# gists

This repository is a personal toolbox: small utilities, shell config, Docker build recipes, forensic helpers, network scripts, and a few larger side projects. It is not a single application, so the useful documentation is a map of what lives where and which files matter.

## How To Read This Repo

- `tools/` is the main home for standalone utilities grouped by purpose.
- `projects/` holds larger multi-file projects that deserve their own subtree.
- `scripts/` holds machine-management helpers.
- `config/` holds shell, desktop, and VisiData configuration.
- `dockerfiles/` holds container recipes and small Compose setups.
- `archive/` holds older or experimental material that is kept for reference, not as the primary entrypoint.

This README explains the parts that need context. Boilerplate and standard metadata files such as `go.mod`, `go.sum`, `.gitignore`, GitHub Actions files, and obvious launcher/config assets are not documented line-by-line unless they carry important behavior.

## Refined Repository Structure

The old `restructure_git.sh` captured the right direction but in the wrong form. The useful part is the structure itself, not a one-shot move script. The intended layout for this repo is:

- root: only discovery files and broad entrypoints such as `README.md`, `.gitignore`, `what`, and small repo-wide metadata.
- `tools/`: single-purpose utilities that can usually be understood and run on their own.
- `projects/`: anything multi-file, stateful, tested, or large enough to deserve its own local README or build flow.
- `scripts/`: machine-setup and environment-management scripts, grouped by operational area such as proxy, display, setup, or platform.
- `config/`: reusable configuration, completions, themes, desktop entries, and tool-specific setup.
- `dockerfiles/`: container recipes and Compose stacks.
- `archive/`: historical material kept for reference, not the default place to start.

The practical cleanup rules are:

- keep the root shallow; do not leave new standalone utilities at the top level if they fit under `tools/`, `scripts/`, or `config/`
- move one-file tools by function, not by language
- move multi-file codebases by project, even if they are small
- keep generated artifacts, captured output, and binaries out of active source directories unless they are intentionally distributed
- use `archive/experimental/` for things worth keeping but not worth advertising
- keep macOS Finder metadata out of the repo; `.DS_Store`, AppleDouble files, and `__MACOSX/` bundles are ignored

Applied to the current tree, the remaining rough edges are:

- a few tracked binaries still sit beside source and may eventually deserve a dedicated `bin/` or `dist/` convention
- some material under `archive/experimental/` may still be worth deleting rather than merely archiving

## Top-Level Files

- `what`: README-driven repository search helper. It uses one local Ollama model and searches only the catalog below.
- `README.md`: this guide.
- `.gitignore`: standard repository ignore rules.

## Tool Catalog

Format: `path | goal | usage`. This section is intentionally compact so `what` can pass it to a small local model without dragging the whole repository into context.

### Active Tools

- `what` | goal: search this repository's tool catalog with Ollama only | usage: `./what "query"` or `./what -l`

### Security

- `tools/security/scan_vt.py` | goal: check file hashes against VirusTotal | usage: `python3 tools/security/scan_vt.py sample.bin`
- `tools/security/imphash.py` | goal: calculate PE import hashes for malware triage | usage: `python3 tools/security/imphash.py file.exe`
- `tools/security/scapy_arp.py` | goal: scan a local network with ARP requests | usage: `python3 tools/security/scapy_arp.py`
- `tools/security/simple_portscan.py` | goal: do a lightweight TCP port scan | usage: `python3 tools/security/simple_portscan.py host`
- `tools/security/smtpbanner.py` | goal: grab SMTP banners from remote servers | usage: `python3 tools/security/smtpbanner.py host`
- `tools/security/testpw.py` | goal: test password candidates against a target workflow | usage: `python3 tools/security/testpw.py ...`
- `tools/security/vt_download.py` | goal: download malware samples or data from VirusTotal-related workflows | usage: `python3 tools/security/vt_download.py ...`
- `tools/security/vt_ip.py` | goal: enrich IP addresses with VirusTotal intel | usage: `python3 tools/security/vt_ip.py 8.8.8.8`
- `tools/security/vt_pdns.py` | goal: query passive DNS style data from VirusTotal workflows | usage: `python3 tools/security/vt_pdns.py domain.tld`
- `tools/security/certwipe` | goal: wipe disks with secure-erase oriented steps | usage: `tools/security/certwipe /dev/sdX`

