Add new parser plist plugin on iOS WiFi Known Networks #4925
Conversation
|
Thanks for the PR, I'm a bit preoccupied at the moment will try to take a look as soon as time permits |
joachimmetz
force-pushed
the
ios_wifi
branch
from
75e8365 to
87bffee
Compare
plaso/data/formatters/ios.yaml
Outdated
| @@ -1,6 +1,19 @@ | |||
| # Plaso iOS related event formatters. | |||
| --- | |||
| type: 'conditional' | |||
| data_type: 'ios:wifi:known_networks:knowing' | |||
There was a problem hiding this comment.
Please keep the entries in this file in alphabetical order of data type.
plaso/data/timeliner.yaml
Outdated
| description: 'Time network was added' | ||
| - name: 'last_associated' | ||
| description: 'Last associated time' | ||
| - name: 'ssid' |
There was a problem hiding this comment.
You only need to specify date and time values here.
plaso/data/formatters/ios.yaml
Outdated
| @@ -1,6 +1,19 @@ | |||
| # Plaso iOS related event formatters. | |||
| --- | |||
| type: 'conditional' | |||
| data_type: 'ios:wifi:known_networks:knowing' | |||
| message: | |||
| - 'SSID={ssid}' | |||
There was a problem hiding this comment.
style nits: yaml and textual formatting does not match rest of the file
plaso/data/formatters/ios.yaml
Outdated
| - 'SSID={ssid}' | ||
| - 'BSSID={bssid}' | ||
| - 'Channel={channel}' | ||
| - 'Added At={added_at_time_str}' |
There was a problem hiding this comment.
date and time values are handled by the timeliner
plaso/data/timeliner.yaml
Outdated
| @@ -581,6 +581,20 @@ attribute_mappings: | |||
| description: 'Content Modification Time' | |||
| place_holder_event: true | |||
| --- | |||
| data_type: 'ios:wifi:known_networks:knowing' | |||
| attribute_mappings: | |||
| - name: 'added_at' | |||
There was a problem hiding this comment.
style nit: yaml formatting does not match rest of the file
| event_data.last_associated = last_associated_obj | ||
| event_data.last_associated_time_str = last_associated_obj.CopyToDateTimeString() | ||
|
|
||
| print(f"Debug Event: SSID={event_data.ssid}, Added At={event_data.added_at_time_str}, Last Associated={event_data.last_associated_time_str}") |
There was a problem hiding this comment.
what is this print doing here?
| last_associated_obj = dfdatetime_posix_time.PosixTime( | ||
| timestamp=last_associated.timestamp()) | ||
| event_data.last_associated = last_associated_obj | ||
| event_data.last_associated_time_str = last_associated_obj.CopyToDateTimeString() |
There was a problem hiding this comment.
there is no need for added_at_time_str the timeliner will take care of this.
| event_data.ssid = ssid_key | ||
|
|
||
| if added_at: | ||
| added_at_obj = dfdatetime_posix_time.PosixTime( |
There was a problem hiding this comment.
Why not use _GetDateTimeValueFromPlistKey ?
| match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS. | ||
| top_level (Optional[dict[str: object]]): entire plist file. | ||
| """ | ||
| for ssid_key, ssid_data in top_level.items(): |
There was a problem hiding this comment.
ssid_key appears to be the internal network key
|
|
||
| for bssid_data in bssid_list: | ||
| event_data = IOSWiFiKnownNetworksEventData() | ||
| event_data.ssid = ssid_key |
There was a problem hiding this comment.
Isn't the SSID stored in the SSID value ?
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #4925 +/- ##
==========================================
+ Coverage 85.05% 85.07% +0.01%
==========================================
Files 431 432 +1
Lines 38648 38676 +28
==========================================
+ Hits 32873 32903 +30
+ Misses 5775 5773 -2 ☔ View full report in Codecov by Sentry. |
Added a new Plist plugin parser for extracting known WiFi network details from iOS devices.
Description:
This pull request introduces a new Plist plugin parser specifically for the
com.apple.wifi.known-networks.plistfile. The parser extracts relevant WiFi information such as SSID, BSSID, channels, and associated timestamps, providing enhanced visibility into known network connections on iOS devices.The implementation includes:
Added AtandLast Associated.com.apple.wifi.known-networks.plist) for unit testing.Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: