dfindexeddb 20240331__tar.gz → 20240331a0__tar.gz

{dfindexeddb-20240331/dfindexeddb.egg-info → dfindexeddb-20240331a0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dfindexeddb
-Version: 20240331
+Version: 20240331a0
 Summary: dfindexeddb is an experimental Python tool for performing digital forensic analysis of IndexedDB and leveldb files.
 Author-email: Syd Pleno <sydp@google.com>
 Maintainer-email: dfIndexeddb Developers <dfindexeddb-dev@googlegroups.com>

dfindexeddb-20240331a0/dfindexeddb/indexeddb/chromium/__init__.py

@@ -0,0 +1,13 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

dfindexeddb-20240331a0/dfindexeddb/indexeddb/chromium/blink.py

@@ -0,0 +1,116 @@
+# -*- coding: utf-8 -*-
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Parsers for blink javascript serialized objects."""
+import io
+from typing import Any
+
+from dfindexeddb import utils
+from dfindexeddb.indexeddb.chromium import definitions
+from dfindexeddb.indexeddb.chromium import v8
+
+
+
+class V8ScriptValueDecoder:
+  """A Blink V8 Serialized Script Value (SSV) decoder.
+
+  Attributes:
+    deserializer (v8.ValueDeserializer): the V8 value deserializer.
+    raw_data (bytes): the raw bytes containing the serialized javascript
+        value.
+    version (int): the blink version.
+  """
+  _MIN_VERSION_FOR_SEPARATE_ENVELOPE = 16
+
+  # As defined in trailer_reader.h
+  _MIN_WIRE_FORMAT_VERSION = 21
+
+  def __init__(self, raw_data: bytes):
+    self.deserializer = None
+    self.raw_data = raw_data
+    self.version = 0
+
+  def _ReadVersionEnvelope(self) -> int:
+    """Reads the Blink version envelope.
+
+    Returns:
+      The number of bytes consumed reading the Blink version envelope or zero
+          if no blink envelope is detected.
+    """
+    if not self.raw_data:
+      return 0
+
+    decoder = utils.StreamDecoder(io.BytesIO(self.raw_data))
+    _, tag_value = decoder.DecodeUint8()
+    tag = definitions.BlinkSerializationTag(tag_value)
+    if tag != definitions.BlinkSerializationTag.VERSION:
+      return 0
+
+    _, version = decoder.DecodeUint32Varint()
+    if version < self._MIN_VERSION_FOR_SEPARATE_ENVELOPE:
+      return 0
+
+    consumed_bytes = decoder.stream.tell()
+
+    if version >= self._MIN_WIRE_FORMAT_VERSION:
+      trailer_offset_data_size = 1 + 8 + 4 # 1 + sizeof(uint64) + sizeof(uint32)
+      consumed_bytes += trailer_offset_data_size
+      if consumed_bytes >= len(self.raw_data):
+        return 0
+    return consumed_bytes
+
+  def ReadTag(self) -> definitions.BlinkSerializationTag:
+    """Reads a blink serialization tag.
+
+    Returns:
+      The blink serialization tag.
+    """
+    _, tag_value = self.deserializer.decoder.DecodeUint8()
+    return definitions.BlinkSerializationTag(tag_value)
+
+  def ReadHostObject(self) -> Any:
+    """Reads a host DOM object.
+
+    Raises:
+      NotImplementedError: when called.
+    """
+    tag = self.ReadTag()
+    raise NotImplementedError(
+        f'V8ScriptValueDecoder.ReadHostObject - {tag.name}')
+
+  def Deserialize(self) -> Any:
+    """Deserializes a Blink SSV.
+
+    The serialization format has two 'envelopes'.
+    [version tag] [Blink version] [version tag] [v8 version] ...
+
+    Returns:
+      The deserialized script value.
+    """
+    version_envelope_size = self._ReadVersionEnvelope()
+    self.deserializer = v8.ValueDeserializer(
+        io.BytesIO(self.raw_data[version_envelope_size:]), delegate=self)
+    v8_version = self.deserializer.ReadHeader()
+    if not self.version:
+      self.version = v8_version
+    return self.deserializer.ReadValue()
+
+  @classmethod
+  def FromBytes(cls, data: bytes) -> Any:
+    """Deserializes a Blink SSV from the data array.
+
+    Returns:
+      The deserialized script value.
+    """
+    return cls(data).Deserialize()

dfindexeddb-20240331a0/dfindexeddb/indexeddb/chromium/definitions.py

@@ -0,0 +1,306 @@
+# -*- coding: utf-8 -*-
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Definitions for IndexedDB."""
+from enum import Enum, IntEnum, IntFlag
+
+
+class DatabaseMetaDataKeyType(IntEnum):
+  """Database Metadata key types."""
+  ORIGIN_NAME = 0
+  DATABASE_NAME = 1
+  IDB_STRING_VERSION_DATA = 2
+  MAX_ALLOCATED_OBJECT_STORE_ID = 3
+  IDB_INTEGER_VERSION = 4
+  BLOB_NUMBER_GENERATOR_CURRENT_NUMBER = 5
+  OBJECT_STORE_META_DATA = 50
+  INDEX_META_DATA = 100
+  OBJECT_STORE_FREE_LIST = 150
+  INDEX_FREE_LIST = 151
+  OBJECT_STORE_NAMES = 200
+  INDEX_NAMES = 201
+
+
+class GlobalMetadataKeyType(IntEnum):
+  """Global Metadata key types."""
+  SCHEMA_VERSION = 0
+  MAX_DATABASE_ID = 1
+  DATA_VERSION = 2
+  RECOVERY_BLOB_JOURNAL = 3
+  ACTIVE_BLOB_JOURNAL = 4
+  EARLIEST_SWEEP = 5
+  EARLIEST_COMPACTION_TIME = 6
+  SCOPES_PREFIX = 50
+  DATABASE_FREE_LIST = 100
+  DATABASE_NAME = 201
+
+
+class IDBKeyPathType(IntEnum):
+  """IndexedDB key path types."""
+  NULL = 0
+  STRING = 1
+  ARRAY = 2
+
+
+class IDBKeyType(IntEnum):
+  """IndexedDB key types."""
+  NULL = 0
+  STRING = 1
+  DATE = 2
+  NUMBER = 3
+  ARRAY = 4
+  MIN_KEY = 5
+  BINARY = 6
+
+
+class IndexMetaDataKeyType(IntEnum):
+  """IndexedDB metadata key types."""
+  INDEX_NAME = 0
+  UNIQUE_FLAG = 1
+  KEY_PATH = 2
+  MULTI_ENTRY_FLAG = 3
+
+
+class KeyPrefixType(Enum):
+  """IndexedDB key prefix types."""
+  GLOBAL_METADATA = 0
+  DATABASE_METADATA = 1
+  OBJECT_STORE_DATA = 2
+  EXISTS_ENTRY = 3
+  INDEX_DATA = 4
+  INVALID_TYPE = 5
+  BLOB_ENTRY = 6
+
+
+class ObjectStoreMetaDataKeyType(IntEnum):
+  """IndexedDB object store metadata key types."""
+  OBJECT_STORE_NAME = 0
+  KEY_PATH = 1
+  AUTO_INCREMENT_FLAG = 2
+  IS_EVICTABLE = 3
+  LAST_VERSION_NUMBER = 4
+  MAXIMUM_ALLOCATED_INDEX_ID = 5
+  HAS_KEY_PATH = 6
+  KEY_GENERATOR_CURRENT_NUMBER = 7
+
+
+class ExternalObjectType(IntEnum):
+  """IndexedDB external object types."""
+  BLOB = 0
+  FILE = 1
+  FILE_SYSTEM_ACCESS_HANDLE = 2
+
+
+class BlinkSerializationTag(IntEnum):
+  """Blink Javascript serialization tags."""
+  MESSAGE_PORT = ord('M')
+  MOJO_HANDLE = ord('h')
+  BLOB = ord('b')
+  BLOB_INDEX = ord('i')
+  FILE = ord('f')
+  FILE_INDEX = ord('e')
+  DOM_FILE_SYSTEM = ord('d')
+  FILE_SYSTEM_FILE_HANDLE = ord('n')
+  FILE_SYSTEM_DIRECTORY_HANDLE = ord('N')
+  FILE_LIST = ord('l')
+  FILE_LIST_INDEX = ord('L')
+  IMAGE_DATA = ord('#')
+  IMAGE_BITMAP = ord('g')
+  IMAGE_BITMAP_TRANSFER = ord('G')
+  OFFSCREEN_CANVAS_TRANSFER = ord('H')
+  READABLE_STREAM_TRANSFER = ord('r')
+  TRANSFORM_STREAM_TRANSFER = ord('m')
+  WRITABLE_STREAM_TRANSFER = ord('w')
+  MEDIA_STREAM_TRACK = ord('s')
+  DOM_POINT = ord('Q')
+  DOM_POINT_READ_ONLY = ord('W')
+  DOM_RECT = ord('E')
+  DOM_RECT_READ_ONLY = ord('R')
+  DOM_QUAD = ord('T')
+  DOM_MATRIX = ord('Y')
+  DOM_MATRIX_READ_ONLY = ord('U')
+  DOM_MATRIX2D = ord('I')
+  DOM_MATRIX2D_READ_ONLY = ord('O')
+  CRYPTO_KEY = ord('K')
+  RTC_CERTIFICATE = ord('k')
+  RTC_ENCODED_AUDIO_FRAME = ord('A')
+  RTC_ENCODED_VIDEO_FRAME = ord('V')
+  AUDIO_DATA = ord('a')
+  VIDEO_FRAME = ord('v')
+  ENCODED_AUDIO_CHUNK = ord('y')
+  ENCODED_VIDEO_CHUNK = ord('z')
+  CROP_TARGET = ord('c')
+  MEDIA_SOURCE_HANDLE = ord('S')
+  DEPRECATED_DETECTED_BARCODE = ord('B')
+  DEPRECATED_DETECTED_FACE = ord('F')
+  DEPRECATED_DETECTED_TEXT = ord('t')
+  DOM_EXCEPTION = ord('x')
+  TRAILER_OFFSET = 0xFE
+  VERSION = 0xFF
+  TRAILER_REQUIRES_INTERFACES = 0xA0
+
+
+class CryptoKeyAlgorithm(IntEnum):
+  """CryptoKey Algorithm types."""
+  AES_CBC = 1
+  HMAC = 2
+  RSA_SSA_PKCS1_V1_5 = 3
+  SHA1 = 5
+  SHA256 = 6
+  SHA384 = 7
+  SHA512 = 8
+  AES_GCM = 9
+  RSA_OAEP = 10
+  AES_CTR = 11
+  AES_KW = 12
+  RSA_PSS = 13
+  ECDSA = 14
+  ECDH = 15
+  HKDF = 16
+  PBKDF2 = 17
+  ED25519 = 18
+
+
+class NamedCurve(IntEnum):
+  """Named Curve types."""
+  P256 = 1
+  P384 = 2
+  P521 = 3
+
+
+class CryptoKeyUsage(IntFlag):
+  """CryptoKey Usage flags."""
+  EXTRACTABLE = 1 << 0
+  ENCRYPT = 1 << 1
+  DECRYPT = 1 << 2
+  SIGN = 1 << 3
+  VERIFY = 1 << 4
+  DERIVE_KEY = 1 << 5
+  WRAP_KEY = 1 << 6
+  UNWRAP_KEY = 1 << 7
+  DRIVE_BITS = 1 << 8
+
+
+class CryptoKeySubTag(IntEnum):
+  """CryptoKey subtag types."""
+  AES_KEY = 1
+  HMAC_KEY = 2
+  RSA_HASHED_KEY = 4
+  EC_KEY = 5
+  NO_PARAMS_KEY = 6
+  ED25519_KEY = 7
+
+
+class AsymmetricCryptoKeyType(IntEnum):
+  """Asymmetric CryptoKey types."""
+  PUBLIC_KEY = 1
+  PRIVATE_KEY = 2
+
+
+class WebCryptoKeyType(Enum):
+  """WebCryptoKey types."""
+  SECRET = 'Secret'
+  PUBLIC = 'Public'
+  PRIVATE = 'Private'
+
+
+class V8SerializationTag(IntEnum):
+  """V8 Javascript serialization tags."""
+  VERSION = 0xFF
+  PADDING = ord('\0')
+  VERIFY_OBJECT_COUNT = ord('?')
+  THE_HOLE = ord('-')
+  UNDEFINED = ord('_')
+  NULL = ord('0')
+  TRUE = ord('T')
+  FALSE = ord('F')
+  INT32 = ord('I')
+  UINT32 = ord('U')
+  DOUBLE = ord('N')
+  BIGINT = ord('Z')
+  UTF8_STRING = ord('S')
+  ONE_BYTE_STRING = ord('"')
+  TWO_BYTE_STRING = ord('c')
+  OBJECT_REFERENCE = ord('^')
+  BEGIN_JS_OBJECT = ord('o')
+  END_JS_OBJECT = ord('{')
+  BEGIN_SPARSE_JS_ARRAY = ord('a')
+  END_SPARSE_JS_ARRAY = ord('@')
+  BEGIN_DENSE_JS_ARRAY = ord('A')
+  END_DENSE_JS_ARRAY = ord('$')
+  DATE = ord('D')
+  TRUE_OBJECT = ord('y')
+  FALSE_OBJECT = ord('x')
+  NUMBER_OBJECT = ord('n')
+  BIGINT_OBJECT = ord('z')
+  STRING_OBJECT = ord('s')
+  REGEXP = ord('R')
+  BEGIN_JS_MAP = ord(';')
+  END_JS_MAP = ord(':')
+  BEGIN_JS_SET = ord('\'')
+  END_JS_SET = ord(',')
+  ARRAY_BUFFER = ord('B')
+  RESIZABLE_ARRAY_BUFFER = ord('~')
+  ARRAY_BUFFER_TRANSFER = ord('t')
+  ARRAY_BUFFER_VIEW = ord('V')
+  SHARED_ARRAY_BUFFER = ord('u')
+  SHARED_OBJECT = ord('p')
+  WASM_MODULE_TRANSFER = ord('w')
+  HOST_OBJECT = ord('\\')
+  WASM_MEMORY_TRANSFER = ord('m')
+  ERROR = ord('r')
+  LEGACY_RESERVED_MESSAGE_PORT = ord('M')
+  LEGACY_RESERVED_BLOB = ord('b')
+  LEGACY_RESERVED_BLOB_INDEX = ord('i')
+  LEGACY_RESERVED_FILE = ord('f')
+  LEGACY_RESERVED_FILE_INDEX = ord('e')
+  LEGACY_RESERVED_DOM_FILE_SYSTEM = ord('d')
+  LEGACY_RESERVED_FILE_LIST = ord('l')
+  LEGACY_RESERVED_FILE_LIST_INDEX = ord('L')
+  LEGACY_RESERVED_IMAGE_DATA = ord('#')
+  LEGACY_RESERVED_IMAGE_BITMAP = ord('g')
+  LEGACY_RESERVED_IMAGE_BITMAP_TRANSFER = ord('G')
+  LEGACY_RESERVED_OFF_SCREEN_CANVAS = ord('H')
+  LEGACY_RESERVED_CRYPTO_KEY = ord('K')
+  LEGACY_RESERVED_RTC_CERTIFICATE = ord('k')
+
+
+class V8ArrayBufferViewTag(IntEnum):
+  """V8 ArrayBufferView tags."""
+  INT8_ARRAY = ord('b')
+  UINT8_ARRAY = ord('B')
+  UINT8_CLAMPED_ARRAY = ord('C')
+  INT16_ARRAY = ord('w')
+  UINT16_ARRAY = ord('W')
+  INT32_ARRAY = ord('d')
+  UINT32_ARRAY = ord('D')
+  FLOAT32_ARRAY = ord('f')
+  FLOAT64_ARRAY = ord('F')
+  BIGINT64_ARRAY = ord('q')
+  BIGUINT64_ARRAY = ord('Q')
+  DATAVIEW = ord('?')
+
+
+class V8ErrorTag(IntEnum):
+  """V8 Error tags."""
+  EVAL_ERROR_PROTOTYPE = ord('E')
+  RANGE_ERROR_PROTOTYPE = ord('R')
+  REFERENCE_ERROR_PROTOTYPE = ord('F')
+  SYNTAX_ERROR_PROTOTYPE = ord('S')
+  TYPE_ERROR_PROTOTYPE = ord('T')
+  URI_ERROR_PROTOTYPE = ord('U')
+  MESSAGE = ord('m')
+  CAUSE = ord('c')
+  STACK = ord('s')
+  END = ord('.')