dfindexeddb 20240229__py3-none-any.whl → 20240301__py3-none-any.whl

dfindexeddb/cli.py

@@ -19,10 +19,12 @@ from datetime import datetime
 import json
 import pathlib
 import sys
+import traceback
 
 from dfindexeddb.leveldb import log
 from dfindexeddb.leveldb import ldb
 from dfindexeddb.indexeddb import chromium
+from dfindexeddb import errors
 from dfindexeddb.indexeddb import v8
 
 
@@ -66,7 +68,13 @@ def IndexeddbCommand(args):
     return
 
   for record in records:
-    record = chromium.IndexedDBRecord.FromLevelDBRecord(record)
+    try:
+      record = chromium.IndexedDBRecord.FromLevelDBRecord(record)
+    except (errors.ParserError, errors.DecoderError) as err:
+      print(
+          (f'Error parsing blink value: {err} for {record.__class__.__name__} '
+           f'at offset {record.offset}'), file=sys.stderr)
+      print(f'Traceback: {traceback.format_exc()}', file=sys.stderr)
     _Output(record, to_json=args.json)
 
 

dfindexeddb/indexeddb/chromium.py

@@ -17,8 +17,6 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from datetime import datetime
 import io
-import sys
-import traceback
 from typing import Any, BinaryIO, Optional, Tuple, Type, TypeVar, Union
 
 from dfindexeddb import errors
@@ -406,7 +404,7 @@ class BaseIndexedDBKey:
       The decoded key.
     """
     decoder = utils.LevelDBDecoder(stream)
-    key_prefix = KeyPrefix.FromDecoder(decoder)
+    key_prefix = KeyPrefix.FromDecoder(decoder, base_offset=base_offset)
     return cls.FromDecoder(
         decoder=decoder, key_prefix=key_prefix, base_offset=base_offset)
 
@@ -963,6 +961,23 @@ class ObjectStoreMetaDataKey(BaseIndexedDBKey):
         offset=base_offset + offset, key_prefix=key_prefix,
         object_store_id=object_store_id, metadata_type=metadata_type)
 
+@dataclass
+class ObjectStoreDataValue:
+  """The parsed values from an ObjectStoreDataKey.
+
+  Attributes:
+    unknown: an unknown integer (possibly a sequence number?).
+    is_wrapped: True if the value was wrapped.
+    blob_size: the blob size, only valid if wrapped.
+    blob_offset: the blob offset, only valid if wrapped.
+    value: the blink serialized value, only valid if not wrapped.
+  """
+  unkown: int
+  is_wrapped: bool
+  blob_size: Optional[int]
+  blob_offset: Optional[int]
+  value: Any
+
 
 @dataclass
 class ObjectStoreDataKey(BaseIndexedDBKey):
@@ -974,11 +989,33 @@ class ObjectStoreDataKey(BaseIndexedDBKey):
   encoded_user_key: IDBKey
 
   def DecodeValue(
-      self, decoder: utils.LevelDBDecoder) -> Tuple[int, bytes]:
+      self, decoder: utils.LevelDBDecoder) -> ObjectStoreDataValue:
     """Decodes the object store data value."""
-    _, version = decoder.DecodeVarint()
-    _, encoded_string = decoder.ReadBytes()
-    return version, encoded_string
+    _, unknown_integer = decoder.DecodeVarint()
+
+    _, wrapped_header_bytes = decoder.PeekBytes(3)
+    if len(wrapped_header_bytes) != 3:
+      raise errors.DecoderError('Insufficient bytes')
+
+    if (wrapped_header_bytes[0] == definitions.BlinkSerializationTag.VERSION and
+        wrapped_header_bytes[1] == 0x11 and
+        wrapped_header_bytes[2] == 0x01):
+      _, blob_size = decoder.DecodeVarint()
+      _, blob_offset = decoder.DecodeVarint()
+      return ObjectStoreDataValue(
+          unkown=unknown_integer,
+          is_wrapped=True,
+          blob_size=blob_size,
+          blob_offset=blob_offset,
+          value=None)
+    _, blink_bytes = decoder.ReadBytes()
+    blink_value = blink.V8ScriptValueDecoder.FromBytes(blink_bytes)
+    return ObjectStoreDataValue(
+        unkown=unknown_integer,
+        is_wrapped=False,
+        blob_size=None,
+        blob_offset=None,
+        value=blink_value)
 
   @classmethod
   def FromDecoder(
@@ -990,7 +1027,7 @@ class ObjectStoreDataKey(BaseIndexedDBKey):
         definitions.KeyPrefixType.OBJECT_STORE_DATA):
       raise errors.ParserError('Invalid KeyPrefix for ObjectStoreDataKey')
     offset = decoder.stream.tell()
-    encoded_user_key = IDBKey.FromDecoder(decoder, base_offset)
+    encoded_user_key = IDBKey.FromDecoder(decoder, offset)
     return cls(
         offset=base_offset + offset,
         key_prefix=key_prefix, encoded_user_key=encoded_user_key)
@@ -1017,7 +1054,7 @@ class ExistsEntryKey(BaseIndexedDBKey):
   ) -> ExistsEntryKey:
     """Decodes the exists entry key."""
     offset = decoder.stream.tell()
-    encoded_user_key = IDBKey.FromDecoder(decoder, base_offset)
+    encoded_user_key = IDBKey.FromDecoder(decoder, offset)
 
     return cls(
         offset=base_offset + offset,
@@ -1048,7 +1085,7 @@ class IndexDataKey(BaseIndexedDBKey):
                  base_offset: int = 0) -> IndexDataKey:
     """Decodes the index data key."""
     offset = decoder.stream.tell()
-    encoded_user_key = IDBKey.FromDecoder(decoder, base_offset)
+    encoded_user_key = IDBKey.FromDecoder(decoder, offset)
 
     if decoder.NumRemainingBytes() > 0:
       _, sequence_number = decoder.DecodeVarint()
@@ -1056,7 +1093,9 @@ class IndexDataKey(BaseIndexedDBKey):
       sequence_number = None
 
     if decoder.NumRemainingBytes() > 0:
-      encoded_primary_key = IDBKey.FromDecoder(decoder, base_offset)
+      encoded_primary_key_offset = decoder.stream.tell()
+      encoded_primary_key = IDBKey.FromDecoder(
+          decoder, encoded_primary_key_offset)
     else:
       encoded_primary_key = None
 
@@ -1089,7 +1128,7 @@ class BlobEntryKey(BaseIndexedDBKey):
   ) -> BlobEntryKey:
     """Decodes the blob entry key."""
     offset = decoder.stream.tell()
-    user_key = IDBKey.FromDecoder(decoder, base_offset)
+    user_key = IDBKey.FromDecoder(decoder, offset)
 
     return cls(key_prefix=key_prefix, user_key=user_key,
                offset=base_offset + offset)
@@ -1310,24 +1349,8 @@ class IndexedDBRecord:
       cls, record: Union[ldb.LdbKeyValueRecord, log.ParsedInternalKey]
   ) -> IndexedDBRecord:
     """Returns an IndexedDBRecord from a ParsedInternalKey."""
-    idb_key = IndexedDbKey.FromBytes(
-        record.key, base_offset=record.offset)
-
+    idb_key = IndexedDbKey.FromBytes(record.key, base_offset=record.offset)
     idb_value = idb_key.ParseValue(record.value)
-    if isinstance(idb_key, ObjectStoreDataKey):
-
-      # The ObjectStoreDataKey value should decode as a 2-tuple comprising
-      # a version integer and a SSV as a raw byte string
-      if (isinstance(idb_value, tuple) and len(idb_value) == 2 and
-          isinstance(idb_value[1], bytes)):
-
-        try:
-          blink_value = blink.V8ScriptValueDecoder.FromBytes(idb_value[1])
-          idb_value = idb_value[0], blink_value
-        except (errors.ParserError, errors.DecoderError) as err:
-          print(f'Error parsing blink value: {err}', file=sys.stderr)
-          print(f'Traceback: {traceback.format_exc()}', file=sys.stderr)
-
     return cls(
       offset=record.offset,
       key=idb_key,

dfindexeddb/version.py

@@ -14,7 +14,7 @@
 # limitations under the License.
 """Version information for dfIndexeddb."""
 
-__version__ = "20240229"
+__version__ = "20240301"
 
 
 def GetVersion():

{dfindexeddb-20240229.dist-info → dfindexeddb-20240301.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dfindexeddb
-Version: 20240229
+Version: 20240301
 Summary: dfindexeddb is an experimental Python tool for performing digital forensic analysis of IndexedDB and leveldb files.
 Author-email: Syd Pleno <sydp@google.com>
 Maintainer-email: dfIndexeddb Developers <dfindexeddb-dev@googlegroups.com>

{dfindexeddb-20240229.dist-info → dfindexeddb-20240301.dist-info}/RECORD

@@ -1,20 +1,20 @@
 dfindexeddb/__init__.py,sha256=KPYL9__l8od6_OyDfGRTgaJ6iy_fqIgZ-dS2S-e3Rac,599
-dfindexeddb/cli.py,sha256=LD2-BwmXC3qFcJwgP09QDFxU3HOGtsg0Kbtyx-hAqzA,4525
+dfindexeddb/cli.py,sha256=QsFPC_B_PW6E42kBPUO0Ny3oRspYJsXlDCQDHmKuDHQ,4866
 dfindexeddb/errors.py,sha256=PNpwyf_lrPc4TE77oAakX3mu5D_YcP3f80wq8Y1LkvY,749
 dfindexeddb/utils.py,sha256=g9iiGRX4DB1wFBSBHa6b9lg7JzAdE0SN0DrdB2aS_Co,10091
-dfindexeddb/version.py,sha256=XwHKYiT0CeLWo90AaJfOYHD1mEEgIlUUSB6ot_rU8wc,750
+dfindexeddb/version.py,sha256=d2fDd3V2U_CkGi3PawWMR77qU0DzHEC3_bk7Ywh3xlM,750
 dfindexeddb/indexeddb/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
 dfindexeddb/indexeddb/blink.py,sha256=MblpYfv-ByG7n_fjYKu2EUhpfVJdUveoW4oSAg5T4tY,3534
-dfindexeddb/indexeddb/chromium.py,sha256=Anw6QIU7PrsxpUW7qxrUXRb5vBRcxozhv3mHov7Ti8k,43984
+dfindexeddb/indexeddb/chromium.py,sha256=oHHyGuy7BanRWRoJu4zqXo5QvxO2j_qLk2KMHBBwZvs,44692
 dfindexeddb/indexeddb/definitions.py,sha256=yline3y3gmZx6s-dwjpPDNs5HO4zT6KZqPWQfEsHDoM,7413
 dfindexeddb/indexeddb/v8.py,sha256=ldqpc9T1kG7BOdjnHjQ5hNO9OCXZ3_Zd6vRSpC-NrEA,21893
 dfindexeddb/leveldb/__init__.py,sha256=KPYL9__l8od6_OyDfGRTgaJ6iy_fqIgZ-dS2S-e3Rac,599
 dfindexeddb/leveldb/ldb.py,sha256=uShhXjQe4Sz3dn54IXbGxRtE6D8RNpu1NDy5Zb0P9LA,7927
 dfindexeddb/leveldb/log.py,sha256=cyMfjDz5a6gfGb5NonxC1Y72OmHYBWzYK8UMVzP_umw,8532
-dfindexeddb-20240229.dist-info/AUTHORS,sha256=QbvjbAom57fpEkekkCVFUj0B9KUMGraR510aUMBC-PE,286
-dfindexeddb-20240229.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-dfindexeddb-20240229.dist-info/METADATA,sha256=ILzTLaRO96ALuHL8d72tt3a3shliEGzGHZC54n5wPpc,15933
-dfindexeddb-20240229.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-dfindexeddb-20240229.dist-info/entry_points.txt,sha256=UsfPLLhTiVAAtZ8Rq3ZR7JNFGMuHqJy-tugGWonQWtc,52
-dfindexeddb-20240229.dist-info/top_level.txt,sha256=X9OTaub1c8S_JJ7g-f8JdkhhdiZ4x1j4eni1hdUCwE4,12
-dfindexeddb-20240229.dist-info/RECORD,,
+dfindexeddb-20240301.dist-info/AUTHORS,sha256=QbvjbAom57fpEkekkCVFUj0B9KUMGraR510aUMBC-PE,286
+dfindexeddb-20240301.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+dfindexeddb-20240301.dist-info/METADATA,sha256=AYggbgjQv3dNPwO-f3e7tK3EPvKsnlNTKM2nPTbAQYg,15933
+dfindexeddb-20240301.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+dfindexeddb-20240301.dist-info/entry_points.txt,sha256=UsfPLLhTiVAAtZ8Rq3ZR7JNFGMuHqJy-tugGWonQWtc,52
+dfindexeddb-20240301.dist-info/top_level.txt,sha256=X9OTaub1c8S_JJ7g-f8JdkhhdiZ4x1j4eni1hdUCwE4,12
+dfindexeddb-20240301.dist-info/RECORD,,