'#2351 Implements NSKeyedArchiver detector.

sepinf-inc · Oct 26, 2024 · 756372b · 756372b
1 parent abf8b8c
commit 756372b
Showing 1 changed file with 19 additions and 1 deletion.
diff --git a/iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/plist/detector/PListDetector.java b/iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/plist/detector/PListDetector.java
@@ -15,6 +15,7 @@
 
 import com.dd.plist.NSDictionary;
 import com.dd.plist.NSObject;
+import com.dd.plist.NSString;
 import com.dd.plist.PropertyListFormatException;
 import com.dd.plist.PropertyListParser;
 
@@ -32,6 +33,7 @@ public class PListDetector implements Detector {
     public static MediaType BITUNES = MediaType.application("x-bplist-itunes");
     public static MediaType WA_USER_PLIST = MediaType.application("x-whatsapp-user-plist");
     public static MediaType THREEMA_USER_PLIST = MediaType.application("x-threema-user-plist");
+    public static MediaType NSKEYEDARCHIVER_PLIST = MediaType.application("x-apple-nskeyedarchiver");
 
     public static MediaType detectOnKeys(Set<String> keySet) {
         if (keySet.contains("nodes") && keySet.contains("edges") && keySet.contains("graphEncodingVersion")) {
@@ -46,9 +48,25 @@ public static MediaType detectOnKeys(Set<String> keySet) {
         } else if (keySet.contains("Threema device ID")) {
             return THREEMA_USER_PLIST;
         }
+
         return BPLIST;
     }
 
+    public static MediaType detectOnNodes(NSDictionary rootObj, Metadata metadata) {
+        NSObject archiver = rootObj.get("$archiver");
+        if (archiver != null) {
+            if (archiver instanceof NSString) {
+                if (archiver.toString().toLowerCase().equals("nskeyedarchiver")) {
+                    metadata.add(null, 0);
+                    return NSKEYEDARCHIVER_PLIST;
+                }
+            }
+        }
+
+        return detectOnKeys(rootObj.getHashMap().keySet());
+
+    }
+
     /**
      * @param input
      *            input stream must support reset
@@ -101,7 +119,7 @@ public MediaType detect(InputStream input, Metadata metadata) throws IOException
         }
 
         if (rootObj instanceof NSDictionary) {
-            return detectOnKeys(((NSDictionary) rootObj).getHashMap().keySet());
+            return detectOnNodes((NSDictionary) rootObj, metadata);
         }
         return BPLIST;
     }