dissect.target 3.18.dev1__tar.gz → 3.18.dev3__tar.gz

{dissect_target-3.18.dev1/dissect.target.egg-info → dissect_target-3.18.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.18.dev1
+Version: 3.18.dev3
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/av/mcafee.py

@@ -71,6 +71,9 @@ class McAfeePlugin(Plugin):
         """Return msc log history records from McAfee.
 
         Yields McAfeeMscLogRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/av/sophos.py

@@ -56,6 +56,9 @@ class SophosPlugin(Plugin):
         """Return alert log records from Sophos Hitman Pro/Alert.
 
         Yields HitmanAlertRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp.
             alert (string): Type of Alert.
             description (string): Short description of the alert.
@@ -85,6 +88,9 @@ class SophosPlugin(Plugin):
         """Return log history records from Sophos Home.
 
         Yields SophosLogRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp.
             description (string): Short description of the alert.
             path (path): Path to the infected file (if available).

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/av/symantec.py

@@ -293,6 +293,9 @@ class SymantecPlugin(Plugin):
         """Return log records.
 
         Yields SEPLogRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp associated with the event.
             virus (string): Name of the virus.
             user (string): Name of the user associated with the event.
@@ -326,6 +329,9 @@ class SymantecPlugin(Plugin):
         """Return log firewall records.
 
         Yields SEPFirewallRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp associated with the event.
             protocol (string): Protocol name associated with the firewall record.
             local_ip ("net.ipaddress"): Local IP address associated with the event.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/av/trendmicro.py

@@ -71,6 +71,9 @@ class TrendMicroPlugin(Plugin):
         """Return Trend Micro Worry-free log history records.
 
         Yields TrendMicroWFLogRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): timestamp.
@@ -94,6 +97,9 @@ class TrendMicroPlugin(Plugin):
         """Return Trend Micro Worry-free firewall log history records.
 
         Yields TrendMicroWFFirewallRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/browser/chromium.py

@@ -148,6 +148,9 @@ class ChromiumMixin:
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts (datetime): Visit timestamp.
                 browser (string): The browser from which the records are generated from.
@@ -209,6 +212,9 @@ class ChromiumMixin:
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_created (datetime): Cookie created timestamp.
                 ts_last_accessed (datetime): Cookie last accessed timestamp.
@@ -284,6 +290,9 @@ class ChromiumMixin:
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_start (datetime): Download start timestamp.
                 ts_end (datetime): Download end timestamp.
@@ -344,6 +353,9 @@ class ChromiumMixin:
             browser_name (str): Name of the browser to scan for extensions.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_install (datetime): Extension install timestamp.
                 ts_update (datetime): Extension update timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/browser/firefox.py

@@ -132,6 +132,9 @@ class FirefoxPlugin(BrowserPlugin):
         """Return browser history records from Firefox.
 
         Yields BrowserHistoryRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Visit timestamp.
             browser (string): The browser from which the records are generated from.
             id (string): Record ID.
@@ -193,6 +196,9 @@ class FirefoxPlugin(BrowserPlugin):
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_created (datetime): Cookie created timestamp.
                 ts_last_accessed (datetime): Cookie last accessed timestamp.
@@ -232,6 +238,9 @@ class FirefoxPlugin(BrowserPlugin):
         """Return browser download records from Firefox.
 
         Yields BrowserDownloadRecord with the following fields:
+
+        .. code-block:: text
+
             ts_start (datetime): Download start timestamp.
             ts_end (datetime): Download end timestamp.
             browser (string): The browser from which the records are generated from.
@@ -315,7 +324,10 @@ class FirefoxPlugin(BrowserPlugin):
     def extensions(self) -> Iterator[BrowserExtensionRecord]:
         """Return browser extension records for Firefox.
 
-        Yields BrowserExtensionRecord with the following fields::
+        Yields BrowserExtensionRecord with the following fields:
+
+        .. code-block:: text
+
             ts_install (datetime): Extension install timestamp.
             ts_update (datetime): Extension update timestamp.
             browser (string): The browser from which the records are generated.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/apps/browser/iexplore.py

@@ -131,6 +131,9 @@ class InternetExplorerPlugin(BrowserPlugin):
         """Return browser history records from Internet Explorer.
 
         Yields BrowserHistoryRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Visit timestamp.
             browser (string): The browser from which the records are generated from.
             id (string): Record ID.
@@ -183,6 +186,9 @@ class InternetExplorerPlugin(BrowserPlugin):
         """Return browser downloads records from Internet Explorer.
 
         Yields BrowserDownloadRecord with the following fields:
+
+        .. code-block:: text
+
             ts_start (datetime): Download start timestamp.
             ts_end (datetime): Download end timestamp.
             browser (string): The browser from which the records are generated from.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/unix/linux/cmdline.py

@@ -29,6 +29,9 @@ class CmdlinePlugin(Plugin):
         Think of this output as the command line that the process wants you to see.
 
         Yields CmdlineRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The starttime of the process.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/unix/linux/environ.py

@@ -27,6 +27,9 @@ class EnvironPlugin(Plugin):
         the environ(7) variable directly), this plugin will not reflect those changes.
 
         Yields EnvironmentVariableRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The modification timestamp of the processes' environ file.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/unix/linux/processes.py

@@ -29,6 +29,9 @@ class ProcProcesses(Plugin):
         Each ``/proc/[pid]`` subdirectory contains various pseudo-files.
 
         Yields ProcProcessRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The start time of the process.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/unix/linux/sockets.py

@@ -78,6 +78,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the packet sockets and available stats associated with them.
 
         Yields PacketSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (int): The captured protocol i.e. 0003 is ETH_P_ALL
@@ -101,6 +104,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the unix sockets and available stats associated with them.
 
         Yields UnixSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
@@ -117,6 +123,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the raw and raw6 sockets and available stats associated with them.
 
         Yields NetSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
@@ -140,6 +149,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the udp and udp6 sockets and available stats associated with them.
 
         Yields NetSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
@@ -163,6 +175,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the tcp and tcp6 sockets and available stats associated with them.
 
         Yields NetSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/unix/locate/plocate.py

@@ -1,8 +1,7 @@
 from __future__ import annotations
 
 import platform
-from io import BytesIO
-from typing import BinaryIO, Iterable
+from typing import BinaryIO, Iterator
 
 from dissect.cstruct import cstruct
 from dissect.util.stream import RangeStream
@@ -13,7 +12,11 @@ from dissect.target.plugin import export
 from dissect.target.plugins.os.unix.locate.locate import BaseLocatePlugin
 
 try:
-    import zstandard  # noqa
+    from zstandard import (
+        DECOMPRESSION_RECOMMENDED_OUTPUT_SIZE,
+        ZstdCompressionDict,
+        ZstdDecompressor,
+    )
 
     HAS_ZSTD = True
 except ImportError:
@@ -32,7 +35,7 @@ struct header {
     uint64_t filename_index_offset_bytes;
 
     /* Version 1 and up only. */
-    uint32_t max_version;
+    uint32_t max_version;   // Nominally 1 or 2, but can be increased if more features are added in a backward-compatible way.
     uint32_t zstd_dictionary_length_bytes;
     uint64_t zstd_dictionary_offset_bytes;
 
@@ -44,6 +47,7 @@ struct header {
     uint64_t conf_block_length_bytes;
     uint64_t conf_block_offset_bytes;
 
+    // Only if max_version >= 2.
     uint8_t check_visibility;
     char padding[7];                         /* padding for alignment */
 };
@@ -51,7 +55,7 @@ struct header {
 struct file {
     char path[];
 };
-"""
+"""  # noqa : E501
 
 PLocateRecord = TargetRecordDescriptor(
     "linux/locate/plocate",
@@ -104,40 +108,46 @@ class PLocateFile:
         self.dict_data = None
 
         if self.header.zstd_dictionary_offset_bytes:
-            self.dict_data = zstandard.ZstdCompressionDict(self.fh.read(self.header.zstd_dictionary_length_bytes))
+            self.dict_data = ZstdCompressionDict(self.fh.read(self.header.zstd_dictionary_length_bytes))
 
         self.compressed_length_bytes = (
             self.header.filename_index_offset_bytes - self.HEADER_SIZE - self.header.zstd_dictionary_length_bytes
         )
-        self.ctx = zstandard.ZstdDecompressor(dict_data=self.dict_data)
+        self.ctx = ZstdDecompressor(dict_data=self.dict_data)
         self.buf = RangeStream(self.fh, self.fh.tell(), self.compressed_length_bytes)
 
-    def __iter__(self) -> Iterable[PLocateFile]:
+    def __iter__(self) -> Iterator[PLocateFile]:
         # NOTE: This is a workaround for a PyPy bug
         # We don't know what breaks, but PyPy + zstandard = unhappy times
         # You just get random garbage data back instead of the decompressed data
         # This weird dance of using a decompressobj and unused data is the only way that seems to work
         # It's more expensive on memory, but at least it doesn't break
         if platform.python_implementation() == "PyPy":
-            obj = self.ctx.decompressobj()
             buf = self.buf.read()
 
-            tmp = obj.decompress(buf)
-            while unused_data := obj.unused_data:
-                obj = self.ctx.decompressobj()
-                tmp += obj.decompress(unused_data)
+            def reader(ctx: ZstdDecompressor) -> Iterator[bytes]:
+                obj = ctx.decompressobj()
 
-            reader = BytesIO(tmp)
+                yield obj.decompress(buf)
+                while unused_data := obj.unused_data:
+                    obj = self.ctx.decompressobj()
+                    yield obj.decompress(unused_data)
+
+            it = reader(self.ctx)
         else:
-            reader = self.ctx.stream_reader(self.buf)
-
-        with reader:
-            try:
-                while True:
-                    file = c_plocate.file(reader)
-                    yield file.path.decode(errors="surrogateescape")
-            except EOFError:
-                return
+            # NOTE: The end of a zstandard frame does not include a final `0x00`.
+            # This causes the c_plocate `file` struct to parse the last path and the first path on the next frame as one
+            # since cstruct will read it across frame boundaries waiting for a `0x00`.
+            def reader() -> Iterator[bytes]:
+                with self.ctx.stream_reader(self.buf) as reader:
+                    while chunk := reader.read(DECOMPRESSION_RECOMMENDED_OUTPUT_SIZE):
+                        yield chunk
+
+            it = reader()
+
+        for chunk in it:
+            for path in chunk.split(b"\x00"):
+                yield path.decode(errors="surrogateescape")
 
     def filename_index(self) -> bytes:
         """Return the filename index of the plocate.db file."""

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/unix/log/atop.py

@@ -270,6 +270,9 @@ class AtopPlugin(Plugin):
             - https://diablohorn.com/2022/11/17/parsing-atop-files-with-python-dissect-cstruct/
 
         Yields AtopRecord with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             process (string): The process name.
             cmdline (string): The command-line of the process.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/activitiescache.py

@@ -77,6 +77,9 @@ class ActivitiesCachePlugin(Plugin):
             - https://salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/
 
         Yields ActivitiesCacheRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             start_time (datetime): StartTime field.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/catroot.py

@@ -105,6 +105,9 @@ class CatrootPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files
 
         Yields CatrootRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             digest (digest): The parsed digest.
@@ -210,6 +213,9 @@ class CatrootPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files
 
         Yields CatrootRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             digest (digest): The parsed digest.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/lnk.py

@@ -51,6 +51,9 @@ class LnkPlugin(Plugin):
         """Parse all .lnk files in /ProgramData, /Users, and /Windows or from a specified path in record format.
 
