Skip to content

Maite modules batch 8 #1323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Maite modules batch 8 #1323

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c4612b2
Refactor biomes artifacts
Maite2003 Oct 31, 2025
7ee5418
Refactor biomeDKKeybag
Maite2003 Oct 31, 2025
f872686
Refactor biomeNotes.py
Maite2003 Oct 31, 2025
6669d2e
Refactor biomeInfocus.py
Maite2003 Oct 31, 2025
b0a18cd
change output type of biomeUseractmeta
Maite2003 Oct 31, 2025
29d364d
Refactor biomeUseractmeta
Maite2003 Nov 3, 2025
7c6d57a
Refactor biomeIntents.py
Maite2003 Nov 3, 2025
dfd088c
Replace plist logic with get_plist_content
Maite2003 Nov 3, 2025
5f5b4e1
removed unused imports
Maite2003 Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 51 additions & 13 deletions scripts/artifacts/biomeAirpMode.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
"name": "Biome - Airplane Mode DKEvent",
"description": "Parses airplane mode entries from biomes",
"author": "@JohnHyla",
"version": "0.0.2",
"date": "2020-04-30",
"creation_date": "2020-04-30",
"last_update_date": "2025-10-31",
"requirements": "none",
"category": "Biome",
"notes": "",
Expand All @@ -15,28 +15,67 @@

import os
import blackboxprotobuf
from datetime import *
from datetime import timezone
from scripts.ccl_segb.ccl_segb import read_segb_file
from scripts.ccl_segb.ccl_segb_common import EntryState
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv, convert_ts_human_to_timezone_offset
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv

@artifact_processor
def get_biomeAirpMode(files_found, report_folder, seeker, wrap_text, timezone_offset):
def get_biomeAirpMode(context):

typess = {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'str', 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}}, 'name': ''}, '2': {'type': 'double', 'name': ''}, '3': {'type': 'double', 'name': ''}, '4': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '3': {'type': 'bytes', 'message_typedef': {'8': {'type': 'fixed64', 'name': ''}}, 'name': ''}}, 'name': ''}, '5': {'type': 'bytes', 'name': ''}, '8': {'type': 'fixed64', 'name': ''}, '10': {'type': 'int', 'name': ''}}
typess = {
'1': {
'type': 'message',
'message_typedef': {
'1': {'type': 'str', 'name': ''},
'2': {
'type': 'message',
'message_typedef': {
'1': {'type': 'int', 'name': ''},
'2': {'type': 'int', 'name': ''}
},
'name': ''
}
},
'name': ''
},
'2': {'type': 'double', 'name': ''},
'3': {'type': 'double', 'name': ''},
'4': {
'type': 'message',
'message_typedef': {
'1': {
'type': 'message',
'message_typedef': {
'1': {'type': 'int', 'name': ''},
'2': {'type': 'int', 'name': ''}
},
'name': ''
},
'3': {
'type': 'bytes',
'message_typedef': {
'8': {'type': 'fixed64', 'name': ''}
},
'name': ''
}
},
'name': ''
},
'5': {'type': 'bytes', 'name': ''},
'8': {'type': 'fixed64', 'name': ''},
'10': {'type': 'int', 'name': ''}
}

data_list = []
report_file = 'Unknown'
for file_found in files_found:
for file_found in context.get_files_found():
file_found = str(file_found)
filename = os.path.basename(file_found)
if filename.startswith('.'):
continue
if os.path.isfile(file_found):
if 'tombstone' in file_found:
continue
else:
report_file = os.path.dirname(file_found)
else:
continue

Expand All @@ -46,10 +85,9 @@ def get_biomeAirpMode(files_found, report_folder, seeker, wrap_text, timezone_of
ts = ts.replace(tzinfo=timezone.utc)

if record.state == EntryState.Written:
protostuff, types = blackboxprotobuf.decode_message(record.data, typess)
protostuff, _ = blackboxprotobuf.decode_message(record.data, typess)
timestart = (webkit_timestampsconv(protostuff['2']))
timeend = (webkit_timestampsconv(protostuff['3']))
#timeend = convert_ts_int_to_utc(timeend)
event = protostuff['1']['1']
guid = protostuff['5'].decode()

Expand All @@ -61,6 +99,6 @@ def get_biomeAirpMode(files_found, report_folder, seeker, wrap_text, timezone_of
data_headers = (('SEGB Timestamp', 'datetime'), ('Timestamp', 'datetime'), ('Timestamp2', 'datetime'), 'SEGB State'
, 'Event', 'GUID', 'Filename', 'Offset')

return data_headers, data_list, report_file
return data_headers, data_list, 'see Filename for more info'


88 changes: 72 additions & 16 deletions scripts/artifacts/biomeAppinstall.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
"name": "Biome - App Install",
"description": "Parses airplane mode entries from biomes",
"author": "@JohnHyla",
"version": "0.0.2",
"date": "2024-10-17",
"creation_date": "2024-10-17",
"last_update_date": "2025-10-31",
"requirements": "none",
"category": "Biome",
"notes": "",
Expand All @@ -18,25 +18,86 @@
import blackboxprotobuf
from scripts.ccl_segb.ccl_segb import read_segb_file
from scripts.ccl_segb.ccl_segb_common import EntryState
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv, convert_utc_human_to_timezone
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv

@artifact_processor
def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_offset):
def get_biomeAppinstall(context):

typess = {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'str', 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}}, 'name': ''}, '2': {'type': 'double', 'name': ''}, '3': {'type': 'double', 'name': ''}, '4': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '3': {'type': 'str', 'name': ''}}, 'name': ''}, '5': {'type': 'str', 'name': ''}, '7': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {}, 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '4': {'type': 'int', 'name': ''}, '3': {'type': 'str', 'name': ''}}, 'name': ''}, '3': {'type': 'int', 'name': ''}}, 'name': ''}, '8': {'type': 'double', 'name': ''}, '10': {'type': 'int', 'name': ''}}
typess = {
'1': {
'type': 'message',
'message_typedef': {
'1': {'type': 'str', 'name': ''},
'2': {
'type': 'message',
'message_typedef': {
'1': {'type': 'int', 'name': ''},
'2': {'type': 'int', 'name': ''}
},
'name': ''
}
},
'name': ''
},
'2': {'type': 'double', 'name': ''},
'3': {'type': 'double', 'name': ''},
'4': {
'type': 'message',
'message_typedef': {
'1': {
'type': 'message',
'message_typedef': {
'1': {'type': 'int', 'name': ''},
'2': {'type': 'int', 'name': ''}
},
'name': ''
},
'3': {'type': 'str', 'name': ''}
},
'name': ''
},
'5': {'type': 'str', 'name': ''},
'7': {
'type': 'message',
'message_typedef': {
'1': {
'type': 'message',
'message_typedef': {},
'name': ''
},
'2': {
'type': 'message',
'message_typedef': {
'1': {
'type': 'message',
'message_typedef': {
'1': {'type': 'int', 'name': ''},
'2': {'type': 'int', 'name': ''}
},
'name': ''
},
'4': {'type': 'int', 'name': ''},
'3': {'type': 'str', 'name': ''}
},
'name': ''
},
'3': {'type': 'int', 'name': ''}
},
'name': ''
},
'8': {'type': 'double', 'name': ''},
'10': {'type': 'int', 'name': ''}
}

data_list = []
report_file = 'Unknown'
for file_found in files_found:
for file_found in context.get_files_found():
file_found = str(file_found)
filename = os.path.basename(file_found)
if filename.startswith('.'):
continue
if os.path.isfile(file_found):
if 'tombstone' in file_found:
continue
else:
report_file = os.path.dirname(file_found)
else:
continue

Expand All @@ -46,15 +107,11 @@ def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_

if record.state == EntryState.Written:

protostuff, types = blackboxprotobuf.decode_message(record.data, typess)
protostuff, _ = blackboxprotobuf.decode_message(record.data, typess)

activity = (protostuff['1']['1'])
timestart = (webkit_timestampsconv(protostuff['2']))
timestart = convert_utc_human_to_timezone(timestart, timezone_offset)


timeend = (webkit_timestampsconv(protostuff['3']))
timeend = convert_utc_human_to_timezone(timeend, timezone_offset)

bundleid = (protostuff['4']['3'])
actionguid = (protostuff['5'])
Expand All @@ -73,7 +130,6 @@ def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_
bundleinfo = ''

timewrite = (webkit_timestampsconv(protostuff['8']))
timewrite = convert_utc_human_to_timezone(timewrite, timezone_offset)

data_list.append((ts, timestart, timeend, timewrite, record.state.name, activity, bundleid, bundleinfo,
appinfo1, appinfo2, actionguid, filename, record.data_start_offset))
Expand All @@ -85,6 +141,6 @@ def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_

data_headers = (('SEGB Timestamp', 'datetime'), ('Timestamp', 'datetime'), ('Time End', 'datetime'), ('Time Write', 'datetime'), 'SEGB State', 'Activity', 'Bundle ID', 'Bundle Info', 'App Info', 'App Info2', 'Action GUID', 'Filename', 'Offset')

return data_headers, data_list, report_file
return data_headers, data_list, 'see Filename for more info'


18 changes: 7 additions & 11 deletions scripts/artifacts/biomeBacklight.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
"name": "Biome - Backlight",
"description": "Parses backlight entries from biomes",
"author": "@JohnHyla",
"version": "0.0.2",
"date": "2024-10-17",
"creation_date": "2024-10-17",
"last_update_date": "2025-10-31",
"requirements": "none",
"category": "Biome",
"notes": "",
Expand All @@ -19,26 +19,23 @@
import blackboxprotobuf
from scripts.ccl_segb.ccl_segb import read_segb_file
from scripts.ccl_segb.ccl_segb_common import EntryState
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv, convert_utc_human_to_timezone
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv


@artifact_processor
def get_biomeBacklight(files_found, report_folder, seeker, wrap_text, timezone_offset):
def get_biomeBacklight(context):

typess = {'1': {'type': 'double', 'name': ''}, '2': {'type': 'int', 'name': ''}}

data_list = []
report_file = 'Unknown'
for file_found in files_found:
for file_found in context.get_files_found():
file_found = str(file_found)
filename = os.path.basename(file_found)
if filename.startswith('.'):
continue
if os.path.isfile(file_found):
if 'tombstone' in file_found:
continue
else:
report_file = os.path.dirname(file_found)
else:
continue

Expand All @@ -47,10 +44,9 @@ def get_biomeBacklight(files_found, report_folder, seeker, wrap_text, timezone_o
ts = ts.replace(tzinfo=timezone.utc)

if record.state == EntryState.Written:
protostuff, types = blackboxprotobuf.decode_message(record.data, typess)
protostuff, _ = blackboxprotobuf.decode_message(record.data, typess)

timestart = (webkit_timestampsconv(protostuff['1']))
timestart = convert_utc_human_to_timezone(timestart, timezone_offset)
state = (protostuff['2'])

data_list.append((ts, timestart, record.state.name, state, filename, record.data_start_offset))
Expand All @@ -60,4 +56,4 @@ def get_biomeBacklight(files_found, report_folder, seeker, wrap_text, timezone_o
data_headers = (('SEGB Timestamp', 'datetime'), ('Timestamp', 'datetime'), 'SEGB State', 'State', 'Filename',
'Offset')

return data_headers, data_list, report_file
return data_headers, data_list, 'see Filename for more info'
Loading
Loading