fox-it/dissect

task plugin issue

naderhabbbab opened this issue · 7 comments

naderhabbbab commented

dear team ,
im facing an issue while execute the following command
target-query test.tar -f tasks after extract some event i get the following
File "/usr/local/bin/target-query", line 8, in
sys.exit(main())
File "/usr/local/lib/python3.10/dist-packages/dissect/target/tools/query.py", line 234, in main
for record_entries in entry:
File "/usr/local/lib/python3.10/dist-packages/dissect/target/plugins/os/windows/tasks.py", line 390, in tasks
for entry in self.parse_task(f):
File "/usr/local/lib/python3.10/dist-packages/dissect/target/plugins/os/windows/tasks.py", line 397, in parse_task
raise InvalidTaskError()
dissect.target.exceptions.InvalidTaskError: None

note that the .tar was part of acquire output

Schamper commented

Looks like we have to make the parsing a bit more robust. Are there non-XML files in any of the task directories? (sysvol/windows/system32/tasks, sysvol/windows/system32/tasks_migrated, sysvol/windows/syswow64/tasks).

naderhabbbab commented

hi,
thanks ,
no unusal xml file found all xml format
it seem it have issue with parsing the any tasks under Windows folder
/fs/sysvol/windows/system32/tasks/Microsoft/Windows/

its Windows 8.1 Pro (NT 6.3) 9600 build

Schamper commented

Is it a clean install or was additional software installed? Otherwise I can try to get a reference install.

naderhabbbab commented

its not clean install , it has additional software installed ,

Schamper commented

Hi @naderhabbbab, the issue should be fixed with fox-it/dissect.target#123. You can install this with pip install --pre --upgrade dissect.target if you wish to try out the pre-release. It should now also log which file fails, if any, so that debugging future broken task files will be easier.

naderhabbbab commented

thanks after upgrade it work with no issue

Schamper commented

Did you notice if it raised any warnings? Might be interesting to see on what file it broke previously.