Add loader for ESXi vm-support (#1492)

Author: william-billaud

dissect/target/loader.py

@@ -278,6 +278,7 @@ def open(path: str | Path, *, fallbacks: list[type[Loader]] | None = None, **kwa
 register("overlay", "OverlayLoader")
 register("phobos", "PhobosLoader")
 register("uac", "UacLoader")
+register("vmsupport", "VmSupportLoader")
 # tar and zip loaders should be low priority to give other loaders a chance first
 register("tar", "TarLoader")
 register("zip", "ZipLoader")

dissect/target/loaders/nscollector.py

@@ -31,7 +31,7 @@ def detect(path: Path, tarfile: tf.TarFile) -> bool:
         return required_paths.issubset(names)
 
     def map(self, target: Target) -> None:
-        fs = TarFilesystem(tarfile=self.tar, base=self.tar.getnames()[0], fh=self.tar.fileobj)
+        fs = TarFilesystem(self.tar.fileobj, base=self.tar.getnames()[0])
         target.filesystems.add(fs)
 
         # Symlink /nsconfig to /flash/nsconfig to make Citrix parsers compatible

dissect/target/loaders/tar.py

@@ -137,6 +137,7 @@ class TarLoader(Loader):
         import_lazy("dissect.target.loaders.acquire").AcquireTarSubLoader,
         import_lazy("dissect.target.loaders.uac").UacTarSubloader,
         import_lazy("dissect.target.loaders.nscollector").NsCollectorTarSubLoader,
+        import_lazy("dissect.target.loaders.vmsupport").VmSupportTarSubloader,
         GenericTarSubLoader,  # should be last
     )
 

dissect/target/loaders/vmsupport.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.filesystems.tar import TarFilesystem
+from dissect.target.loader import Loader
+from dissect.target.loaders.dir import map_dirs
+from dissect.target.loaders.tar import TarSubLoader
+from dissect.target.plugin import OperatingSystem
+
+if TYPE_CHECKING:
+    import tarfile as tf
+    from pathlib import Path
+
+    from dissect.target.target import Target
+
+
+# From tech support readme
+# Files/Directories of Interest:
+# ------------------------------
+#
+# error.log: log containing errors that ocurred while running vm-support
+# action.log: a log of all commands, and/or actions run during vm-support
+# commands: a directory containing output files for all commands run
+#
+# All other directories and files should be mirrors of the the ESXi system
+# vm-support was run on.
+
+EXPECTED_FILES_OR_DIR = ["etc/vmware/esx.conf", "error.log", "action.log"]
+
+
+class VmSupportLoader(Loader):
+    """Loader for extracted ESXi vm-support.
+
+    References:
+        - https://knowledge.broadcom.com/external/article/313542
+    """
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        if not path.is_dir():
+            return False
+        root_dir = next(path.iterdir())
+        return all(root_dir.joinpath(f).exists() for f in EXPECTED_FILES_OR_DIR)
+
+    def map(self, target: Target) -> None:
+        map_dirs(target, [next(self.absolute_path.iterdir())], OperatingSystem.ESXI)
+
+
+class VmSupportTarSubloader(TarSubLoader):
+    """Loader for tar-based ESXi vm-support.
+
+    References:
+        - https://knowledge.broadcom.com/external/article/313542
+    """
+
+    @staticmethod
+    def detect(path: Path, tarfile: tf.TarFile) -> bool:
+        if not (names := tarfile.getnames()):
+            return False
+        root = names[0].split("/")[0]
+        required_paths = {f"{root}/{f}" for f in EXPECTED_FILES_OR_DIR}
+        return required_paths.issubset(names)
+
+    def map(self, target: Target) -> None:
+        fs = TarFilesystem(self.tar.fileobj, tarfile=self.tar, base=self.tar.getnames()[0].split("/")[0])
+        target.filesystems.add(fs)

tests/_data/loaders/vmsupport/esx-localhost6-2026-01-12--13.56-2107676.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fe64d0a2b663e79c2056c21dc753fe02ead6804e33636d947ce7af8ebf3423bf
+size 3994299

tests/_data/loaders/vmsupport/esx-localhost8-2026-01-09--16.04-135806.tgz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:732e75c90fc430e0f28603689f6a2ec1ce1edc42f95f04950eed27520dad37bd
+size 4519237

tests/loaders/test_vmsupport.py

@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from unittest.mock import patch
+
+import pytest
+
+from dissect.target.loader import open as loader_open
+from dissect.target.loaders.tar import TarLoader
+from dissect.target.loaders.vmsupport import VmSupportLoader, VmSupportTarSubloader
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+    from pathlib import Path
+
+    from pytest_benchmark.fixture import BenchmarkFixture
+
+    from dissect.target.loader import Loader
+
+
+@pytest.fixture
+def mock_vmsupport_dir(tmp_path: Path) -> Path:
+    root = tmp_path / "esx-localhost-2026-01-09--16.04-135806"
+
+    (root / "etc" / "vmware").mkdir(parents=True)
+    (root / "action.log").write_bytes(b"")
+    (root / "error.log").write_bytes(b"")
+    (root / "etc" / "vmware" / "esx.conf").write_bytes(b'/resourceGroups/version = "8.0.3"\n')
+    return tmp_path
+
+
+@pytest.mark.parametrize(
+    ("opener"),
+    [
+        pytest.param(Target.open, id="target-open"),
+        pytest.param(lambda x: next(Target.open_all([x])), id="target-open-all"),
+    ],
+)
+# vmsupport files with commands/vsi_traverse_-s* removed (~300mo)
+@pytest.mark.parametrize(
+    ("path", "loader"),
+    [
+        ("_data/loaders/vmsupport/esx-localhost6-2026-01-12--13.56-2107676.tar.gz", TarLoader),
+        ("_data/loaders/vmsupport/esx-localhost8-2026-01-09--16.04-135806.tgz", TarLoader),
+        ("mock_vmsupport_dir", VmSupportLoader),
+    ],
+)
+def test_target_open(
+    opener: Callable[[str | Path], Target], path: str, loader: type[Loader], mock_vmsupport_dir: Path
+) -> None:
+    """Test that we correctly use the ESXi vm-support loaders when opening a ``Target``."""
+    path = mock_vmsupport_dir if path == "mock_vmsupport_dir" else absolute_path(path)
+
+    with patch("dissect.target.target.Target.apply"):
+        target = opener(path)
+
+        assert isinstance(target._loader, loader)
+        if isinstance(target._loader, TarLoader):
+            assert isinstance(target._loader.subloader, VmSupportTarSubloader)
+        assert target.path == path
+
+
+@pytest.mark.parametrize(
+    "data_path",
+    [
+        "_data/loaders/vmsupport/esx-localhost6-2026-01-12--13.56-2107676.tar.gz",
+        "_data/loaders/vmsupport/esx-localhost8-2026-01-09--16.04-135806.tgz",
+    ],
+)
+def test_compressed_tar(data_path: str) -> None:
+    """Test if we map a compressed vm support tar image correctly."""
+    path = absolute_path(data_path)
+
+    loader = loader_open(path)
+    assert isinstance(loader, TarLoader)
+
+    t = Target()
+    loader.map(t)
+    assert isinstance(loader.subloader, VmSupportTarSubloader)
+    assert len(t.filesystems) == 1
+
+    t.apply()
+    test_file = t.fs.path("/etc/vmware/esx.conf")
+    assert test_file.exists()
+    assert test_file.is_file()
+    assert b"/resourceGroups/version" in test_file.open().read()
+
+
+def test_dir(mock_vmsupport_dir: Path) -> None:
+    """Test if we map an extracted vm support directory correctly."""
+
+    loader = loader_open(mock_vmsupport_dir)
+    assert isinstance(loader, VmSupportLoader)
+
+    t = Target()
+    loader.map(t)
+    assert len(t.filesystems) == 1
+
+    t.apply()
+    test_file = t.fs.path("etc/vmware/esx.conf")
+    assert test_file.exists()
+    assert test_file.is_file()
+    assert test_file.open().readline() == b'/resourceGroups/version = "8.0.3"\n'
+
+
+@pytest.mark.parametrize(
+    ("archive", "loader"),
+    [
+        ("_data/loaders/vmsupport/esx-localhost6-2026-01-12--13.56-2107676.tar.gz", TarLoader),
+        ("_data/loaders/vmsupport/esx-localhost8-2026-01-09--16.04-135806.tgz", TarLoader),
+    ],
+)
+@pytest.mark.benchmark
+def test_benchmark(benchmark: BenchmarkFixture, archive: str, loader: type[Loader]) -> None:
+    file = absolute_path(archive)
+
+    benchmark(lambda: loader(file).map(Target()))