vmspect 0.3.1

Blazing-fast static inspection, forensic analysis and information extraction library for virtual machine disk images (VMDK, RAW, QCOW2, VHD, VHDX, VDI).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

use crate::error::Result;
use crate::models::traits::{AnalysisResult, OsInspector, VmDriver};
use crate::models::{GuestInfo, Options, Partition};

pub(crate) struct UnknownInspector;

impl OsInspector for UnknownInspector {
    fn analyze(
        &self,
        _driver: &dyn VmDriver,
        _partitions: &[Partition],
        _chunk_size: u64,
        options: &Options,
    ) -> Result<AnalysisResult> {
        Ok(AnalysisResult {
            guest_info: if options.should_analyze_system() {
                GuestInfo {
                    os_name: "Unknown operating system".to_string(),
                    ..GuestInfo::default()
                }
            } else {
                GuestInfo::default()
            },
            programs: Vec::new(),
            warnings: Vec::new(),
        })
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_unknown_inspector() {
        let inspector = UnknownInspector;
        let options = Options::default();
        let res = inspector.analyze(&MockDriver, &[], 4096, &options).unwrap();
        assert_eq!(res.guest_info.os_name, "Unknown operating system");
        assert!(res.programs.is_empty());

        let options_nosys = Options {
            no_system: true,
            ..Options::default()
        };
        let res_nosys = inspector
            .analyze(&MockDriver, &[], 4096, &options_nosys)
            .unwrap();
        assert_eq!(res_nosys.guest_info.os_name, "");
    }

    struct MockDriver;
    impl VmDriver for MockDriver {
        fn virtual_size(&self) -> u64 {
            0
        }
        fn read_range(&self, _offset: u64, _buf: &mut [u8]) -> Result<()> {
            Ok(())
        }
        fn access_mode(&self) -> &str {
            "mock"
        }
        fn is_native(&self) -> bool {
            true
        }
    }
}