Repository navigation
Expand file tree
/
Copy pathappleMapsApplication.py
More file actions
72 lines (63 loc) · 3.54 KB
/
Copy pathappleMapsApplication.py
File metadata and controls
72 lines (63 loc) · 3.54 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
__artifacts_v2__ = {
"appleMapsApplication": {
"name": "Apple Maps Last Activity Camera",
"description": "Parses the last Apple Maps camera/map location (latitude and longitude) from com.apple.Maps.plist.",
"author": "@AlexisBrignoni",
"creation_date": "2020-08-03",
"last_update_date": "2026-08-21",
"requirements": "none",
"category": "Locations",
"notes": "Protobuf field positions interpreted as latitude/longitude based on observed coordinate-range values in testing. In tested images rows are recovered only on iOS 12.4, 13.3.1 and 17.1 (one row each); the plist is present without recoverable coordinates on the other recorded images (iOS 14-26) and on all 21 extractions in Mattia Epifani's 2026-08 comparison across 21 extractions (iOS 16.1.1-26.5.2), so an empty result on current extractions is common.",
"paths": ('*/Data/Application/*/Library/Preferences/com.apple.Maps.plist'),
"output_types": ["html", "tsv", "lava", "kml"],
"artifact_icon": "map-pin",
"sample_data": {
"ctf2020_ios12": "iOS 12.4 | com.apple.Maps | 1 row",
"dexter_ios18": "iOS 18.3.2 | com.apple.Maps | 0 rows",
"felix_ios17": "iOS 17.6.1 | com.apple.Maps | 0 rows",
"fsfull002_ios17": "iOS 17.1 | com.apple.Maps | 1 row",
"hc_ios18_7": "iOS 18.7.8 | com.apple.Maps | 0 rows",
"iphone11_ios17": "iOS 17.3 | com.apple.Maps | 0 rows",
"iphone12_ios18": "iOS 18.7 | com.apple.Maps | 0 rows",
"otto_ios17": "iOS 17.5.1 | com.apple.Maps | 0 rows",
"abe_ios16": "iOS 16.5 | com.apple.Maps | 0 rows",
"felix23_ios16": "iOS 16.5 | com.apple.Maps | 0 rows",
"hickman_ios13": "iOS 13.3.1 | com.apple.Maps | 1 row",
"hickman_ios14": "iOS 14.3 | com.apple.Maps | 0 rows",
"jess_ios15": "iOS 15.0.2 | com.apple.Maps | 0 rows",
"magnet_ios16": "iOS 16.1.1 | com.apple.Maps | 0 rows",
}
}
}
from scripts import blackboxprotobuf
from google.protobuf.message import DecodeError
from scripts.ilapfuncs import artifact_processor, get_file_path, get_plist_file_content, logfunc
_DECODE_ERRORS = (DecodeError, KeyError, ValueError, TypeError,
IndexError)
@artifact_processor
def appleMapsApplication(context):
files_found = context.get_files_found()
source_path = get_file_path(files_found, "com.apple.Maps.plist")
data_list = []
plist = get_plist_file_content(source_path)
# Check if plist is valid before processing
if not plist or not isinstance(plist, dict):
return (), [], source_path
types = {'1': {'type': 'double', 'name': 'Latitude'},
'2': {'type': 'double', 'name': 'Longitude'},
'3': {'type': 'double', 'name': ''},
'4': {'type': 'fixed64', 'name': ''},
'5': {'type': 'double', 'name': ''}
}
protobuf = plist.get('__internal__LastActivityCamera', None)
if protobuf:
try:
internal_plist, _ = blackboxprotobuf.decode_message(protobuf,types)
latitude = (internal_plist['Latitude'])
longitude = (internal_plist['Longitude'])
data_list.append((latitude, longitude))
except _DECODE_ERRORS as ex:
logfunc(f'Apple Maps Last Activity Camera: could not decode '
f'__internal__LastActivityCamera: {ex}')
data_headers = ('Latitude','Longitude')
return data_headers, data_list, source_path