Fixes a bug on recent phones not having WIFI column in net usage (#580)

Co-authored-by: Donncha Ó Cearbhaill <donncha.ocearbhaill@amnesty.org>
Co-authored-by: Rory Flynn <75283103+roaree@users.noreply.github.com>
This commit is contained in:
Tek
2025-01-07 12:48:35 +01:00
committed by GitHub
co-authored by Donncha Ó Cearbhaill Rory Flynn
parent 7d6dc9e6dc
commit 2aa76c8a1c
+68 -42
View File
@@ -38,44 +38,70 @@ class NetBase(IOSExtraction):
def _extract_net_data(self): def _extract_net_data(self):
conn = sqlite3.connect(self.file_path) conn = sqlite3.connect(self.file_path)
conn.row_factory = sqlite3.Row
cur = conn.cursor() cur = conn.cursor()
cur.execute( try:
cur.execute(
"""
SELECT
ZPROCESS.ZFIRSTTIMESTAMP,
ZPROCESS.ZTIMESTAMP,
ZPROCESS.ZPROCNAME,
ZPROCESS.ZBUNDLENAME,
ZPROCESS.Z_PK AS ZPROCESS_PK,
ZLIVEUSAGE.ZWIFIIN,
ZLIVEUSAGE.ZWIFIOUT,
ZLIVEUSAGE.ZWWANIN,
ZLIVEUSAGE.ZWWANOUT,
ZLIVEUSAGE.Z_PK AS ZLIVEUSAGE_PK,
ZLIVEUSAGE.ZHASPROCESS,
ZLIVEUSAGE.ZTIMESTAMP AS ZL_TIMESTAMP
FROM ZLIVEUSAGE
LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK
UNION
SELECT ZFIRSTTIMESTAMP, ZTIMESTAMP, ZPROCNAME, ZBUNDLENAME, Z_PK,
NULL, NULL, NULL, NULL, NULL, NULL, NULL
FROM ZPROCESS WHERE Z_PK NOT IN
(SELECT ZHASPROCESS FROM ZLIVEUSAGE);
""" """
SELECT )
ZPROCESS.ZFIRSTTIMESTAMP, except sqlite3.OperationalError:
ZPROCESS.ZTIMESTAMP, # Recent phones don't have ZWIFIIN and ZWIFIOUT columns
ZPROCESS.ZPROCNAME, cur.execute(
ZPROCESS.ZBUNDLENAME, """
ZPROCESS.Z_PK, SELECT
ZLIVEUSAGE.ZWIFIIN, ZPROCESS.ZFIRSTTIMESTAMP,
ZLIVEUSAGE.ZWIFIOUT, ZPROCESS.ZTIMESTAMP,
ZLIVEUSAGE.ZWWANIN, ZPROCESS.ZPROCNAME,
ZLIVEUSAGE.ZWWANOUT, ZPROCESS.ZBUNDLENAME,
ZLIVEUSAGE.Z_PK, ZPROCESS.Z_PK AS ZPROCESS_PK,
ZLIVEUSAGE.ZHASPROCESS, ZLIVEUSAGE.ZWWANIN,
ZLIVEUSAGE.ZTIMESTAMP ZLIVEUSAGE.ZWWANOUT,
FROM ZLIVEUSAGE ZLIVEUSAGE.Z_PK AS ZLIVEUSAGE_PK,
LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK ZLIVEUSAGE.ZHASPROCESS,
UNION ZLIVEUSAGE.ZTIMESTAMP AS ZL_TIMESTAMP
SELECT ZFIRSTTIMESTAMP, ZTIMESTAMP, ZPROCNAME, ZBUNDLENAME, Z_PK, FROM ZLIVEUSAGE
NULL, NULL, NULL, NULL, NULL, NULL, NULL LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK
FROM ZPROCESS WHERE Z_PK NOT IN UNION
(SELECT ZHASPROCESS FROM ZLIVEUSAGE); SELECT ZFIRSTTIMESTAMP, ZTIMESTAMP, ZPROCNAME, ZBUNDLENAME, Z_PK,
""" NULL, NULL, NULL, NULL, NULL
) FROM ZPROCESS WHERE Z_PK NOT IN
(SELECT ZHASPROCESS FROM ZLIVEUSAGE);
"""
)
for row in cur: for row in cur:
# ZPROCESS records can be missing after the JOIN. # ZPROCESS records can be missing after the JOIN.
# Handle NULL timestamps. # Handle NULL timestamps.
if row[0] and row[1]: if row["ZFIRSTTIMESTAMP"] and row["ZTIMESTAMP"]:
first_isodate = convert_mactime_to_iso(row[0]) first_isodate = convert_mactime_to_iso(row["ZFIRSTTIMESTAMP"])
isodate = convert_mactime_to_iso(row[1]) isodate = convert_mactime_to_iso(row["ZTIMESTAMP"])
else: else:
first_isodate = row[0] first_isodate = row["ZFIRSTTIMESTAMP"]
isodate = row[1] isodate = row["ZTIMESTAMP"]
if row[11]: if row["ZL_TIMESTAMP"]:
live_timestamp = convert_mactime_to_iso(row[11]) live_timestamp = convert_mactime_to_iso(row["ZL_TIMESTAMP"])
else: else:
live_timestamp = "" live_timestamp = ""
@@ -83,16 +109,18 @@ class NetBase(IOSExtraction):
{ {
"first_isodate": first_isodate, "first_isodate": first_isodate,
"isodate": isodate, "isodate": isodate,
"proc_name": row[2], "proc_name": row["ZPROCNAME"],
"bundle_id": row[3], "bundle_id": row["ZBUNDLENAME"],
"proc_id": row[4], "proc_id": row["ZPROCESS_PK"],
"wifi_in": row[5], "wifi_in": row["ZWIFIIN"] if "ZWIFIIN" in row.keys() else None,
"wifi_out": row[6], "wifi_out": row["ZWIFIOUT"] if "ZWIFIOUT" in row.keys() else None,
"wwan_in": row[7], "wwan_in": row["ZWWANIN"],
"wwan_out": row[8], "wwan_out": row["ZWWANOUT"],
"live_id": row[9], "live_id": row["ZLIVEUSAGE_PK"],
"live_proc_id": row[10], "live_proc_id": row["ZHASPROCESS"],
"live_isodate": live_timestamp if row[11] else first_isodate, "live_isodate": live_timestamp
if row["ZL_TIMESTAMP"]
else first_isodate,
} }
) )
@@ -108,8 +136,6 @@ class NetBase(IOSExtraction):
) )
record_data_usage = ( record_data_usage = (
record_data + " " record_data + " "
f"WIFI IN: {record['wifi_in']}, "
f"WIFI OUT: {record['wifi_out']} - "
f"WWAN IN: {record['wwan_in']}, " f"WWAN IN: {record['wwan_in']}, "
f"WWAN OUT: {record['wwan_out']}" f"WWAN OUT: {record['wwan_out']}"
) )