Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Acquire collection loader #935

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

Matthijsy
Copy link
Contributor

This PR adds a loader for ZIP files, which is mainly useful for ZIP based acquire collects.

I don't have experience with creating loaders, and mainly took the logic from the TarLoader. So if there are things that can be done better would be happy to improve!

fixes #934

@Horofic Horofic self-assigned this Nov 6, 2024
@Horofic
Copy link
Contributor

Horofic commented Nov 7, 2024

First of all, thanks for you contribution @Matthijsy. I think this is a good first attempt :)!

As you kind of pointed out, the ZIPloader mainly took the logic from the TarLoader with some minor tweaks. I think a better way forward would be to create an AcquireLoader that works on both Zip, Tar and Dir based Acquire collections! Kind of like the VelociraptorLoader found here. Here it does some specific checks to see if a collection is
is a Velociraptor collection.

Let me know what you think about this!

@@ -0,0 +1,97 @@
import logging
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add tests for this new functionality? This could be done later, if you decide to go on the AcquireLoader route.

@Matthijsy
Copy link
Contributor Author

@Horofic Thank you for the feedback, that indeed sounds like a good plan. I have now changed it to a dedicated AcquireLoader. This way it seems to work for both the zip and directory types. However, the directory mapping for the tar version does not work yet. When I test this using target-shell the root directories look like this

c:
fs0
fs1

I suspect that the find_and_map_dirs does not handle the tar format correctly, but I cannot figure out how to add support for that. Could you give me some pointers in how to do that?

Furthermore, I suspect this will not work anymore for the legacy acquire format as described in the TarLoader logic. Is this still something that should be supported?

@Horofic Horofic changed the title Add ZIP loader Add Acquire collection loader Nov 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Cannot process ZIP based acquire collects
2 participants