Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add parser for unsaved Windows Notepad tabs #540

Merged
merged 39 commits into from
Aug 16, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
c528241
Initial commit
joost-j Jan 23, 2024
3594ff0
Removed unused 'seek_size' function
joost-j Feb 14, 2024
b1bcd69
Refactored the code to work with new LEB128 structure, added some mor…
joost-j Feb 15, 2024
c634987
Added more comments
joost-j Feb 15, 2024
d3d35a1
Refactor c_def to include parsing of both variants
joost-j Feb 19, 2024
cef81d0
Bump dissect.cstruct version to >=4.0.dev for clarity
joost-j Feb 19, 2024
7934f3e
Apply suggestions from code review
joost-j Feb 26, 2024
e6ea019
Removed duplicate brackets and refactor assertion into warning log
joost-j Feb 26, 2024
12fdd4a
Change variable names to fsize1 and fsize2, plus some linting
joost-j Feb 26, 2024
39a34a7
Refactored to work with LEB128 backport
joost-j Mar 4, 2024
8566028
Process feedback
joost-j Mar 4, 2024
56a26fa
Set cstruct dependency to next release
joost-j Mar 4, 2024
b18e975
Restore original shimcache.py file
joost-j Mar 4, 2024
1a1d80d
Move TextEditorTabRecord definition
joost-j Mar 25, 2024
b00bdc3
Remove content_length field from record
joost-j Mar 25, 2024
a124202
Apply suggestions from code review
joost-j Mar 25, 2024
dbaca5d
Change TabEditorTabRecord formatting
joost-j Mar 25, 2024
d66fa54
Black formatting, fix tests, add annotations import
joost-j Mar 25, 2024
bdaccbc
Bump cstruct version again
joost-j Mar 25, 2024
ad78273
Bump dependencies as leb128 is now included in dev release
joost-j Mar 28, 2024
0d9c88f
Implemented deletion of characters, refactored, added new tests
joost-j Mar 28, 2024
304db58
Small comment changes
joost-j Mar 28, 2024
2ca889c
Remove chunked addition of zero bytes
joost-j Mar 28, 2024
74ffb83
Added new test, changed to list insertion instead of appending
joost-j Mar 28, 2024
c148061
Refactored test file and removed fileState enum
joost-j Mar 28, 2024
2bf6e2f
Small comment changes/typos
joost-j Apr 11, 2024
a19c49b
Split plugin from parsing logic, added more tests
joost-j Apr 26, 2024
f808bc7
Removed fh.read() and re-added them to the c_def
joost-j Apr 26, 2024
9b38f3e
Added options and more test cases to support newest version
joost-j Apr 26, 2024
a3b6f27
Added separate records for unsaved/saved tabs, included more data (ti…
joost-j May 8, 2024
677817c
Change cstruct version
joost-j May 13, 2024
9674e37
Remove the --include-deleted-contents arg and make it default
joost-j Aug 14, 2024
06e3f07
Rewrite TabContent records into WindowsNotepadTab class
joost-j Aug 14, 2024
a384fd9
Implement repr for WindowsNotepadTab class
joost-j Aug 14, 2024
914c324
Merge branch 'main' into feature/windows_notepad_tabs
joost-j Aug 14, 2024
e625684
Add typehints and small fixes
Horofic Aug 16, 2024
9bb13c7
Merge branch 'main' into feature/windows_notepad_tabs
Horofic Aug 16, 2024
27fca92
Add suggestions
Horofic Aug 16, 2024
a9b32eb
Merge branch 'feature/windows_notepad_tabs' of github.com:joost-j/dis…
Horofic Aug 16, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Implement repr for WindowsNotepadTab class
  • Loading branch information
joost-j committed Aug 14, 2024
commit a384fd9810ca2873b59f2617e57a148162a3924f
9 changes: 9 additions & 0 deletions dissect/target/plugins/apps/texteditor/windowsnotepad.py
Original file line number Diff line number Diff line change
Expand Up @@ -120,8 +120,17 @@ class WindowsNotepadTab:

def __init__(self, file: TargetPath):
self.file = file
self.is_saved = None
self.content = None
self.deleted_content = None
self._process_tab_file()

def __repr__(self):
return (
f"<{self.__class__.__name__} saved={self.is_saved} "
f"content_size={len(self.content)} has_deleted_content={self.deleted_content is not None}>"
)

def _process_tab_file(self):
"""Parse a binary tab file and reconstruct the contents."""
with self.file.open("rb") as fh:
Expand Down
5 changes: 1 addition & 4 deletions tests/plugins/apps/texteditor/test_texteditor.py
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,7 @@ def test_windows_tab_parsing():
tab_file = Path(absolute_path("_data/plugins/apps/texteditor/windowsnotepad/unsaved-with-deletions.bin"))
content = WindowsNotepadTab(tab_file)
assert content.content == "Not saved aasdflasd"

content_with_deletions = WindowsNotepadTab(tab_file)
assert content_with_deletions.content == "Not saved aasdflasd"
assert content_with_deletions.deleted_content == "snUlltllafds tjkf"
assert repr(content) == "<WindowsNotepadTab saved=False content_size=19 has_deleted_content=True>"


def test_windows_tab_plugin_deleted_contents(target_win, fs_win, tmp_path, target_win_users, caplog):
Expand Down