{"id":13698666,"url":"https://github.com/abrignoni/ALEAPP","last_synced_at":"2025-05-04T03:31:48.754Z","repository":{"id":36992508,"uuid":"242402791","full_name":"abrignoni/ALEAPP","owner":"abrignoni","description":"Android Logs Events And Protobuf Parser","archived":false,"fork":false,"pushed_at":"2025-04-25T19:52:27.000Z","size":7019,"stargazers_count":600,"open_issues_count":26,"forks_count":127,"subscribers_count":27,"default_branch":"main","last_synced_at":"2025-04-26T03:12:32.771Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/abrignoni.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-02-22T19:55:39.000Z","updated_at":"2025-04-25T16:01:39.000Z","dependencies_parsed_at":"2024-06-06T04:23:38.757Z","dependency_job_id":"a2c8ee42-4735-4399-bc53-d9f855dcb8fb","html_url":"https://github.com/abrignoni/ALEAPP","commit_stats":null,"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrignoni%2FALEAPP","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrignoni%2FALEAPP/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrignoni%2FALEAPP/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrignoni%2FALEAPP/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/abrignoni","download_url":"https://codeload.github.com/abrignoni/ALEAPP/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252283638,"owners_count":21723513,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T19:00:51.678Z","updated_at":"2025-05-04T03:31:48.537Z","avatar_url":"https://github.com/abrignoni.png","language":"Python","readme":"![ALEAPP](scripts/ALEAPP_banner.png)\n\n# Android Logs Events And Protobuf Parser\n\nIf you want to contribute hit me up on twitter: https://twitter.com/AlexisBrignoni\n\nDetails in blog post here: https://abrignoni.blogspot.com/2020/02/aleapp-android-logs-events-and-protobuf.html\n\n## Requirements\n\n**Python 3.9 or above** (older versions of 3.x will also work with the exception of one or two modules)\n\n### Dependencies\n\nDependencies for your python environment are listed in `requirements.txt`. Install them using the below command. Ensure\nthe `py` part is correct for your environment, eg `py`, `python`, or `python3`, etc.\n\n`py -m pip install -r requirements.txt`\nor\n`pip3 install -r requirements.txt`\n\nTo run on **Linux**, you will also need to install `tkinter` separately like so:\n\n`sudo apt-get install python3-tk`\n\n## Compile to executable\n\nTo compile to an executable so you can run this on a system without python installed.\n\nTo create aleapp.exe, run:\n\n```\npyinstaller --onefile aleapp.spec\n```\n\nTo create aleappGUI.exe, run:\n\n```\npyinstaller --onefile --noconsole aleappGUI.spec\n```\n\n## Usage\n\n### CLI\n\n```\n$ python aleapp.py -t \u003czip | tar | fs | gz\u003e -i \u003cpath_to_extraction\u003e -o \u003cpath_for_report_output\u003e\n```\n\n### GUI\n\n```\n$ python aleappGUI.py\n```\n\n### Help\n\n```\n$ python aleapp.py --help\n```\n\n## Contributing artifact plugins\n\nEach plugin is a Python source file which should be added to the `scripts/artifacts` folder which will be loaded dynamically each time ALEAPP is run.\n\nThe plugin source file must contain a dictionary named `__artifacts_v2__` at the very beginning of the module, which defines the artifacts that the plugin processes. The keys in the `__artifacts_v2__` dictionary should be IDs for the artifact(s) which must be unique within ALEAPP. The values should be dictionaries containing the following keys:\n\n- `name`: The name of the artifact as a string.\n- `description`: A description of the artifact as a string.\n- `author`: The author of the plugin as a string.\n- `version`: The version of the artifact as a string.\n- `date`: The date of the last update to the artifact as a string.\n- `requirements`: Any requirements for processing the artifact as a string.\n- `category`: The category of the artifact as a string.\n- `notes`: Any additional notes as a string.\n- `paths`: A tuple of strings containing glob search patterns to match the path of the data that the plugin expects for the artifact.\n- `function`: The name of the function which is the entry point for the artifact's processing as a string.\n\nFor example:\n\n```python\n__artifacts_v2__ = {\n    \"cool_artifact_1\": {\n        \"name\": \"Cool Artifact 1\",\n        \"description\": \"Extracts cool data from database files\",\n        \"author\": \"@username\",\n        \"version\": \"0.1\",\n        \"date\": \"2022-10-25\",\n        \"requirements\": \"none\",\n        \"category\": \"Really cool artifacts\",\n        \"notes\": \"\",\n        \"paths\": ('*/com.android.cooldata/databases/database*.db',),\n        \"function\": \"get_cool_data1\"\n    },\n    \"cool_artifact_2\": {\n        \"name\": \"Cool Artifact 2\",\n        \"description\": \"Extracts cool data from XML files\",\n        \"author\": \"@username\",\n        \"version\": \"0.1\",\n        \"date\": \"2022-10-25\",\n        \"requirements\": \"none\",\n        \"category\": \"Really cool artifacts\",\n        \"notes\": \"\",\n        \"paths\": ('*/com.android.cooldata/files/cool.xml',),\n        \"function\": \"get_cool_data2\"\n    }\n}\n```\n\nThe functions referenced as entry points in the `__artifacts__` dictionary must take the following arguments:\n\n- An iterable of the files found which are to be processed (as strings)\n- The path of ALEAPP's output folder(as a string)\n- The seeker (of type FileSeekerBase) which found the files\n- A Boolean value indicating whether or not the plugin is expected to wrap text\n\nFor example:\n\n```python\ndef get_cool_data1(files_found, report_folder, seeker, wrap_text):\n    pass  # do processing here\n```\n\nPlugins are generally expected to provide output in ALEAPP's HTML output format, TSV, and optionally submit records to\nthe timeline. Functions for generating this output can be found in the `artifact_report` and `ilapfuncs` modules.\nAt a high level, an example might resemble:\n\n```python\n__artifacts_v2__ = {\n    \"cool_artifact_1\": {\n        \"name\": \"Cool Artifact 1\",\n        \"description\": \"Extracts cool data from database files\",\n        \"author\": \"@username\",  # Replace with the actual author's username or name\n        \"version\": \"0.1\",  # Version number\n        \"date\": \"2022-10-25\",  # Date of the latest version\n        \"requirements\": \"none\",\n        \"category\": \"Really cool artifacts\",\n        \"notes\": \"\",\n        \"paths\": ('*/com.android.cooldata/databases/database*.db',),\n        \"function\": \"get_cool_data1\"\n    }\n}\n\nimport datetime\nfrom scripts.artifact_report import ArtifactHtmlReport\nimport scripts.ilapfuncs\n\ndef get_cool_data1(files_found, report_folder, seeker, wrap_text):\n    # let's pretend we actually got this data from somewhere:\n    rows = [\n     (datetime.datetime.now(), \"Cool data col 1, value 1\", \"Cool data col 1, value 2\", \"Cool data col 1, value 3\"),\n     (datetime.datetime.now(), \"Cool data col 2, value 1\", \"Cool data col 2, value 2\", \"Cool data col 2, value 3\"),\n    ]\n\n    headers = [\"Timestamp\", \"Data 1\", \"Data 2\", \"Data 3\"]\n\n    # HTML output:\n    report = ArtifactHtmlReport(\"Cool stuff\")\n    report_name = \"Cool DFIR Data\"\n    report.start_artifact_report(report_folder, report_name)\n    report.add_script()\n    report.write_artifact_data_table(headers, rows, files_found[0])  # assuming only the first file was processed\n    report.end_artifact_report()\n\n    # TSV output:\n    scripts.ilapfuncs.tsv(report_folder, headers, rows, report_name, files_found[0])  # assuming first file only\n\n    # Timeline:\n    scripts.ilapfuncs.timeline(report_folder, report_name, rows, headers)\n\n```\n\n## Acknowledgements\n\nThis tool is the result of a collaborative effort of many people in the DFIR community.\n","funding_links":[],"categories":["Tools","Challenges"],"sub_categories":["Mobile Forensics"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabrignoni%2FALEAPP","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fabrignoni%2FALEAPP","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabrignoni%2FALEAPP/lists"}