-
Notifications
You must be signed in to change notification settings - Fork 220
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support some recent Telegram iOS chats not being parsed #1998
Comments
Thank you very much @wladimirleite for reporting this relevant situation, debugging it and sending a PR! Just a minor question: do you think this is really a bug fix or support for new Telegram versions? |
Good question! |
Changed to enhancement and edited the issue title to make it clearer. By the way, the decoding code is quite complex, so I made some "house keeping" changes (like renaming some variables), to make the comparison with the reference implementation a bit easier, which may be helpful in the future. |
Working on a real case with many iOS Telegram databases (db_sqlite), I noticed that no chat was extracted by IPED.
Checking the log, there were many exceptions, most of them AIOOB.
For some of the chats I have the chats generated by Cellebrite PA, but part of them were missed by PA because they were stored in different paths (stored by Nicegram not Telegram), so it would be great if IPED can parse them.
I collected iOS Telegram database samples from other cases, and most of the recent databases could not be parsed either.
Debugging the issue I found that, at least since Oct/2021 (date that Telegram code related to this was changed), if some flags are set (e.g. forwarded message), the parser fails because it doesn't skip the information present when these flags are set.
I think this issue is not related to #1976 because when there is an exception reading a message, the parsing is aborted and the chat subitem is not created.
Anyway, I reviewed the methods
readMessage
andreadForwardInfo
inPostBoxCoding
class and now all the samples I have (including old ones) are being parsed.The text was updated successfully, but these errors were encountered: