diff options
| -rw-r--r-- | README.md | 102 | ||||
| -rw-r--r-- | tools/inspect_apps.py | 20 | ||||
| -rw-r--r-- | tools/inspect_os.py | 10 | ||||
| -rw-r--r-- | tools/libvmdk.py | 12 | ||||
| -rw-r--r-- | tools/libvslvm.py | 12 | ||||
| -rw-r--r-- | tools/lklfuse.py | 9 | ||||
| -rw-r--r-- | tools/nbdfuse.py | 3 | ||||
| -rw-r--r-- | tools/pyparted.py | 11 |
8 files changed, 104 insertions, 75 deletions
@@ -6,12 +6,110 @@ A sample tool for inspecting a disk image file, e.g. vmdk, vdi, qcow, etc., to d To inspect a disk image file: -``` +```sh python3 inspect.py foo.vmdk ``` or -``` +```sh ./inspect.py foo.vmdk ``` + +## CLI options + +```sh +./inspect.py foo.vmdk --help +``` + +``` +usage: inspect.py [-h] [-b {libvmdk,nbdfuse}] [-v] image + +Tool for inspecting a disk image file to determine which operating +system and applications it contains. + +positional arguments: + image disk image file to inspect + +optional arguments: + -h, --help show this help message and exit + -b {libvmdk,nbdfuse}, --backend {libvmdk,nbdfuse} + used backend for mounting disk image files in + the local filesystem (default: nbdfuse) + -v, --verbose print debug messages +``` + +## Requirements + +- Python >= 3.9 + +- Debian 11 Bullseye (recommended) + +- [lklfuse](https://github.com/lkl/linux) + + ```sh + $ sudo apt install build-essential flex bison bc libfuse-dev libarchive-dev xfsprogs python git + $ git clone https://github.com/lkl/linux.git + $ cd linux + $ echo "CONFIG_NTFS_FS=y" >> arch/lkl/configs/defconfig + $ make -C tools/lkl + $ sudo cp tools/lkl/lklfuse /usr/local/bin + ``` + +- [nbdfuse](https://libguestfs.org/nbdfuse.1.html) + [qemu-nbd](https://www.qemu.org/docs/master/tools/qemu-nbd.html) (qcow2, vdi, vmdk, etc.) or [libvmdk](https://github.com/libyal/libvmdk) >= 20210807 (vmdk only) + + ```sh + $ sudo apt install qemu-utils nbdfuse + ``` + + ```sh + $ sudo apt install build-essential libfuse-dev + $ wget https://github.com/libyal/libvmdk/releases/download/20210807/libvmdk-alpha-20210807.tar.gz + $ tar xfv libvmdk-alpha-20210807.tar.gz + $ cd libvmdk-20210807/ + $ ./configure + $ make + $ sudo make install + $ sudo ldconfig + ``` + +- [libvslvm](https://github.com/libyal/libvslvm) >= 20210807 + + ```sh + $ sudo apt install build-essential libfuse-dev + $ wget https://github.com/libyal/libvslvm/releases/download/20210807/libvslvm-experimental-20210807.tar.gz + $ tar xfv libvslvm-experimental-20210807.tar.gz + $ cd libvslvm-20210807/ + $ ./configure + $ make + $ sudo make install + $ sudo ldconfig + ``` + +- [pyparted](https://github.com/dcantrell/pyparted) + + ```sh + $ sudo apt install python3 python3-pip python3-dev libparted-dev pkg-config + $ pip3 install pyparted + ``` + +- [python-registry](https://github.com/williballenthin/python-registry) + + ```sh + $ sudo apt install python3 python3-pip + $ pip3 install python-registry + ``` + +- [python3-rpm](https://github.com/rpm-software-management/rpm) >= 4.16.1.3 + + ```sh + $ sudo apt install build-essential python3 python3-dev python3-pip zlib1g-dev libgcrypt20-dev libmagic-dev libpopt-dev libsqlite3-dev libarchive-dev + $ wget https://ftp.osuosl.org/pub/rpm/releases/rpm-4.16.x/rpm-4.16.1.3.tar.bz2 + $ tar xfv rpm-4.16.1.3.tar.bz2 + $ cd rpm-4.16.1.3/ + $ ./autogen.sh --enable-python --enable-bdb=no --enable-bdb-ro --enable-sqlite=yes --enable-ndb --without-lua --disable-plugins + $ make + $ sudo make install + $ sudo ldconfig + $ cd python && sudo python3 setup.py install + ``` diff --git a/tools/inspect_apps.py b/tools/inspect_apps.py index 2b9f57d..5b6ec00 100644 --- a/tools/inspect_apps.py +++ b/tools/inspect_apps.py @@ -1,7 +1,9 @@ import logging import os import re +import rpm # type: ignore +from Registry import Registry # type: ignore from . import log, subdirs __all__ = [ @@ -15,24 +17,6 @@ __all__ = [ L = logging.getLogger(__name__) -try: - import rpm # type: ignore -except ModuleNotFoundError: - L.error( - "You need to install the following package:\n" - "sudo apt install python3-rpm" - ) - raise - -try: - from Registry import Registry # type: ignore -except ModuleNotFoundError: - L.error( - "You need to install the following package:\n" - "pip3 install python-registry" - ) - raise - @log def list_applications_apk(path): diff --git a/tools/inspect_os.py b/tools/inspect_os.py index ce03ee9..acfe14f 100644 --- a/tools/inspect_os.py +++ b/tools/inspect_os.py @@ -3,21 +3,13 @@ import logging import re from glob import iglob +from Registry import Registry # type: ignore from . import log __all__ = ["get_linux_os_info", "get_windows_os_info"] L = logging.getLogger(__name__) -try: - from Registry import Registry # type: ignore -except ModuleNotFoundError: - L.error( - "You need to install the following package:\n" - "pip3 install python-registry" - ) - raise - @log def get_linux_os_info(path): diff --git a/tools/libvmdk.py b/tools/libvmdk.py index c29d18a..b151429 100644 --- a/tools/libvmdk.py +++ b/tools/libvmdk.py @@ -19,20 +19,8 @@ def mount(path): local filesystem with read-only support using `libvmdk`. See also: - https://github.com/libyal/libvmdk/wiki/Building https://github.com/libyal/libvmdk/wiki/Mounting - Make sure you have downloaded the latest source distribution package from - https://github.com/libyal/libvmdk/releases, e.g. - libvmdk-alpha-20210807.tar.gz and built it as follows: - $ sudo apt install build-essential libfuse-dev - $ tar xfv libvmdk-alpha-20210807.tar.gz - $ cd libvmdk-20210807/ - $ ./configure - $ make - $ sudo make install - $ sudo ldconfig - Args: path (str): Path to the VMDK file. diff --git a/tools/libvslvm.py b/tools/libvslvm.py index ec1fdbb..4c2255a 100644 --- a/tools/libvslvm.py +++ b/tools/libvslvm.py @@ -17,18 +17,6 @@ def mount(path, offset): See also: https://github.com/libyal/libvslvm/wiki/Mounting - https://github.com/libyal/libvslvm/wiki/Building - - Make sure you have downloaded the latest source distribution package from - https://github.com/libyal/libvslvm/releases, e.g. - libvslvm-experimental-20210807.tar.gz and built it as follows: - $ sudo apt install build-essential libfuse-dev - $ tar xfv libvslvm-experimental-20210807.tar.gz - $ cd libvslvm-20210807/ - $ ./configure - $ make - $ sudo make install - $ sudo ldconfig Args: path (str): Path to the RAW image file containing LVM volume system. diff --git a/tools/lklfuse.py b/tools/lklfuse.py index 6982be1..da5ce8f 100644 --- a/tools/lklfuse.py +++ b/tools/lklfuse.py @@ -16,15 +16,6 @@ def mount(path, fs_type, part_nr=None): """Mount a RAW image file containing an ext2/ext3/ext4/xfs/btrfs/vfat/ntfs filesystem with read-only support using `lklfuse`. - Make sure you have built `LKL` from the source code: - $ sudo apt install build-essential flex bison bc libfuse-dev \ - libarchive-dev xfsprogs python git - $ git clone https://github.com/lkl/linux.git - $ cd linux - $ echo "CONFIG_NTFS_FS=y" >> arch/lkl/configs/defconfig - $ make -C tools/lkl - $ sudo cp tools/lkl/lklfuse /usr/local/bin - Args: path (str): Path to the RAW image file. fs_type (str): Filesystem type. diff --git a/tools/nbdfuse.py b/tools/nbdfuse.py index 09591ea..6926a1c 100644 --- a/tools/nbdfuse.py +++ b/tools/nbdfuse.py @@ -20,9 +20,6 @@ def mount(path): https://manpages.debian.org/bullseye/qemu-utils/qemu-nbd.8.en.html https://manpages.debian.org/bullseye/libnbd-bin/nbdfuse.1.en.html - Make sure you have the following packages installed: - $ sudo apt install qemu-utils nbdfuse - Args: path (str): Path to the disk image file. diff --git a/tools/pyparted.py b/tools/pyparted.py index 492e032..c51a13b 100644 --- a/tools/pyparted.py +++ b/tools/pyparted.py @@ -1,4 +1,5 @@ import logging +import parted # type: ignore from . import log @@ -6,16 +7,6 @@ __all__ = ["list_partitions"] L = logging.getLogger(__name__) -try: - import parted # type: ignore -except ModuleNotFoundError: - L.error( - "You need to install the following packages:\n" - "sudo apt install python3-dev libparted-dev pkg-config\n" - "pip3 install pyparted" - ) - raise - SUPPORTED_FS_TYPES = ["ext2", "ext3", "ext4", "xfs", "btrfs", "vfat", "ntfs"] |