`dissect.target.plugins.os.unix.linux.proc`¶

Module Contents¶

Classes¶

`NetSocket`
`UnixSocket`
`PacketSocket`
`Environ`
`ProcessStateEnum`	Sortable and serializible string-based enum
`Sockets`
`ProcProcess`
`ProcPlugin`	Base class for plugins.

Functions¶

parse_ip

Convert /proc/net IPv4 or IPv6 hex address into their standard IP notation.

Attributes¶

PROC_STAT_NAMES

dissect.target.plugins.os.unix.linux.proc.parse_ip(addr: str | int, version: int = 4) → ipaddress.IPv6Address | ipaddress.IPv4Address¶: Convert /proc/net IPv4 or IPv6 hex address into their standard IP notation.

class dissect.target.plugins.os.unix.linux.proc.NetSocket¶

sl: str¶

local_address: str¶

rem_address: str¶

state: str¶

tx_rx_queue: str¶

tr_tm_when: str¶

restansmit: str¶

uid: int¶

timeout: str¶

inode: int¶

ref: str | None¶

pointer: str | None¶

drops: str | None¶

predicted_tick: str | None¶

ack_pingpong: str | None¶

congestion_window: str | None¶

size_threshold: str | None¶

protocol_string: str | None¶

local_ip: str | None¶

local_port: int | None¶

remote_ip: str | None¶

remote_port: int | None¶

state_string: str | None¶

owner: str | None¶

rx_queue: int | None¶

tx_queue: int | None¶

pid: int | None¶

name: str | None¶

cmdline: str | None¶

classmethod from_line(line: str, ip_vers: int = 4) → NetSocket¶

class dissect.target.plugins.os.unix.linux.proc.UnixSocket¶

num: str¶

ref: int¶

protocol: int¶

flags: str¶

type: int¶

state: int¶

inode: int¶

path: str | None¶

state_string: str | None¶

stream_type_string: str | None¶

protocol_string: str = 'unix'¶

classmethod from_line(line: str) → UnixSocket¶

class dissect.target.plugins.os.unix.linux.proc.PacketSocket¶

sk: int¶

ref: int¶

type: int¶

protocol: int¶

iface: int¶

r: int¶

rmem: int¶

user: int¶

inode: int¶

pid: int | None¶

name: str | None¶

cmdline: str | None¶

protocol_type: int | None¶

owner: str | None¶

protocol_string: str = 'packet'¶

classmethod from_line(line: str) → PacketSocket¶

class dissect.target.plugins.os.unix.linux.proc.Environ¶

variable: str¶

contents: str¶

class dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum¶

Bases: dissect.target.helpers.utils.StrEnum

Sortable and serializible string-based enum

R = 'Running'¶

I = 'Idle'¶

S = 'Sleeping'¶

D = 'Waiting'¶

Z = 'Zombie'¶

T = 'Stopped'¶

t = 'Tracing'¶

X = 'Dead'¶

x = 'Dead'¶

K = 'Wakekill'¶

W = 'Waking'¶

P = 'Parked'¶

N = 'None'¶

dissect.target.plugins.os.unix.linux.proc.PROC_STAT_NAMES = ['pid', 'comm', 'state', 'ppid', 'pgrp', 'session', 'tty_nr', 'tpgid', 'flags', 'minflt',...¶

class dissect.target.plugins.os.unix.linux.proc.Sockets(target: dissect.target.target.Target)¶

class PacketProtocolTypes¶

Bases: enum.IntEnum

Enum where members are also (and must be) ints

ETH_P_802_3 = 1¶

ETH_P_AX25 = 2¶

ETH_P_ALL = 3¶

ETH_P_802_2 = 4¶

ETH_P_SNAP = 5¶

ETH_P_DDCMP = 6¶

ETH_P_WAN_PPP = 7¶

ETH_P_PPP_MP = 8¶

ETH_P_LOCALTALK = 9¶

ETH_P_CAN = 12¶

ETH_P_PPPTALK = 16¶

ETH_P_TR_802_2 = 17¶

ETH_P_MOBITEX = 21¶

ETH_P_CONTROL = 22¶

ETH_P_IRDA = 23¶

ETH_P_ECONET = 24¶

ETH_P_HDLC = 25¶

ETH_P_ARCNET = 26¶

ETH_P_DSA = 27¶

ETH_P_TRAILER = 28¶

ETH_P_PHONET = 245¶

ETH_P_IEEE802154 = 246¶

class SocketStreamType¶

Bases: enum.IntEnum

Enum where members are also (and must be) ints

STREAM = 1¶

DGRAM = 2¶

SEQPACKET = 5¶

class SocketStateType¶

Bases: enum.IntEnum

Enum where members are also (and must be) ints

LISTENING = 1¶

CONNECTED = 3¶

class TCPStates¶

Bases: enum.IntEnum

Enum where members are also (and must be) ints

DUMMY = 0¶

ESTABLISHED = 1¶

SYN_SENT = 2¶

SYN_RECV = 3¶

FIN_WAIT1 = 4¶

FIN_WAIT2 = 5¶

TIME_WAIT = 6¶

CLOSE = 7¶

CLOSE_WAIT = 8¶

LAST_ACK = 9¶

LISTEN = 10¶

CLOSING = 11¶

NEW_SYN_RECV = 12¶

MAX_STATES = 13¶

class UDPStates¶

Bases: enum.IntEnum

Enum where members are also (and must be) ints

DUMMY = 0¶

ESTABLISHED = 1¶

LISTEN = 7¶

packet() → Iterator[PacketSocket]¶: Yield parsed /proc/net/packet entries.

raw() → Iterator[NetSocket]¶: Yield parsed /proc/net/raw entries.

raw6() → Iterator[NetSocket]¶: Yield parsed /proc/net/raw6 entries.

tcp6() → Iterator[NetSocket]¶: Yield parsed /proc/net/tcp6 entries.

tcp() → Iterator[NetSocket]¶: Yield parsed /proc/net/tcp entries.

udp() → Iterator[NetSocket]¶: Yield parsed /proc/net/upd entries.

udp6() → Iterator[NetSocket]¶: Yield parsed /proc/net/udp6 entries.

unix() → Iterator[UnixSocket]¶: Yield parsed /proc/net/unix entries.

class dissect.target.plugins.os.unix.linux.proc.ProcProcess(target: dissect.target.target.Target, pid: int | str, proc_root: str = '/proc')¶

property owner: str¶: Return the username or the user ID (uid) (if owner is not found) of the owner of this process.

property uid: int¶: Return the user ID (uid) of the owner of this process.

property pid: int¶: Returns the process ID (pid) associated to this process.

property parent: ProcProcess | None¶: Returns the parent ProcProcess of this process.

property ppid: int | None¶: Returns the parent process ID (ppid) associated to this process.

property parent_name: str | None¶: Returns the name associated to the parent process ID (ppid) of this process.

property state: str¶: Returns the state of the process (S’leeping, R’unning, I’dle, etc).

property starttime: datetime.datetime¶: Returns the start time of the process.

property runtime: datetime.timedelta¶: Returns the runtime of a process until the moment of acquisition.

property now: datetime.datetime¶: Returns the now() timestamp of the system at the moment of acquisition.

property uptime: datetime.timedelta¶: Returns the uptime of the system from the moment it was acquired.

property cmdline: str¶: Return the command line of a process.

get(path: str) → pathlib.Path¶: Returns a TargetPath relative to this process.

environ() → Iterator[Environ]¶: Yields the content of the environ file associated with the process.

stat() → dissect.target.filesystem.fsutil.stat_result¶: Return a stat entry of the process.

class dissect.target.plugins.os.unix.linux.proc.ProcPlugin(target: dissect.target.target.Target)¶

Bases: dissect.target.plugin.Plugin

Base class for plugins.

Plugins can optionally be namespaced by specifying the __namespace__ class attribute. Namespacing results in your plugin needing to be prefixed with this namespace when being called. For example, if your plugin has specified test as namespace and a function called example, you must call your plugin with test.example:

A Plugin class has the following private class attributes:

__namespace__
__record_descriptors__

With the following three being assigned in register():

__plugin__
__functions__
__exports__

Additionally, the methods and attributes of Plugin receive more private attributes by using decorators.

The export() decorator adds the following private attributes

__exported__
__output__: Set with the export() decorator.
__record__: Set with the export() decorator.

The internal() decorator and InternalPlugin set the __internal__ attribute. Finally. args() decorator sets the __args__ attribute.

Parameters:: target – The Target object to load the plugin for.

__namespace__ = 'proc'¶

check_compatible() → None¶

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:: UnsupportedPluginError – If the plugin could not be loaded.

inode_map() → dict[int, list[ProcProcess]]¶: Creates a inode to pid mapping for all process IDs in /proc/[pid].

iter_proc() → Iterator[pathlib.Path]¶: Yields /proc/[pid] filesystems entries for every process id (pid) found in procfs.

inode_to_pids(inode: int) → list[ProcProcess]¶

process(pid: int | str) → ProcProcess¶

processes() → Iterator[ProcProcess]¶

dissect.target.plugins.os.unix.linux.proc¶

Module Contents¶

Classes¶

Functions¶

Attributes¶

`dissect.target.plugins.os.unix.linux.proc`¶