### Forensics

- `tools/forensics/chechsqlite.py` | goal: inspect SQLite databases for password or hash style columns | usage: `python3 tools/forensics/chechsqlite.py sample.db`
- `tools/forensics/extractfolder.py` | goal: bulk-extract or sort files from a folder workflow | usage: `python3 tools/forensics/extractfolder.py input_dir`
- `tools/forensics/process_leak.py` | goal: inspect process-leak style artifacts | usage: `python3 tools/forensics/process_leak.py artifact`
- `tools/forensics/mailunpack` | goal: extract mail attachments inside a constrained container workflow | usage: `tools/forensics/mailunpack message.eml`
- `tools/forensics/showgm.sh` | goal: open image GPS EXIF coordinates in Google Maps | usage: `tools/forensics/showgm.sh image.jpg`
- `tools/forensics/showosm.sh` | goal: open image GPS EXIF coordinates in OpenStreetMap | usage: `tools/forensics/showosm.sh image.jpg`

### Data And Text

- `tools/data/domgrep.py` | goal: extract domain names specifically from URLs or mixed text input | usage: `cat urls.txt | python3 tools/data/domgrep.py`
- `tools/data/geturls.py` | goal: extract full raw URLs from text when you want links rather than domains | usage: `python3 tools/data/geturls.py file.txt`
- `tools/data/unum.py` | goal: inspect Unicode code points and names | usage: `echo "text" | python3 tools/data/unum.py`
- `tools/data/quickchardet.py` | goal: guess file encoding quickly | usage: `python3 tools/data/quickchardet.py file.txt`
- `tools/data/json_save.py` | goal: normalize or save JSON fragments from text streams | usage: `python3 tools/data/json_save.py ...`
- `tools/data/kv_parse.py` | goal: parse key-value formatted text | usage: `python3 tools/data/kv_parse.py input.txt`
- `tools/data/vba_chr_decode.py` | goal: decode VBA `Chr(...)` obfuscation patterns | usage: `python3 tools/data/vba_chr_decode.py macro.txt`
- `tools/data/concat.py` | goal: concatenate structured text inputs in a repeatable way | usage: `python3 tools/data/concat.py file1 file2`
- `tools/data/split_linewise.py` | goal: split text into line-based chunks | usage: `python3 tools/data/split_linewise.py input.txt`
- `tools/data/uniq.py` | goal: remove duplicate lines while preserving first occurrence order | usage: `python3 tools/data/uniq.py file.txt`
- `tools/data/urldecode.py` | goal: URL-decode strings from stdin or files | usage: `python3 tools/data/urldecode.py`
- `tools/data/between` | goal: print text between delimiters | usage: `tools/data/between START END < file.txt`
- `tools/data/csv_get` | goal: extract selected CSV fields quickly | usage: `tools/data/csv_get file.csv column`
- `tools/data/csv2dot` | goal: turn CSV relationships into Graphviz dot edges | usage: `tools/data/csv2dot`

### Hashing And Archives

- `tools/hashing/libarchivesum.py` | goal: hash files inside archives without full extraction | usage: `python3 tools/hashing/libarchivesum.py archive.zip`
- `tools/hashing/scatterhash.py` | goal: hash very large files by sparse sampling when you need a fingerprint rather than a comparison | usage: `python3 tools/hashing/scatterhash.py huge.img`
- `tools/hashing/hashzip.py` | goal: hash ZIP contents or metadata for comparison | usage: `python3 tools/hashing/hashzip.py sample.zip`
- `tools/hashing/tarsum.py` | goal: compute tar-oriented checksums in Python | usage: `python3 tools/hashing/tarsum.py archive.tar`
- `tools/hashing/sparsecmp.sh` | goal: compare very large files or block devices by sampling chunks at fixed offsets | usage: `tools/hashing/sparsecmp.sh source target 100`
- `tools/hashing/trunc_by_hash.py` | goal: find the byte length where a rolling hash matches a target digest | usage: `python3 tools/hashing/trunc_by_hash.py HASH file.bin`

### Network And Cloud

- `tools/network/ipgrep` | goal: extract IP or MAC indicators from text | usage: `cat file.txt | tools/network/ipgrep`
- `tools/network/fritzshark.sh` | goal: inspect or capture FritzBox traffic workflows | usage: `tools/network/fritzshark.sh`
- `tools/network/fritzshark2.sh` | goal: alternate FritzBox traffic workflow | usage: `tools/network/fritzshark2.sh`
- `tools/network/get_ntp.py` | goal: query NTP information from remote systems | usage: `python3 tools/network/get_ntp.py host`
- `tools/network/get_stp.sh` | goal: inspect spanning-tree data on a network | usage: `tools/network/get_stp.sh device`
- `tools/cloud/cloudsend.py` | goal: upload files to Nextcloud or OwnCloud shares | usage: `python3 tools/cloud/cloudsend.py file`
- `tools/cloud/cloudsend.sh` | goal: shell wrapper for cloud share upload workflows | usage: `tools/cloud/cloudsend.sh file`
- `tools/cloud/docker_pull.py` | goal: download image layers from a container registry without `docker pull` | usage: `python3 tools/cloud/docker_pull.py ubuntu:latest`
- `tools/cloud/speech.py` | goal: run cloud-backed speech or transcription tasks | usage: `python3 tools/cloud/speech.py input`
- `tools/cloud/vqa3.py` | goal: classify images with a local or model-backed VQA workflow | usage: `python3 tools/cloud/vqa3.py image.jpg`
- `tools/cloud/youtube_resolve.sh` | goal: resolve direct media URLs from YouTube-like inputs | usage: `tools/cloud/youtube_resolve.sh URL`

### Formats, System, And Text Experiments

- `tools/formats/convert2pdf.sh` | goal: convert documents into PDF form | usage: `tools/formats/convert2pdf.sh input.docx`
- `tools/formats/flatpdf.sh` | goal: flatten or normalize PDFs for downstream handling | usage: `tools/formats/flatpdf.sh input.pdf`
- `tools/formats/openflattenpdf.sh` | goal: flatten a PDF through PostScript and open the result | usage: `tools/formats/openflattenpdf.sh input.pdf`
- `tools/formats/rename.mime.py` | goal: rename or sort files by MIME type | usage: `python3 tools/formats/rename.mime.py`
- `tools/system/backup_docker.sh` | goal: back up a Docker Compose stack | usage: `tools/system/backup_docker.sh docker-compose.yml`
- `tools/system/restore_docker.sh` | goal: restore a saved Docker workflow | usage: `tools/system/restore_docker.sh`
- `tools/system/watchgrowth.sh` | goal: watch a file or directory grow over time | usage: `tools/system/watchgrowth.sh path`
- `tools/system/ltop.py` | goal: show the most frequent lines from a stream like `top` | usage: `tail -f log | python3 tools/system/ltop.py`
- `tools/system/noerr` | goal: run a command with stderr suppressed | usage: `tools/system/noerr some command`
- `tools/system/wipe.sh` | goal: perform destructive wipe or cleanup steps | usage: `tools/system/wipe.sh target`
- `tools/text/probability.py` | goal: run a small text probability experiment | usage: `python3 tools/text/probability.py`
- `tools/text/depth` | goal: inspect text depth or nesting characteristics | usage: `tools/text/depth input.txt`

### CTF Helpers

- `tools/ctf/filtertext.py` | goal: filter challenge text to useful fragments | usage: `python3 tools/ctf/filtertext.py input.txt`
- `tools/ctf/getjs.py` | goal: extract JavaScript from challenge pages | usage: `python3 tools/ctf/getjs.py page.html`
- `tools/ctf/guess.py` | goal: brute-force or guess through a challenge search space | usage: `python3 tools/ctf/guess.py ...`
- `tools/ctf/ps_.py` | goal: run a CTF-specific parsing or post-processing step | usage: `python3 tools/ctf/ps_.py ...`
- `tools/ctf/search.py` | goal: search challenge artifacts for signals | usage: `python3 tools/ctf/search.py input`
- `tools/ctf/submit_flag.sh` | goal: submit flags to a challenge endpoint | usage: `tools/ctf/submit_flag.sh FLAG`
- `tools/ctf/transpose.py` | goal: transpose text or matrix-like challenge data | usage: `python3 tools/ctf/transpose.py input`

### Go Tools And Small Projects

- `tools/go/bincmp/gobincmp.go` | goal: compare files or directories with fuzzy hashing | usage: `go run tools/go/bincmp/gobincmp.go left right`
- `tools/go/gopname/pname.go` | goal: demo process-title renaming with `gspt` | usage: `go run tools/go/gopname/pname.go`
- `tools/go/tarsum/tarsum.go` | goal: print a SHA-256 checksum for a tar file | usage: `go run tools/go/tarsum/tarsum.go archive.tar`
- `projects/go-tools/go/goipgrep/` | goal: production-grade IP and MAC extractor with ping, DNS, and lookup support | usage: `projects/go-tools/go/goipgrep/scripts/build.sh`
- `projects/go-tools/go/csv2json/csv2json.go` | goal: convert CSV input to JSON | usage: `go run projects/go-tools/go/csv2json/csv2json.go`
- `projects/go-tools/go/gobetween/gobetween.go` | goal: extract text between delimiters in Go | usage: `go run projects/go-tools/go/gobetween/gobetween.go`
- `projects/go-tools/go/goinfo/goinfo.go` | goal: inspect file or system information in Go | usage: `go run projects/go-tools/go/goinfo/goinfo.go`
- `projects/go-tools/go/gosoft/gosoft.go` | goal: enumerate installed software from multiple package sources | usage: `go run projects/go-tools/go/gosoft/gosoft.go`
- `projects/go-tools/go/gouniq/gouniq.go` | goal: remove duplicate lines in Go | usage: `go run projects/go-tools/go/gouniq/gouniq.go < file.txt`
- `projects/rust-tools/between.rs` | goal: Rust version of between-delimiter extraction | usage: `rustc projects/rust-tools/between.rs && ./between`
- `projects/rust-tools/uniq.rs` | goal: Rust uniq implementation preserving first occurrences | usage: `rustc projects/rust-tools/uniq.rs && ./uniq file.txt`
- `projects/rust-tools/uniq2.rs` | goal: alternate Rust uniq implementation | usage: `rustc projects/rust-tools/uniq2.rs && ./uniq2 file.txt`
- `projects/puzzlebox/` | goal: solve voxel and puzzlebox search problems with several solver variants | usage: `python3 projects/puzzlebox/solve.py`
- `projects/timesketch/deploy_timesketch.sh` | goal: deploy a Timesketch environment | usage: `projects/timesketch/deploy_timesketch.sh`

### Admin And Setup Scripts

- `scripts/proxy/get_proxy.sh` | goal: print current proxy settings | usage: `scripts/proxy/get_proxy.sh`
- `scripts/proxy/update_apt_proxy.sh` | goal: write apt proxy configuration | usage: `scripts/proxy/update_apt_proxy.sh host port`
- `scripts/proxy/update_bashrc_proxy.sh` | goal: add shell proxy exports to a bash config | usage: `scripts/proxy/update_bashrc_proxy.sh host port`
- `scripts/proxy/update_service_proxy.sh` | goal: apply proxy settings to service units | usage: `scripts/proxy/update_service_proxy.sh service`
- `scripts/display/3_screen_setup.sh` | goal: apply a fixed three-monitor `xrandr` layout | usage: `scripts/display/3_screen_setup.sh`
- `scripts/display/notebook_extended.sh` | goal: apply a laptop-plus-external-display layout | usage: `scripts/display/notebook_extended.sh`
- `scripts/display/reset_screens.sh` | goal: reset screen outputs to a known state | usage: `scripts/display/reset_screens.sh`
- `scripts/display/single_fullhd.sh` | goal: force a single full-HD laptop display mode | usage: `scripts/display/single_fullhd.sh`
- `scripts/display/toggle_display.sh` | goal: toggle an external display workflow | usage: `scripts/display/toggle_display.sh`
- `scripts/display/toggle_touchpad` | goal: toggle touchpad state on or off | usage: `scripts/display/toggle_touchpad`
- `scripts/setup/automountctl` | goal: manage automount-related setup | usage: `scripts/setup/automountctl`
- `scripts/setup/disable_ubuntu_telemetry.sh` | goal: disable Ubuntu telemetry packages and endpoints | usage: `sudo scripts/setup/disable_ubuntu_telemetry.sh`
- `scripts/setup/mount_container` | goal: mount or unmount LUKS container files listed in `.containers` manifests | usage: `scripts/setup/mount_container mount`
- `scripts/setup/share.sh` | goal: run a local sharing workflow | usage: `scripts/setup/share.sh`
- `scripts/setup/terminal-logs.sh` | goal: configure or collect terminal logging | usage: `scripts/setup/terminal-logs.sh`
- `scripts/windows/Get-ZimmermanTools.ps1` | goal: download Zimmerman forensic tools on Windows | usage: `powershell -File scripts/windows/Get-ZimmermanTools.ps1`
- `scripts/windows/getscreen.psm1` | goal: provide PowerShell screen-capture helpers | usage: `Import-Module scripts/windows/getscreen.psm1`
- `scripts/windows/sbom.ps1` | goal: generate or inspect SBOM-related data in PowerShell | usage: `powershell -File scripts/windows/sbom.ps1`

### Config And Reference Entry Points

- `config/visidata/` | goal: install and use the local VisiData config plus plugins | usage: `cd config/visidata && ./install.sh --link`
- `config/install.sh` | goal: bootstrap local environment configuration | usage: `config/install.sh`
- `config/z.sh` | goal: provide a shell directory-jump helper | usage: `source config/z.sh`
- `config/shell/completions/eslogger.zsh` | goal: add Zsh completion for Apple's `eslogger` | usage: `source config/shell/completions/eslogger.zsh`

### Archived Or Narrow Tools

- `archive/experimental/ctf_primefac.py` | goal: factor a hard-coded challenge integer with `primefac` | usage: `python3 archive/experimental/ctf_primefac.py`
- `archive/experimental/screen2.js` | goal: capture a specific webpage screenshot with PhantomJS | usage: `phantomjs archive/experimental/screen2.js`
- `archive/experimental/screenshot.js` | goal: capture screenshots for multiple URLs with PhantomJS | usage: `phantomjs archive/experimental/screenshot.js URL ...`
- `archive/experimental/usbreset.c` | goal: reset a USB device from Linux userspace | usage: `gcc archive/experimental/usbreset.c -o usbreset`
- `archive/experimental/sep_test.sh` | goal: binary-search Docker image tags for a malware detection change | usage: `archive/experimental/sep_test.sh image start_tag end_tag`
- `archive/experimental/flm.py` | goal: keep an old experimental script available for salvage | usage: `python3 archive/experimental/flm.py`
- `archive/experimental/fuzz.sh` | goal: keep an old shell fuzzing experiment available for salvage | usage: `archive/experimental/fuzz.sh`
- `archive/experimental/hydrogentest.py` | goal: keep an old experiment available for salvage | usage: `python3 archive/experimental/hydrogentest.py`
- `archive/experimental/kv.py` | goal: keep an old key-value parsing experiment available for salvage | usage: `python3 archive/experimental/kv.py`
- `archive/experimental/lpic.sh` | goal: keep an old system experiment available for salvage | usage: `archive/experimental/lpic.sh`
- `archive/experimental/matplottest.py` | goal: keep an old plotting experiment available for salvage | usage: `python3 archive/experimental/matplottest.py`
- `archive/experimental/rootshell.c` | goal: keep a dangerous historical C example archived rather than active | usage: `do not run; reference only`

## `tools/`: Standalone Utilities

### Security

- `tools/security/scan_vt.py`: VirusTotal file lookup helper.
- `tools/security/imphash.py`: PE import-hash calculator for malware triage.
- `tools/security/scapy_arp.py`: ARP-based host discovery on local networks.
- `tools/security/simple_portscan.py`: lightweight port scanner.
- `tools/security/smtpbanner.py`: banner grabber for SMTP targets.
- `tools/security/testpw.py`: password-testing helper.
- `tools/security/vt_download.py`, `vt_ip.py`, `vt_pdns.py`: VirusTotal-related download and enrichment helpers.
- `tools/security/certwipe`: disk wiping helper with secure-erase focused intent.

### Forensics

- `tools/forensics/chechsqlite.py`: inspects SQLite databases for password/hash-like fields and consistency issues.
- `tools/forensics/extractfolder.py`: folder extraction/helper script for bulk processing.
- `tools/forensics/mailunpack`: containerized `munpack` wrapper for extracting mail attachments safely.
- `tools/forensics/process_leak.py`: process-memory or artifact triage helper.
- `tools/forensics/showgm.sh`, `showosm.sh`: extract GPS EXIF data from images and open the location in Google Maps or OpenStreetMap.

### Data / Text Processing

- `tools/data/domgrep.py`: extracts domains from URL-ish input.
- `tools/data/geturls.py`: URL extraction helper.
- `tools/data/unum.py`: Unicode inspection tool that prints code points, categories, and names.
- `tools/data/quickchardet.py`: quick character-encoding detection.
- `tools/data/json_save.py`, `kv_parse.py`, `vba_chr_decode.py`: small transformation helpers for structured or obfuscated data.
- `tools/data/concat.py`, `split_linewise.py`, `uniq.py`, `between`, `csv_get`: general command-line text and record wrangling tools.
- `tools/data/urldecode.py`: URL-decoding helper.

### Hashing / Archives

- `tools/hashing/libarchivesum.py`: hashes files inside archives without extracting them first.
- `tools/hashing/scatterhash.py`: sparse hashing for large files.
- `tools/hashing/hashzip.py`: ZIP-oriented hashing helper.
- `tools/hashing/sparsecmp.sh`: spot-check large files or block devices by comparing chunks at intervals.
- `tools/hashing/tarsum.py`: tar hashing utility in Python.
- `tools/hashing/trunc_by_hash.py`: finds the byte offset where a stream first matches a target hash so a file can be truncated deterministically.

### Networking / Cloud

- `tools/network/ipgrep`: network indicator extractor for IPs and MACs; there is a fuller Go project version under `projects/go-tools/go/goipgrep/`.
- `tools/network/fritzshark.sh`, `fritzshark2.sh`: FritzBox traffic / packet capture helpers.
- `tools/network/get_ntp.py`, `get_stp.sh`: NTP and STP inspection scripts.
- `tools/cloud/cloudsend.py`, `cloudsend.sh`: Nextcloud/OwnCloud share upload helpers.
- `tools/cloud/docker_pull.py`: registry client that downloads container images without requiring `docker pull`.
- `tools/cloud/speech.py`: cloud-backed speech or transcription helper.
- `tools/cloud/vqa3.py`: CLIP-based image classification experiment.
- `tools/cloud/youtube_resolve.sh`: YouTube/media URL resolution helper.

### Formats / System / Misc

- `tools/formats/convert2pdf.sh`, `flatpdf.sh`, `rename.mime.py`: document conversion and MIME-based file organization helpers.
- `tools/formats/openflattenpdf.sh`: flatten a PDF by round-tripping it through PostScript, then open the result for viewing.
- `tools/system/backup_docker.sh`, `restore_docker.sh`: Docker/Compose backup and restore workflows.
- `tools/system/watchgrowth.sh`: live file growth watcher.
- `tools/system/ltop.py`: `top`-style frequency counter for streamed lines.
- `tools/system/noerr`: tiny wrapper that runs a command with stderr suppressed.
- `tools/system/wipe.sh`: destructive cleanup / wiping helper.
- `tools/ctf/`: small CTF-solving utilities such as text filtering, JS extraction, guessing, search, transpose, and flag submission helpers.
- `tools/text/probability.py`, `tools/text/depth`: text-analysis experiments.

### Go Tools Under `tools/go/`

- `tools/go/bincmp/`: fuzzy binary and directory comparison using `ssdeep`.
- `tools/go/gopname/`: process-title renaming demo using `gspt`.
- `tools/go/tarsum/`: Go tar checksum utility; currently behaves as a raw SHA-256 of the tar file contents.

## `projects/`: Larger Multi-File Work

- `projects/go-tools/go/goipgrep/`: the most complete standalone project in the repo. It extracts IPs and MACs from text and can optionally do ping checks, reverse DNS, and IP info lookups. Read its local README first.
- `projects/go-tools/go/csv2json/`, `gobetween/`, `goinfo/`, `gosoft/`, `gouniq/`: smaller Go experiments and utilities.
- `projects/puzzlebox/`: puzzle-solving and voxel-based search experiments with several solver variants.
- `projects/rust-tools/`: small Rust utilities and built binaries.
- `projects/timesketch/deploy_timesketch.sh`: deployment helper for Timesketch.

## `config/`: Shell, Desktop, and VisiData

- `config/shell/`: shell prompt, aliases, input settings, dircolors, and local completions. `config/shell/completions/eslogger.zsh` is the local Zsh completion for Apple’s `eslogger`.
- `config/applications/`: desktop launchers.
- `config/install.sh`: environment/bootstrap installer.
- `config/z.sh`, `config/zupdate.sh`: directory-jump helper and update script.
- `config/visidata/`: a real subsystem, not just dotfiles. It contains installation logic, a `visidatarc`, local plugins, validation scripts, sample datasets, and a dedicated README. If you use VisiData in this repo, start there.

## `dockerfiles/`: Container Recipes

- `dockerfiles/build_firefox.sh`, `build_kali.sh`: convenience builders.
- `dockerfiles/*.dockerfile` and subdirectory `Dockerfile`s: one-off environments for Firefox, Kali, Plaso, Rekall, RegRipper, Volatility, FlatPDF, and several security tools.
- `dockerfiles/elk/`: ELK stack setup with a short README about required kernel tuning.
- `dockerfiles/pdf-analysis/`: PDF analysis container with Didier Stevens tools, peepdf, and related utilities; see its local README and command help.
- `dockerfiles/droppy/`, `openhab/`: small Compose-based service setups.
- `dockerfiles/logstash/`: Logstash configs for different ingestion cases.

## `scripts/`

- `scripts/proxy/`: proxy environment propagation for apt, bash, and services.
- `scripts/display/`: display and touchpad toggles, including named `xrandr` screen-layout presets.
- `scripts/setup/`: host setup helpers such as automounting, sharing, terminal logging, encrypted container mounting, and Ubuntu telemetry disabling.
- `scripts/windows/`: PowerShell helpers, including Zimmerman tools bootstrap and SBOM-related work.

## `archive/`: Reference Material

- `archive/collected/`: old collected command and tool lists plus a small README.
- `archive/experimental/`: scripts kept for reference or later salvage, including older PhantomJS screenshot helpers, one-off CTF code, USB reset code, and narrow test scripts.
- `archive/awk/` and `archive/binaries/`: older helpers that were kept but de-emphasized.

## Where To Start

- If you want a single-file utility, start in `tools/`.
- If you want a more complete tool with tests or a build flow, check `projects/`.
- If you want local environment setup or terminal customizations, check `config/`.
- If you want containers, check `dockerfiles/`.
- If you are unsure, run `./what -l` or ask `./what "query"`.
