Add iOS IMO HD chat message custom parser plugin #4927
Conversation
|
Thanks for the PR, I'm a bit preoccupied at the moment will try to take a look as soon as time permits |
plaso/data/formatters/ios.yaml
Outdated
| - 'Message : {ztext}' | ||
| - 'Message Status : {zissent}' | ||
| short_source: 'LOG' | ||
| source: 'IMO HD Chat Message Log' |
There was a problem hiding this comment.
style nit: make sure line has end-of-line character
plaso/data/timeliner.yaml
Outdated
| attribute_mappings: | ||
| - name: 'zts' | ||
| description: 'Timestamp' | ||
| place_holder_event: true |
There was a problem hiding this comment.
style nit: make sure line has end-of-line character
| @@ -42,3 +42,4 @@ | |||
| from plaso.parsers.sqlite_plugins import windows_push_notification | |||
| from plaso.parsers.sqlite_plugins import windows_timeline | |||
| from plaso.parsers.sqlite_plugins import zeitgeist | |||
| from plaso.parsers.sqlite_plugins import ios_imohdchat_message | |||
There was a problem hiding this comment.
style nit: make sure line has end-of-line character
|
rebased PR |
|
@agusgiinarsa could you PTAL the tests are failing with: https://github.com/log2timeline/plaso/actions/runs/13491915032/job/37691437250?pr=4927#step:7:3036 |
|
|
||
| Attributes: | ||
| application (str): name of the application. | ||
| bundle_identifier (str): bundle identifier of the application. |
There was a problem hiding this comment.
docstring don't match attribute names
self.zalias = None
self.ztext = None
self.zissent = None
self.zts = None
self.query = None
| @@ -117,4 +117,4 @@ def ParseApplicationUsageRow( | |||
| parser_mediator.ProduceEventData(event_data) | |||
|
|
|||
|
|
|||
| sqlite.SQLiteParser.RegisterPlugin(MacOSApplicationUsagePlugin) | |||
| sqlite.SQLiteParser.RegisterPlugin(MacOSApplicationUsagePlugin) | |||
| DATA_FORMAT = ( | ||
| 'IMO HD chat message SQLite database (IMODb2.sqlite) file') | ||
|
|
||
| REQUIRED_STRUCTURE = { |
There was a problem hiding this comment.
what about the other timestamp ZSENDERTS ?
CREATE TABLE ZIMOCHATMSG ( Z_PK INTEGER PRIMARY KEY, Z_ENT INTEGER, Z_OPT INTEGER, ZISSENT INTEGER, ZNUM_RETRIES INTEGER, ZSENDERTS INTEGER, ZSTATE INTEGER, ZTS INTEGER, ZTYPE INTEGER, ZA_UID VARCHAR, ZALIAS VARCHAR, ZBATCH_ID VARCHAR, ZBUID VARCHAR, ZCONTACT_ALIAS VARCHAR, ZICON VARCHAR, ZPHOTO_ID VARCHAR, ZTEXT VARCHAR, ZIMDATA BLOB );
| if timestamp is None: | ||
| return None | ||
|
|
||
| return dfdatetime_posix_time.PosixTime(timestamp=timestamp) |
There was a problem hiding this comment.
Why not use PosixTimeInNanoseconds ?
| 'ZTS'])} | ||
|
|
||
| QUERIES = [( | ||
| ('SELECT ZTS/1000000000, ZALIAS, ZTEXT, ZISSENT ' |
There was a problem hiding this comment.
ZTS/1000000000 will remove precision, which maybe not forensically sound
ORDER BY ZTS is not needed given psort will sort events
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4927 +/- ##
==========================================
+ Coverage 85.08% 85.10% +0.02%
==========================================
Files 431 433 +2
Lines 38765 38825 +60
==========================================
+ Hits 32982 33041 +59
- Misses 5783 5784 +1 ☔ View full report in Codecov by Sentry. |
|
@agusgiinarsa what is the origin of the test data file? |
joachimmetz
added
the
pending reporter input
One line description of pull request
Add iOS IMO HD chat message custom parser plugin
Description:
In this pull request I add several files :
• Add file plaso/parsers/sqlite_plugins/ios_imohdchat_message.py
• Add one line at plaso/parsers/sqlite_plugins/init.py
• Add file plaso/tests/parsers/sqlite_plugins/ios_imohdchat_message.py
• Add file plaso/test_data/IMODb2.sqlite to use as test data (from iOS forensic image in Digital Corpora)
Related issue (if applicable): fixes #
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: