-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Feature]: Plist Data Viewer / Editor #3796
Comments
I am not completely sure if this really makes sense: JSON and XML are human-readable formats commonly used by lots of applications. Plist files are in some binary format which requires further conversion to make use of it inside DB4S and has more or less rather specific use cases. |
Oh, .plist files don't have to be in binary format. They have a text representation too, and there are macOS utilities to convert between them. I kind of wonder if we should have some kind of file detection logic (similar to |
Our formats extension is able to decode binary Plist. You can use it as a display format. See #1716. As with any display format, editing is not supported, though. |
@mgrojo Thanks for sharing that. I did some searching around and hadn't found that functionality. It seems that there is an issue with that extension though. on 3.13.1 it seems that the extensions were compiled for Arm in the Intel package. I am on an Intel Macbook with Sequoia 15.0. App installed and updated with homebrew. I got a sneak at the functionality in 3.12.2 before I realized I didn't have the latest. Now it gives this error when I try to load the extension manually or have it loaded automatically in settings. |
@lucydodo maybe this is something you can sort out? |
It looks like a relatively easy fix in the build script if I am understanding correctly - still kinda new to github actions. The extension build looks to be only building for the architecture the github runner is (guessing its arm). I was gonna fork and test this, but the workflows are intertwined and I can't get them to run in my fork as a test on the builds. So this section: sqlitebrowser/.github/workflows/build-macos.yml Lines 69 to 70 in a7e35c2
might get fixed like this:
|
Cool. Yeah @lucydodo will definitely be interested in investigating, and that'll likely help heaps. 😄 |
I am also trying to add in some functionality where these extensions can share a list of display formats that can be added to the format drop down rather than having to manipulate these manually into place. since its in the core, i have to build to test the changes. I am having trouble with doing a build though, so I am wondering if it is because of me trying to build on an intel mac rather than arm. i tried following the
here is the command I am using to build
not fully related to the initial issue submission, but any thoughts here? should i open a new issue? |
Oops, I forgot about this extension when transitioning to the universal binary. I'm sorry about that. |
Hi @JamesHabben, If necessary, you can build SQLite yourself using the following set of commands: curl -O https://www.sqlite.org/2024/sqlite-autoconf-3460100.tar.gz
tar -xvf sqlite-autoconf-3460100.tar.gz && cd sqlite-autoconf-3460100
export CPPFLAGS="-DSQLITE_ENABLE_API_ARMOR=1 -DSQLITE_ENABLE_COLUMN_METADATA=1 -DSQLITE_ENABLE_DBSTAT_VTAB=1 -DSQLITE_ENABLE_FTS3=1 -DSQLITE_ENABLE_FTS3_PARENTHESIS=1 -DSQLITE_ENABLE_FTS5=1 -DSQLITE_ENABLE_GEOPOLY=1 -DSQLITE_ENABLE_JSON1=1 -DSQLITE_ENABLE_MATH_FUNCTIONS=1 -DSQLITE_ENABLE_MEMORY_MANAGEMENT=1 -DSQLITE_ENABLE_RTREE=1 -DSQLITE_ENABLE_SNAPSHOT=1 -DSQLITE_ENABLE_SOUNDEX=1 -DSQLITE_ENABLE_STAT4=1 -DSQLITE_ENABLE_UNLOCK_NOTIFY=1 -DSQLITE_MAX_ATTACHED=125 -DSQLITE_MAX_VARIABLE_NUMBER=250000 -DSQLITE_USE_URI=1"
./configure --prefix=[PREFIX_TO_INSTALL] --disable-dependency-tracking --enable-dynamic-extensions --disable-readline --disable-editline
make && make install And when executing the cmake command, provide the prefix path specified above in the |
Hi @JamesHabben, |
Just got the continuous build. Confirmed the error is gone and the |
Awesome! Ok, lets close this issue an we can follow up the plist PR stuff in the PR itself. Good work both everyone! 😁 |
sounds good and thanks for the quick response and help. |
Describe the new feature
Lots of sqlite database files pulled from iphones and mac computers have blob cells that store plist data. It would be great to view in an interpreted or parsed view similar to how there are currently XML and JSON viewers for cell data.
Does this feature exist in another product or project? Please provide a link
Not in an open source tool.
Here is an example of the process to view the blob data when encountered: https://www.hexordia.com/blog/mobile-forensics-data-structures
Here is a commercial tool that provides plist viewer and protobuf viewer: https://docs.magnetforensics.com/docs/axiom-cyber/html/Content/en-us/axiom/reviewing-evidence/explorers/viewing-database-tables.htm#ViewBLOBdata
Another commercial tool that provides the viewer: https://sqliteforensictoolkit.com/sqlite-forensic-toolkit/forensic-browser-for-sqlite/
Do you have a screenshot? Please add screenshots to help explain your idea.
The text was updated successfully, but these errors were encountered: