Worked on Apple Unified Logging format support

libyal · May 21, 2023 · 85d9b05 · 85d9b05
1 parent da0f293
commit 85d9b05
Show file tree

Hide file tree

Showing 3 changed files with 386 additions and 87 deletions.
diff --git a/documentation/Apple Unified Logging and Activity Tracing formats.asciidoc b/documentation/Apple Unified Logging and Activity Tracing formats.asciidoc
@@ -778,8 +778,9 @@ Contains a 32-bit value
 | 0x02 | | [yellow-background]*Unknown (integer)* +
 Contains a 8-bit, 16-bit, 32-bit or 64-bit value
 3+|
-| 0x12 | | [yellow-background]*Unknown* +
-Contains a 32-bit value
+| 0x12 | | [yellow-background]*Unknown (format string precision)* +
+Contains a 32-bit value +
+This value has been seen to be used in combination with format strings like "%.16s" and "%.*s", where this value contains the number of characters of the string that should be printed.
 3+|
 | 0x20 | | [yellow-background]*Unknown (string)* +
 Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UTF-8 encoded string with an optional end-of-string character.
@@ -802,7 +803,7 @@ Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Fire
 | 0x40 | | [yellow-background]*Unknown (string)* +
 Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UTF-8 encoded string with an optional end-of-string character.
 | 0x41 | | [yellow-background]*Unknown (private string)* +
-Contains a 32-bit value
+Contains a 32-bit value, formatted as "<private>"
 | 0x42 | | [yellow-background]*Unknown (string)* +
 Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UTF-8 encoded string with an optional end-of-string character.
 3+|
@@ -1027,26 +1028,70 @@ The built-in value type decoders are:
 | "{darwin.errno}" | | Formatted as a system error, for example "[32: Broken pipe]"
 | "{darwin.mode}" | | Formatted as a file mode value, for example "drwxr-xr-x"
 | "{darwin.signal}" | | Formatted as a signal, for example "[sigsegv: Segmentation Fault]"
-| "{errno}" | | Formatted as a system error, for example "[32: Broken pipe]"
 | "{iec-bitrate}" | | Formatted as an IEC bit-rate value, for example "118 Kibps"
 | "{iec-bytes}" | | Formatted as IEC bytes value, for example "4.61 KiB"
 | "{in_addr}" | | Formatted as an IPv4 address, for example "127.0.0.1"
 | "{in6_addr}" | | Formatted as an IPv6 address, for example "fe80::f:86ff:fee9:5c16"
-| "{private}" | | Private log argument
-| "{public}" | | Public log argument
 | "{sockaddr}" | | Formatted as socket address, for example "fe80::f:86ff:fee9:5c16"
 | "{time_t}" | | Formatted as a seconds precision date and time value, for example "2016-01-12 19:41:37"
 | "{timespec}" | | Formatted as a nanoseconds precision date and time value, for example "2016-01-12 19:41:37.2382382823"
 | "{timeval}" | | Formatted as a microseconds precision date and time value, for example "2016-01-12 19:41:37.774236"
 | "{uuid_t}" | | Formatted as an UUID, for example "10742E39-0657-41F8-AB99-878C5EC2DCAA"
 |===
 
+Other observerd value type decoders are:
+
+[cols="1,1,5",options="header"]
+|===
+| Value | Identifier | Description
+| "{errno}" | | Formatted as a system error, for example "[32: Broken pipe]"
+| "{location:_CLLocationManagerStateTrackerState}" | |
+| "{location:_CLClientManagerStateTrackerState}" | |
+| "{location:CLClientAuthorizationStatus}" | |
+| "{location:CLDaemonStatus_Type::Reachability}" | |
+| "{location:CLSubHarvesterIdentifier}" | |
+| "{location:escape_only}" | |
+| "{location:IOMessage}" | |
+| "{location:SqliteResult}" | |
+| "{mask.hash}" | |
+| "{mdns:acceptable}" | |
+| "{mdns:addrmv}" | |
+| "{mdns:dns.counts}" | |
+| "{mdns:dns.idflags}" | |
+| "{mdns:dnshdr}" | |
+| "{mdns:gaiopts}" | |
+| "{mdns:nreason}" | |
+| "{mdns:protocol}" | |
+| "{mdns:rd.svcb}" | |
+| "{mdns:rrtype}" | |
+| "{mdns:yesno}" | |
+| "{mdnsresponder:domain_name}" | |
+| "{mdnsresponder:ip_addr}" | |
+| "{mdnsresponder:mac_addr}" | |
+| "{network:in_addr}" | |
+| "{network:in6_addr}" | |
+| "{network:sockaddr}" | |
+| "{network:tcp_flags}" | |
+| "{network:tcp_state}" | |
+| "{odtypes:ODError}" | |
+| "{odtypes:mbr_details}" | |
+| "{odtypes:mbridtype}" | |
+| "{odtypes:nt_sid_t}" | |
+| "{sensitive}" | |
+| "{private}" | | Private log argument
+| "{public}" | | Public log argument
+|===
+
+[NOTE]
+The public and private value type decoders can be used in combination with
+other value type decoders for example "%{public,uuid_t}.16P".
+
 The flags are defined as:
 
 [cols="1,1,5",options="header"]
 |===
 | Value | Identifier | Description
-| "#" | |
+| "#" | | Value should be converted to an "alternate form"
 | "0" | | Value should be padded with 0
 | "-" | |
 | " " | |
@@ -1069,36 +1114,45 @@ The length modifiers are defined as:
 | "z" | | size_t
 |===
 
+The .precision is defined as:
+
+[cols="1,1,5",options="header"]
+|===
+| Value | Identifier | Description
+| "0" | | Observed that this has no effect in "%.0s"
+| "*" | | An additional integer argument supplies the field width or precision.
+|===
+
 The types are defined as:
 
 [cols="1,1,5",options="header"]
 |===
 | Value | Identifier | Description
 | "@" | | Obj-C/CF/Swift object
-| "a" | |
-| "A" | |
+| "a" | | Floating-point value
+| "A" | | Floating-point value
 | "c" | | Character value
-| "C" | | Equivalent to "lc"
+| "C" | | wide character value, equivalent to "lc"
 | "d" | | Signed decimal integer value
-| "D" | |
-| "e" | |
-| "E" | |
-| "f" | |
-| "F" | |
-| "g" | |
-| "G" | |
-| "i" | |
+| "D" | | Long signed decimal integer value, equivalent to "ld"
+| "e" | | Floating-point value
+| "E" | | Floating-point value
+| "f" | | Floating-point value
+| "F" | | Floating-point value
+| "g" | | Floating-point value
+| "G" | | Floating-point value
+| "i" | | Signed decimal integer value
 | "n" | |
-| "o" | |
-| "O" | |
-| "p" | | Pointer value
+| "o" | | Octal integer value
+| "O" | | Long octal integer value, equivalent to "lo"
+| "p" | | Pointer value, equivalent to "0x%x"
 | "P" | | Binary data
 | "s" | | String value
-| "S" | | Equivalent to "ls"
+| "S" | | Wide character string value, equivalent to "ls"
 | "u" | | Unsigned decimal integer value
-| "U" | |
-| "x" | | Lower case hexadecimal interger value
-| "X" | | Upper case hexadecimal interger value
+| "U" | | Long unsigned decimal integer value, equivalent to "lu"
+| "x" | | Hexadecimal interger value, formatter in lower case
+| "X" | | Hexadecimal interger value, formatter in upper case
 |===
 
 === Oversize chunk