CN114443568B

CN114443568B - Telegram series application data analysis method, terminal device and storage medium

Info

Publication number: CN114443568B
Application number: CN202111577850.4A
Authority: CN
Inventors: 李哲; 周开军; 张磊; 张辉极
Original assignee: Xiamen Meiya Pico Information Co Ltd
Current assignee: Xiamen Meiya Pico Information Co Ltd
Priority date: 2021-12-22
Filing date: 2021-12-22
Publication date: 2024-11-19
Anticipated expiration: 2041-12-22
Also published as: CN114443568A

Abstract

The invention relates to Telegram series application data analysis method, terminal equipment and storage medium, wherein the method comprises the following steps: s1: judging whether the packet name of the data packet of the application to be analyzed contains a key field for representing Telegram application characteristics, if so, entering S3; otherwise, entering S2; s2: judging whether the subdirectory under the packet name directory contains Telegram applied characteristic files or not, if so, entering S3; otherwise, ending; s3: mapping package names and characteristic files which are contained in the application to be analyzed and do not accord with Telegram standard according to Telegram standard; s4: mapping the accessory catalogue of the application to be analyzed according to Telegram standard; s5: and analyzing the application to be analyzed according to the analysis method of Telegram applications based on the package name, the attachment directory and the feature file after application mapping. The invention can conveniently realize the rapid analysis of the target application and improve the data analysis capability of each platform.

Description

Telegram series application data analysis method, terminal equipment and storage medium

Technical Field

The present invention relates to the field of data analysis, and in particular, to a Telegram series application data analysis method, a terminal device, and a storage medium.

Background

Telegram (TG for short, full name TELEGRAM MESSENGER) is cross-platform instant messaging software, whose client is free and open source software, but server is proprietary software. Users can exchange encrypted and self-destruction messages (similar to burn after reading) with each other, and send all types of files such as photos, films and the like. The authorities provide various platform clients such as mobile Phone version (Android, IOS, windows Phone), desktop version (Windows, macOS, linux) and webpage version; while an open Application Program Interface (API) is official, so that clients with many third parties are available for selection.

The Telegram series of applications are third party client applications developed based on Telegram Application Program Interface (API) or third party client applications implemented based on Telegram application open source code. The function is similar to Telegram, the chat content encryption and the powerful group chat function can be basically realized, the number of the group chat is not limited, the function is free, and the unique burn-after-reading function is more favored by most people.

The Telegram application strong group chat function is pointed out to have strong propagation capability, and the strong security of chat content encryption determines that Telegram application is one of the applications which are used more globally, so that data analysis of Telegram application is an important point of evidence collection analysis. However, with the development of technology and the enhancement of relevant partial striking force, the user gradually shifts the gravity center from Telegram application to Telegram series of other applications, so as to improve the concealment of behaviors, therefore, various Telegram series applications and mountain village version applications in recent years are endless, related cases related to similar applications frequently appear, and difficulties are brought to the work of electronic evidence obtaining and law enforcement personnel. A common Telegram series of applications is shown in figure 1.

Disclosure of Invention

In order to solve the above problems, the present invention provides a Telegram series application data parsing method, a terminal device and a storage medium, so as to quickly parse the above-mentioned mass Telegram series applications.

The specific scheme is as follows:

A Telegram series application data analysis method comprises the following steps:

S1: judging whether the packet name of the data packet of the application to be analyzed contains a key field for representing Telegram application characteristics, if so, entering S3; otherwise, entering S2;

S2: judging whether the subdirectory under the packet name directory contains Telegram applied characteristic files or not, if so, entering S3; otherwise, ending;

s3: mapping package names and characteristic files which are contained in the application to be analyzed and do not accord with Telegram standard according to Telegram standard;

s4: mapping the accessory catalogue of the application to be analyzed according to Telegram standard;

s5: and analyzing the application to be analyzed according to the analysis method of Telegram applications based on the package name, the attachment directory and the feature file after application mapping.

Further, in the Android and IOS systems, key fields characterizing Telegram application features include tg, telegram, tele and gram.

Further, in the Android system, whether the subdirectories of the feature files applied by Telegram are contained in the subdirectories under the package name directory or not is judged, wherein the subdirectories comprise shared_ prefs and file directories, and the corresponding feature files under the shared_ prefs directory comprise: userconfing. Xml and userconfig. Xml, the corresponding profile under the files directory is cached 4.Db.

Further, in the IOS system, it is determined whether the subdirectory of the signature file applied by Telegram is a Documents directory, and the corresponding signature file includes an account data cache directory PACKAGE _name\documents\account-and a database file PACKAGE _name\documents\account-postbox \db\db_sqlite of the account data cache.

Further, in the Android system, when the package name is mapped, the package name is mapped into a standard data package name org.

Furthermore, in the Android system, logininfo x xml files are mapped into logistic 2 xml files when feature files are mapped; userconfig. Xml is mapped into a userconfig1.xml file or a userconfig2.xml file, and the numbers of the suffixes in the file names are sequentially accumulated according to the number of the files.

Further, in the IOS system, when the packet name is mapped, the packet name is mapped to the standard packet name ph.

Further, in step S4, when the Android system is the Android system, backing up the attachment directory to the attachment sub-directory of the packet directory corresponding to Telegram is further included before the directory mapping.

Further, in step S4, when the Android system is used, mapping the attachment directory to the attachment directory of the corresponding type according to the type of the attachment, where the mapped attachment directory includes Telegram Audio, telegram Documents, TELEGRAM IMAGES and Telegram Video.

Further, in step S5, when the Android system is used, account information is parsed from the userconfin. Analyzing friend information and chat information from the cached 4.Db file; the cache4.Db file completes the analysis of each data field according to the read-write interface of the database.

A Telegram series of application data analysis terminal equipment comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the steps of the method according to the embodiment of the invention are realized when the processor executes the computer program.

A computer readable storage medium storing a computer program which, when executed by a processor, implements the steps of the method described above for embodiments of the present invention.

According to the technical scheme, through the characteristics that Telegram series of applications and Telegram applications have the same data structure and file structure, supportable analysis degree is determined by comparing the similarity of internal data of the applications, then the data packet format of the target application is mapped and arranged according to the format of Telegram data packets, and the accessory files are backed up to a fixed accessory catalog to carry out accessory association of target application data analysis, so that a complete electronic data evidence obtaining result is finally formed and is used for case detection and data analysis.

Drawings

Fig. 1 shows a schematic diagram of a common Telegram series of applications.

Fig. 2 is a flowchart of a first embodiment of the present invention.

FIG. 3 is a diagram showing the comparison effect of Telegram series of application data directories in this embodiment.

Detailed Description

For further illustration of the various embodiments, the invention is provided with the accompanying drawings. The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate embodiments and together with the description, serve to explain the principles of the embodiments. With reference to these matters, one of ordinary skill in the art will understand other possible embodiments and advantages of the present invention.

The invention will now be further described with reference to the drawings and detailed description.

Embodiment one:

The embodiment of the invention provides a Telegram series application data analysis method, as shown in fig. 2, which comprises the following steps:

S1: judging whether the packet name of the data packet of the application to be analyzed contains a key field for representing Telegram application characteristics, if so, entering S3; otherwise, S2 is entered.

S2: judging whether the subdirectory under the packet name directory contains telegram applied characteristic files or not, if so, entering S3; otherwise, ending.

S3: and mapping the package names and the feature files which are contained in the application to be analyzed and do not accord with Telegram standard according to Telegram standard.

S4: and mapping the accessory catalog of the application to be analyzed according to Telegram standard.

In order to ensure the integrity of data, the backup of the data catalog is required before carrying out Telegram series of application data analysis, so that the fact that the iPhone mobile phone breaks the jail and the Android mobile phone has root is required to be ensured to possibly backup the complete data package is required. The backup of the data package is carried out in various ways through third party mobile phone management software, mobile phone self-provided backup function or mobile phone official tools and Android adb commands. The application package that has been backed up is named PACKAGE _NAME in this embodiment. The following describes the common parsing method of Telegram series application data packets on two platforms respectively by using two systems of Android and IOS.

(1) For Telegram series of applications of the Android system, since the applications are realized based on Telegram open source codes or API interfaces of Telegram, the similarity degree can be identified from the feature files according to the similarity of the application realization, then general analysis file mapping is carried out, package names, catalogues and file names of analysis files of different applications are mapped into Telegram analysis files of standard, then attachments cached on an SD card are associated to standard analysis catalogues corresponding to Telegram, finally analysis is carried out according to Telegram standard applications, and general analysis of the applications can be realized.

In this embodiment, the application package NAME is set to PACKAGE _NAME, and the package NAMEs of the data packages of most of the Telegram series applications of Android contain the characteristic fields of Telegram applications, such as tg, telegram, tele and gram, etc., so in this embodiment, these characteristic fields are set to be key fields for characterizing Telegram application characteristics. It should be noted that the case is ignored when matching is performed.

The feature files are stored in two subdirectories of shared_ prefs and files under the package name directory under the Android system, and are respectively: xml and userconfig in PACKAGE _NAME_shared_ prefs directory, and the cached 4.Db file in PACKAGE _NAME_files_directory. If the two sub-directories contain the corresponding feature files, the subsequent steps can be continued to analyze according to Telegram series application general analysis methods, and if the feature files are not contained, the application to be analyzed is judged to be unable to conduct general analysis. As shown in fig. 3, which is a schematic diagram showing the comparison effect of the data catalogs of the Telegram series applications, it can be seen that the catalogs of the Telegram series applications all contain the three kinds of characteristic files.

When the common Telegram parsing method is used, the package NAME and the feature file of the Telegram series application of the Android version, which do not meet the Telegram standard, are required to be mapped, so that the package NAME is Telegram data packages under the standard Android platform, and the unified method can be performed for parsing, so that in the embodiment, the package NAME PACKAGE _NAME is mapped into the standard data package NAME org.

