Compatibility with the new dissect.cstruct

dissect/target/helpers/protobuf.py

@@ -1,9 +1,12 @@
 from __future__ import annotations
 
-from typing import Any, BinaryIO
+from typing import TYPE_CHECKING, Any, BinaryIO
 
 from dissect.cstruct.types.base import BaseType
 
+if TYPE_CHECKING:
+    from dissect.cstruct.cstruct import AllowedEndianess
+
 
 class ProtobufVarint(BaseType):
     """Implements a protobuf integer type for dissect.cstruct that can span a variable amount of bytes.
@@ -16,11 +19,11 @@ class ProtobufVarint(BaseType):
     """
 
     @classmethod
-    def _read(cls, stream: BinaryIO, context: dict[str, Any] | None = None) -> int:
+    def _read(cls, stream: BinaryIO, *, context: dict[str, Any] | None = None, endian: AllowedEndianess) -> int:
         return decode_varint(stream)
 
     @classmethod
-    def _write(cls, stream: BinaryIO, data: int) -> int:
+    def _write(cls, stream: BinaryIO, data: int, *, endian: AllowedEndianess) -> int:
         return stream.write(encode_varint(data))
 
 

dissect/target/plugins/apps/editor/windowsnotepad.py

@@ -33,7 +33,7 @@
     uleb128     updateNumber;                   // increases on every settings update when fileType=9,
                                                 // doesn't seem to change on fileType 0 or 1
     uleb128     fileType;                       // 0 if unsaved, 1 if saved, 9 if contains settings?
-}
+};
 
 struct tab_header_saved {
     uleb128     filePathLength;

dissect/target/plugins/apps/ssh/ssh.py

@@ -14,7 +14,7 @@
 struct ssh_string {
     uint32 length;
     char value[length];
-}
+};
 
 struct ssh_private_key {
     char magic[15];
@@ -27,7 +27,7 @@
 
     ssh_string public;
     ssh_string private;
-}
+};
 """
 
 c_rfc4716 = cstruct(endian=">").load(rfc4716_def)

dissect/target/plugins/os/unix/locate/gnulocate.py

@@ -18,7 +18,7 @@
 struct entry {
     int8 offset;
     char path[];
-}
+};
 """
 
 GNULocateRecord = TargetRecordDescriptor(

dissect/target/plugins/os/unix/log/journal.py

@@ -220,7 +220,7 @@
 
 struct EntryItem_Compact {
     le32_t object_offset;
-}
+};
 
 // The first four members are copied from ObjectHeader, so that the size can be used as the length of items
 struct EntryObject {

dissect/target/plugins/os/unix/log/lastlog.py

@@ -37,9 +37,9 @@
 #define size        292
 
 
-struct {
+struct time_t {
     uint32 tv_sec;
-} time_t;
+};
 
 
 struct entry {

dissect/target/plugins/os/unix/log/utmp.py

@@ -71,10 +71,10 @@
     uint16 e_exit;
 };
 
-struct {
+struct timeval {
     uint32 tv_sec;
     uint32 tv_usec;
-} timeval;
+};
 
 struct entry {
     uint32  ut_type;

dissect/target/plugins/os/windows/everything/parser.py

@@ -17,6 +17,8 @@
     from collections.abc import Iterator
     from datetime import datetime
 
+    from dissect.cstruct import Endianess
+
 BZIP_HEADER = b"BZh9"
 FILE_MAGIC = b"ESDb"
 COMPAT_1 = (1, 7, 9)
@@ -27,11 +29,11 @@
 
 class EverythingVarInt(int, BaseType):
     @classmethod
-    def _read(cls, stream: BinaryIO, context: dict[str, Any] | None = None) -> int:
+    def _read(cls, stream: BinaryIO, *, context: dict[str, Any] | None = None, endian: Endianess) -> int:
         return read_varint(stream)
 
     @classmethod
-    def _write(cls, stream: BinaryIO, data: int) -> int:
+    def _write(cls, stream: BinaryIO, data: int, *, endian: Endianess) -> int:
         return stream.write(write_varint(data))
 
 

dissect/target/plugins/os/windows/jumplist.py

@@ -45,21 +45,21 @@
     int unknown1;
     int unknown2;
     int value_type;
-}
+};
 
 struct header_end {
     int number_of_entries;
-}
+};
 
 struct header_end_0 {
     uint16  name_length;
     wchar   name[name_length];
     int     number_of_entries;
-}
+};
 
 struct footer {
     char magic[4];
-}
+};
 """
 
 c_custom_destination = cstruct()

dissect/target/plugins/os/windows/regf/trusteddocs.py

@@ -37,8 +37,8 @@
 typedef QWORD FILETIME;
 
 enum TRFLAG {
-    EDITING_ENABLED     = 0x00000001
-    MACROS_ENABLED      = 0x7fffffff
+    EDITING_ENABLED     = 0x00000001,
+    MACROS_ENABLED      = 0x7fffffff,
 };
 
 struct TrustRecordEntry {

dissect/target/tools/qfind.py

@@ -7,7 +7,7 @@
 import sys
 from typing import TYPE_CHECKING
 
-from dissect.cstruct import utils
+from dissect.cstruct import util
 
 from dissect.target.exceptions import TargetError
 from dissect.target.helpers.logging import get_logger
@@ -92,7 +92,7 @@ def main() -> int:
                 header = f"[{hit.offset:#08x} @ {hit.needle} ({hit.codec})]"
 
                 if not NO_COLOR:
-                    header = utils.COLOR_WHITE_BOLD + header + utils.COLOR_CLEAR
+                    header = util.COLOR_WHITE_BOLD + header + util.COLOR_CLEAR
 
                 before_offset = max(0, hit.offset - args.window)
                 needle_len = len(hit.match)
@@ -101,11 +101,11 @@ def main() -> int:
 
                 if args.raw:
                     palette = (
-                        [(hit.offset - before_offset, utils.COLOR_CLEAR), (needle_len, utils.COLOR_BG_RED)]
+                        [(hit.offset - before_offset, util.COLOR_CLEAR), (needle_len, util.COLOR_BG_RED)]
                         if not NO_COLOR
                         else None
                     )
-                    utils.hexdump(hit.buffer, palette=palette, offset=before_offset)
+                    util.hexdump(hit.buffer, palette=palette, offset=before_offset)
 
                 else:
                     codec = "utf-8" if hit.codec == "hex" else hit.codec
@@ -117,9 +117,9 @@ def main() -> int:
                     )
                     hit = (
                         before_part,
-                        (utils.COLOR_BG_RED if not NO_COLOR else ""),
+                        (util.COLOR_BG_RED if not NO_COLOR else ""),
                         after_part[:needle_len],
-                        (utils.COLOR_CLEAR if not NO_COLOR else ""),
+                        (util.COLOR_CLEAR if not NO_COLOR else ""),
                         after_part[needle_len:],
                     )
                     print("".join(hit))
@@ -316,13 +316,13 @@ def update(disk: Container | Volume, offset: int, size: int) -> None:
         nonlocal current_disk, char
 
         if current_disk is None:
-            sys.stderr.write(f"{utils.COLOR_WHITE_BOLD}{target}{utils.COLOR_CLEAR}\n")
+            sys.stderr.write(f"{util.COLOR_WHITE_BOLD}{target}{util.COLOR_CLEAR}\n")
 
         if current_disk != disk:
-            sys.stderr.write(f"\n{utils.COLOR_WHITE_BOLD}[Current disk: {disk}]{utils.COLOR_CLEAR}\n")
+            sys.stderr.write(f"\n{util.COLOR_WHITE_BOLD}[Current disk: {disk}]{util.COLOR_CLEAR}\n")
             current_disk = disk
 
-        sys.stderr.write(f"\r{COLOR_GREY}{offset / float(size) * 100:0.2f}% {animation[char]}{utils.COLOR_CLEAR}")
+        sys.stderr.write(f"\r{COLOR_GREY}{offset / float(size) * 100:0.2f}% {animation[char]}{util.COLOR_CLEAR}")
         sys.stderr.flush()
 
         if offset % (1337 * 3) == 0:

pyproject.toml

@@ -26,7 +26,7 @@ classifiers = [
 ]
 dependencies = [
     "defusedxml",
-    "dissect.cstruct>=4.8.dev7,<5",  # TODO: Update on release!
+    "dissect.cstruct>=5.0.dev,<6",  # TODO: Update on release!
     "dissect.database>=1.1,<2",
     "dissect.eventlog>=3,<4",
     "dissect.evidence>=3.14.dev3,<4",  # TODO: Update on release!
@@ -83,7 +83,7 @@ dev = [
     "dissect.cim[dev]>=3.0.dev,<4.0.dev",
     "dissect.clfs[dev]>=1.0.dev,<2.0.dev",
     "dissect.cramfs[dev]>=1.0.dev,<2.0.dev",
-    "dissect.cstruct>=4.8.dev7,<5.0.dev",  # TODO: Update on release!
+    "dissect.cstruct>=5.0.dev,<6.0.dev",  # TODO: Update on release!
     "dissect.database[dev]>=1.1,<2.0.dev",
     "dissect.etl[dev]>=3.0.dev,<4.0.dev",
     "dissect.eventlog[dev]>=3.0.dev,<4.0.dev",