search

abrignoni / iLEAPP

iOS Logs, Events, And Plist Parser
MIT License
740 stars 154 forks source link

Inconsistent join on Z_PK in DataUsage.sqlite #705

Closed Schramp closed 7 months ago

Schramp commented 7 months ago

netusage incorrectly joined two tables of DataUsage.sqlite on Z_PK. Compared to code in ./scripts/artifacts/DataUsage.py

Schramp commented 7 months ago

Sorry for the late update, while inspecting the diff I noticed a vim artefact that added a trailing newline

stark4n6 commented 7 months ago

@Schramp I tried your updated query on a test CTF image and it failed, are you sure your query is correct?

stark4n6 commented 7 months ago

@Schramp do you mean at line 136 instead?

stark4n6 commented 7 months ago

@Schramp I'll get this patched up, I think I made both parsers and combined both in the NetUsage at some point, not realizing the other was already here. So what I'll do is remove the DataUsage section from the NetUsage.py and it'll be two separate parsers now.

I had found some small other bugs in the NetUsage script as is so I'll push all of it over shortly to the main repo. Going to close this PR out.