Skip to content

Fix parsing errors in Alarms, Connected Devices, Plist, and NetUsage artifacts#1402

Draft
alfathandr wants to merge 1 commit into
abrignoni:mainfrom
alfathandr:main
Draft

Fix parsing errors in Alarms, Connected Devices, Plist, and NetUsage artifacts#1402
alfathandr wants to merge 1 commit into
abrignoni:mainfrom
alfathandr:main

Conversation

@alfathandr

Copy link
Copy Markdown

Summary

This PR fixes several execution errors encountered when processing specific artifacts (Alarms, Connected Devices, System Version Plist, and Network Usage). These changes improve tool stability and prevent crashes due to data parsing issues.

Detailed Changes

1. Alarms Artifact (appleAlarms.py)

  • Issue: Encountered ValueError: Invalid isoformat string: '...Z' because datetime.fromisoformat() does not support the 'Z' suffix (Zulu time) in certain Python versions.
  • Fix: Switched to using the native plistlib date object and explicitly set the timezone to UTC using .replace(tzinfo=timezone.utc).

2. Connected Device Information (ConnectedDeviceInformation.py)

  • Issue: sqlite3.DatabaseError: file is not a database crashed the tool when processing corrupt or 0-byte SQLite files.
  • Fix: Implemented a try-except block to catch sqlite3.DatabaseError and sqlite3.OperationalError. This allows the tool to log the error and skip the invalid file gracefully instead of crashing.

3. System Version Plist (systemVersionPlist.py)

  • Issue: TypeError caused by variable shadowing. The variable name system_version_plist conflicted with a function/module name, causing Python to treat it as a function instead of a string path.
  • Fix: Refactored the variable name to plist_file to ensure type safety.

4. Network Usage (netusage.py)

  • Issue: ValueError: year 0 is out of range. The SQLite database contained timestamps with year 0, which is invalid in Python's Gregorian calendar implementation.
  • Fix: Added a try-except block to handle conversion failures. If a timestamp is invalid, it falls back to the raw string value instead of crashing the artifact.

@JamesHabben

Copy link
Copy Markdown
Collaborator

this is a very large PR and would be better done as a single module in each PR. additionally, other PRs have resolved some of the issues here. please review this PR and see what is still needed.

@JamesHabben JamesHabben added the question Further information is requested label Jun 17, 2026
@abrignoni

Copy link
Copy Markdown
Owner

Thanks for this! Since this was opened, main has moved a lot — several of these artifacts plus ilapfuncs.py changed during the ongoing LAVA/@artifact_processor modernization (e.g. tikTok was updated in #1545), and GitHub now flags this PR as conflicting. Could you rebase onto the latest main and confirm which fixes are still needed? Some may already be resolved. Happy to re-review once it's rebased. Thanks again!

@JamesHabben JamesHabben marked this pull request as draft June 23, 2026 19:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

question Further information is requested

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants