-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Zip loader for Velociraptor packages #355
Zip loader for Velociraptor packages #355
Conversation
@Zawadidone it would be nice if you could quickly review this as well given your history with parsing Velociraptor |
I have tested the Velociraptor features of version https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0.
For Linux, MacOS, etc see the table below.
I have created a PR (#358) to fix this in the |
The
Combining the loaders probably solves this problem too? |
…ct.target into fix/velociraptor_loader
…support_velociraptor_zip
…ct.target into feature/support_velociraptor_zip
@OlafHaalstra is it possible to add the ZIP Loader to the updated VelociraptorLoader (#358) that supports version Velociraptor version 0.7.0? target-query -q -f hostname,os -t *
<Target VSSAnalysisAge-N> MSEDGEWIN10 windows
<Target VSSAnalysisAge-Y> MSEDGEWIN10 windows
<Target autoaccessor-N.exe> MSEDGEWIN10 windows
<Target autoaccessor-Y> MSEDGEWIN10 windows
<Target linux-auto> dummy unix
<Target linux-file> dummy unix |
@Zawadidone could you test the original zipfiles with the current PR? |
With the new commit I tried to combine both loaders into a single file, due to the fact that Ideally you would combine more code for zips and non zips but I wasn't fully able to do so. The |
@OlafHaalstra I've made some changes to re-use more existing code. The unit tests pass, can you test if this works on real Velociraptor ZIPs too? I looked briefly into making |
Codecov Report
@@ Coverage Diff @@
## main #355 +/- ##
==========================================
+ Coverage 71.93% 71.95% +0.02%
==========================================
Files 236 236
Lines 18740 18755 +15
==========================================
+ Hits 13481 13496 +15
Misses 5259 5259
Flags with carried forward coverage won't be shown. Click here to find out more.
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
@OlafHaalstra it works thanks for the feature! |
@Schamper your improvements work on the real zip from Velociraptor! Thanks 😄 |
@OlafHaalstra thank you for your contribution! As this is your first code contribution, please read the following Contributor License Agreement (CLA). If you agree with the CLA, please reply with the following information:
Contributor License Agreement
Contribution License AgreementThis Contribution License Agreement ("Agreement") governs your Contribution(s) (as defined below) and conveys certain license rights to Fox-IT B.V. ("Fox-IT") for your Contribution(s) to Fox-IT"s open source Dissect project. This Agreement covers any and all Contributions that you ("You" or "Your"), now or in the future, Submit (as defined below) to this project. This Agreement is between Fox-IT B.V. and You and takes effect when you click an “I Accept” button, check box presented with these terms, otherwise accept these terms or, if earlier, when You Submit a Contribution.
|
@DissectBot agree |
…support_velociraptor_zip
…lstra/dissect.target into feature/support_velociraptor_zip
Co-authored-by: Paul M <22234727+Poeloe@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Implemented a zip loader for Velociraptor packages.
Currently works on Velociraptor packages that have been created with release >=0.6.7
Still looking for advise on: