fox-it/flow.record

Unpacking fieldtype path

Zawadidone opened this issue · 0 comments

The fieldtype path in the PR (fox-it/dissect.target#87) outputted by rdump works with csv, line and the default record output, but json(lines) results in errors.

python query.py -f muicache -t MSEDGEWIN10_20220708124036.tar -q --limit 3 | rdump -J
[reading from stdin]
{"_type": "recorddescriptor", "_data": ["windows/registry/muicache", [["string", "hostname"], ["string", "domain"], ["varint", "index"], ["string", "name"], ["string", "value"], ["path", "path"], ["string", "regf_hive_path"], ["string", "regf_key_path"], ["string", "username"], ["string", "user_id"], ["string", "user_home"]]]}
Traceback (most recent call last):
  File "[...]/dissect.target/.tox/py3/bin/rdump", line 8, in <module>
    sys.exit(main())
  File "[...]/dissect.target/.tox/py3/lib/python3.10/site-packages/flow/record/utils.py", line 57, in wrapper
    return func(*args, **kwargs)
  File "[...]/dissect.target/.tox/py3/lib/python3.10/site-packages/flow/record/tools/rdump.py", line 212, in main
    record_writer.write(rec)
  File "[...]/dissect.target/.tox/py3/lib/python3.10/site-packages/flow/record/adapter/jsonfile.py", line 37, in write
    self._write(r)
  File "[...]/dissect.target/.tox/py3/lib/python3.10/site-packages/flow/record/adapter/jsonfile.py", line 33, in _write
    record_json = self.packer.pack(obj)
  File "[...]/dissect.target/.tox/py3/lib/python3.10/site-packages/flow/record/jsonpacker.py", line 93, in pack
    return json.dumps(obj, default=self.pack_obj, indent=self.indent)
  File "/usr/local/Cellar/python@3.10/3.10.7/Frameworks/Python.framework/Versions/3.10/lib/python3.10/json/__init__.py", line 238, in dumps
    **kw).encode(obj)
  File "/usr/local/Cellar/python@3.10/3.10.7/Frameworks/Python.framework/Versions/3.10/lib/python3.10/json/encoder.py", line 199, in encode
    chunks = self.iterencode(o, _one_shot=True)
  File "/usr/local/Cellar/python@3.10/3.10.7/Frameworks/Python.framework/Versions/3.10/lib/python3.10/json/encoder.py", line 257, in iterencode
    return _iterencode(o, 0)
  File "[...]/dissect.target/.tox/py3/lib/python3.10/site-packages/flow/record/jsonpacker.py", line 71, in pack_obj
    raise Exception("Unpackable type " + str(type(obj)))
Exception: Unpackable type <class 'flow.record.fieldtypes.windows_path'>