Add macOS plugins

dissect/target/container.py

@@ -258,3 +258,4 @@ def open(item: list | str | BinaryIO | Path, *args, **kwargs) -> Container:
 register("hds", "HdsContainer")
 register("split", "SplitContainer")
 register("fortifw", "FortiFirmwareContainer")
+register("asif", "AsifContainer")

dissect/target/helpers/utils.py

@@ -110,7 +110,7 @@ def readinto(buffer: bytearray, fh: BinaryIO) -> int:
 
 def year_rollover_helper(
     path: Path, re_ts: str | re.Pattern, ts_format: str, tzinfo: tzinfo = timezone.utc
-) -> Iterator[tuple[datetime, str]]:
+) -> Iterator[tuple[datetime | None, str]]:
     """Helper function for determining the correct timestamps for log files without year notation.
 
     Supports compressed files by using :func:`open_decompress`.
@@ -142,7 +142,7 @@ def year_rollover_helper(
                 if not warned:
                     log.warning("No timestamp found in one of the lines in %s!", path)
                     warned = True
-                log.debug("Skipping line: %s", line)
+                yield None, line
                 continue
 
             # We have to append the current_year to strptime instead of adding it using replace later.

dissect/target/plugins/os/unix/bsd/darwin/macos/airport_preferences.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import plistlib
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target import Target
+
+AirportPreferencesRecord = TargetRecordDescriptor(
+    "macos/airport_preferences",
+    [
+        ("varint", "counter"),
+        ("string", "device_uuid"),
+        ("string", "version"),
+        ("string", "preferred_order"),
+        ("path", "source"),
+    ],
+)
+
+
+class AirportPreferencesPlugin(Plugin):
+    """macOS AirPort (WiFi) preferences plugin."""
+
+    PATH = "/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.file = None
+        self._resolve_file()
+
+    def _resolve_file(self) -> None:
+        path = self.target.fs.path(self.PATH)
+        if path.exists():
+            self.file = path
+
+    def check_compatible(self) -> None:
+        if not self.file:
+            raise UnsupportedPluginError("No com.apple.airport.preferences.plist file found")
+
+    @export(record=AirportPreferencesRecord)
+    def airport_preferences(self) -> Iterator[AirportPreferencesRecord]:
+        """Yield AirPort preference information."""
+        plist = plistlib.load(self.file.open())
+
+        counter = plist.get("Counter")
+        version = plist.get("Version")
+        device_uuid = plist.get("DeviceUUID")
+        preferred_order = plist.get("PreferredOrder")
+
+        yield AirportPreferencesRecord(
+            counter=counter,
+            device_uuid=device_uuid,
+            version=version,
+            preferred_order=preferred_order,
+            source=self.file,
+            _target=self.target,
+        )

dissect/target/plugins/os/unix/bsd/darwin/macos/authorization_rules.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.os.unix.bsd.darwin.macos.helpers.build_records import build_sqlite_records
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target import Target
+
+AuthorizationRulesRecord = TargetRecordDescriptor(
+    "macos/authorization_rules",
+    [
+        ("string[]", "tables"),
+        ("varint", "rules_id"),
+        ("string", "rules_name"),
+        ("varint", "rules_type"),
+        ("varint", "rules_class"),
+        ("string", "rules_group"),
+        ("varint", "rules_kofn"),
+        ("varint", "rules_timeout"),
+        ("varint", "rules_flags"),
+        ("string", "rules_tries"),
+        ("varint", "rules_version"),
+        ("datetime", "rules_created"),
+        ("datetime", "rules_modified"),
+        ("string", "rules_hash"),
+        ("string", "rules_identifier"),
+        ("string", "rules_requirement"),
+        ("string", "rules_comment"),
+        ("string[]", "rules_delegates_map"),
+        ("datetime", "rules_history_timestamp"),
+        ("string", "rules_history_source"),
+        ("varint", "rules_history_operation"),
+        ("varint", "mechanisms_map_m_id"),
+        ("varint", "mechanisms_map_ord"),
+        ("string", "mechanisms_plugin"),
+        ("string", "mechanisms_param"),
+        ("varint", "mechanisms_privileged"),
+        ("path", "source"),
+    ],
+)
+
+ConfigTableRecord = TargetRecordDescriptor(
+    "macos/authorization_rules/config",
+    [
+        ("string", "table"),
+        ("string", "key"),
+        ("string", "value"),
+        ("path", "source"),
+    ],
+)
+
+SQLiteSequenceTableRecord = TargetRecordDescriptor(
+    "macos/authorization_rules/sqlite_sequence",
+    [
+        ("string", "table"),
+        ("string", "name"),
+        ("varint", "seq"),
+        ("path", "source"),
+    ],
+)
+
+AuthorizationRulesRecords = (
+    AuthorizationRulesRecord,
+    ConfigTableRecord,
+    SQLiteSequenceTableRecord,
+)
+
+joins = (
+    {"table1": "rules", "key1": "name", "table2": "rules_history", "key2": "rule", "join": "iterate"},
+    {"table1": "rules", "key1": "version", "table2": "rules_history", "key2": "version", "join": "ignore"},
+    {"table1": "rules", "key1": "id", "table2": "mechanisms_map", "key2": "r_id", "join": "iterate"},
+    {"table1": "mechanisms_map", "key1": "m_id", "table2": "mechanisms", "key2": "id", "join": "iterate"},
+    {"table1": "rules", "key1": "id", "table2": "delegates_map", "key2": "r_id", "join": "nested"},
+)
+
+
+class AuthorizationRulesPlugin(Plugin):
+    """macOS authorization rules plugin."""
+
+    PATH = "/var/db/auth.db"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.file = None
+        self._resolve_file()
+
+    def _resolve_file(self) -> None:
+        path = self.target.fs.path(self.PATH)
+        if path.exists():
+            self.file = path
+
+    def check_compatible(self) -> None:
+        if not self.file:
+            raise UnsupportedPluginError("No auth.db file found")
+
+    @export(record=AuthorizationRulesRecords)
+    def authorization_rules(self) -> Iterator[AuthorizationRulesRecords]:
+        """Yield authorization rules information."""
+        yield from build_sqlite_records(self, (self.file,), AuthorizationRulesRecords, joins)
+
+        # Still missing prompts & buttons tables

dissect/target/plugins/os/unix/bsd/darwin/macos/code_signature_coderesources.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.os.unix.bsd.darwin.macos.helpers.build_records import build_plist_records
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target.target import Target
+
+re_illegal_characters = re.compile(r"[\(\): \.\-#\/\>\<]")
+
+OmitRecord = TargetRecordDescriptor(
+    "macos/code_signature_coderesources/omit",
+    [
+        ("boolean", "omit"),
+        ("varint", "weight"),
+        ("string", "plist_path"),
+        ("path", "source"),
+    ],
+)
+
+NestedRecord = TargetRecordDescriptor(
+    "macos/code_signature_coderesources/nested",
+    [
+        ("boolean", "nested"),
+        ("varint", "weight"),
+        ("string", "plist_path"),
+        ("path", "source"),
+    ],
+)
+
+CDHashRecord = TargetRecordDescriptor(
+    "macos/code_signature_coderesources/cdhash",
+    [
+        ("string", "cdhash"),
+        ("string", "requirement"),
+        ("string", "plist_path"),
+        ("path", "source"),
+    ],
+)
+
+
+CodeSignatureCodeResourcesRecords = (
+    OmitRecord,
+    NestedRecord,
+    CDHashRecord,
+)
+
+
+class CodeSignatureCodeResourcesPlugin(Plugin):
+    """macOS Code signature CodeResources plugin."""
+
+    PATHS = (
+        "/Applications/Utilities/*.app/Contents/_CodeSignature/CodeResources",
+        "/System/Library/CoreServices/*.app/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Extensions/*.kext/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/PlugIns/*.plugin/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.bundle/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Extensions/*.kext/Contents/Resources/*.bundle/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Filesystems/*/*.kext/Contents/_CodeSignature/CodeResources",
+        "/System/Library/Filesystems/*/Encodings/*.kext/Contents/_CodeSignature/CodeResource",
+        "/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.kext/Contents/_CodeSignature/CodeResources",
+    )
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.files = set()
+        self._find_files()
+
+    def _find_files(self) -> None:
+        for pattern in self.PATHS:
+            for path in self.target.fs.glob(pattern):
+                self.files.add(path)
+
+    def check_compatible(self) -> None:
+        if not (self.files):
+            raise UnsupportedPluginError("No code signature coderesources files found")
+
+    @export(record=CodeSignatureCodeResourcesRecords)
+    def code_signature_coderesources(self) -> Iterator[CodeSignatureCodeResourcesRecords]:
+        """Yield code signature coderesources information."""
+        yield from build_plist_records(self, self.files, CodeSignatureCodeResourcesRecords)

dissect/target/plugins/os/unix/bsd/darwin/macos/contents_info.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import DynamicDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.os.unix.bsd.darwin.macos.helpers.build_records import build_plist_records
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target.target import Target
+
+re_illegal_characters = re.compile(r"[\(\): \.\-#\/\>\<]")
+
+
+class ContentsInfoPlugin(Plugin):
+    """macOS contents info plugin."""
+
+    PATHS = (
+        "/Applications/*/*.app/Contents/Info.plist",
+        "/Applications/*/*.app/Contents/Resources/*.help/Contents/Info.plist",
+        "/System/Library/CoreServices/*.app/Contents/Info.plist",
+        "/System/Library/Extensions/*.kext/Contents/Info.plist",
+        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Info.plist",
+        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/PlugIns/*.plugin/Contents/Info.plist",
+        "/System/Library/Extensions/*.kext/Contents/PlugIns/*.kext/Contents/Resources/*.bundle/Contents/Info.plist",
+        "/System/Library/Extensions/*.kext/Contents/Resources/*.bundle/Contents/Info.plist",
+        "/System/Library/Extensions/*.kext/PlugIns/*.kext/Info.plist",
+        "/System/Library/Filesystems/*/*.kext/Contents/Info.plist",
+        "/System/Library/Filesystems/*/Encodings/*.kext/Contents/Info.plist",
+        "/System/Library/Frameworks/*.framework/Versions/A/Resources/Info.plist",
+        "/System/Library/PrivateFrameworks/*.framework/Versions/A/Resources/*.kext/Contents/Info.plist",
+    )
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.files = set()
+        self._find_files()
+
+    def _find_files(self) -> None:
+        for pattern in self.PATHS:
+            for path in self.target.fs.glob(pattern):
+                self.files.add(path)
+
+    def check_compatible(self) -> None:
+        if not (self.files):
+            raise UnsupportedPluginError("No contents info files found")
+
+    @export(record=DynamicDescriptor(["string"]))
+    def contents_info(self) -> Iterator[DynamicDescriptor]:
+        """Yield contents info information."""
+        yield from build_plist_records(self, self.files, function_name="macos/contents_info")