dfindexeddb 20240519__py3-none-any.whl → 20241031__py3-none-any.whl

dfindexeddb/indexeddb/firefox/record.py

@@ -0,0 +1,180 @@
+# -*- coding: utf-8 -*-
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Firefox IndexedDB records."""
+from dataclasses import dataclass
+import sqlite3
+import sys
+import traceback
+from typing import Any, Generator, Optional
+
+from dfindexeddb import errors
+from dfindexeddb.indexeddb.firefox import gecko
+
+
+@dataclass
+class FirefoxObjectStoreInfo:
+  """A FireFox ObjectStoreInfo.
+
+  Attributes:
+    id: the object store ID.
+    name: the object store name.
+    key_path: the object store key path.
+    auto_inc: the current auto-increment value.
+    database_name: the database name from the database table.
+  """
+  id: int
+  name: str
+  key_path: str
+  auto_inc: int
+  database_name: str
+
+
+@dataclass
+class FirefoxIndexedDBRecord:
+  """A Firefox IndexedDBRecord.
+
+  Attributes:
+    key: the parsed key.
+    value: the parsed value.
+    file_ids: the file identifiers.
+    object_store_id: the object store id.
+    object_store_name: the object store name from the object_store table.
+    database_name: the IndexedDB database name from the database table.
+  """
+  key: Any
+  value: Any
+  file_ids: Optional[str]
+  object_store_id: int
+  object_store_name: str
+  database_name: str
+
+
+class FileReader:
+  """A reader for Firefox IndexedDB sqlite3 files.
+
+  Attributes:
+    database_name: the database name.
+    origin: the database origin.
+    metadata_version: the metadata version.
+    last_vacuum_time: the last vacuum time.
+    last_analyze_time: the last analyze time.
+  """
+
+  def __init__(self, filename: str):
+    """Initializes the FileReader.
+
+    Args:
+      filename: the IndexedDB filename.
+    """
+    self.filename = filename
+
+    with sqlite3.connect(f'file:{self.filename}?mode=ro', uri=True) as conn:
+      cursor = conn.execute(
+          'SELECT name, origin, version, last_vacuum_time, last_analyze_time '
+          'FROM database')
+      result = cursor.fetchone()
+      self.database_name = result[0]
+      self.origin = result[1]
+      self.metadata_version = result[2]
+      self.last_vacuum_time = result[3]
+      self.last_analyze_time = result[4]
+
+  def _ParseKey(self, key: bytes) -> Any:
+    """Parses a key."""
+    try:
+      return gecko.IDBKey.FromBytes(key)
+    except errors.ParserError as e:
+      print('failed to parse', key, file=sys.stderr)
+      traceback.print_exception(type(e), e, e.__traceback__)
+      return key
+
+  def _ParseValue(self, value: bytes) -> Any:
+    """Parses a value."""
+    try:
+      return gecko.JSStructuredCloneDecoder.FromBytes(value)
+    except errors.ParserError as err:
+      print('failed to parse', value, file=sys.stderr)
+      traceback.print_exception(type(err), err, err.__traceback__)
+      return value
+
+  def ObjectStores(self) -> Generator[FirefoxObjectStoreInfo, None, None]:
+    """Returns the Object Store information from the IndexedDB database.
+
+    Yields:
+      FirefoxObjectStoreInfo instances.
+    """
+    with sqlite3.connect(f'file:{self.filename}?mode=ro', uri=True) as conn:
+      cursor = conn.execute(
+          'SELECT id, auto_increment, name, key_path FROM object_store')
+      results = cursor.fetchall()
+      for result in results:
+        yield FirefoxObjectStoreInfo(
+            id=result[0],
+            name=result[2],
+            key_path=result[3],
+            auto_inc=result[1],
+            database_name=self.database_name)
+
+  def RecordsByObjectStoreId(
+      self,
+      object_store_id: int
+  ) -> Generator[FirefoxIndexedDBRecord, None, None]:
+    """Returns FirefoxIndexedDBRecords by a given object store id.
+
+    Args:
+      object_store_id: the object store id.
+    """
+    with sqlite3.connect(f'file:{self.filename}?mode=ro', uri=True) as conn:
+      conn.text_factory = bytes
+      cursor = conn.execute(
+          'SELECT od.key, od.data, od.object_store_id, od.file_ids, os.name '
+          'FROM object_data od '
+          'JOIN object_store os ON od.object_store_id == os.id '
+          'WHERE os.id = ? ORDER BY od.key', (object_store_id, ))
+      for row in cursor:
+        key = self._ParseKey(row[0])
+        if row[3]:
+          value = row[1]
+        else:
+          value = self._ParseValue(row[1])
+        yield FirefoxIndexedDBRecord(
+            key=key,
+            value=value,
+            object_store_id=row[2],
+            file_ids=row[3],
+            object_store_name=row[4].decode('utf-8'),
+            database_name=self.database_name)
+
+  def Records(self) -> Generator[FirefoxIndexedDBRecord, None, None]:
+    """Returns FirefoxIndexedDBRecords from the database."""
+    with sqlite3.connect(f'file:{self.filename}?mode=ro', uri=True) as conn:
+      conn.text_factory = bytes
+      cursor = conn.execute(
+          'SELECT od.key, od.data, od.object_store_id, od.file_ids, os.name '
+          'FROM object_data od '
+          'JOIN object_store os ON od.object_store_id == os.id')
+      for row in cursor:
+        key = self._ParseKey(row[0])
+        if row[3]:
+          value = row[1]
+        else:
+          value = self._ParseValue(row[1])
+        yield FirefoxIndexedDBRecord(
+            key=key,
+            value=value,
+            object_store_id=row[2],
+            file_ids=row[3],
+            object_store_name=row[4].decode('utf-8'),
+            database_name=self.database_name)

