Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions dissect/eventlog/__init__.py
Original file line number Diff line number Diff line change
@@ -1,9 +1,13 @@
from dissect.eventlog.evt import Evt
from dissect.eventlog.evtx import Evtx
from dissect.eventlog.exceptions import Error, BxmlException, MalformedElfChnkException, UnknownSignatureException
from dissect.eventlog.exceptions import (
BxmlException,
Error,
MalformedElfChnkException,
UnknownSignatureException,
)
from dissect.eventlog.wevt import CRIM


__all__ = [
"CRIM",
"Evt",
Expand Down
7 changes: 4 additions & 3 deletions dissect/eventlog/bxml.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,17 @@


import binascii
from typing import Any, BinaryIO, Dict, List, Tuple
import uuid
from datetime import datetime
from io import BytesIO
from enum import IntEnum
from io import BytesIO
from typing import Any, BinaryIO, Dict, List, Tuple

from dissect.cstruct.cstruct import cstruct
from dissect.util.ts import wintimestamp

from dissect.eventlog.exceptions import BxmlException
from dissect.eventlog.utils import KeyValueCollection
from dissect.util.ts import wintimestamp


class BxmlToken(IntEnum):
Expand Down
6 changes: 3 additions & 3 deletions dissect/eventlog/wevt.py
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
from dissect.eventlog.exceptions import UnknownSignatureException
from io import BufferedReader
from uuid import UUID

import dissect.eventlog.wevt_object as wevt_objects

from dissect.cstruct import cstruct

import dissect.eventlog.wevt_object as wevt_objects
from dissect.eventlog.exceptions import UnknownSignatureException

header_dev = """
struct Event_Descriptor {
char ProviderId[16];
Expand Down
8 changes: 5 additions & 3 deletions dissect/eventlog/wevt_object.py
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
from io import BytesIO
from typing import List
from dissect.eventlog.bxml import Bxml, Template, WevtNameReader, parse_bxml, BxmlType
from dissect.cstruct import cstruct
from uuid import UUID
from io import BytesIO

from dissect.cstruct import cstruct

from dissect.eventlog.bxml import Bxml, BxmlType, Template, WevtNameReader, parse_bxml

wevt_object_def = """
struct DATA_ITEM {
Expand Down
3 changes: 2 additions & 1 deletion tests/_utils.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
from dissect.cstruct import cstruct
from dissect.eventlog.wevt_object import wevt_object_def

from dissect.eventlog.wevt import header_dev
from dissect.eventlog.wevt_object import wevt_object_def

definitions = cstruct()
definitions.load(header_dev + wevt_object_def)
Expand Down
1 change: 1 addition & 0 deletions tests/conftest.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import os

import pytest


Expand Down
7 changes: 4 additions & 3 deletions tests/test_binxml.py
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
from dissect.eventlog.exceptions import BxmlException
from io import BytesIO
from dissect.eventlog.bxml import BxmlToken, Bxml
from unittest.mock import Mock, patch

import pytest

from unittest.mock import Mock, patch
from dissect.eventlog.bxml import Bxml, BxmlToken
from dissect.eventlog.exceptions import BxmlException


@pytest.mark.parametrize(
Expand Down
5 changes: 3 additions & 2 deletions tests/test_crim.py
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
from dissect.eventlog.exceptions import UnknownSignatureException
from dissect.eventlog.wevt import CRIM
from unittest.mock import patch

import pytest

from dissect.eventlog.exceptions import UnknownSignatureException
from dissect.eventlog.wevt import CRIM

CRIM_HEADER = (
b"\x43\x52\x49\x4D\xF8\x1B\x07\x00\x05\x00\x01\x00\x01\x00\x00\x00"
b"\xB7\xE6\xF3\x2F\x90\xCB\x00\x47\x96\x21\x44\x3F\x38\x97\x34\xED"
Expand Down
1 change: 0 additions & 1 deletion tests/test_evtx.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
from dissect.eventlog.evtx import Evtx


# $rawData = [System.Text.Encoding]::Unicode.GetBytes("Test Binary Data")

# New-EventLog -Source TestAppX -LogName TestLogX
Expand Down
3 changes: 2 additions & 1 deletion tests/test_wevt.py
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
from dissect.eventlog.exceptions import UnknownSignatureException
from unittest.mock import MagicMock, mock_open, patch

import pytest

from dissect.eventlog.exceptions import UnknownSignatureException
from dissect.eventlog.wevt import MAPS_WEVT_TYPE, TTBL_WEVT_TYPE, WEVT, WEVT_TYPE

WEVT_HEADER = (
Expand Down
14 changes: 8 additions & 6 deletions tests/test_wevt_type.py
Original file line number Diff line number Diff line change
@@ -1,16 +1,18 @@
from dissect.eventlog.exceptions import UnknownSignatureException
from dissect.eventlog.wevt import WEVT_TYPE, TTBL_WEVT_TYPE, MAPS_WEVT_TYPE
from dissect.eventlog.wevt_object import WevtObject
from unittest.mock import Mock, patch

import pytest

from dissect.eventlog.exceptions import UnknownSignatureException
from dissect.eventlog.wevt import MAPS_WEVT_TYPE, TTBL_WEVT_TYPE, WEVT_TYPE
from dissect.eventlog.wevt_object import WevtObject

from ._utils import (
TTBL_HEADER,
CHAN_HEADER,
CHAN_DATA,
CHAN_HEADER,
TEMP_HEADER,
create_header,
TTBL_HEADER,
create_data_item,
create_header,
create_header_type,
)

Expand Down
5 changes: 2 additions & 3 deletions tests/test_wevtobj.py
Original file line number Diff line number Diff line change
@@ -1,12 +1,11 @@
import pytest
from unittest.mock import call, patch

from unittest.mock import patch, call
import pytest

from dissect.eventlog import wevt_object

from ._utils import TEMP_HEADER, create_data_item, create_header_type


signatures = ["CHAN", "OPCO", "LEVL", "KEYW"]


Expand Down
1 change: 1 addition & 0 deletions tox.ini
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ deps =
black==23.1.0
flake8
flake8-black
flake8-isort
vermin
commands =
flake8 dissect tests setup.py
Expand Down