From cfbcc0a943cf73582e4709f2ec2474b5c13af9e7 Mon Sep 17 00:00:00 2001 From: Johann POLEWCZYK Date: Fri, 3 Jan 2025 22:23:05 +0100 Subject: [PATCH] Update wire.py for lava output --- scripts/artifacts/wire.py | 168 +++++++++++++++++--------------------- 1 file changed, 74 insertions(+), 94 deletions(-) diff --git a/scripts/artifacts/wire.py b/scripts/artifacts/wire.py index 27913605..80a922d0 100644 --- a/scripts/artifacts/wire.py +++ b/scripts/artifacts/wire.py @@ -1,85 +1,78 @@ __artifacts_v2__ = { - "wire": { - "name": "Wire Artifacts", - "description": "Get Wire", + "wireAccount": { + "name": "Wire Account", + "description": "Wire account details", "author": "Elliot Glendye", - "version": "0.0.1", - "date": "2024-01-17", + "creation_date": "2024-01-21", + "last_update_date": "2025-01-03", "requirements": "", "category": "Wire", - "notes": "No notes at present.", - "paths": ('**/store.wiredatabase*'), - "function": "get_wire" + "notes": "", + "paths": ('*/mobile/Containers/Shared/AppGroup/*/AccountData/*/store/store.wiredatabase*'), + "output_types": "all", + "artifact_icon": "user" + }, + "wireMessages": { + "name": "Wire Messages", + "description": "Wire messages, including message sender, associated user identifiers and message type", + "author": "Elliot Glendye", + "creation_date": "2024-01-21", + "last_update_date": "2025-01-03", + "requirements": "", + "category": "Wire", + "notes": "", + "paths": ('*/mobile/Containers/Shared/AppGroup/*/AccountData/*/store/store.wiredatabase*'), + "output_types": "standard", + "artifact_icon": "message-circle" } } -import scripts.artifacts.artGlobals -import sqlite3 -from packaging import version -from scripts.artifact_report import ArtifactHtmlReport -from scripts.ilapfuncs import logfunc, tsv, open_sqlite_db_readonly +from scripts.ilapfuncs import artifact_processor, get_file_path, get_sqlite_db_records, convert_cocoa_core_data_ts_to_utc -def get_wire(files_found, report_folder, seeker, wrap_text, timezone_offset): - - for file_found in files_found: - file_found = str(file_found) - - iOSversion = scripts.artifacts.artGlobals.versionf - if version.parse(iOSversion) < version.parse('15'): - logfunc('Wire parsing has not been tested on iOS version ' + iOSversion) - - if file_found.endswith('store.wiredatabase'): - break - - else: - continue - - db = open_sqlite_db_readonly(file_found) - - account_query = (''' - SELECT DISTINCT - ZUSER.ZHANDLE AS 'User ID', +@artifact_processor +def wireAccount(files_found, report_folder, seeker, wrap_text, timezone_offset): + source_path = get_file_path(files_found, "store.wiredatabase") + data_list = [] + + query = ''' + SELECT + DISTINCT ZUSER.ZHANDLE AS 'User ID', ZUSER.ZNAME AS 'Display Name', - datetime(ZUSERCLIENT.ZACTIVATIONDATE + 978307200, 'unixepoch') AS 'Activation Date', + ZUSERCLIENT.ZACTIVATIONDATE AS 'Activation Date', ZUSER.ZPHONENUMBER AS 'Phone Number', ZUSER.ZEMAILADDRESS AS 'Email Address', ZUSERCLIENT.ZACTIVATIONLOCATIONLATITUDE AS 'Activation Latitude', ZUSERCLIENT.ZACTIVATIONLOCATIONLONGITUDE AS 'Activation Longitude' FROM ZUSER - LEFT JOIN ZUSERCLIENT ON ZUSER.Z_PK = ZUSERCLIENT.ZUSER; - ''') - - cursor = db.cursor() - cursor.execute(account_query) - - all_rows = cursor.fetchall() - usageentries = len(all_rows) - data_list = [] - print(data_list) - - if usageentries > 0: - for row in all_rows: - data_list.append((row[0], row[1], row[2], row[3], row[4], row[5], row[6])) - - description = 'A report of Wire account details.' + LEFT JOIN ZUSERCLIENT ON ZUSER.Z_PK = ZUSERCLIENT.ZUSER; + ''' - report = ArtifactHtmlReport('Wire Account') - report.start_artifact_report(report_folder, 'Wire Account', description) - report.add_script() - data_headers = ('User ID', 'Display Name', 'Activation Date', 'Phone Number', 'Email Address', 'Activation Latitude', 'Activation Longitude') - report.write_artifact_data_table(data_headers, data_list, file_found) - report.end_artifact_report() - - tsvname = 'Wire Account' - tsv(report_folder, data_headers, data_list, tsvname) + data_headers = ( + 'User ID', + 'Display Name', + ('Activation Date', 'datetime'), + ('Phone Number', 'phonenumber'), + 'Email Address', + 'Latitude', + 'Longitude' + ) + + db_records = get_sqlite_db_records(source_path, query) + + for record in db_records: + activation_date = convert_cocoa_core_data_ts_to_utc(record[2]) + data_list.append((record[0], record[1], activation_date, record[3], record[4], record[5], record[6])) - else: - logfunc('No Wire account details present') - + return data_headers, data_list, source_path - message_query = (''' +@artifact_processor +def wireMessages(files_found, report_folder, seeker, wrap_text, timezone_offset): + source_path = get_file_path(files_found, "store.wiredatabase") + data_list = [] + + query = ''' SELECT - datetime(ZMESSAGE.ZSERVERTIMESTAMP + 978307200, 'unixepoch') AS 'Date / Time', + ZMESSAGE.ZSERVERTIMESTAMP AS 'Date / Time', ZUSER.ZHANDLE AS 'User ID', ZUSER.ZNAME AS 'Display Name', ZMESSAGE.ZNORMALIZEDTEXT AS 'Message', @@ -91,35 +84,22 @@ def get_wire(files_found, report_folder, seeker, wrap_text, timezone_offset): END AS 'Message Type', ZMESSAGE.ZDURATION AS 'Call Duration (seconds)' FROM ZMESSAGE - LEFT Join ZUSER On ZUSER.Z_PK = ZMESSAGE.ZSENDER - WHERE ZMESSAGE.ZCACHEDCATEGORY != 1; - ''') + LEFT Join ZUSER On ZUSER.Z_PK = ZMESSAGE.ZSENDER + WHERE ZMESSAGE.ZCACHEDCATEGORY != 1; + ''' - cursor = db.cursor() - cursor.execute(message_query) - - all_rows = cursor.fetchall() - usageentries = len(all_rows) - data_list = [] + data_headers = ( + ('Date / Time', 'datetime'), + 'User ID', + 'Display Name', + 'Message', + 'Message Type', + 'Call Duration (seconds)') + + db_records = get_sqlite_db_records(source_path, query) - if usageentries > 0: - for row in all_rows: - data_list.append((row[0], row[1], row[2], row[3], row[4], row[5])) - - description = 'A report of Wire messages, including message sender, associated user identifiers and message type.' - - report = ArtifactHtmlReport('Wire Messages') - report.start_artifact_report(report_folder, 'Wire Messages', description) - report.add_script() - data_headers = ('Date / Time', 'User ID', 'Display Name', 'Message', 'Message Type', 'Call Duration (seconds)') - report.write_artifact_data_table(data_headers, data_list, file_found) - report.end_artifact_report() - - tsvname = 'Wire Messages' - tsv(report_folder, data_headers, data_list, tsvname) - - else: - logfunc('No Wire messages present') - - db.close() - return \ No newline at end of file + for record in db_records: + date_time = convert_cocoa_core_data_ts_to_utc(record[0]) + data_list.append((date_time, record[1], record[2], record[3], record[4], record[5])) + + return data_headers, data_list, source_path \ No newline at end of file