||
|
|||
if "app" in data: | |||
data["app"] = self.target.resolve(data["app"]) | |||
data["app"] = str(self.target.resolve(data["app"])) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't the app
field in the record become a path
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
techically it should, i did see some instances it wasn't a path tho. but some other information
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
seems I was mistaken on that front, that was another changed app
dissect/target/tools/query.py
Outdated
modifier = None | ||
|
||
if args.resolve: | ||
modifier = modifier.Modifier.RESOLVE |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't this conflict with the import name?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That it did, that was an oversight
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #485 +/- ##
==========================================
+ Coverage 74.05% 74.07% +0.02%
==========================================
Files 260 261 +1
Lines 21070 21110 +40
==========================================
+ Hits 15603 15638 +35
- Misses 5467 5472 +5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Co-authored-by: pyrco <[email protected]>
55e3592
to
c28c323
Compare
* Changes the target.resolve() functionality to return a TargetPath * Create modifiers that can change records before printing them. (DIS-2624)
* Changes the target.resolve() functionality to return a TargetPath * Create modifiers that can change records before printing them. (DIS-2624)
Moves all the record modifier code to helpers/modifier.py
Adds modifier logic, to allow for more modifiers to get added later (currently only paths get used)
open the target_path during hashing:
When opened in a DirLoader, the OS will "open" the file
However, the file never got closed, so on linux you'd get
an error that the maximum open files threshold was reached