dissect.target 3.19.dev27__tar.gz → 3.19.dev29__tar.gz

{dissect_target-3.19.dev27/dissect.target.egg-info → dissect_target-3.19.dev29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev27
+Version: 3.19.dev29
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29}/dissect/target/plugins/apps/browser/firefox.py

@@ -3,6 +3,7 @@ import json
 import logging
 from base64 import b64decode
 from hashlib import pbkdf2_hmac, sha1
+from itertools import chain
 from typing import Iterator, Optional
 
 from dissect.sql import sqlite3
@@ -14,7 +15,7 @@ from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.record import create_extended_descriptor
-from dissect.target.plugin import export
+from dissect.target.plugin import OperatingSystem, export
 from dissect.target.plugins.apps.browser.browser import (
     GENERIC_COOKIE_FIELDS,
     GENERIC_DOWNLOAD_RECORD_FIELDS,
@@ -24,7 +25,7 @@ from dissect.target.plugins.apps.browser.browser import (
     BrowserPlugin,
     try_idna,
 )
-from dissect.target.plugins.general.users import UserDetails
+from dissect.target.plugins.general.users import UserRecord
 
 try:
     from asn1crypto import algos, core
@@ -44,7 +45,10 @@ try:
 except ImportError:
     HAS_CRYPTO = False
 
-FIREFOX_EXTENSION_RECORD_FIELDS = [("uri", "source_uri"), ("string[]", "optional_permissions")]
+FIREFOX_EXTENSION_RECORD_FIELDS = [
+    ("uri", "source_uri"),
+    ("string[]", "optional_permissions"),
+]
 
 log = logging.getLogger(__name__)
 
@@ -54,7 +58,7 @@ class FirefoxPlugin(BrowserPlugin):
 
     __namespace__ = "firefox"
 
-    DIRS = [
+    USER_DIRS = [
         # Windows
         "AppData/Roaming/Mozilla/Firefox/Profiles",
         "AppData/local/Mozilla/Firefox/Profiles",
@@ -66,6 +70,10 @@ class FirefoxPlugin(BrowserPlugin):
         "Library/Application Support/Firefox",
     ]
 
+    SYSTEM_DIRS = [
+        "/data/data/org.mozilla.vrbrowser/files/mozilla",
+    ]
+
     BrowserHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
         "browser/firefox/history", GENERIC_HISTORY_RECORD_FIELDS
     )
@@ -79,7 +87,8 @@ class FirefoxPlugin(BrowserPlugin):
     )
 
     BrowserExtensionRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-        "browser/firefox/extension", GENERIC_EXTENSION_RECORD_FIELDS + FIREFOX_EXTENSION_RECORD_FIELDS
+        "browser/firefox/extension",
+        GENERIC_EXTENSION_RECORD_FIELDS + FIREFOX_EXTENSION_RECORD_FIELDS,
     )
 
     BrowserPasswordRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
@@ -88,27 +97,32 @@ class FirefoxPlugin(BrowserPlugin):
 
     def __init__(self, target):
         super().__init__(target)
-        self.users_dirs: list[tuple[UserDetails, TargetPath]] = []
+        self.dirs: list[tuple[UserRecord, TargetPath]] = []
+
         for user_details in self.target.user_details.all_with_home():
-            for directory in self.DIRS:
+            for directory in self.USER_DIRS:
                 cur_dir = user_details.home_path.joinpath(directory)
                 if not cur_dir.exists():
                     continue
-                self.users_dirs.append((user_details, cur_dir))
+                self.dirs.append((user_details.user, cur_dir))
+
+        for directory in self.SYSTEM_DIRS:
+            if (cur_dir := target.fs.path(directory)).exists():
+                self.dirs.append((None, cur_dir))
 
     def check_compatible(self) -> None:
-        if not len(self.users_dirs):
+        if not len(self.dirs):
             raise UnsupportedPluginError("No Firefox directories found")
 
-    def _iter_profiles(self) -> Iterator[tuple[UserDetails, TargetPath, TargetPath]]:
+    def _iter_profiles(self) -> Iterator[tuple[UserRecord, TargetPath, TargetPath]]:
         """Yield user directories."""
-        for user, cur_dir in self.users_dirs:
+        for user, cur_dir in self.dirs:
             for profile_dir in cur_dir.iterdir():
                 if not profile_dir.is_dir():
                     continue
                 yield user, cur_dir, profile_dir
 
-    def _iter_db(self, filename: str) -> Iterator[tuple[UserDetails, SQLite3]]:
+    def _iter_db(self, filename: str) -> Iterator[tuple[UserRecord, SQLite3]]:
         """Yield opened history database files of all users.
 
         Args:
@@ -117,12 +131,24 @@ class FirefoxPlugin(BrowserPlugin):
         Yields:
             Opened SQLite3 databases.
         """
-        for user, cur_dir, profile_dir in self._iter_profiles():
-            db_file = profile_dir.joinpath(filename)
+        iter_system = ((None, system_dir, None) for user, system_dir in self.dirs if user is None)
+
+        for user, cur_dir, profile_dir in chain(iter_system, self._iter_profiles()):
+            if user is None and profile_dir is None:
+                db_file = cur_dir.parent.joinpath(filename)
+                # On some Android variants, some files may exist in the base directory (places.sqlite) but others
+                # in a nested profile directory (cookies.sqlite)
+                # /data/data/org.mozilla.vrbrowser/files/places.sqlite
+                # /data/data/org.mozilla.vrbrowser/files/mozilla/xxxxxx.default/cookies.sqlite
+                if not db_file.exists():
+                    continue
+            else:
+                db_file = profile_dir.joinpath(filename)
+
             try:
                 yield user, db_file, sqlite3.SQLite3(db_file.open())
             except FileNotFoundError:
-                self.target.log.warning("Could not find %s file: %s", filename, db_file)
+                self.target.log.info("Could not find %s file: %s", filename, db_file)
             except SQLError as e:
                 self.target.log.warning("Could not open %s file: %s", filename, db_file)
                 self.target.log.debug("", exc_info=e)
@@ -151,6 +177,11 @@ class FirefoxPlugin(BrowserPlugin):
             from_url (uri): URL of the "from" visit.
             source: (path): The source file of the history record.
         """
+        if self.target.os == OperatingSystem.ANDROID:
+            from_timestamp = from_unix_ms
+        else:
+            from_timestamp = from_unix_us
+
         for user, db_file, db in self._iter_db("places.sqlite"):
             try:
                 places = {row.id: row for row in db.table("moz_places").rows()}
@@ -167,7 +198,7 @@ class FirefoxPlugin(BrowserPlugin):
                         from_visit, from_place = None, None
 
                     yield self.BrowserHistoryRecord(
-                        ts=from_unix_us(row.visit_date),
+                        ts=from_timestamp(row.visit_date),
                         browser="firefox",
                         id=row.id,
                         url=try_idna(place.url),
@@ -183,7 +214,7 @@ class FirefoxPlugin(BrowserPlugin):
                         from_url=try_idna(from_place.url) if from_place else None,
                         source=db_file,
                         _target=self.target,
-                        _user=user.user,
+                        _user=user,
                     )
             except SQLError as e:
                 self.target.log.warning("Error processing history file: %s", db_file, exc_info=e)
@@ -229,7 +260,7 @@ class FirefoxPlugin(BrowserPlugin):
                         same_site=bool(cookie.sameSite),
                         source=db_file,
                         _target=self.target,
-                        _user=user.user,
+                        _user=user,
                     )
             except SQLError as e:
                 self.target.log.warning("Error processing cookie file: %s", db_file, exc_info=e)
@@ -255,7 +286,10 @@ class FirefoxPlugin(BrowserPlugin):
         for user, db_file, db in self._iter_db("places.sqlite"):
             try:
                 places = {row.id: row for row in db.table("moz_places").rows()}
-                attributes = {row.id: row.name for row in db.table("moz_anno_attributes").rows()}
+                if not (moz_anno_attributes := db.table("moz_anno_attributes")):
+                    continue
+
+                attributes = {row.id: row.name for row in moz_anno_attributes.rows()}
                 annotations = {}
 
                 for row in db.table("moz_annos"):
@@ -316,7 +350,7 @@ class FirefoxPlugin(BrowserPlugin):
                         state=state,
                         source=db_file,
                         _target=self.target,
-                        _user=user.user,
+                        _user=user,
                     )
             except SQLError as e:
                 self.target.log.warning("Error processing history file: %s", db_file, exc_info=e)
@@ -351,7 +385,9 @@ class FirefoxPlugin(BrowserPlugin):
 
             if not extension_file.exists():
                 self.target.log.warning(
-                    "No 'extensions.json' addon file found for user %s in directory %s", user.user.name, profile_dir
+                    "No 'extensions.json' addon file found for user %s in directory %s",
+                    user.name,
+                    profile_dir,
                 )
                 continue
 
@@ -360,8 +396,8 @@ class FirefoxPlugin(BrowserPlugin):
 
                 for extension in extensions.get("addons", []):
                     yield self.BrowserExtensionRecord(
-                        ts_install=extension.get("installDate", 0) // 1000,
-                        ts_update=extension.get("updateDate", 0) // 1000,
+                        ts_install=from_unix_ms(extension.get("installDate", 0)),
+                        ts_update=from_unix_ms(extension.get("updateDate", 0)),
                         browser="firefox",
                         id=extension.get("id"),
                         name=(extension.get("defaultLocale", {}) or {}).get("name"),
@@ -377,12 +413,14 @@ class FirefoxPlugin(BrowserPlugin):
                         optional_permissions=(extension.get("optionalPermissions", {}) or {}).get("permissions"),
                         source=extension_file,
                         _target=self.target,
-                        _user=user.user,
+                        _user=user,
                     )
 
             except FileNotFoundError:
                 self.target.log.info(
-                    "No 'extensions.json' addon file found for user %s in directory %s", user.user.name, profile_dir
+                    "No 'extensions.json' addon file found for user %s in directory %s",
+                    user.name,
+                    profile_dir,
                 )
             except json.JSONDecodeError:
                 self.target.log.warning(
@@ -410,7 +448,9 @@ class FirefoxPlugin(BrowserPlugin):
 
             if not login_file.exists():
                 self.target.log.warning(
-                    "No 'logins.json' password file found for user %s in directory %s", user, profile_dir
+                    "No 'logins.json' password file found for user %s in directory %s",
+                    user.name,
+                    profile_dir,
                 )
                 continue
 
@@ -445,9 +485,9 @@ class FirefoxPlugin(BrowserPlugin):
                             break
 
                     yield self.BrowserPasswordRecord(
-                        ts_created=login.get("timeCreated", 0) // 1000,
-                        ts_last_used=login.get("timeLastUsed", 0) // 1000,
-                        ts_last_changed=login.get("timePasswordChanged", 0) // 1000,
+                        ts_created=from_unix_ms(login.get("timeCreated", 0)),
+                        ts_last_used=from_unix_ms(login.get("timeLastUsed", 0)),
+                        ts_last_changed=from_unix_ms(login.get("timePasswordChanged", 0)),
                         browser="firefox",
                         id=login.get("id"),
                         url=login.get("hostname"),
@@ -457,14 +497,19 @@ class FirefoxPlugin(BrowserPlugin):
                         decrypted_password=decrypted_password,
                         source=login_file,
                         _target=self.target,
-                        _user=user.user,
+                        _user=user,
                     )
 
             except FileNotFoundError:
-                self.target.log.info("No password file found for user %s in directory %s", user, profile_dir)
+                self.target.log.info(
+                    "No password file found for user %s in directory %s",
+                    user.name,
+                    profile_dir,
+                )
             except json.JSONDecodeError:
                 self.target.log.warning(
-                    "logins.json file in directory %s is malformed, consider inspecting the file manually", profile_dir
+                    "logins.json file in directory %s is malformed, consider inspecting the file manually",
+                    profile_dir,
                 )
 
 

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29}/dissect/target/plugins/filesystem/yara.py

@@ -76,17 +76,15 @@ class YaraPlugin(Plugin):
         if hasattr(compiled_rules, "warnings") and (num_warns := len(compiled_rules.warnings)) > 0:
             self.target.log.warning("YARA generated %s warnings while compiling rules", num_warns)
             for warning in compiled_rules.warnings:
-                self.target.log.debug(warning)
+                self.target.log.info(warning)
 
         self.target.log.warning("Will not scan files larger than %s MB", max_size // 1024 // 1024)
 
         for _, _, files in self.target.fs.walk_ext(path):
             for file in files:
                 try:
-                    if file_size := file.stat().st_size > max_size:
-                        self.target.log.debug(
-                            "Skipping file '%s' as it is larger than %s bytes (size is %s)", file, file_size, max_size
-                        )
+                    if (file_size := file.stat().st_size) > max_size:
+                        self.target.log.info("Not scanning file of %s MB: '%s'", (file_size // 1024 // 1024), file)
                         continue
 
                     buf = file.open().read()

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29}/dissect/target/plugins/general/users.py

@@ -1,5 +1,7 @@
+from __future__ import annotations
+
 from functools import lru_cache
-from typing import Generator, NamedTuple, Optional, Union
+from typing import Iterator, NamedTuple, Union
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
@@ -7,10 +9,12 @@ from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.record import UnixUserRecord, WindowsUserRecord
 from dissect.target.plugin import InternalPlugin
 
+UserRecord = Union[UnixUserRecord, WindowsUserRecord]
+
 
 class UserDetails(NamedTuple):
-    user: Union[UnixUserRecord, WindowsUserRecord]
-    home_path: Optional[TargetPath]
+    user: UserRecord
+    home_path: TargetPath | None
 
 
 class UsersPlugin(InternalPlugin):
@@ -28,11 +32,11 @@ class UsersPlugin(InternalPlugin):
 
     def find(
         self,
-        sid: Optional[str] = None,
-        uid: Optional[str] = None,
-        username: Optional[str] = None,
+        sid: str | None = None,
+        uid: str | None = None,
+        username: str | None = None,
         force_case_sensitive: bool = False,
-    ) -> Optional[UserDetails]:
+    ) -> UserDetails | None:
         """Find User record matching provided sid, uid or username and return UserDetails object"""
         if all(map(lambda x: x is None, [sid, uid, username])):
             raise ValueError("Either sid or uid or username is expected")
@@ -52,7 +56,7 @@ class UsersPlugin(InternalPlugin):
             ):
                 return self.get(user)
 
-    def get(self, user: Union[UnixUserRecord, WindowsUserRecord]) -> UserDetails:
+    def get(self, user: UserRecord) -> UserDetails:
         """Return additional details about the user"""
         # Resolving the user home can not use the user's environment variables,
         # as those depend on the user's home to be known first. So we resolve
@@ -60,12 +64,12 @@ class UsersPlugin(InternalPlugin):
         home_path = self.target.fs.path(self.target.resolve(str(user.home))) if user.home else None
         return UserDetails(user=user, home_path=home_path)
 
-    def all(self) -> Generator[UserDetails, None, None]:
+    def all(self) -> Iterator[UserDetails]:
         """Return UserDetails objects for all users found"""
         for user in self.target.users():
             yield self.get(user)
 
-    def all_with_home(self) -> Generator[UserDetails, None, None]:
+    def all_with_home(self) -> Iterator[UserDetails]:
         """Return UserDetails objects for users that have existing directory set as home directory"""
         for user in self.target.users():
             if user.home:

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29}/dissect/target/target.py

@@ -344,7 +344,7 @@ class Target:
                 child_plugin.check_compatible()
                 self._child_plugins[child_plugin.__type__] = child_plugin
             except PluginError as e:
-                self.log.info("Child plugin reported itself as incompatible: %s (%s)", plugin_desc["class"], e)
+                self.log.debug("Child plugin reported itself as incompatible: %s (%s)", plugin_desc["class"], e)
             except Exception:
                 self.log.exception(
                     "An exception occurred while checking for child plugin compatibility: %s", plugin_desc["class"]

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29}/dissect/target/tools/yara.py

@@ -27,6 +27,7 @@ def main():
 
     parser.add_argument("targets", metavar="TARGETS", nargs="*", help="Targets to load")
     parser.add_argument("-s", "--strings", default=False, action="store_true", help="print output as string")
+    parser.add_argument("--children", action="store_true", help="include children")
 
     for args, kwargs in getattr(YaraPlugin.yara, "__args__", []):
         parser.add_argument(*args, **kwargs)
@@ -45,8 +46,7 @@ def main():
         parser.exit(1)
 
     try:
-        for target in Target.open_all(args.targets):
-            target.log.info("Scanning target")
+        for target in Target.open_all(args.targets, args.children):
             rs = record_output(args.strings, False)
             for record in target.yara(args.rules, args.path, args.max_size, args.check):
                 rs.write(record)

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev27
+Version: 3.19.dev29
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev27 → dissect_target-3.19.dev29}/tests/plugins/apps/browser/test_firefox.py

@@ -2,7 +2,6 @@ from typing import Iterator
 from unittest.mock import patch
 
 import pytest
-from _pytest.fixtures import fixture
 from asn1crypto.algos import EncryptionAlgorithmId
 from flow.record.fieldtypes import datetime as dt
 
@@ -47,6 +46,18 @@ def target_firefox_unix(target_unix_users: Target, fs_unix: VirtualFilesystem) -
     yield target_unix_users
 
 
+@pytest.fixture
+def target_firefox_oculus(target_android: Target, fs_android: VirtualFilesystem) -> Iterator[Target]:
+    fs_android.map_dir(
+        "/data/data/org.mozilla.vrbrowser",
+        absolute_path("_data/plugins/apps/browser/firefox/android/org.mozilla.vrbrowser"),
+    )
+
+    target_android.add_plugin(FirefoxPlugin)
+
+    yield target_android
+
+
 @pytest.mark.parametrize(
     "target_platform",
     ["target_firefox_win", "target_firefox_unix"],
@@ -99,6 +110,7 @@ def test_firefox_cookies(target_platform: Target, request: pytest.FixtureRequest
     assert len(records) == 4
     assert set(["firefox"]) == set(record.browser for record in records)
 
+    assert records[0].ts_created == dt("2023-07-13 09:53:47.460676+00:00")
     assert sorted([*map(lambda c: c.name, records)]) == [
         "_lr_env_src_ats",
         "_lr_retry_request",
@@ -119,8 +131,8 @@ def test_firefox_extensions(target_platform: Target, request: pytest.FixtureRequ
     assert set(["firefox"]) == set(record.browser for record in records)
     assert len(records) == 2
     assert records[0].id == "uBlock0@raymondhill.net"
-    assert records[0].ts_install == dt("2024-04-23 07:07:21+00:00")
-    assert records[0].ts_update == dt("2024-04-23 07:07:21+00:00")
+    assert records[0].ts_install == dt("2024-04-23 07:07:21.516000+00:00")
+    assert records[0].ts_update == dt("2024-04-23 07:07:21.516000+00:00")
     assert (
         records[0].ext_path == "C:\\Users\\Win11\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
         "\\9nxit8q0.default-release\\extensions\\uBlock0@raymondhill.net.xpi"
@@ -144,7 +156,7 @@ def test_firefox_extensions(target_platform: Target, request: pytest.FixtureRequ
     "target_platform",
     ["target_firefox_win", "target_firefox_unix"],
 )
-def test_firefox_password_plugin(target_platform: Target, request: pytest.FixtureRequest) -> None:
+def test_firefox_passwords(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
 
     records = list(target_platform.firefox.passwords())
@@ -156,9 +168,7 @@ def test_firefox_password_plugin(target_platform: Target, request: pytest.Fixtur
         assert record.decrypted_password == "password"
 
 
-def test_unix_firefox_password_plugin_with_primary_password(
-    target_unix_users: Target, fs_unix: VirtualFilesystem
-) -> None:
+def test_unix_firefox_passwords_with_primary_password(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
     fs_unix.map_dir(
         "/root/.mozilla/firefox/g1rbw8y7.default-release/",
         absolute_path("_data/plugins/apps/browser/firefox/passwords/primary/"),
@@ -185,8 +195,76 @@ def test_unix_firefox_password_plugin_with_primary_password(
         assert record.decrypted_password == "password"
 
 
-@fixture
-def path_key4(fs_unix):
+def test_firefox_oculus_history(target_firefox_oculus: Target) -> None:
+    records = list(target_firefox_oculus.firefox.history())
+
+    assert len(records) == 191
+    assert set(["firefox"]) == set(record.browser for record in records)
+
+    assert records[0].url == "https://webxr.today/"
+    assert records[0].id == "1"
+    assert records[0].description == "47356570952011"
+    assert records[0].ts == dt("2021-11-04 13:29:30.780000+00:00")
+
+
+def test_firefox_oculus_cookies(target_firefox_oculus: Target) -> None:
+    records = list(target_firefox_oculus.firefox.cookies())
+
+    assert len(records) == 33
+    assert set(["firefox"]) == set(record.browser for record in records)
+
+    assert records[0].ts_created == dt("2023-07-06 07:50:55.352988+00:00")
+    assert sorted([*map(lambda c: c.name, records)]) == [
+        "AEC",
+        "AWSALBTGCORS",
+        "CONSENT",
+        "Features",
+        "Locale",
+        "NID",
+        "OptanonConsent",
+        "SNID",
+        "SOCS",
+        "Session-Id",
+        "Tag",
+        "Tag",
+        "Tag",
+        "Tag",
+        "VISITOR_INFO1_LIVE",
+        "_ga",
+        "_ga_18EC69JQ0P",
+        "_ga_2VC139B3XV",
+        "_gat_gtag_UA_36116321_2",
+        "_gid",
+        "_hjFirstSeen",
+        "count",
+        "is-proton-user",
+        "lst",
+        "lst",
+        "mp_abe3945ad0ddaadc3d987393d8d7c2ce_mixpanel",
+        "session_id",
+        "spid.6b32",
+        "spses.6b32",
+        "visid_incap_1329355",
+        "visid_incap_2188750",
+        "visid_incap_2295456",
+        "visid_incap_2809573",
+    ]
+
+
+def test_firefox_oculus_extensions(target_firefox_oculus: Target) -> None:
+    records = list(target_firefox_oculus.firefox.extensions())
+
+    assert set(["firefox"]) == set(record.browser for record in records)
+    assert len(records) == 5
+    assert records[0].id == "default-theme@mozilla.org"
+    assert records[0].ts_install == dt("2021-11-04 13:29:29.988000+00:00")
+    assert records[0].ts_update == dt("1970-01-01 00:00:00+00:00")
+    assert records[0].ext_path is None
+    assert records[0].permissions == []
+
+
+@pytest.fixture
+def path_key4(fs_unix: VirtualFilesystem) -> TargetPath:
     fs_unix.map_file(
         "/key4.db",
         absolute_path("_data/plugins/apps/browser/firefox/key4.db"),
@@ -197,8 +275,8 @@ def path_key4(fs_unix):
 PRIMARY_PASSWORD = "PrimaryPassword"
 
 
-@fixture
-def path_key4_primary_password(fs_unix):
+@pytest.fixture
+def path_key4_primary_password(fs_unix: VirtualFilesystem) -> TargetPath:
     fs_unix.map_file(
         "/key4.db",
         absolute_path("_data/plugins/apps/browser/firefox/passwords/primary/key4.db"),
@@ -206,45 +284,45 @@ def path_key4_primary_password(fs_unix):
     return TargetPath(fs_unix, "/key4.db")
 
 
-@fixture
-def logins():
+@pytest.fixture
+def logins() -> dict[str, str]:
     return {
         "username": "MDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECIFVMX6MyYxpBBC2j8K+bCEaE9/FmqE1wo2A",
         "password": "MDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECB2ZPCZBORUJBBDZ8dBZUVgECoiFD5vPvTbP",
     }
 
 
-@fixture
-def logins_with_primary_password():
+@pytest.fixture
+def logins_with_primary_password() -> dict[str, str]:
     return {
         "username": "MDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECPEZvPh6dhBkBBB3/O2puJy1NiBUo5gS8hZh",
         "password": "MDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECM00msnMxFyVBBByTarrnS+FSR5OHQhZfs8t",
     }
 
 
-@fixture
-def decrypted():
+@pytest.fixture
+def decrypted() -> dict[str, str]:
     return {
         "username": "username",
         "password": "password",
     }
 
 
-def test_decrypt_is_succesful(path_key4, logins, decrypted):
+def test_decrypt_is_succesful(path_key4: TargetPath, logins: dict[str, str], decrypted: dict[str, str]) -> None:
     dec_username, dec_password = decrypt(logins.get("username"), logins.get("password"), path_key4)
     assert dec_username == decrypted.get("username")
     assert dec_password == decrypted.get("password")
 
 
 @patch("dissect.target.plugins.apps.browser.firefox.retrieve_master_key", side_effect=ValueError(""))
-def test_decrypt_bad_master_key(mock_target, path_key4, logins):
+def test_decrypt_bad_master_key(path_key4: TargetPath, logins: dict[str, str]) -> None:
     with pytest.raises(ValueError):
         decrypt(logins.get("username"), logins.get("password"), path_key4)
 
 
 def test_decrypt_with_primary_password_is_succesful(
-    path_key4_primary_password, logins_with_primary_password, decrypted
-):
+    path_key4_primary_password: TargetPath, logins_with_primary_password: dict[str, str], decrypted: dict[str, str]
+) -> None:
     dec_username, dec_password = decrypt(
         logins_with_primary_password.get("username"),
         logins_with_primary_password.get("password"),
@@ -256,9 +334,9 @@ def test_decrypt_with_primary_password_is_succesful(
 
 
 def test_decrypt_with_bad_primary_password_is_unsuccesful(
-    path_key4_primary_password,
-    logins_with_primary_password,
-):
+    path_key4_primary_password: TargetPath,
+    logins_with_primary_password: dict[str, str],
+) -> None:
     with pytest.raises(ValueError) as e:
         decrypt(
             logins_with_primary_password.get("username"),
@@ -269,7 +347,7 @@ def test_decrypt_with_bad_primary_password_is_unsuccesful(
         assert e.msg == "Failed to decrypt password using keyfile /key4.db and password 'BAD_PRIMARY_PASSWORD'"
 
 
-def test_retrieve_master_key_is_succesful(path_key4):
+def test_retrieve_master_key_is_succesful(path_key4: TargetPath) -> None:
     key, algorithm = retrieve_master_key(b"", path_key4)
 
     assert EncryptionAlgorithmId.map(algorithm) == "pbes2"
@@ -277,13 +355,13 @@ def test_retrieve_master_key_is_succesful(path_key4):
 
 
 @patch("dissect.target.plugins.apps.browser.firefox.query_master_key", return_value=(b"aaaa", "BAD_CKA_VALUE"))
-def test_retrieve_master_key_bad_cka_value(mock_target, path_key4):
+def test_retrieve_master_key_bad_cka_value(mock_target: Target, path_key4: TargetPath) -> None:
     with pytest.raises(ValueError) as e:
         retrieve_master_key(b"", path_key4)
         assert "Password master key CKA_ID 'BAD_CKA_VALUE' is not equal to expected value" in e.msg
 
 
-def test_query_master_key(path_key4):
+def test_query_master_key(path_key4: TargetPath) -> None:
     master_key, master_key_cka = query_master_key(path_key4)
 
     assert isinstance(master_key, bytes)