-
Notifications
You must be signed in to change notification settings - Fork 227
Description
The get_netusage function in netusage.py encounters a critical error when processing network usage data containing invalid or NULL timestamps in the SQLite database. The parser crashes with a ValueError, preventing the extraction of any network usage data, even if valid records exist.
Root Cause Analysis
The issue stems from the convert_ts_human_to_utc function being called on raw data from the SQLite query without error handling.
- The SQLite query uses
datetime(...)which may return empty strings or unexpected formats for NULL/0 values. - These values are passed to
convert_ts_human_to_utc. datetime.strptimeraises aValueError(e.g.,time data '' does not match format...) orTypeError.- Since there are no
try-exceptblocks around these conversion calls, the exception propagates and terminates the artifact parsing immediately.
Traceback
ValueError: time data '' does not match format '%Y-%m-%d %H:%M:%S'
Traceback (most recent call last):
File "scripts/artifacts/netusage.py", line 56
lastconnected = convert_utc_human_to_timezone(convert_ts_human_to_utc(row[0]),timezone_offset)
File "scripts/ilapfuncs.py", line 1117, in convert_ts_human_to_utc
dt = datetime.strptime(ts, '%Y-%m-%d %H:%M:%S')
Affected File
- netusage.py (Lines 52-60 and 104-105 approx)
Steps to Reproduce
- Run iLEAPP against an iOS backup containing a
netusage.sqlitedatabase. - Ensure the database contains rows where
ZTIMESTAMPorZFIRSTTIMESTAMPresults in a NULL or invalid string when queried. - Observe the crash during the "Network Usage" artifact parsing stage.
Expected Behavior
The parser should implement defensive programming: if a timestamp is invalid, it should be logged or set to a fallback value (e.g., "N/A"), allowing the parser to continue processing the remaining valid rows.
Proposed Fix
Wrap the timestamp conversion logic in try-except blocks to catch ValueError and TypeError, setting the value to 'N/A' upon failure.