Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NSKeyedAchiverParser #2353

Open
wants to merge 23 commits into
base: master
Choose a base branch
from
Open

NSKeyedAchiverParser #2353

wants to merge 23 commits into from

Conversation

patrickdalla
Copy link
Collaborator

Closes #2351.

@patrickdalla
'#1773 adds categories to include bplist files.
8c95b82
@patrickdalla
'#1773 Replaces Tika PListParser with IPED custom bplist parser
cb4281e
@patrickdalla
'#1773 PListParser implementation
d2e553f
@patrickdalla
'#1773 Configuration to make bplist preview html
af86f3a
@patrickdalla
'#1773 The style sheet to implement the BPList html tree view uses the
fb314d5 
child combinator (https://www.w3.org/TR/selectors/#child-combinators)
which uses the '>' character that was being escaped by
ToXMLContentHandler. I've made some changes to avoid XML escape
application when calling characters inside 'style' element, so the > is
preserved as is.
@patrickdalla
'#1773 Avoid showing empty details
c9ae918
@patrickdalla
'#1773 Parses great long numbers as datetime
7c3aa8f
@patrickdalla
'#1773 Expands all parents of each hit
a83115d
@patrickdalla
'#1773 Represents values as li tag as it has no details.
e0b12b6
@patrickdalla
'#1773 adds missing CSS and JS. Calls method to open tree nodes only
4bf3fd1 
when the page has declared an window.containsNavigableTree boolean
variable with true value to avoid unnecessary code execution.
@patrickdalla
'#1773 Set makepreview config to enable javascript execution to open
8784bea 
node trees of search hits. Adds text do inform that NSData was extracted
as subitem.
@patrickdalla
'#1773 skip caracter escape when inside script tag
7d82ac9
@patrickdalla
'#2351 Implements NSKeyedArchiver detector.
756372b
@patrickdalla
Merge branch 'BPListParser' into NSKeyedAchiverParser
7b2f0bb
@patrickdalla
'#2351 Removes erroneous line
86a10ea
@patrickdalla
'#2351 Creates function to scroll object into view, opening all its
b315d4c 
parent and highlighting it for 1 second.
@patrickdalla
'#2351 NSKeyedArchiver parser implementation.
ee770c4
@patrickdalla
'#2351 Propagates path correctly to name date values metadata.
1c2b28d
@patrickdalla
'#2351 corrects js call.
685cdce
@patrickdalla
'#2351 Implements some error avoidance code.
8d158dd
@patrickdalla
Copy link
Collaborator Author

This implementation is dependent of BPList PR, so it has the commits of that PR too.

@patrickdalla
Copy link
Collaborator Author

patrickdalla commented Oct 29, 2024 •
edited
Loading

Some issues/improvements derived from this implementation:

  1. Can be implemented "specialized" parsers for specific object classes found inside the Object graph. Maybe an improvement can be to extract such kind of objects as new subitems, once registered. For example, I found some objects with info o a IGUser class that seems to represent instagram user information inside of a NSKeyedArchiver file of a IGDirectBanyanRankedRecipientsCollection object.
    image

  2. The metadata name of the extracted timestamps are given as the tree path to the variable. I think IPED was not designed to support such long metadata names. One possible solution is to extract any object that has as timestamp field member as subitem, so the metadata name would be the path starting from this object class name.
    image

@patrickdalla
Copy link
Collaborator Author

On the long metadata name given from path issue: i've found one case that was leading to IPED indexing halt due to this long names (concatenated in eventtimegroups metadata) so I changed the implementation to use only the last member name on the object path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

NSKeyedArchiver parser
1 participant
@patrickdalla