Skip to content

Conversation

@alfathandr
Copy link

Summary

This PR fixes several execution errors encountered when processing specific artifacts (Alarms, Connected Devices, System Version Plist, and Network Usage). These changes improve tool stability and prevent crashes due to data parsing issues.

Detailed Changes

1. Alarms Artifact (appleAlarms.py)

  • Issue: Encountered ValueError: Invalid isoformat string: '...Z' because datetime.fromisoformat() does not support the 'Z' suffix (Zulu time) in certain Python versions.
  • Fix: Switched to using the native plistlib date object and explicitly set the timezone to UTC using .replace(tzinfo=timezone.utc).

2. Connected Device Information (ConnectedDeviceInformation.py)

  • Issue: sqlite3.DatabaseError: file is not a database crashed the tool when processing corrupt or 0-byte SQLite files.
  • Fix: Implemented a try-except block to catch sqlite3.DatabaseError and sqlite3.OperationalError. This allows the tool to log the error and skip the invalid file gracefully instead of crashing.

3. System Version Plist (systemVersionPlist.py)

  • Issue: TypeError caused by variable shadowing. The variable name system_version_plist conflicted with a function/module name, causing Python to treat it as a function instead of a string path.
  • Fix: Refactored the variable name to plist_file to ensure type safety.

4. Network Usage (netusage.py)

  • Issue: ValueError: year 0 is out of range. The SQLite database contained timestamps with year 0, which is invalid in Python's Gregorian calendar implementation.
  • Fix: Added a try-except block to handle conversion failures. If a timestamp is invalid, it falls back to the raw string value instead of crashing the artifact.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant