:py:mod:`dissect.target.plugins.os.windows.services`
====================================================

.. py:module:: dissect.target.plugins.os.windows.services


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.services.ServicesPlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.services.ServiceRecord
   dissect.target.plugins.os.windows.services.SERVICE_ENUMS
   dissect.target.plugins.os.windows.services.RE_PATH_SPLIT
   dissect.target.plugins.os.windows.services.RE_PATH_SPLIT_FALLBACK


.. py:data:: ServiceRecord

   

.. py:data:: SERVICE_ENUMS

   

.. py:data:: RE_PATH_SPLIT

   

.. py:data:: RE_PATH_SPLIT_FALLBACK

   

.. py:class:: ServicesPlugin(target: dissect.target.Target)


   Bases: :py:obj:`dissect.target.plugin.Plugin`

   Services plugin.

   .. py:attribute:: KEY
      :value: 'HKLM\\SYSTEM\\CurrentControlSet\\Services'

      

   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with
      the current target (``self.target``). For example, check if a certain
      file exists.
      Otherwise it should raise an ``UnsupportedPluginError``.

      :raises UnsupportedPluginError: If the plugin could not be loaded.


   .. py:method:: services()

      Return information about all installed services.

      The HKLM\SYSTEM\CurrentControlSet\Services registry key contains information about the installed services and
      drivers on the system.

      .. rubric:: References

      - https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html

      Yields ServiceRecords with fields:
          hostname (string): The target hostname.
          domain (string): The target domain.
          ts (datatime): The last modified timestamp of the registry key.
          name (string): The service name.
          displayname (string): The service display name.
          servicedll (path): The service dll.
          imagepath (path): The service image path.
          objectname (string): The object under which the service runs (for example LocalSystem)
          start (string): The service start field.
          type (string): The service type field.
          errorcontrol (string): The service error control field.