Google Chat - Reactions Research

[JamesHabben]

I am looking for some help from anyone looking to do some research. the current Google Chat module has code to parse reactions to chat messages. I think it's not totally correct since the code has an assumption that there will only be one reaction. we have a sample image from Josh Hickman in his iOS 15 image that has Google Chat artifacts, but there is only 2 users in that data so there are only messages with a single reaction in that data set. I would like to get a data set that has more users and ultimately more reactions on a single message so we can determine the shape of how that would be stored. this doesn't require any coding, but it does need a little technical digging.

how to help

options on how to help - literally any single one of these would be a helpful step forward:

• create new data on test device and extract for sample testing
• find some other public images that have google chat data
• determine if there are more than 2 google chat users in identified image
• dig into the topic_messages table and inspect the reactions column data

knowns

database path from ios15: /filesystem2/mobile/Containers/Data/Application/B7D14EE9-5849-4A3F-927A-3D2A7A92FA74/Documents/user_accounts/116154953456844128063/dynamite.db

search pattern for path from module: '*/Documents/user_accounts/*/dynamite.db*'

here is a little summary of semi-known structure. the data is stored as a protobuf. there are 3 known states in the ios15 image:

1. no reactions
   cell data size is 22 bytes.
   fe ff 00 45 00 4d 00 50 00 54 00 59 00 5f 00 42 00 4c 00 4f 00 42
   decoded as EMPTY_BLOB
2. single reaction with no user
   cell data size is 25 bytes.
   0a 17 0a 15 0a 06 0a 04 f0 9f a7 a1 10 01 18 00 20 8f b3 85 96 c2 b1 fb 02

1 {
  1 {
    1 {
      1: "🧡"
    }
    2 [varint]: 1
        # sint64 (zigzag): -1
        # bool: true
    3 [varint]: 0
        # sint64 (zigzag): 0
        # bool: false
    4 [varint]: 1668561017854351
        # sint64 (zigzag): -834280508927176
  }
}

3. single reaction with a user id
   data cell is 48 bytes.
   0a 2e 0a 13 0a 06 0a 04 f0 9f a4 a3 10 01 20 9f f0 96 e8 fd c7 fe 02 12 17 0a 15 31 30 38 36 36 38 30 34 38 33 35 34 30 38 37 39 34 32 38 39 32

1 {
  1 {
    1 {
      1: "🤣"
    }
    2 [varint]: 1
        # sint64 (zigzag): -1
        # bool: true
    4 [varint]: 1682527081576479
        # sint64 (zigzag): -841263540788240
  }
  2 {
    1: "108668048354087942892"
  }
}

decoding tool

I am using crush forensics to open and decode the data.

steps:

1. open image
2. find dynamite db based on path values above
3. double to view sqlite data
4. use drop down to open topic_messages table
5. find reactions column with rows larger than 22 bytes
6. right click > inspect cell...
7. choose protobuf in the interpretations list