dissect.target 3.23.dev44__tar.gz → 3.23.dev45__tar.gz

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev44
+Version: 3.23.dev45
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/filesystems/overlay.py

@@ -123,7 +123,7 @@ class OverlayFilesystem(LayerFilesystem):
     Currently does not support mounting of (anonymous) volumes, named volumes and bind mounts.
     Also does not map mount point files, hosts, hostname and resolv.conf files.
 
-    Resources:
+    References:
         - https://github.com/containers/podman
         - https://docs.podman.io/en/latest/
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/helpers/configutil.py

@@ -503,7 +503,7 @@ class Env(ConfigurationParser):
     strings. Does not support dynamic env files, e.g. ``foo=`bar```. Also does not support multi-line key/value
     assignments (yet).
 
-    Resources:
+    References:
         - https://docs.docker.com/compose/environment-variables/variable-interpolation/#env-file-syntax
         - https://github.com/theskumar/python-dotenv/blob/main/src/dotenv/parser.py
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/helpers/localeutil.py

@@ -25,7 +25,7 @@ def normalize_language(input: str) -> str:
 
     Output will be in the format ``ISO-3166-1-alpha-2-code_ISO-3166-2``, e.g.: ``en_US``, ``nl_NL`` or ``en_GB``.
 
-    Resources:
+    References:
         - https://en.wikipedia.org/wiki/ISO_3166
         - https://en.wikipedia.org/wiki/ISO_3166-1
         - https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/helpers/mui.py

@@ -2,7 +2,7 @@
 
 This dictionary was exported from a ``tzres.dll.mui`` file from Windows Server 2019.
 
-Resources:
+References:
     - Reversing DLL String Table in ``C:/Windows/System32/en-US/tzres.dll.mui``.
     - https://learn.microsoft.com/en-us/windows/win32/intl/using-registry-string-redirection
     - https://learn.microsoft.com/en-us/windows/win32/api/winnls/ns-winnls-filemuiinfo

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/helpers/protobuf.py

@@ -10,7 +10,7 @@ class ProtobufVarint(BaseType):
 
     Supports protobuf's msb varint implementation.
 
-    Resources:
+    References:
         - https://protobuf.dev/programming-guides/encoding/
         - https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder.py
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/helpers/regex/ipaddress.py

@@ -49,7 +49,7 @@ def extract_ips(text: str) -> list[str]:
     ``8.8.8.8`` or ``10.10.10.10``. Most indexing services such as Elasticsearch also do not accept
     octal representations of IP addresses.
 
-    Resources:
+    References:
         - https://github.com/GCHQ/CyberChef/blob/main/src/core/operations/ExtractIPAddresses.mjs
         - https://gist.github.com/dfee/6ed3a4b05cfe7a6faf40a2102408d5d8
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/helpers/regutil.py

@@ -36,7 +36,7 @@ ValueType = Union[int, str, bytes, list[str], None]
 class RegistryValueType(IntEnumMissing):
     """Registry value types as defined in ``winnt.h``.
 
-    Resources:
+    References:
         - https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types
         - https://github.com/fox-it/dissect.regf/blob/main/dissect/regf/c_regf.py
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/loaders/vbk.py

@@ -22,7 +22,7 @@ RE_RAW_DISK = re.compile(r"(?:[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a
 class VbkLoader(Loader):
     """Load Veaam Backup (VBK) files.
 
-    Resources:
+    References:
         - https://helpcenter.veeam.com/docs/backup/hyperv/backup_files.html?ver=120
     """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/browser/chromium.py

@@ -52,7 +52,7 @@ CHROMIUM_DOWNLOAD_RECORD_FIELDS = [
     ("string", "mime_type"),
 ]
 
-# Resources:
+# References:
 # - Reversing ``PostProcessData`` in ``elevation_service.exe``
 # - https://chromium.googlesource.com/chromium/src/+/master/chrome/elevation_service/elevator.cc
 elevation_def = """
@@ -71,7 +71,7 @@ struct GoogleChromeCipher {
 """
 c_elevation = cstruct(endian="<").load(elevation_def)
 
-# Resources:
+# References:
 # - https://github.com/chromium/chromium/blob/main/components/download/public/common/download_item.h
 DOWNLOAD_STATES = {
     0: "in_progress",
@@ -501,7 +501,7 @@ class ChromiumMixin:
 
         You can supply a SHA1 hash or plaintext password using the keychain (``-Kv`` or ``-K``).
 
-        Resources:
+        References:
             - https://chromium.googlesource.com/chromium/src/+/master/docs/linux/password_storage.md
             - https://chromium.googlesource.com/chromium/src/+/master/components/os_crypt/sync/os_crypt_linux.cc#40
         """
@@ -569,7 +569,7 @@ class ChromiumMixin:
 
         Used by :meth:`ChromiumMixin.passwords` and :meth:`ChromiumMixin.cookies` for Windows targets.
 
-        Resources:
+        References:
             - https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html
             - https://github.com/chromium/chromium/tree/main/chrome/browser/os_crypt
             - https://github.com/chromium/chromium/tree/main/chrome/elevation_service
@@ -760,7 +760,7 @@ def decrypt_v10_linux(
     Returns:
         Decrypted password string.
 
-    Resources:
+    References:
         - https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/os_crypt/sync/os_crypt_linux.cc
     """
 
@@ -879,7 +879,7 @@ def decrypt_dpapi(target: Target, user: UserDetails, keys: ChromiumKeys, encrypt
 
     They can be decrypted directly by utilizing the DPAPI plugin.
 
-    Resources:
+    References:
         - https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/os_crypt/sync/os_crypt_win.cc
     """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/browser/firefox.py

@@ -444,7 +444,7 @@ class FirefoxPlugin(BrowserPlugin):
         ``PASSPHRASE`` passwords in the keychain with providers ``browser``, ``firefox``, ``user`` and no provider
         can be used to decrypt secrets for this plugin.
 
-        Resources:
+        References:
             - https://github.com/lclevy/firepwd
         """
         for user, _, profile_dir in self._iter_profiles():
@@ -801,7 +801,7 @@ def decrypt(
     Returns:
         A tuple of decoded username and password strings.
 
-    Resources:
+    References:
         - https://github.com/lclevy/firepwd
     """
     if not HAS_CRYPTO:

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/chat/msn.py

@@ -30,7 +30,7 @@ class MSNPlugin(ChatPlugin):
     Other versions might work but have not been tested. Does not support ``Messenger Plus! Live`` artifacts.
     Tested using Escargot (https://escargot.chat).
 
-    Resources:
+    References:
         - https://en.wikipedia.org/wiki/Microsoft_Messenger_service
         - https://en.wikipedia.org/wiki/MSN_Messenger
         - http://computerforensics.parsonage.co.uk/downloads/MSNandLiveMessengerArtefactsOfConversations.pdf

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/container/docker.py

@@ -43,7 +43,7 @@ DockerLogRecord = TargetRecordDescriptor(
     COMMON_LOG_FIELDS,
 )
 
-# Resources:
+# References:
 # - https://github.com/moby/moby/pull/37092
 # - https://github.com/cpuguy83/docker/blob/master/daemon/logger/local/doc.go
 # - https://github.com/moby/moby/blob/master/api/types/plugins/logdriver/entry.proto
@@ -230,7 +230,7 @@ class DockerPlugin(ContainerPlugin):
         Eventually ``local`` will likely replace ``json-file`` as the
         default log driver.
 
-        Resources:
+        References:
             - https://docs.docker.com/config/containers/logging/configure/
             - https://docs.docker.com/config/containers/logging/json-file/
             - https://docs.docker.com/config/containers/logging/local/
@@ -422,7 +422,7 @@ def strip_log(input: str | bytes, exc_backspace: bool = False) -> str:
 
     Also translates ASCII codes such as backspaces to readable format.
 
-    Resources:
+    References:
         - https://gist.github.com/fnky/458719343aabd01cfb17a3a4f7296797#general-ascii-codes
     """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/container/podman.py

@@ -45,7 +45,7 @@ PodmanLogRecord = TargetRecordDescriptor(
 class ContainerState(Enum):
     """Enum of possible Container states.
 
-    Resources:
+    References:
         - https://github.com/containers/podman/blob/v4.9/libpod/define/containerstate.go
     """
 
@@ -291,7 +291,7 @@ class PodmanPlugin(ContainerPlugin):
 
         Currently does not parse custom configuration in ``containers.conf`` for ``log_opt path`` values.
 
-        Resources:
+        References:
             - https://docs.podman.io/en/latest/markdown/podman-create.1.html#log-driver-driver
         """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/editor/windowsnotepad.py

@@ -304,7 +304,7 @@ class WindowsNotepadPlugin(EditorPlugin):
         Windows Notepad application for Windows 11 is now able to restore both saved and unsaved tabs when you re-open
         the application.
 
-        Resources:
+        References:
             - https://github.com/fox-it/dissect.target/pull/540
             - https://github.com/JustArion/Notepad-Tabs
             - https://github.com/ogmini/Notepad-Tabstate-Buffer

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/remoteaccess/rustdesk.py

@@ -85,7 +85,7 @@ class RustdeskPlugin(RemoteAccessPlugin):
         The log files are stored in different locations, based on the Target OS and client type.
         Unlike Anydesk, Rustdesk does carry a time zone designator (TZD).
 
-        Refrences:
+        References:
             - https://rustdesk.com/docs/en/self-host/rustdesk-server-pro/faq
             - https://www.reddit.com/r/rustdesk/comments/1072zst/going_to_need_to_know_where_the_client_installer/
             - https://github.com/IRB0T/Remote-Access-Tools---4N6/blob/main/RustDesk/README.md

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/remoteaccess/splashtop.py

@@ -68,7 +68,7 @@ class SplashtopPlugin(RemoteAccessPlugin):
         Splashtop is a remote desktop application that can be used to get (persistent) access to a machine.
         It might be used in combination with Atera Management Agent.
 
-        Refrences:
+        References:
             - https://www.synacktiv.com/en/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects#atera-and-splashtop
         """
         target_tz = self.target.datetime.tzinfo
@@ -102,10 +102,9 @@ class SplashtopPlugin(RemoteAccessPlugin):
     def filetransfer(self) -> Iterator[RemoteAccessFileTransferRecord]:
         """Parse Splashtop filetransfers.
 
-        Splashtop is a remote desktop application and can be used by adversaries
-        to get (persistent) access to a machine.
-        File transfers as logged in the generic logfile (``SPLog.txt``)
-        show what files are downloaded to a system.
+        Splashtop is a remote desktop application and can be used by adversaries to get (persistent) access to a
+        machine. File transfers as logged in the generic logfile (``SPLog.txt``) show what files are downloaded
+        to a system.
         """
         methods = ("OnUploadRequest", "OnUploadFileCPRequest", "OnDownloadRequest")
         for log_record in self.logs():

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/remoteaccess/teamviewer.py

@@ -52,7 +52,7 @@ RE_START = re.compile(
 class TeamViewerPlugin(RemoteAccessPlugin):
     """TeamViewer client plugin.
 
-    Resources:
+    References:
         - https://teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/contact-support/find-your-log-files
         - https://www.systoolsgroup.com/forensics/teamviewer/
         - https://benleeyr.wordpress.com/2020/05/19/teamviewer-forensics-tested-on-v15/

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/shell/wget.py

@@ -53,7 +53,7 @@ class WgetPlugin(Plugin):
         directory by default. The ``.wget-hsts`` file records HTTP Strict Transport Security (HSTS) information for the
         websites visited by the user via ``wget``.
 
-        Resources:
+        References:
             - https://www.gnu.org/software/wget
             - https://gitlab.com/gnuwget/wget/-/blob/master/src/hsts.c
             - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/ssh/opensshd.py

@@ -108,7 +108,7 @@ class SSHServerPlugin(SSHPlugin):
 
         This parser does not (yet) follow Include directives.
 
-        Resources:
+        References:
             - https://github.com/openssh/openssh-portable
             - https://www.man7.org/linux/man-pages/man5/sshd_config.5.html
         """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/ssh/putty.py

@@ -60,7 +60,7 @@ class PuTTYPlugin(SSHPlugin):
         - Does not parse ``$HOME/.putty/randomseed`` (GNU/Linux)
           and ``HKCU\\Software\\SimonTatham\\PuTTY\\RandSeedFile`` (Windows)
 
-    Resources:
+    References:
         - http://www.chiark.greenend.org.uk/~sgtatham/putty/0.78/puttydoc.txt
         - http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-settings
     """
@@ -235,7 +235,7 @@ def construct_public_key(key_type: str, iv: str) -> tuple[str, tuple[str, str, s
 
     NOTE: More key types could be supported in the future.
 
-    Resources:
+    References:
         - https://github.com/github/putty/blob/master/contrib/kh2reg.py
         - https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html
         - https://pycryptodome.readthedocs.io/en/latest/src/public_key/ecc.html

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/ssh/ssh.py

@@ -117,7 +117,7 @@ def calculate_fingerprints(public_key_decoded: bytes, ssh_keygen_format: bool =
     parameter is set to ``True``. When set to ``False`` (default) hexdigests are calculated
     instead for ``sha1``and ``sha256``.
 
-    Resources:
+    References:
         - https://en.wikipedia.org/wiki/Public_key_fingerprint
         - https://man7.org/linux/man-pages/man1/ssh-keygen.1.html
         - ``ssh-keygen -l -E <alg> -f key.pub``

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/webserver/apache.py

@@ -286,7 +286,7 @@ class ApachePlugin(WebserverPlugin):
 
         Apache / Httpd directives are case-insensitive which is why we convert lines to lowercase for pattern matching.
 
-        Resources:
+        References:
             - https://httpd.apache.org/docs/2.4/en/configuring.html#syntax
         """
         seen = set() if seen is None else seen
@@ -476,7 +476,7 @@ class ApachePlugin(WebserverPlugin):
     def hosts(self) -> Iterator[WebserverHostRecord]:
         """Return found ``VirtualHost`` directives in the Apache configuration.
 
-        Resources:
+        References:
             - https://httpd.apache.org/docs/2.4/mod/core.html#virtualhost
         """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/apps/webserver/nginx.py

@@ -245,7 +245,7 @@ class NginxPlugin(WebserverPlugin):
     def error(self) -> Iterator[WebserverErrorLogRecord]:
         """Return contents of NGINX error log files in unified ``WebserverErrorLogRecord`` format.
 
-        Resources:
+        References:
             - https://nginx.org/en/docs/ngx_core_module.html#error_log
             - https://github.com/nginx/nginx/blob/master/src/core/ngx_log.c
         """
@@ -285,7 +285,7 @@ class NginxPlugin(WebserverPlugin):
     def hosts(self) -> Iterator[WebserverHostRecord]:
         """Return found server directives in the NGINX configuration.
 
-        Resources:
+        References:
             - https://nginx.org/en/docs/http/ngx_http_core_module.html#server
         """
 
@@ -333,7 +333,7 @@ def parse_json_line(line: str) -> dict[str, str] | None:
     Unfortunately NGINX has no official default naming convention for JSON access logs,
     users can configure the JSON ``log_format`` as they see fit.
 
-    Resources:
+    References:
         - https://nginx.org/en/docs/http/ngx_http_log_module.html
         - https://github.com/elastic/examples/blob/master/Common%20Data%20Formats/nginx_json_logs/README.md
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/child/colima.py

@@ -27,7 +27,7 @@ class ColimaChildTargetPlugin(ChildTargetPlugin):
 
     Colima is a container runtime for macOS and Linux.
 
-    Resources:
+    References:
         - https://github.com/abiosoft/colima/blob/5d2e91c4a491d4ae35d69fb2583f4f959401bc37
     """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/child/parallels.py

@@ -27,7 +27,7 @@ PARALLELS_SYSTEM_PATHS = [
 def find_pvms(target: Target) -> Iterator[TargetPath]:
     """Finds virtual machines located in default folders on a macOS target.
 
-    Resources:
+    References:
         - https://kb.parallels.com/117333
     """
     for user_details in target.user_details.all_with_home():

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/child/virtualbox.py

@@ -21,7 +21,7 @@ class VirtualBoxChildTargetPlugin(ChildTargetPlugin):
 
     Tested with configuration files from major versions 5, 6 and 7.
 
-    Resources:
+    References:
         - https://docs.oracle.com/en/virtualization/virtualbox/6.1/admin/TechnicalBackground.html
     """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/filesystem/unix/capability.py

@@ -97,7 +97,7 @@ class CapabilityPlugin(Plugin):
     def capability_binaries(self) -> Iterator[CapabilityRecord]:
         """Find all files that have capabilities set on files.
 
-        Resources:
+        References:
             - https://github.com/torvalds/linux/blob/master/include/uapi/linux/capability.h
         """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/_os.py

@@ -83,7 +83,7 @@ class UnixPlugin(OSPlugin):
     def users(self, sessions: bool = False) -> Iterator[UnixUserRecord]:
         """Yield unix user records from passwd files or syslog session logins.
 
-        Resources:
+        References:
             - https://manpages.ubuntu.com/manpages/oracular/en/man5/passwd.5.html
         """
 
@@ -422,7 +422,7 @@ class UnixPlugin(OSPlugin):
     def _get_architecture(self, os: str = "unix", path: Path | str = "/bin/ls") -> str | None:
         """Determine architecture by reading an ELF header of a binary on the target.
 
-        Resources:
+        References:
             - https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#ISA
         """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/applications.py

@@ -59,7 +59,7 @@ class UnixApplicationsPlugin(Plugin):
     def applications(self) -> Iterator[UnixApplicationRecord]:
         """Yield installed Unix GUI applications from GNOME and XFCE.
 
-        Resources:
+        References:
             - https://wiki.archlinux.org/title/Desktop_entries
             - https://specifications.freedesktop.org/desktop-entry-spec/latest/
             - https://unix.stackexchange.com/questions/582928/where-gnome-apps-are-installed

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/bsd/darwin/_os.py

@@ -55,7 +55,7 @@ def detect_macho_arch(paths: list[str | Path], fs: Filesystem | None = None) ->
     Returns:
         Detected architecture (e.g. ``arm64``) or ``None``.
 
-    Resources:
+    References:
         - https://github.com/opensource-apple/cctools/blob/master/include/mach/machine.h
     """
     for path in paths:

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/bsd/darwin/ios/_os.py

@@ -24,7 +24,7 @@ if TYPE_CHECKING:
 class IOSPlugin(DarwinPlugin):
     """Apple iOS plugin.
 
-    Resources:
+    References:
         - https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemOverview/FileSystemOverview.html
         - https://corp.digitalcorpora.org/corpora/mobile/iOS17/
     """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/cronjobs.py

@@ -104,7 +104,7 @@ class CronjobPlugin(Plugin):
         A cronjob is a scheduled task/command on a Unix based system. Adversaries may use cronjobs to gain
         persistence on the system.
 
-        Resources:
+        References:
             - https://linux.die.net/man/8/cron
             - https://linux.die.net/man/1/crontab
             - https://linux.die.net/man/5/crontab

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/history.py

@@ -98,7 +98,7 @@ class CommandHistoryPlugin(Plugin):
             #1648598339
             echo "this is a test"
 
-        Resources:
+        References:
             - http://git.savannah.gnu.org/cgit/bash.git/tree/bashhist.c
         """
         next_cmd_ts = None
@@ -142,7 +142,7 @@ class CommandHistoryPlugin(Plugin):
             : 1673860722:0;sudo apt install sl
             : :;
 
-        Resources:
+        References:
             - https://sourceforge.net/p/zsh/code/ci/master/tree/Src/hist.c
         """
         i = 0
@@ -191,7 +191,7 @@ class CommandHistoryPlugin(Plugin):
         Note that the last ``- cmd: echo "test: test"`` is not valid YAML,
         which is why we cannot safely use the Python yaml module.
 
-        Resources:
+        References:
             - https://github.com/fish-shell/fish-shell/blob/master/src/history.cpp
         """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/linux/_os.py

@@ -34,7 +34,7 @@ class LinuxPlugin(UnixPlugin, LinuxNetworkManager):
         the Filesystem Hierarchy Standard (FHS). We can differentiate between Unix and Linux by checking for specific
         Linux kernel-only files not present on actual Unix filesystems (e.g. BSD, Solaris, IBM AIX and HP-UX).
 
-        Resources:
+        References:
             - https://refspecs.linuxfoundation.org/fhs.shtml
             - https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard
         """

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/linux/debian/snap.py

@@ -46,7 +46,7 @@ class SnapPlugin(Plugin):
         Reads information from installed SquashFS ``*.snap`` files found in ``/var/lib/snapd/snaps``.
         Logs of the ``snapd`` daemon can be parsed using the ``journal`` or ``syslog`` plugins.
 
-        Resources:
+        References:
             - https://github.com/canonical/snapcraft
             - https://en.wikipedia.org/wiki/Snap_(software)
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/linux/fortios/_os.py

@@ -422,7 +422,7 @@ def parse_version(input: str) -> str:
     The input ``FGVM64-7.4.1-FW-build2463-230830:opmode=0:vdom=0`` would
     return the following output: ``FortiGate VM 7.4.1 (build 2463, 2023-08-30)``.
 
-    Resources:
+    References:
         - https://support.fortinet.com/Download/VMImages.aspx
     """
 
@@ -473,7 +473,7 @@ def decrypt_password(input: str) -> str:
 
     Returns decoded plaintext or original input ciphertext when decryption failed.
 
-    Resources:
+    References:
         - https://www.fortiguard.com/psirt/FG-IR-19-007
     """
 
@@ -608,7 +608,7 @@ def decrypt_rootfs(fh: BinaryIO, key: ChaCha20Key | AesKey) -> BinaryIO:
 
     Known keys can be found in the ``_keys.py`` file.
 
-    Resources:
+    References:
         - https://docs.fortinet.com/document/fortimanager/7.4.2/release-notes/519207/special-notices
         - Reversing kernel (fgt_verifier_iv, fgt_verifier_decrypt, fgt_verifier_initrd)
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/linux/fortios/locale.py

@@ -44,7 +44,7 @@ class FortiOSLocalePlugin(LocalePlugin):
 def translate_timezone(timezone_num: str) -> str:
     """Translate a FortiOS timezone number to IANA TZ.
 
-    Resources:
+    References:
         - https://<fortios>/ng/system/settings
     """
 

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/linux/network_managers.py

@@ -594,7 +594,7 @@ def parse_unix_dhcp_log_messages(target: Target, iter_all: bool = False) -> set[
 def parse_unix_dhcp_leases(target: Target) -> set[str]:
     """Parse NetworkManager and dhclient DHCP ``.lease`` files.
 
-    Resources:
+    References:
         - https://linux.die.net/man/5/dhclient.conf
 
     Args:

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/locate/gnulocate.py

@@ -40,7 +40,7 @@ class GNULocateFile:
     The file is encoded with front compression (incremental encoding). This is a form of compression
     which takes a number of characters of the previous encoded entries. Entries are separated with a null byte.
 
-    Resources:
+    References:
         - https://manpages.ubuntu.com/manpages/trusty/en/man5/locatedb.5.html
     """
 
@@ -86,7 +86,7 @@ class GNULocatePlugin(BaseLocatePlugin):
     def locate(self) -> Iterator[GNULocateRecord]:
         """Yield file and directory names from GNU findutils' locatedb file.
 
-        Resources:
+        References:
             - https://manpages.debian.org/testing/locate/locatedb.5.en.html
         """
         locate_fh = self.target.fs.path(self.path).open()

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/locate/mlocate.py

@@ -15,7 +15,7 @@ if TYPE_CHECKING:
     from collections.abc import Iterator
     from datetime import datetime
 
-# Resources: https://linux.die.net/man/5/locate.db
+# References: https://linux.die.net/man/5/locate.db
 mlocate_def = """
 #define MAGIC 0x006d6c6f63617465             /* b'/x00mlocate' */
 
@@ -77,7 +77,7 @@ c_mlocate = cstruct(endian=">").load(mlocate_def)
 class MLocateFile:
     """Parser for mlocate files.
 
-    Resources:
+    References:
         - https://manpages.debian.org/testing/mlocate/mlocate.db.5.en.html
     """
 
@@ -135,7 +135,7 @@ class MLocatePlugin(BaseLocatePlugin):
         ``mlocate`` is a new implementation of GNU locate,
         but has been deprecated since Ubuntu 22.
 
-        Resources:
+        References:
             - https://manpages.debian.org/testing/mlocate/mlocate.db.5.en.html
         """
         mlocate_fh = self.target.fs.path(self.path).open()

{dissect_target-3.23.dev44 → dissect_target-3.23.dev45}/dissect/target/plugins/os/unix/locate/plocate.py

@@ -90,7 +90,7 @@ class PLocateFile:
 
     No documentation other than the source code is available on the format of this file.
 
-    Resources:
+    References:
         - https://git.sesse.net/?p=plocate
     """
 
@@ -188,7 +188,7 @@ class PLocatePlugin(BaseLocatePlugin):
         ``plocate`` is the default package on Ubuntu 22 and newer to locate files.
         It replaces ``mlocate`` and GNU ``locate``.
 
-        Resources:
+        References:
             - https://manpages.debian.org/testing/plocate/plocate.1.en.html
             - https://git.sesse.net/?p=plocate
         """