Activitiescache plugin bug "invalid literal for int() with base 10"

[narimantos]

Hello guys!

While testing one of our windows 11 images, I ran into a bug?

Command we used:

target-query -f activitiescache ./Windows11.vmdk -Kv XXXX-XXX-XXX-XXX

Traceback (most recent call last):
  File "/home/naretem01/dev/ans/flab/.venv/bin/target-query", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/tools/utils.py", line 394, in wrapper
    return func(\*args, \*\*kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/tools/query.py", line 246, in main
    for record in record_generator:
  File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/plugins/os/windows/activitiescache.py", line 128, in activitiescache
    yield ActivitiesCacheRecord(
          ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/helpers/record.py", line 82, in __call__
    return super().__call__(\*args, \*\*kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/nari/dev/.venv/lib/python3.12/site-packages/flow/record/base.py", line 588, in __call__
    return self.recordType(\*args, \*\*kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<string>", line 63, in __init__
  File "/home/nari/dev/.venv/lib/python3.12/site-packages/flow/record/base.py", line 193, in __setattr__
    v = field_type(v)
        ^^^^^^^^^^^^^
ValueError: invalid literal for int() with base 10: 'default$windows.data.consent.consentitem$consents'

If you need the windows11 vmdk to reproduce the issue, let me know!

[EinatFox]

Hi @narimantos ! The windows11 vmdk would help indeed, thanks.

[EinatFox]

BTW the activitiescache.db is enough, and just the details of the windows 11 build/version @narimantos

[narimantos]

Thanks for the response @EinatFox . i hope i can send it next week. Will let you know asap ❤️

EDIT (30 okt): I hope I can get you the activitiescache.db next week (3nov).

[narimantos]

Mail is headed your way with the activitiescache.db

Alvast bedankt ❤️