         Yields a LnkRecord record with the following fields:
+
+        .. code-block:: text
+
             lnk_path (path): Path of the link (.lnk) file.
             lnk_name (string): Name of the link (.lnk) file.
             lnk_mtime (datetime): Modification time of the link (.lnk) file.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/log/etl.py

@@ -122,6 +122,9 @@ class EtlPlugin(Plugin):
 
         Yields dynamically created records based on the fields inside an ETL event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.
@@ -140,6 +143,9 @@ class EtlPlugin(Plugin):
 
         Yields dynamically created records based on the fields inside an ETL event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.
@@ -157,6 +163,9 @@ class EtlPlugin(Plugin):
 
         Yields dynamically created records based on the fields inside an ETL event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/log/evt.py

@@ -125,6 +125,9 @@ class EvtPlugin(WindowsEventlogsMixin, plugin.Plugin):
 
         Yields dynamically created records based on the fields in the event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/log/evtx.py

@@ -47,6 +47,9 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
 
         Yields dynamically created records based on the fields in the event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/log/pfro.py

@@ -41,6 +41,9 @@ class PfroPlugin(Plugin):
             - https://community.ccleaner.com/topic/49106-pending-file-rename-operations-log/
 
         Yields PfroRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The parsed timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/log/schedlgu.py

@@ -129,9 +129,12 @@ class SchedLgUPlugin(Plugin):
 
         Adversaries may use malicious ``.job`` files to gain persistence on a system.
 
-        Yield:
+        Yields SchedLgURecord with fields:
+
+        .. code-block:: text
+
             ts (datetime): The timestamp of the event.
-            job (str): The name of the ``.job`` file.
+            job (str): The name of the .job file.
             command (str): The command executed.
             status (str): The status of the event (finished, completed, exited, stopped).
             exit_code (int): The exit code of the event.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/prefetch.py

@@ -258,6 +258,9 @@ class PrefetchPlugin(Plugin):
             - https://www.geeksforgeeks.org/prefetch-files-in-windows/
 
         Yields PrefetchRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): Run timestamp.
@@ -269,6 +272,9 @@ class PrefetchPlugin(Plugin):
         with --grouped:
 
         Yields PrefetchRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): Run timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/recyclebin.py

@@ -66,6 +66,9 @@ class RecyclebinPlugin(Plugin):
         Return files located in the recycle bin ($Recycle.Bin).
 
         Yields RecycleBinRecords with fields:
+
+        .. code-block:: text
+
           hostname (string): The target hostname
           domain (string): The target domain
           ts (datetime): The time of deletion

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/appxdebugkeys.py

@@ -86,6 +86,9 @@ class AppxDebugKeysPlugin(Plugin):
             - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
 
         Yields AppXDebugKeyRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/bam.py

@@ -41,6 +41,9 @@ class BamDamPlugin(Plugin):
         """Parse bam and dam registry keys.
 
         Yields BamDamRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The parsed timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/clsid.py

@@ -55,6 +55,9 @@ class CLSIDPlugin(Plugin):
         HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID.
 
         Yields CLSIDRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): Last modified timestamp of the registry key.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/firewall.py

@@ -26,6 +26,9 @@ class FirewallPlugin(Plugin):
         HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules registry key.
 
         Yields dynamic records with usually the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             key (string): The rule key name.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/muicache.py

@@ -48,6 +48,9 @@ class MuiCachePlugin(Plugin):
             - https://forensafe.com/blogs/muicache.html
 
         Yields MuiCacheRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             index (varint): The index of the entry.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/recentfilecache.py

@@ -45,6 +45,9 @@ class RecentFileCachePlugin(Plugin):
         """Parse RecentFileCache.bcf.
 
         Yields RecentFileCacheRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             path (uri): The parsed path.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/regf.py

@@ -49,6 +49,9 @@ class RegfPlugin(Plugin):
         Yields RegistryKeyRecords and RegistryValueRecords
 
         RegistryKeyRecord fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified time.
@@ -57,6 +60,9 @@ class RegfPlugin(Plugin):
             source (string): The hive file path.
 
         RegistryValueRecord fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified time.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/runkeys.py

@@ -61,6 +61,9 @@ class RunKeysPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
 
         Yields RunKeyRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified timestamp.

{dissect_target-3.18.dev1 → dissect_target-3.18.dev3}/dissect/target/plugins/os/windows/regf/shimcache.py

@@ -318,6 +318,9 @@ class ShimcachePlugin(Plugin):
             - https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/
 
         Yields ShimcacheRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             last_modified (datetime): The last modified date.