Android Logs Events And Protobuf Parser
If you want to contribute hit me up here: https://abrignoni.github.io
Blog posts here: https://leapps.org/blog
Download
Pre-built releases need no Python installation: ALEAPP GitHub Releases,
or LEAPPs Releases for the whole LEAPP family.
| Platform | Download |
|---|
| Windows (Intel/AMD) | ALEAPP-*-windows-x64-portable.zip |
| Windows (ARM) | ALEAPP-*-windows-arm64-portable.zip |
| macOS (Apple Silicon) | ALEAPP-*-macos-arm64.dmg |
| macOS (Intel) | ALEAPP-*-macos-x64.dmg |
| Linux (Intel/AMD) | ALEAPP-*-linux-x64.AppImage |
| Linux (ARM) | ALEAPP-*-linux-arm64.AppImage |
| Debian, Ubuntu (Intel/AMD, ARM) | ALEAPP-*-linux-x64.deb, ALEAPP-*-linux-arm64.deb |
| Fedora and other RPM-based Linux (Intel/AMD, ARM) | ALEAPP-*-linux-x64.rpm, ALEAPP-*-linux-arm64.rpm |
Each download holds one program, aleapp. SHA256SUMS.txt in each release lets you check a download.
The .deb and .rpm hold the same build as the AppImage and put aleapp on the PATH,
with a menu entry. Install one with your package manager, from the folder you downloaded it to:
sudo apt install ./ALEAPP-<version>-linux-x64.deb
sudo dnf install ./ALEAPP-<version>-linux-x64.rpm
GUI: open ALEAPP the usual way: by double-clicking aleapp.exe from the zip on
Windows, ALEAPP in Applications on macOS, or the AppImage on Linux. Started without
arguments, it opens the window.
CLI: give aleapp arguments in a terminal and it runs as a command line instead. The
output folder must already exist. On Windows, use aleapp.exe from the zip.
aleapp.exe -t zip -i C:\path\to\extraction.zip -o C:\path\to\output\
On Linux, run the AppImage with the same arguments, or aleapp itself once the .deb or .rpm is installed. On macOS it is inside the app; to
type just aleapp in a terminal, link it onto your PATH once:
sudo ln -s /Applications/ALEAPP.app/Contents/MacOS/aleapp /usr/local/bin/aleapp
Requirements
Python 3.11 or above
Dependencies
Dependencies for your python environment are listed in requirements.txt. Install them using the below command. Ensure
the py part is correct for your environment, eg py, python, or python3, etc.
py -m pip install -r requirements.txt
or
pip3 install -r requirements.txt
For the exact mister_skinnylegs dependency chain the releases are built with, use this
instead. It installs requirements.txt without the mister_skinnylegs line, then
requirements-msl-lock.txt without dependencies, and stops if Brotli is older than 1.2.1.
It also works on a day when one of the ccl readers' default branches will not install:
python3 admin/scripts/install_requirements.py
To run on Linux, you will also need to install tkinter separately like so:
sudo apt-get install python3-tk
Building the binaries
packaging/build.py builds aleapp with PyInstaller for the machine it runs on, from the
same virtual environment. It installs the pinned build tools, then requirements.txt and
requirements-msl-lock.txt with admin/scripts/install_requirements.py, first.
python packaging/build.py exe # dist/ALEAPP/, and dist/ALEAPP.app on macOS
python packaging/build.py smoke # run what it built, without opening a window
python packaging/build.py installer # Windows: Inno Setup installer; macOS: .dmg; Linux: AppImage
python packaging/build.py linux-packages # Linux: .deb and .rpm around dist/ALEAPP/ (dpkg-deb, rpmbuild)
exe --onefile makes dist/aleapp (dist\aleapp.exe on Windows) as a single file
instead. The Windows installer needs Inno Setup; on
Linux, smoke needs a display, which xvfb-run provides. python packaging/build.py --help
has the rest.
Usage
CLI
$ python aleapp.py -t <zip | tar | fs | gz | raw> -i <path_to_extraction> -o <path_for_report_output>
raw reads a disk image (.img, .dd, .bin, or any numbered .001 segment of
a split set), or an acquisition and the segments or files beside it (EnCase/EWF
.E01, SMART .s01, EWF2 .Ex01, AFF .aff, AFM .afm, any .aff in an AFD folder,
AFF4 .aff4, an Apple .dmg, with any .dmgpart files beside it, .sparseimage or
.sparsebundle folder, or a virtual machine disk, .vhd, .vhdx, .vmdk or .qcow2), in
place: no mounting and no administrator rights. Its NTFS, FAT32, FAT16, FAT12, exFAT, ext2/3/4,
F2FS, HFS+, APFS, QNX6, QNX4, ETFS, EFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS and QNX IFS
volumes are searched directly (and a U-Boot environment or Belkin NVRM store is read as one
file), and
only the files an artifact asks for are read out of the image. Logical evidence, an
EnCase .L01 or an FTK Imager .ad1, is read as the files it holds. The GUI picks
raw on its own for those extensions, and for a sparse bundle or AFD folder chosen with
its folder button. See admin/docs/raw_image_input.md.
An encrypted image opens with its password (--image_password_file or
--image_password_env), or, when it is sealed to a certificate, with that certificate's
RSA private key (--image_private_key). A BitLocker volume in an image opens with its
password or recovery password, given the same way, or its startup key
(--bitlocker_key, repeatable), an APFS volume macOS encrypted in software with its
password or personal recovery key, and a LUKS container with its passphrase, each given
the same way. At a terminal whatever is missing is asked for, and the GUI asks in dialogs;
a BitLocker, APFS or LUKS volume nothing opens is reported and not searched.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
