Skip to content

Add App Inventory module for parsing-coverage analysis#1680

Merged
abrignoni merged 2 commits into
mainfrom
app-inventory
Jul 8, 2026
Merged

Add App Inventory module for parsing-coverage analysis#1680
abrignoni merged 2 commits into
mainfrom
app-inventory

Conversation

@abrignoni

@abrignoni abrignoni commented Jul 8, 2026

Copy link
Copy Markdown
Owner

Summary

Adds scripts/alternate_artifacts/appInventory.py — three developer-only artifacts that write machine-readable coverage data into the LAVA SQLite output (_lava_artifacts.db), so downstream tooling (batch-leapp) can determine which installed apps were NOT parsed by iLEAPP. Artifact-level only; no core/framework changes.

Not part of normal runs. The module lives in scripts/alternate_artifacts/, which is only loaded with the existing CLI option:

python3 ileapp.py -t zip -i <extraction.zip> -o <out> --custom_artifacts_path scripts/alternate_artifacts

The GUI and default CLI runs are unaffected (598 plugins load as before; 601 with the flag).

Artifacts

  • extractionInfo (paths: None, always runs when loaded): LEAPP name/version, input path/name, extraction type, report folder, iOS version, device name/time zone (data_ark.plist) and iTunes backup Info.plist identifiers. Fills the gap that device identifiers were previously HTML-only.
  • installedAppInventory: one row per app container (bundle / data / shared group / plugin) with bundle ID, container path and UUID. Sources: applicationState.db compatibilityInfo blobs + .com.apple.mobile_container_manager.metadata.plist files. Bundle containers matched with [Cc]ontainers since they live under lowercase /private/var/containers/ on device.
  • appFileInventory (lava_only due to size): every file in the extraction with size and modified time, mapped to its app container (GUID→bundle map for FFS; AppDomain prefixes for iTunes backups). Enumerates the seeker's existing listings (zip/tar central directory, dir walk, iTunes manifest) — no extraction/copying.

Modified Time is stored as text, not LAVA datetime: zip archives carry zone-less DOS timestamps, so UTC coercion would be wrong. Tar/dir/iTunes values are UTC.

Testing

  • PYTHONPATH=. pylint --disable=C,R → 10.00
  • PluginLoader: 598 plugins without the flag (module invisible), 601 with it, all three wrapped, no display-name collisions
  • End-to-end runs on a synthetic zip (applicationState.db + container metadata plists + data_ark.plist + LastBuildInfo.plist): with the flag all three tables populate correctly (orphan app container listed unmapped with its UUID — the "installed but not parsed" signal); without the flag no inventory tables are created

abrignoni added 2 commits July 8, 2026 15:45
…y in LAVA

Three new artifacts write machine-readable coverage data into
_lava_artifacts.db so batch tooling can diff installed apps against
what the tooling parsed:

- extractionInfo: LEAPP version, input path/name, extraction type,
  iOS version and device identifiers (data_ark.plist, iTunes Info.plist)
- installedAppInventory: one row per app container (bundle/data/group/
  plugin) with bundle ID, container path and UUID, from
  applicationState.db and container metadata plists
- appFileInventory (lava_only): every file in the extraction with size,
  modified time and the app container it belongs to, enumerated from
  the seeker listings without extracting anything
The inventory artifacts are meant for developer tooling (batch-leapp
coverage analysis), not the main user base. Moved the module to
scripts/alternate_artifacts/, which is only loaded when the CLI is run
with --custom_artifacts_path scripts/alternate_artifacts. The GUI and
default CLI runs are unaffected (598 plugins as before; 601 with the
flag). Added a README documenting usage.
@abrignoni abrignoni merged commit eeba5b8 into main Jul 8, 2026
1 check passed
@abrignoni abrignoni deleted the app-inventory branch July 8, 2026 22:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant