Add ntds cli tools and add all tools as pyproject entry points by william-billaud · Pull Request #34 · fox-it/dissect.database

william-billaud · 2026-02-18T12:37:45Z

Add a cli tool to dump all object with a specific object class of an NTDS. This could mainly be used for testing.

E.g

python3 -m dissect.database.ese.ntds.ntds -o User ./paht/to//ntds.dit [--json]

Just a small point, it is a bit weird that NTDS tools is in dissect.database.ese.ntds, and others are in dissect.database.ese.tools. Maybe the ntds.py file should be moved in dissect.database.ese.tools (but that would require refactoring in some other project, and this is definitely not an important problem).

closes Add ntds cli tools #33

Matthijsy · 2026-02-18T12:56:15Z

Doesn't it make more sense to put the tool in dissect.database.ese.tools and leave the NTDS class itself at the current path? That means you don't have to refactor anything and from the tool just call the NTDS class?

william-billaud · 2026-02-18T13:16:14Z

It's another option, we will see what is preferred by the maintainers.
I'm agree just putting the cli tools in dissect.database.ese.tools.ntds is probably the more "user friendly' and does not needs any refactoring.

Schamper · 2026-02-19T08:36:21Z

I was thinking about the location too. Maybe dissect/database/ese/ntds/tools/inspect.py? That way we keep the tooling within the ntds namespace but out of the "library" part of it.

And you can add a console_script entry point too. Maybe dissect-ntds or ntds-inspect, or another name you suggest 😄.

william-billaud · 2026-02-19T09:43:16Z

I have added console script + edited readme for all script.
Feel free to move/rename if you prefer another name, I won't be offended ^^

dissect/database/ese/ntds/tools/ntds.py

pyproject.toml

README.md

dissect/database/ese/ntds/tools.py

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

…se, help="output in JSON format") to all ese tools

william-billaud · 2026-02-19T11:11:54Z

I have also modified the ual/sru to support the '-j, --json output in JSON format'

E.g

uv run dissect-sru -p 'application' -j srudb.dat | head -n 3
{"AutoIncId": 55, "TimeStamp": 4676351156559788988, "AppId": 19, "UserId": 65, "ForegroundCycleTime": 68229922, "BackgroundCycleTime": 0, "FaceTime": 157506984, "ForegroundContextSwitches": 166, "BackgroundContextSwitches": 0, "ForegroundBytesRead": 0, "ForegroundBytesWritten": 0, "ForegroundNumReadOperations": 0, "ForegroundNumWriteOperations": 0, "ForegroundNumberOfFlushes": 0, "BackgroundBytesRead": 0, "BackgroundBytesWritten": 0, "BackgroundNumReadOperations": 0, "BackgroundNumWriteOperations": 0, "BackgroundNumberOfFlushes": 0, "provider": "{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}"}
{"AutoIncId": 56, "TimeStamp": 4676351156559788988, "AppId": 19, "UserId": 66, "ForegroundCycleTime": 95656812, "BackgroundCycleTime": 0, "FaceTime": 12744437411, "ForegroundContextSwitches": 343, "BackgroundContextSwitches": 0, "ForegroundBytesRead": 0, "ForegroundBytesWritten": 0, "ForegroundNumReadOperations": 0, "ForegroundNumWriteOperations": 0, "ForegroundNumberOfFlushes": 0, "BackgroundBytesRead": 0, "BackgroundBytesWritten": 0, "BackgroundNumReadOperations": 0, "BackgroundNumWriteOperations": 0, "BackgroundNumberOfFlushes": 0, "provider": "{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}"}
{"AutoIncId": 57, "TimeStamp": 4676351156559788988, "AppId": 19, "UserId": 67, "ForegroundCycleTime": 229011358, "BackgroundCycleTime": 0, "FaceTime": 18743077832, "ForegroundContextSwitches": 804, "BackgroundContextSwitches": 0, "ForegroundBytesRead": 0, "ForegroundBytesWritten": 0, "ForegroundNumReadOperations": 0, "ForegroundNumWriteOperations": 0, "ForegroundNumberOfFlushes": 0, "BackgroundBytesRead": 0, "BackgroundBytesWritten": 0, "BackgroundNumReadOperations": 0, "BackgroundNumWriteOperations": 0, "BackgroundNumberOfFlushes": 0, "provider": "{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}"}

uv run dissect-ual -j current.mdb | head -n 3
{"RoleGuid": "ad495fc3-0eaa-413d-ba7d-8b13fa7ec598", "FirstSeen": "2021-07-23 10:30:54.934538+00:00", "LastSeen": "2021-11-22 15:56:27.094593+00:00"}
{"RoleGuid": "7fb09bd3-7fe6-435e-8348-7d8aefb6cea3", "FirstSeen": "2021-07-23 10:30:55.191715+00:00", "LastSeen": "2021-11-22 15:51:56.144556+00:00"}
{"RoleGuid": "10a9226f-50ee-49d8-a393-9a501d47ce04", "FirstSeen": "2021-07-23 10:33:33.182354+00:00", "LastSeen": "2021-11-12 16:23:58.337612+00:00"}

Schamper · 2026-02-19T11:45:05Z

dissect/database/ese/tools/sru.py

+            generator = parser.entries()
+        for e in generator:
+            if args.json:
+                record_as_dict = e.record.as_dict()


Wouldn't you now miss the serialization that happens in Entry.__repr__? Maybe add an as_dict to the Entry class.

I have added the as_dict method. No sure to understant what you mean by 'Wouldn't you now miss the serialization that happens'.
If by miss you speak of the AppId/UserId resolution / ts conversion, this is not done in repr either, but I can add it (but maybe in another PR).

Ah apologies, I thought serialise_record_column_values was from this file and did some value conversion (the AppId, UserId, ts stuff), but that's not the case.

this is not done in repr either, but I can add it (but maybe in another PR).

Yes I only just now noticed this. That would be appreciated and can be a separate PR. Thanks!

dissect/database/ese/ntds/tools/ntds.py

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

codecov · 2026-02-19T17:09:15Z

Codecov Report

❌ Patch coverage is 0% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (658aa54) to head (d9be412).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
dissect/database/ese/ntds/tools/ntds.py	0.00%	19 Missing ⚠️
dissect/database/ese/tools/sru.py	0.00%	12 Missing ⚠️
dissect/database/ese/tools/ual.py	0.00%	5 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##            main     #34   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files        150     151    +1     
  Lines       4125    4155   +30     
=====================================
- Misses      4125    4155   +30

Flag	Coverage Δ
unittests	`0.00% <0.00%> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

codspeed-hq · 2026-02-19T17:26:03Z

Merging this PR will not alter performance

✅ 6 untouched benchmarks

_{Comparing william-billaud:ese_tools (d9be412) with main (658aa54)}

Fix issue fox-it#33

0e8136c

william-billaud changed the title ~~Fix issue #33~~ Add ntds cli tools Feb 18, 2026

Add project.scripts

ef3ccb0

Schamper requested changes Feb 19, 2026

View reviewed changes

william-billaud and others added 6 commits February 19, 2026 11:50

Update pyproject.toml

9a563ac

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

Update README.md

38c183c

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

Update README.md

702c517

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

Update dissect/database/ese/ntds/tools.py

d41cab3

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

Update dissect/database/ese/ntds/tools.py

b3e8582

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

parser.add_argument("-j", "--json", action="store_true", default=Fal…

d649dec

…se, help="output in JSON format") to all ese tools

william-billaud requested a review from Schamper February 19, 2026 11:12

Schamper requested changes Feb 19, 2026

View reviewed changes

william-billaud and others added 4 commits February 19, 2026 13:08

Update dissect/database/ese/ntds/tools/ntds.py

e139691

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

Update dissect/database/ese/ntds/tools/ntds.py

5b81ab3

Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>

Add as_dict function to sru entrie

e07162c

Merge branch 'main' into ese_tools

25f32b4

william-billaud requested a review from Schamper February 19, 2026 12:35

william-billaud changed the title ~~Add ntds cli tools~~ Add ntds cli tools and add all tools as pyproject entry points Feb 19, 2026

Schamper added 2 commits February 19, 2026 18:03

Delete dissect/__init__.py

2d78335

Format commands table in README.md

515806f

Schamper approved these changes Feb 19, 2026

View reviewed changes

Merge branch 'main' into ese_tools

b436865

Merge branch 'main' into ese_tools

d9be412

Schamper merged commit 357f642 into fox-it:main Feb 19, 2026
19 of 21 checks passed

william-billaud mentioned this pull request Feb 20, 2026

Enhance SRU tools #40

Open

Conversation

william-billaud commented Feb 18, 2026

Uh oh!

Matthijsy commented Feb 18, 2026

Uh oh!

william-billaud commented Feb 18, 2026

Uh oh!

Schamper commented Feb 19, 2026

Uh oh!

william-billaud commented Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

william-billaud commented Feb 19, 2026

Uh oh!

Schamper Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

william-billaud Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Schamper Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

codspeed-hq bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

william-billaud Feb 19, 2026 •

edited

Loading

codecov bot commented Feb 19, 2026 •

edited

Loading

codspeed-hq bot commented Feb 19, 2026 •

edited

Loading