abrignoni / abrignoni/iLEAPP

Google Chat - Reactions Research

Open
#1,668 0 comments 0 reactions 0 assignees View on GitHub
help wanted
Dominant language
Python
Stars
1.2k
Forks
303
Avg merge
4h 32m
Merged PRs (30d)
216

Description

I am looking for some help from anyone looking to do some research. the current Google Chat module has code to parse reactions to chat messages. I think it's not totally correct since the code has an assumption that there will only be one reaction. we have a sample image from Josh Hickman in his iOS 15 image that has Google Chat artifacts, but there is only 2 users in that data so there are only messages with a single reaction in that data set. I would like to get a data set that has more users and ultimately more reactions on a single message so we can determine the shape of how that would be stored. this doesn't require any coding, but it does need a little technical digging.

## how to help
options on how to help - literally any single one of these would be a helpful step forward:
- create new data on test device and extract for sample testing
- find some other public images that have google chat data
- determine if there are more than 2 google chat users in identified image
- dig into the `topic_messages` table and inspect the `reactions` column data

## knowns
database path from ios15: `/filesystem2/mobile/Containers/Data/Application/B7D14EE9-5849-4A3F-927A-3D2A7A92FA74/Documents/user_accounts/116154953456844128063/dynamite.db`

search pattern for path from module: `'*/Documents/user_accounts/*/dynamite.db*'`

here is a little summary of semi-known structure. the data is stored as a protobuf. there are 3 known states in the ios15 image:
1. no reactions
cell data size is 22 bytes.
`fe ff 00 45 00 4d 00 50 00 54 00 59 00 5f 00 42 00 4c 00 4f 00 42`
decoded as `EMPTY_BLOB`
2. single reaction with no user
cell data size is 25 bytes.
`0a 17 0a 15 0a 06 0a 04 f0 9f a7 a1 10 01 18 00 20 8f b3 85 96 c2 b1 fb 02`
```
1 {
1 {
1 {
1: "🧡"
}
2 [varint]: 1
# sint64 (zigzag): -1
# bool: true
3 [varint]: 0
# sint64 (zigzag): 0
# bool: false
4 [varint]: 1668561017854351
# sint64 (zigzag): -834280508927176
}
}
```
3. single reaction with a user id
data cell is 48 bytes.
`0a 2e 0a 13 0a 06 0a 04 f0 9f a4 a3 10 01 20 9f f0 96 e8 fd c7 fe 02 12 17 0a 15 31 30 38 36 36 38 30 34 38 33 35 34 30 38 37 39 34 32 38 39 32`
```
1 {
1 {
1 {
1: "🤣"
}
2 [varint]: 1
# sint64 (zigzag): -1
# bool: true
4 [varint]: 1682527081576479
# sint64 (zigzag): -841263540788240
}
2 {
1: "108668048354087942892"
}
}
```

## decoding tool
I am using crush forensics to open and decode the data.

steps:
1. open image
2. find dynamite db based on path values above
3. double to view sqlite data
4. use drop down to open `topic_messages` table
5. find `reactions` column with rows larger than 22 bytes
6. right click > inspect cell...
7. choose `protobuf` in the `interpretations` list

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.