dfindexeddb/indexeddb/safari/webkit.py

@@ -82,15 +82,22 @@ class FileList:
   files: List[FileData]
 
 
-class JSArray(list):
-  """A parsed JavaScript array.
+class JSArray:
+  """A parsed Javascript array.
 
-  This is a wrapper around a standard Python list to allow assigning arbitrary
-  properties as is possible in the JavaScript equivalent.
+  A Javascript array behaves like a Python list but allows assigning arbitrary
+  properties.  The array is stored in the attribute __array__.
   """
+  def __init__(self):
+    self.__array__ = []
+
+  def Append(self, element: Any):
+    """Appends a new element to the array."""
+    self.__array__.append(element)
 
   def __repr__(self):
-    array_entries = ", ".join([str(entry) for entry in list(self)])
+    array_entries = ", ".join(
+        [str(entry) for entry in list(self.__array__)])
     properties = ", ".join(
         f'{key}: {value}' for key, value in self.properties.items())
     return f'[{array_entries}, {properties}]'
@@ -100,6 +107,11 @@ class JSArray(list):
     """Returns the object properties."""
     return self.__dict__
 
+  def __eq__(self, other: JSArray):
+    return (
+        self.__array__ == other.__array__
+        and self.properties == other.properties)
+
   def __contains__(self, item):
     return item in self.__dict__
 
@@ -107,24 +119,36 @@ class JSArray(list):
     return self.__dict__[name]
 
 
-class JSSet(set):
-  """A parsed JavaScript set.
+class JSSet:
+  """A parsed Javascript set.
 
-  This is a wrapper around a standard Python set to allow assigning arbitrary
-  properties as is possible in the JavaScript equivalent.
+  A Javascript set behaves like a Python set but allows assigning arbitrary
+  properties.  The array is stored in the attribute __set__.
   """
+  def __init__(self):
+    self.__set__ = set()
+
+  def Add(self, element: Any):
+    """Adds a new element to the set."""
+    self.__set__.add(element)
 
   def __repr__(self):
-    set_entries = ", ".join([str(entry) for entry in list(self)])
+    array_entries = ", ".join(
+        [str(entry) for entry in list(self.__set__)])
     properties = ", ".join(
         f'{key}: {value}' for key, value in self.properties.items())
-    return f'[{set_entries}, {properties}]'
+    return f'[{array_entries}, {properties}]'
 
   @property
   def properties(self) -> Dict[str, Any]:
     """Returns the object properties."""
     return self.__dict__
 
+  def __eq__(self, other: JSSet):
+    return (
+        self.__set__ == other.__set__
+        and self.properties == other.properties)
+
   def __contains__(self, item):
     return item in self.__dict__
 
@@ -294,7 +318,7 @@ class SerializedScriptValueDecoder():
     for _ in range(length):
       _, _ = self.decoder.DecodeUint32()
       _, value = self.DecodeValue()
-      array.append(value)
+      array.Append(value)
 
     offset, terminator_tag = self.decoder.DecodeUint32()
     if terminator_tag != definitions.TerminatorTag:
@@ -480,7 +504,7 @@ class SerializedScriptValueDecoder():
 
     while tag != definitions.SerializationTag.NON_SET_PROPERTIES:
       _, key = self.DecodeValue()
-      js_set.add(key)
+      js_set.Add(key)
       tag = self.PeekSerializationTag()
 
     # consume the NonSetPropertiesTag

dfindexeddb/indexeddb/types.py

@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*-
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Types for indexeddb."""
+from __future__ import annotations
+
+import dataclasses
+from typing import Any, Dict, List, Set
+
+
+@dataclasses.dataclass
+class JSArray:
+  """A parsed Javascript array.
+
+  A JavaScript array behaves like a Python list but allows assigning arbitrary
+  properties.  The array is stored in the attribute __array__.
+
+  Attributes:
+    values: the array values.
+    properties: the array properties.
+  """
+  values: List[Any] = dataclasses.field(default_factory=list)
+  properties: Dict[Any, Any] = dataclasses.field(default_factory=dict)
+
+
+@dataclasses.dataclass
+class JSSet:
+  """A parsed JavaScript set.
+
+  A JavaScript set behaves like a Python set but allows assigning arbitrary
+  properties.  The array is stored in the attribute __set__.
+
+  Attributes:
+    values: the set values.
+    properties: the set properties.
+  """
+  values: Set[Any] = dataclasses.field(default_factory=set)
+  properties: Dict[Any, Any] = dataclasses.field(default_factory=dict)
+
+
+@dataclasses.dataclass
+class Null:
+  """A parsed JavaScript Null."""
+
+
+@dataclasses.dataclass
+class RegExp:
+  """A parsed JavaScript RegExp.
+  
+  Attributes:
+    pattern: the pattern.
+    flags: the flags.
+  """
+  pattern: str
+  flags: int
+
+
+@dataclasses.dataclass
+class Undefined:
+  """A JavaScript undef."""

dfindexeddb/leveldb/descriptor.py

@@ -384,5 +384,6 @@ class FileReader:
 
   def GetLatestVersion(self) -> LevelDBVersion:
     """Returns the latest LevelDBVersion instance."""
-    *_, latest = self.GetVersions()
+    for version in self.GetVersions():
+      latest = version
     return latest

dfindexeddb/utils.py

@@ -213,7 +213,7 @@ T = TypeVar('T')
 
 
 class FromDecoderMixin:
-  """A mixin for parsing dataclass attributes using a LevelDBDecoder."""
+  """A mixin for parsing dataclass attributes using a StreamDecoder."""
 
   @classmethod
   def FromDecoder(

dfindexeddb/version.py

@@ -15,7 +15,7 @@
 """Version information for dfIndexeddb."""
 
 
-__version__ = "20240519"
+__version__ = "20241031"
 
 
 def GetVersion():

{dfindexeddb-20240519.dist-info → dfindexeddb-20241031.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dfindexeddb
-Version: 20240519
+Version: 20241031
 Summary: dfindexeddb is an experimental Python tool for performing digital forensic analysis of IndexedDB and leveldb files.
 Author-email: Syd Pleno <sydp@google.com>
 Maintainer-email: dfIndexeddb Developers <dfindexeddb-dev@googlegroups.com>
@@ -230,8 +230,7 @@ analysis of IndexedDB and LevelDB files.
 
 It parses LevelDB, IndexedDB and JavaScript structures from these files without
 requiring native libraries.  (Note: only a subset of IndexedDB key types and
-JavaScript types for Safari and Chromium-based browsers are currently supported.
-Firefox is under development).
+JavaScript types for Firefox, Safari and Chromium-based browsers are currently supported).
 
 The content of IndexedDB files is dependent on what a web application stores
 locally/offline using the web browser's
@@ -313,6 +312,13 @@ options:
 
 #### Examples:
 
+To parse IndexedDB records from an sqlite file for Firefox and output the
+results as JSON, use the following command:
+
+```
+dfindexeddb db -s SOURCE --format firefox -o json
+```
+
 To parse IndexedDB records from an sqlite file for Safari and output the
 results as JSON-L, use the following command:
 
@@ -376,7 +382,7 @@ To parse records from a LevelDB folder, use the following command:
 dfleveldb db -s SOURCE
 ```
 
-To parse records from a LevelDB folder, and use the sequence number to 
+To parse records from a LevelDB folder, and use the sequence number to
 determine recovered records and output as JSON, use the
 following command:
 
@@ -409,8 +415,8 @@ $ dfleveldb descriptor -s SOURCE [-o {json,jsonl,repr}] [-t {blocks,physical_rec
 
 #### Plugins
 
-To apply a plugin parser for a leveldb file/folder, add the 
-`--plugin [Plugin Name]` argument.  Currently, there is support for the 
+To apply a plugin parser for a leveldb file/folder, add the
+`--plugin [Plugin Name]` argument.  Currently, there is support for the
 following artifacts:
 
 | Plugin Name | Artifact Name |

{dfindexeddb-20240519.dist-info → dfindexeddb-20241031.dist-info}/RECORD

@@ -1,24 +1,28 @@
 dfindexeddb/__init__.py,sha256=KPYL9__l8od6_OyDfGRTgaJ6iy_fqIgZ-dS2S-e3Rac,599
 dfindexeddb/errors.py,sha256=PNpwyf_lrPc4TE77oAakX3mu5D_YcP3f80wq8Y1LkvY,749
-dfindexeddb/utils.py,sha256=NEqnBNgAmSrZ7iwhEZx8PYlDrT8c-NnTLbm86ZLsOsc,9998
-dfindexeddb/version.py,sha256=PzaqD9kWSx3q6RDQLgClQ7dmnrp2h8nqJcq5jprK2uY,751
+dfindexeddb/utils.py,sha256=g-uqQzT_iKM7PPEIuSCNkQG2ltwpnLpRA_dPtrgVzzc,9997
+dfindexeddb/version.py,sha256=UAMCa51yvzp9xG8y5eagDkYAfzVLED94Kp7hTfVBSSI,751
 dfindexeddb/indexeddb/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
-dfindexeddb/indexeddb/cli.py,sha256=WeOaQXFZglkI9Mwc97rCnVsCX32Dw0CgMQX3RKutwIA,6339
+dfindexeddb/indexeddb/cli.py,sha256=O07_DpVeGtYx2V-jUJF5Oc3OftM2FPLSwNdS45MLCdo,7435
+dfindexeddb/indexeddb/types.py,sha256=cIXmShUbbXJMSbXkmthxGGrpIF9fWr3Ypfl6ckGoSBU,1892
 dfindexeddb/indexeddb/utils.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dfindexeddb/indexeddb/chromium/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
 dfindexeddb/indexeddb/chromium/blink.py,sha256=kwhPfzcWOOxYyXUWfV6f4grQwXzS2ABFaNVMIVhol3c,32268
 dfindexeddb/indexeddb/chromium/definitions.py,sha256=1a-AmHVZ95uDB6se_fdarwJR8q0tFMQNh2xrZ2-VxN8,8739
 dfindexeddb/indexeddb/chromium/record.py,sha256=LIuTwwQeQbn6CBXdo0AZZHounOWcnXRg6W082yxmNBo,47578
-dfindexeddb/indexeddb/chromium/v8.py,sha256=NsbMgA6nRcAfdLg6CFwWadwsDS6TJ95-4MrgphaTuLw,22102
+dfindexeddb/indexeddb/chromium/v8.py,sha256=tzkKhx0S53HLCNMCls4GCFXrRCjjrgkFSwL3mbNQsjg,22656
 dfindexeddb/indexeddb/firefox/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
+dfindexeddb/indexeddb/firefox/definitions.py,sha256=xkvlYaaFR2IDQBGJGnrhVIOUce6VuMq-kWXe2CLX3Aw,4306
+dfindexeddb/indexeddb/firefox/gecko.py,sha256=m6-tGHOFnND-XG4C-9o1Atxo4BkHTMhFWCGqW2vFVPk,19423
+dfindexeddb/indexeddb/firefox/record.py,sha256=yB7dYiwzCx1c67Sf6ViMSX51SCrcgU8OBUaVYczqTik,5766
 dfindexeddb/indexeddb/safari/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
 dfindexeddb/indexeddb/safari/definitions.py,sha256=nW8MmYx9Ob86W4pxm4QD4Xvr5QjoV34-U7wDhm2GIr0,2779
 dfindexeddb/indexeddb/safari/record.py,sha256=bzoMSgpXs2SsEOKHjVh9tkJDZtzGkQByq3G5dK_Yd7Q,8010
-dfindexeddb/indexeddb/safari/webkit.py,sha256=SmmwuJKF8NfHCiAaz1Zc1LsVm6IF3bTkaEzi6M0-HdM,21969
+dfindexeddb/indexeddb/safari/webkit.py,sha256=LHaSLOGr74dzGblrqC_RVYD6GCftzGP-p0oWujZ3l1c,22592
 dfindexeddb/leveldb/__init__.py,sha256=KPYL9__l8od6_OyDfGRTgaJ6iy_fqIgZ-dS2S-e3Rac,599
 dfindexeddb/leveldb/cli.py,sha256=e2C94FSP28dh83FWQXD5N44ymUDwkfFeX0Tfk9YLCTo,9913
 dfindexeddb/leveldb/definitions.py,sha256=lPW_kjc47vyoGOoEWfgWvKcpGbN-0h7XXwCeMoFmYKk,1486
-dfindexeddb/leveldb/descriptor.py,sha256=WR3irG16oIE6VbaP9UPnzOD3KlHR8GYFnoeG6ySJUzU,12211
+dfindexeddb/leveldb/descriptor.py,sha256=BgWO-sEqT2zhPu9oEplTa8O_szpgU2N4QfDZeroTcx0,12237
 dfindexeddb/leveldb/ldb.py,sha256=mN-M7PLtE_VLZCbCbzRgjkSezbMUhgDjgWgPgIxJ1jM,8087
 dfindexeddb/leveldb/log.py,sha256=ofw0r2f_3Ll5oHzssvp61nmjhIPdt3tmb9UeNiGLHXk,9401
 dfindexeddb/leveldb/record.py,sha256=j7ZnU6VDVcYVpJRGFRb5Sr2edhC3aGp3U0kPNcoZgng,11912
@@ -28,10 +32,10 @@ dfindexeddb/leveldb/plugins/chrome_notifications.py,sha256=-dyb_AJbUPE2wPJg_Y1Ns
 dfindexeddb/leveldb/plugins/interface.py,sha256=QlNEvVvU8K9ChE2kblM97cOvXwvmCh9NuSf2b6WwezQ,1257
 dfindexeddb/leveldb/plugins/manager.py,sha256=jisYyks3OQQQUVACoGcWN81UCGQEa537YvYL7v3CiFs,2139
 dfindexeddb/leveldb/plugins/notification_database_data_pb2.py,sha256=DCPZHbyq2szLgrBprOKrJKycKJma8Z_SnAQM6Jx9bZg,4389
-dfindexeddb-20240519.dist-info/AUTHORS,sha256=QbvjbAom57fpEkekkCVFUj0B9KUMGraR510aUMBC-PE,286
-dfindexeddb-20240519.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-dfindexeddb-20240519.dist-info/METADATA,sha256=aDy87_6iqVwvkSI4teKm-Sq8DKb6GHpuydePrZXsydA,18818
-dfindexeddb-20240519.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-dfindexeddb-20240519.dist-info/entry_points.txt,sha256=WG9YNLZ9lBx4Q9QF6wS4dZdZfADT3Zs4_-MV5TcA0ls,102
-dfindexeddb-20240519.dist-info/top_level.txt,sha256=X9OTaub1c8S_JJ7g-f8JdkhhdiZ4x1j4eni1hdUCwE4,12
-dfindexeddb-20240519.dist-info/RECORD,,
+dfindexeddb-20241031.dist-info/AUTHORS,sha256=QbvjbAom57fpEkekkCVFUj0B9KUMGraR510aUMBC-PE,286
+dfindexeddb-20241031.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+dfindexeddb-20241031.dist-info/METADATA,sha256=0Wi-Bd_2GyLC3ssYcDQuPKiFK6s98gOgir-1QuYfTPo,18972
+dfindexeddb-20241031.dist-info/WHEEL,sha256=P9jw-gEje8ByB7_hXoICnHtVCrEwMQh-630tKvQWehc,91
+dfindexeddb-20241031.dist-info/entry_points.txt,sha256=WG9YNLZ9lBx4Q9QF6wS4dZdZfADT3Zs4_-MV5TcA0ls,102
+dfindexeddb-20241031.dist-info/top_level.txt,sha256=X9OTaub1c8S_JJ7g-f8JdkhhdiZ4x1j4eni1hdUCwE4,12
+dfindexeddb-20241031.dist-info/RECORD,,

{dfindexeddb-20240519.dist-info → dfindexeddb-20241031.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.43.0)
+Generator: setuptools (75.3.0)
 Root-Is-Purelib: true
 Tag: py3-none-any