def _convert_nodepath(self, raw_path): ''' huawei: /data/user/0/com.baidu.searchbox/files/template/profile.zip ''' try: if not raw_path: return if self.rename_file_path is not None: # '/storage/emulated', '/data/media' raw_path = raw_path.replace(self.rename_file_path[0], self.rename_file_path[1]) fs = self.root.FileSystem for prefix in [ '', '/data', ]: file_node = fs.GetByPath(prefix + raw_path) if file_node and file_node.Type == NodeType.File: return file_node.AbsolutePath invalid_path = re.search(r'[\\:*?"<>|\r\n]+', raw_path) if invalid_path: return nodes = list(fs.Search(raw_path)) if nodes and nodes[0].Type == NodeType.File: return nodes[0].AbsolutePath except: tp('android_browser.py _conver_2_nodeapth error, raw_path:', raw_path) exc()
def _convert_nodepath(self, raw_path): try: if not raw_path: return if self.rename_file_path: # replace: '/storage/emulated', '/data/media' raw_path = raw_path.replace(self.rename_file_path[0], self.rename_file_path[1]) fs = self.root.FileSystem for prefix in [ '', '/data', ]: file_node = fs.GetByPath(prefix + raw_path) if file_node and file_node.Type == NodeType.File: return file_node.AbsolutePath invalid_path = re.search(r'[\\:*?"<>|\r\n]+', raw_path) if invalid_path: return nodes = list(fs.Search(raw_path)) if nodes and nodes[0].Type == NodeType.File: return nodes[0].AbsolutePath except: tp('android_chrome.py _conver_2_nodeapth error, raw_path:', raw_path) exc()
def _convert_email(eml): """ :eml: (str) pangu_x01 <*****@*****.**>, pangu_x02 <*****@*****.**> :rtype: [email protected] pangu_x01 [email protected] pangu_x02 """ if not eml: return None try: res = '' _name = '' _email = '' for i in eml.split(', '): _name_address = i.split(' ') if len(_name_address) == 2: _name = MailUtils.encoded_mailaddress_name( _name_address[0]) _email = _name_address[1][1:-1] elif '@' in _name_address[0]: _email = _name_address[0] else: tp(_name_address) _name = _name_address[0] res += ' ' + _email + ' ' + _name return res.lstrip() except: exc() tp(eml) return None
def _bookmark_from_json(self, json_list, is_synced=False): ''' chrome _bookmark_from_json recursively Args: json_list (list of dict): Returns: None ''' for bookmark_dict in json_list: bookmark_type = bookmark_dict.get('type', None) if bookmark_type == 'folder' and bookmark_dict.get('children', []): self._bookmark_from_json(bookmark_dict.get('children', []), is_synced) elif bookmark_type == 'url': bm = model_browser.Bookmark() bm.id = bookmark_dict.get('id', None) # bm.owneruser = self.cur_account_name bm.time = self._convert_webkit_ts(bookmark_dict.get('date_added', None)) bm.title = bookmark_dict.get('name', None) bm.url = bookmark_dict.get('url', None) bm.owneruser = self.cur_account_name bm.is_synced = is_synced bm.source = self.cur_json_source self.csm.db_insert_table_bookmarks(bm) else: tp('>>> chrome new bookmark type:', bookmark_type)
def _convert_friend_type(ZCONTACTTYPE): '''ZUSER 'ZCONTACTTYPE' field to model_im FRIEND_TYPE_ :type ZTYPE: int :rtype: int ''' if not ZCONTACTTYPE: return type_map = { # 1: model_im.FRIEND_TYPE_ , # = 0 通讯录好友 0: model_im.FRIEND_TYPE_NONE, # = 0 未知 # 2: model_im.FRIEND_TYPE_FRIEND, # = 1 好友 # 3: model_im.FRIEND_TYPE_FANS, # = 3 粉丝 # 4: model_im.FRIEND_TYPE_FOLLOW, # = 4 关注 5: model_im.FRIEND_TYPE_GROUP_FRIEND, # = 2 群好友 # 6: model_im.FRIEND_TYPE_SPECAIL_FOLLOW, # = 5 特别关注 # 7: model_im.FRIEND_TYPE_MUTUAL_FOLLOW, # = 6 互相关注 8: model_im.FRIEND_TYPE_SUBSCRIBE, # = 8 官方账号 - 公众号 # 9: model_im.FRIEND_TYPE_RECENT, # = 7 最近 # 10: model_im.FRIEND_TYPE_STRANGER, # = 9 陌生人 } try: return type_map[ZCONTACTTYPE] except: tp('new ZCONTACTTYPE {}!!!!!!!!!!!!!!!!!'.format(ZCONTACTTYPE))
def analyze_yixin(root, extract_deleted, extract_source): if root.AbsolutePath == '/data/media/0/Android/data/im.yixin': return tp(root.AbsolutePath) pr = ParserResults() _pr = base_analyze(AppleYiXinParser, root, bcp_im.CONTACT_ACCOUNT_TYPE_IM_YIXIN, VERSION_APP_VALUE, build_name='易信', db_name='yixin_i') gc.collect() pr.Add(_pr) return pr
def _convert_chat_type(ZTYPE): ''' ZCHAT 'ZTYPE' field to model_im.py CHAT_TYPE :type ZTYPE: int :rtype: int ''' type_map = { 0: model_im.CHAT_TYPE_FRIEND, 2: model_im.CHAT_TYPE_GROUP, } try: return type_map[ZTYPE] except: tp('new CHAT_TYPE {}!!!!!!!!!!!!!!!!!'.format(ZTYPE))
def parse_main(self): for user in self.user_id_list: self.friends = {} self.chatrooms = {} self.user_id = user tp(user) self.get_user() self.get_contacts() self.get_chats() self.user_id = '' self.friends = None self.chatrooms = None
def _convert_2_nodepath(self, raw_path, file_name): try: # huawei: /data/user/0/com.baidu.searchbox/files/template/profile.zip paths = [ '/data/com.baidu.searchbox/files/template/', '/storage/emulated/0/baidu/flyflow/downloads/', 'data/media/0/baidu/' ] fs = self.root.FileSystem # 新版本 file_nodes = list(fs.Search(raw_path)) if file_nodes: file_node = file_nodes[0] if file_node.Type == NodeType.File: return file_node.AbsolutePath # 老版本 if not file_name: raw_path_list = raw_path.split(r'/') file_name = raw_path_list[-1] for path in paths: # tp(self.root.FileSystem.AbsolutePath) # tp(os.path.join(path, file_name)) #path_node = self.root.FileSystem.GetByPath(os.path.join(path, file_name)) path_node = self.root.FileSystem.GetByPath('data.tar') # tp(self.root.FileSystem.Children) if path_node: if path_node.Type == NodeType.File: return path_node.AbsolutePath _path = None if len(file_name) > 0: try: invalid_file_name = re.search(r'[\\/:*?"<>|\r\n]+', file_name) if invalid_file_name: return file_name node = fs.Search(r'baidu.*?/{}$'.format(file_name)) for i in node: _path = i.AbsolutePath except: pass if _path: return _path return _path if _path else file_name except: tp('android_baidubrowser.py _conver_2_nodeapth error, file_name:', file_name) exc() return file_name
def analyze_ucbrowser(node, extract_deleted, extract_source): ''' com.UCMobile/databases/WXStorage$ ''' tp('android_ucbrowser.py is running ...') res = [] pr = ParserResults() try: res = AndroidUCParser(node, db_name='UC_A').parse(bcp_browser.NETWORK_APP_UC, VERSION_APP_VALUE) except: TraceService.Trace(TraceLevel.Debug, 'analyze_ucbrowser 解析新案例 <{}> 出错: {}'.format(CASE_NAME, traceback.format_exc())) if res: pr.Models.AddRange(res) pr.Build('UC浏览器') tp('android_ucbrowser.py is finished !') return pr
