DFOR 772 Final Presentation

ALEAPP Telegram Parser

## {matrix} Overview
- Background
- Sample Output
- Code Overview
- Demo
- Limitations
- Issues
- Future work
- Links

---
{matrix} What is ALEAPP?

- Android Logs Events and Protobuf Parser
- Open source competitior to mobile forensic analysis tools
---
## {matrix} Sample Parser Output

<gallery>
  <img src="1.png" alt="One">
  <img src="2.png" alt="Two">
  <img src="3.png" alt="Three">
  <img src="4.png">
<gallery>
(click to enlarge)

---
<section>
<h2 class="matrix-text">Code Overview</h2>
  <div class="code-gallery"> 
    <img src="6.png">
    <img src="7.png">
    <img src="8.png">
    <img src="9.png">
    <img src="10.png">
    <img src="11.png">
  </div>
</section>

<section>
  <h2 class="matrix-text">Helper Functions</h2>
  <div class="code-gallery"> 
    <img src="12.png" alt="Three">
    <img src="13.png" alt="Three">
    <img src="14.png" alt="Three">
  </div>
</section>

<section>
  <h2 class="matrix-text">Test Harness</h2>
  The parser has support to use it standalone instead of part of ALEAPP. The syntax is:
  <p style="font-size: 25px"><code>python .\scripts\artifacts\telegram.py  --cache4db "CACHE4DBPATH" --userconfig "USERCONFINGPATH" --output "OUTPUTHPATH"  --limit 50</code></p>
</section>
---

{matrix} Demo
<iframe data-src="https://www.youtube.com/embed/-ct4Rc8C4L8" data-preview-video allowfullscreen></iframe>
---

## {matrix} Limitations

- Messages only works for Telegram builds that use constructor ID <code>76bec211</code> for messages
- Doesn't parse Write Ahead Logs
- Doesn't parse all tables
- Doesn't parse all files
---

## {matrix} Issues
<div class="split-slide">
  <div class="text-panel">
    <ul>
      <li>Test Data</li>
      <li>Other constructor types</li>
    </ul>
  </div>
  <div class="image-panel">
    <img class="zoomable" src="5.png">
  </div>
</div>
---

## {matrix} Future work

- Adding support for more constructors 
- Parsing tables such as scheduled messages, media_v4, stories, sent_files, etc.
- Multi-user support
- Write Ahead Log parsing
- Pushing to ALEAPP!
---
{matrix} Links

- [School GitHub Repo](https://github.com/WriteBlocked/DFOR/blob/main/DFOR%20772/Hoover_Hiller_Final.py)
- [ALEAPP GitHub Repo](https://github.com/WriteBlocked/ALEAPP/blob/telegram-parser/scripts/artifacts/Telegram.py)
- [Telegram Documentation](https://core.telegram.org/schema)
- [Telegram Message Constructor](https://core.telegram.org/constructor/message)
- [Blog Writeup](https://hhoover.net/classwork/772-final/)
- [Source Paper](https://people.unipmn.it/sguazt/publications/anglano-2017-telegram/Anglano-2017-Telegram.pdf)