Adjust teamviewer plugin to account for daylight savings time in timestamps by Miauwkeru · Pull Request #1614 · fox-it/dissect.target

Miauwkeru · 2026-03-09T14:32:37Z

Use the target timezone in the teamviewer plugin if the utcoffsets match
Rewrite parse_start to account for only (UTC) inside the string

codecov · 2026-03-09T14:37:50Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.09%. Comparing base (4ba8f14) to head (c442096).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1614      +/-   ##
==========================================
+ Coverage   81.06%   81.09%   +0.03%     
==========================================
  Files         402      402              
  Lines       35244    35264      +20     
==========================================
+ Hits        28571    28599      +28     
+ Misses       6673     6665       -8

Flag	Coverage Δ
unittests	`81.09% <100.00%> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

codspeed-hq · 2026-03-09T14:47:02Z

Merging this PR will not alter performance

✅ 12 untouched benchmarks

_{Comparing teamviewer-timezone-parsing (c442096) with main (4ba8f14)}

twiggler · 2026-03-10T14:44:34Z

dissect/target/plugins/apps/remoteaccess/teamviewer.py

                    self.target.log.debug("", exc_info=e)
                    timestamp = 0

+                if timestamp:


Assuming we have the target timezone self.target.datetime.tzinfo,

what if we renormalize every timestamp, instead of detecting deltas:

naive_dt = datetime.strptime(f"{date} {time}", "%Y/%m/%d %H:%M:%S.%f") timestamp = naive_dt.replace(tzinfo=target_tz) if prev_timestamp and prev_timestamp > timestamp: timestamp = timestamp.replace(fold=1) prev_timestamp = timestamp

Would that not also help with "spring forward" events?

In other words, why not rely on the target_tz calendar rules?

I didn't know that the fold was used for this. I did notice when working on it that the fold doesn't get passed to flow.record. I made this PR for it fox-it/flow.record#217

Miauwkeru · 2026-03-11T14:28:02Z

I decided to ignore the gap that happens when daylight savings time occurs, as that timestamp should not get generated normally

Determine whether the timezone found by parsing `Start:` is the same timezone as that of the target. This automatically adjust the timestamp when dst time ends or starts. There is a grey area where it cannot determine whether a timestamp is in dst time or not, so when it is observed that the previous timestamp was less than the current one, it adjust the timezone for those entries (UTC+XXXX)

And add tests for it

…ing tests

dissect/target/plugins/apps/remoteaccess/teamviewer.py

Horofic · 2026-03-17T08:10:17Z

dissect/target/plugins/apps/remoteaccess/teamviewer.py

                except Exception as e:
                    self.target.log.warning("Unable to parse timestamp %r in file %s", line, logfile)
                    self.target.log.debug("", exc_info=e)
                    timestamp = 0


Wouldn't this cause a timestamp of 0 to be yielded? Not sure if that behaviour is expected.

Suggested change

except Exception as e:

self.target.log.warning("Unable to parse timestamp %r in file %s", line, logfile)

self.target.log.debug("", exc_info=e)

timestamp = 0

except Exception as e:

self.target.log.warning("Unable to parse timestamp %r in file %s", line, logfile)

self.target.log.debug("", exc_info=e)

continue

I was also confused about that, as it would return 1 January 1970, but didn't touch it as it is how it worked before.
This does mean we won't be able to get a record if we couldn't parse the timestamp. Tho, it is still available in the logging.

With this patch, other logic can also be updated

I think having a log line without a timestamp is preferred over ignoring the log line altogether, as it could hold forensic value.

The only times I have seen this code path occurring is specifically with the following entries after Start: which occurs when the teamviewer service gets started:

Start: 2026/03/05 13:33:56.539 (UTC+5:30) Version: 15.74.6 (64-bit) Version short hash: e34788d05e8 ID: 0 Loglevel: Critical License: 0 IC: -2056635597 CPU: Intel64 Family 6 Model 141 Stepping 1, GenuineIntel CPU extensions: k0 OS: Win_10.0.26100_W (64-bit) IP: 127.0.0.1 MID: 0x525400fad56f_1da8405dc678cec_983722041 MIDv: 0 Proxy-Settings: Type=1 IP= User= IE: 11.1.26100.0 AppPath: C:\Program Files\TeamViewer\TeamViewer_Service.exe UserAccount: SYSTEM Server-Environment: Global

All following entries have a timestamp until another Start: gets is found.
It could be a good compromise to use timestamp=start_time here instead, as those entries belong to start_time

In the worst case, the entries won't have any timestamp then

Or we could store the last timestamp we encountered and use that one instead.

as we already store the previous timestamp for overlap detection that should be fine

@JSCU-CNI I changed it to use the previous timestamp. Note that this path is only reached when the timestamp contains a number that is invalid for a timestamp. For example:

2025/10/26 02:50:90.300

If the time regex itself doesn't match, for example if the timestamp contained a letter instead of a number, it already gets ignored

dissect/target/plugins/apps/remoteaccess/teamviewer.py

tests/plugins/apps/remoteaccess/test_teamviewer.py

Co-authored-by: Stefan de Reuver <9864602+Horofic@users.noreply.github.com>

changes have been implemented

…ion occurred during parsing The only case it gets in this exception is when `Start:` gets parsed and the next lines contain some system information. Technically those records have the same time as the start_date In the worst case scenario the `start_date` would be None if there is an error or the line couldn't get parsed.

Need to be invalid times that exceed normal datetime behaviour, because if they are not numbers they are already ignored due to the regex not matching

Horofic

Can you remove the len() calls in the check_compatible function? Other that ack.

Miauwkeru requested a review from twiggler March 9, 2026 14:32

twiggler previously requested changes Mar 10, 2026

View reviewed changes

Miauwkeru mentioned this pull request Mar 11, 2026

Add fold to the datetime fieldtype to resolve datetime ambiguity fox-it/flow.record#217

Merged

Miauwkeru added 6 commits March 12, 2026 09:06

Rewrite parse_start to account for only (UTC) inside the string

a7cdb7d

And add tests for it

Fix linting

334d7fa

Replace fold instead of changing the timezone with a delta

1d7e4c5

Persist fold between Start:

3562f9f

Depend on new flow.record version

2d708e1

Miauwkeru force-pushed the teamviewer-timezone-parsing branch from 59c3895 to 2d708e1 Compare March 12, 2026 09:07

Change grouped record definitions to use __name__ and __records__ dur…

5e46152

…ing tests

Miauwkeru requested a review from twiggler March 12, 2026 09:41

Horofic requested changes Mar 17, 2026

View reviewed changes

Apply suggestions from code review

f92238d

Co-authored-by: Stefan de Reuver <9864602+Horofic@users.noreply.github.com>

Miauwkeru force-pushed the teamviewer-timezone-parsing branch from 867cb2c to 451c426 Compare March 17, 2026 10:02

Miauwkeru requested a review from Horofic March 17, 2026 10:04

Horofic previously approved these changes Mar 17, 2026

View reviewed changes

Miauwkeru requested a review from JSCU-CNI March 17, 2026 13:14

Miauwkeru dismissed Horofic’s stale review via 3c2e678 March 17, 2026 14:13

Miauwkeru force-pushed the teamviewer-timezone-parsing branch from 53b5f78 to 3c2e678 Compare March 17, 2026 14:13

Miauwkeru added 2 commits March 18, 2026 09:49

Add a test when parsing invalid datetimes

8734848

Need to be invalid times that exceed normal datetime behaviour, because if they are not numbers they are already ignored due to the regex not matching

Merge branch 'main' into teamviewer-timezone-parsing

475f91d

Miauwkeru requested a review from Horofic March 19, 2026 09:45

Horofic requested changes Mar 19, 2026

View reviewed changes

Remove redundant len checks in check_compatible

5a29da7

Merge branch 'main' into teamviewer-timezone-parsing

c442096

Miauwkeru requested a review from Horofic March 19, 2026 12:36

Horofic approved these changes Mar 19, 2026

View reviewed changes

Miauwkeru merged commit 945ad90 into main Mar 19, 2026
37 of 45 checks passed

Miauwkeru deleted the teamviewer-timezone-parsing branch March 19, 2026 13:34

Conversation

Miauwkeru commented Mar 9, 2026

Uh oh!

codecov bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

twiggler Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Miauwkeru Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Miauwkeru commented Mar 11, 2026

Uh oh!

Uh oh!

Horofic Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Miauwkeru Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

JSCU-CNI Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Miauwkeru Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JSCU-CNI Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Miauwkeru Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Miauwkeru Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Horofic left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Mar 9, 2026 •

edited

Loading

codspeed-hq bot commented Mar 9, 2026 •

edited

Loading

twiggler Mar 10, 2026 •

edited

Loading

Miauwkeru Mar 17, 2026 •

edited

Loading

Horofic left a comment •

edited

Loading