def _decode_mms_subject(_rec_value): ''' handle mms subject garbled ''' try: if IsDBNull(_rec_value): return _list = list(bytearray(_rec_value, 'utf8', 'ignore')) if _list.count(0) < 2 or _list[:2] != [0xff, 0xfe]: _res = _rec_value.decode('utf8', 'ignore') else: # 去 0 stripped_list = _list[2:-1:2] _res = str(bytearray(stripped_list, 'utf8', 'ignore')).decode('utf8') return _res except: tp('_decode_mms_subject' + _rec_value) return _rec_value
def _read_plist(plist_node, *keys): ''' read .plist file :type plist_node: node :type keys: tuple(*str) :rtype: tuple(*str) ''' res = {} bp = BPReader(plist_node.Data).top for k in keys: try: # tp(k) if bp and bp[k]: res[k] = bp[k].Value # tp(res[k]) except: tp('plist error key:', k) return res
def encoded_mailaddress_name(encoded_words): ''' "=?UTF-8?B?572R5piT5Lil6YCJ?=" -> 网易邮件中心''' try: encoded_word_regex = r'=\?{1}(.+)\?{1}([B|Q])\?{1}(.+)\?{1}=' re_m = re.match(encoded_word_regex, encoded_words) if re_m is None: return encoded_words charset, encoding, encoded_text = re_m.groups() if encoding == 'B': byte_string = base64.b64decode(encoded_text) elif encoding == 'Q': byte_string = quopri.decodestring(encoded_text) else: tp(encoded_words) return encoded_words return byte_string.decode(charset) except: exc() return encoded_words
def _convert_msg_status(ZSENDSTATUS): '''ZMESSAGE 'ZSENDSTATUS' field to model_im MESSAGE_STATUS_ :type ZTYPE: int :rtype: int ''' if not ZSENDSTATUS: return type_map = { 0: model_im.MESSAGE_STATUS_DEFAULT, # 1: model_im.MESSAGE_STATUS_READ, # 2: model_im.MESSAGE_STATUS_UNSENT, # # 3: model_im.MESSAGE_STATUS_UNREAD, # # 2: model_im.MESSAGE_STATUS_SENT, # } try: return type_map[ZSENDSTATUS] except: tp('new ZSENDSTATUS {}!!!!!!!!!!!!!!!!!'.format(ZSENDSTATUS))
def _convert_nodepath(self, raw_path): ''' huawei: /data/user/0/com.baidu.searchbox/files/template/profile.zip ''' try: if not raw_path: return fs = self.root.FileSystem file_node = fs.GetByPath(raw_path) if file_node and file_node.Type == NodeType.File: return file_node.AbsolutePath invalid_path = re.search(r'[\\:*?"<>|\r\n]+', raw_path) if invalid_path: return nodes = list(fs.Search(raw_path)) if nodes and nodes[0].Type == NodeType.File: return nodes[0].AbsolutePath except: tp('apple_chrome.py _conver_2_nodeapth error, raw_path:', raw_path) exc()
def _search_media_file(self, raw_file_path, path_flag='Yixin'): try: if not raw_file_path: return if self.media_node: file_path = raw_file_path.split(path_flag)[1] _node = self.media_node.GetByPath(file_path) if _node: tp('!!!!!!!!! find file_path:', _node.AbsolutePath) return _node.AbsolutePath else: # save media file node res_file_path = self._fs_search(raw_file_path) if res_file_path and path_flag in res_file_path: _path = res_file_path.split(path_flag)[0] self.media_node = self.root.FileSystem.GetByPath(_path + path_flag) if res_file_path: tp('!!!!!!!!! find file_path:', res_file_path) return res_file_path except: exc() return
def _convert_send_status(ZSENDSTATUS): '''ZMESSAGE 'ZSENDSTATUS' field to model_im MESSAGE_STATUS_ :type ZTYPE: int :rtype: int MESSAGE_STATUS_DEFAULT = 0 MESSAGE_STATUS_UNSENT = 1 MESSAGE_STATUS_SENT = 2 MESSAGE_STATUS_UNREAD = 3 MESSAGE_STATUS_READ = 4 ''' if not ZSENDSTATUS: return type_map = { 0: model_im.MESSAGE_STATUS_DEFAULT, 1: model_im.MESSAGE_STATUS_READ, 2: model_im.MESSAGE_STATUS_UNSENT, } try: return type_map[ZSENDSTATUS] except: tp('new ZSENDSTATUS {}!!!!!!!!!!!!!!!!!'.format(ZSENDSTATUS))
def analyze_sim(node, extract_deleted, extract_source): """ android 小米 SIM (user_de/0/com.android.providers.telephony/databases/telephony.db) user_de/0/com.android.providers.telephony/databases$ """ node_path = node.AbsolutePath tp(node.AbsolutePath) _Parser = SIMParser if node_path.endswith('sim/sim.db'): _Parser = SIMParser_no_tar elif node_path.endswith( 'com.android.providers.telephony/databases/telephony.db'): _Parser = SIMParser elif node_path.endswith('simcardmanagement.db'): _Parser = OldSamsungSIMParser return base_analyze(_Parser, node, bcp_basic.BASIC_SIM_INFORMATION, VERSION_APP_VALUE, build_name='SIM 卡', db_name='AndroidSIM')
def _convert_msg_type(ZCONTENTTYPE): '''ZMESSAGE 'ZMESSAGETYPE' field to model_im CHAT_TYPE :type ZTYPE: int :rtype: int ''' type_map = { 0: model_im.MESSAGE_CONTENT_TYPE_TEXT, # TEXT 1: model_im.MESSAGE_CONTENT_TYPE_IMAGE, # 图片 2: model_im.MESSAGE_CONTENT_TYPE_VIDEO, # 视频 3: model_im.MESSAGE_CONTENT_TYPE_VOICE, # 语音 # 5: model_im.MESSAGE_CONTENT_TYPE_, 6: model_im.MESSAGE_CONTENT_TYPE_VOIP, # 网络电话 7: model_im.MESSAGE_CONTENT_TYPE_EMOJI, # 表情 13: None, # 推荐好友名片 14: model_im.MESSAGE_CONTENT_TYPE_ATTACHMENT, # 附件 16: None, # 群系统消息, 群记事本/添加群相册... 18: model_im.MESSAGE_CONTENT_TYPE_SYSTEM, # 删除图片 100: model_im.MESSAGE_CONTENT_TYPE_LOCATION, # 位置 } try: return type_map[ZCONTENTTYPE] except: tp('new ZCONTENTTYPE {}!!!!!!!!!!!!!!!!!'.format(ZCONTENTTYPE))
def parse_Chatroom(self, table_name, CHATROOM_MEMBER_COUNT): ''' account_id+'/Messages/Line.sqlite', 'ZGROUP' :type CHATROOM_MEMBER_COUNT: :rtype CHATROOM_MID_NAME: :rtype CHATROOM_PK_MID: ''' ''' RecNo FieldName SQLType Size 1 Z_PK INTEGER 2 Z_ENT INTEGER 3 Z_OPT INTEGER 4 ZALERT INTEGER 5 ZENABLE INTEGER 6 ZFAVORITEORDER INTEGER 7 ZISACCEPTED INTEGER 8 ZISPREVENTLINKINVITATION INTEGER 9 ZISVIEWED INTEGER creator_id 10 ZCREATOR INTEGER create_time 11 ZCREATEDTIME TIMESTAMP mid 12 ZID VARCHAR 13 ZLINKINVITATION VARCHAR name 14 ZNAME VARCHAR photo 15 ZPICTURESTATUS VARCHAR account_id # 账号ID[TEXT] chatroom_id # 群ID[TEXT] name # 群名称[TEXT] photo # 群头像[TEXT] type # 群类型[INT] notice # 群声明[TEXT] description # 群描述[TEXT] creator_id # 创建者[TEXT] owner_id # 管理员[TEXT] member_count # 群成员数量[INT] max_member_count # 群最大成员数量[INT create_time # 创建时间[INT] ''' CHATROOM_MID_NAME = {} CHATROOM_PK_MID = {} for rec in self._read_table(table_name): if canceller.IsCancellationRequested: return () if self._is_empty(rec, 'ZNAME', 'ZID') or rec['ZISACCEPTED'].Value != 1: continue chatroom = model_im.Chatroom() chatroom.account_id = self.cur_account_id chatroom.chatroom_id = rec['ZID'].Value chatroom.name = rec['ZNAME'].Value pic_url = rec['ZPICTURESTATUS'].Value chatroom.photo = self._search_profile_img( pic_url) if pic_url else None chatroom.creator_id = str(rec['ZCREATOR'].Value) chatroom.create_time = self._convert_ios_time( rec['ZCREATEDTIME'].Value) chatroom.member_count = CHATROOM_MEMBER_COUNT.get( rec['Z_PK'].Value, None) chatroom.deleted = 1 if rec.IsDeleted else 0 chatroom.source = self.cur_db_source try: CHATROOM_MID_NAME[chatroom.chatroom_id] = chatroom.name CHATROOM_PK_MID[rec['Z_PK'].Value] = chatroom.chatroom_id except: tp('self.CHATROOM_MID_NAME', CHATROOM_MID_NAME) tp('chatroom.chatroom_id', chatroom.chatroom_id) exc() try: chatroom.insert_db(self.csm) except: exc() self.csm.db_commit() return CHATROOM_MID_NAME, CHATROOM_PK_MID
def _get_msg_media_path(self, json_data, LOCAL_IMG): ''' Media Path: Documents/DataContainer/Data/110609878986/Publish # self.account.mid /Image/ /OriginalVideo/ /96C32D00-F5A7-45BF-A749-CDCD1FA2BDFB 96C32D00-F5A7-45BF-A749-CDCD1FA2BDFB DraftVideo_1548212946.405598.mp4 /Video/ 9dd1328e2287a0e5274ebb586bf4a6b8.mp4 { "height":183, "image_type":"webp", "url":{ "uri":"", "url_list":["http://dl2.weshineapp.com/300/bb8801168996fbbc5b99c7f6ae26a537.webp?v\u003d5993cba02eaf3"]}, "width":300, "aweType":0, "classic_show_type":0, "msg_from":0, "msgHint":"" } { "poster": { "uri":"tos-cn-o-0061\/3510d97cd0a94922a27553e49ce33362" }, "post_type":1, "height":1024, "width":576, "check_pics":["tos-cn-o-0812\/53c127df0eb44908ac78bd138165b0b2"], "duration":5836, "from_gallery":0, "video":{"vid":"v0303db10000bh3tlvllt63vlha4sbfg"}, "mass_msg":1, "check_texts":["my"] } ''' try: tp(json_data) img_uri = '' filename = '' # 视频 if json_data.has_key('story'): img_uri = json_data.get('story', {}).get('cover', {}).get('uri', None) elif json_data.has_key('poster'): if json_data.has_key('video'): img_uri = json_data.get('poster', {}).get('oid', None) else: img_uri = json_data.get('poster', {}).get('uri', None) # 图片 elif json_data.has_key('resource_url'): img_uri = json_data.get('resource_url', {}).get('oid', '') # 官方动图表情 if 'webp' in [ json_data.get('image', None), json_data.get('image_type', None) ]: img_uri = json_data.get('url', {}).get('url_list', [''])[0] # filename if img_uri: if LOCAL_IMG.has_key(img_uri): filename = LOCAL_IMG.get(img_uri, {}).get('filename') else: for k in LOCAL_IMG: if re.search(img_uri, k): filename = LOCAL_IMG.get(k, {}).get('filename') if filename: _path = DUOSHAN_LOCAL_IMG_PATH + filename _node = self.root.GetByPath(_path) if _node: return _node.AbsolutePath return img_uri except: exc()
def _db_reader_get_int_value(reader, index, default_value=0): try: return reader.GetInt64(index) if not reader.IsDBNull(index) else default_value except: tp(index, reader[index], type(reader[index])) exc()
def _db_reader_get_string_value(reader, index, default_value=''): try: return reader.GetString(index) if not reader.IsDBNull(index) else default_value except: tp(index, reader[index], type(reader[index])) exc()