TABLE 1

Application name	Original package name	Post-mapping package name
			Telegreat	xxx.sean.telegram.messenger.beta	org.telegram.messenger
BiYong	org.telegram.btcchat	org.telegram.messenger
			vidogram	org.vidogram.messenger	org.telegram.messenger
Plus	org.telegram.plus	org.telegram.messenger
			Aka	org.aka.messenger	org.telegram.messenger
……	……	……

In the mapping of the characteristic files of the Android system, logininfo x.xml files are mapped into logistic 2.Xml files; and mapping userconfig x.xml into files such as userconfig1.xml and userconfig2.xml …, wherein the numbers of the suffixes in the file names are sequentially accumulated according to the number of the files, and the files correspond to a plurality of accounts.

Because the attachments of Telegram series of applications in the Android system are stored in the sdcard (sd card) directory, the storage position is sdcard \appname, and only a small number of thumbnail images, head images and voice files can be cached in the local data directory. The attachment files transmitted by a large number of friends are all under sdcard catalogs, so that the sdcard catalogs need to be backed up to the attachment subdirectories org.

Mapping of directory names is performed after backup of the attached directory, and the specific mapping is shown in table 2.

TABLE 2

Original attachment directory	Mapped file directory
		sdcard\appname\*Audio	Telegram Audio
sdcard\appname\*Documents	Telegram Documents
		sdcard\appname\*Images	Telegram Images
sdcard\appname\*Video	Telegram Video

After the mapping of the package name, the attachment directory and the feature file of the application is completed, the universal analysis plug-in can be applied to conduct data analysis through Telegram of the Android system. Analyzing account information from shared_ prefs \userconfing.xml file; and analyzing friend information and chat information from the files\cache4.db file. The analysis of the userconfin. Xml file is completed according to standard xml analysis. The cache4.Db file is a standard sqlit database, and the analysis of each data field is completed according to the read-write interface of the database. The data field stores friend information, chat information and group chat information, which are hexadecimal data streams, and the final plaintext data information can be obtained by bit analysis according to the data stream storage rule.

(2) For the Telegram series of applications of the IOS system, the total number is much smaller than the number and scale of the Android platform. But the flow of data parsing is similar to that of the Android platform.

The key fields of the packet name in the IOS are tg, telegram, tele and gram, which are the same as Android.

The feature files in the IOS system are stored in the Documents sub-directory under the packet NAME directory, and the included feature files include account data cache directory PACKAGE _name\documents\account-, and account data cache database file PACKAGE _name\documents\account\ postbox \db_sqlite.

The mapping of the package name and the feature file of the IOS system is similar to that of the Android system, and the package name and the feature file of Telegram series applications under the IOS system, which do not accord with Telegram standard, are required to be mapped to become Telegram data packages under the standard IOS system. In this embodiment, the packet NAME PACKAGE _name and the mapping result of mapping to the standard packet NAME ph.

TABLE 3 Table 3

Application name	Original package name	Mapping package name
			Btok	com.biyong.biyongApp	ph.telegra.Telegraph
Nicegram	com.nicegram.Telegram-iOS	ph.telegra.Telegraph
			……	……	……

The accessory catalog of the application in the IOS system is \ PACKAGE _NAME\documents\account\ postbox \media, and because the accessories of Telegram series of applications in the IOS system are cached under the data packet catalog of the application, the backup of the accessory catalog in an Android system is not needed, and only the packet NAME PACKAGE _NAME is mapped into a standard data packet NAME ph.

After the mapping of the package name, the attachment directory and the feature file of the application is completed, the data analysis can be performed by using a common analysis plug-in through Telegram of the IOS system. The data of Telegram series applications under IOS system are basically cached in PACKAGE _name\documents\account\ postbox \db_sqlite database file, which is a standard Sqlit database file. And obtaining Telegram series of application local cache data through analyzing the db_sqlite database.

The method is suitable for mainstream Android platforms and IOS platforms, can analyze data of a reconstruction upgrading application or Telegram non-original mountain village application and different Han edition applications based on Telegram applications, and can finish data output according to data requirements of electronic data evidence obtaining standards for character attribute characterization, key data analysis and related character relation analysis.

The embodiment is simple and efficient in technical realization, can realize a universal analysis plug-in for Telegram series instant messaging application simultaneously supporting the Android and the IOS by means of Telegram series application data analysis interfaces on the Android and the IOS, can conveniently realize rapid analysis of target application, can be integrated into each evidence-taking analysis platform in a plug-in manner, and improves the data analysis capability of each platform.

In addition, the method of the embodiment can be further popularized to Telegram series application data analysis of other system platforms besides Android and IOS, and is not limited herein.

Embodiment two:

the invention also provides Telegram series application data analysis terminal equipment, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the steps in the method embodiment of the first embodiment of the invention are realized when the processor executes the computer program.

Further, as an executable scheme, the Telegram series of application data analysis terminal devices may be computing devices such as a desktop computer, a notebook computer, a palm computer, and a cloud server. The Telegram series of application data parsing terminal devices may include, but are not limited to, a processor, a memory. It will be appreciated by those skilled in the art that the above-described Telegram-series application data analysis terminal device is merely an example of a Telegram-series application data analysis terminal device, and does not limit the Telegram-series application data analysis terminal device, and may include more or fewer components than the above-described components, or may combine some components, or different components, for example, the Telegram-series application data analysis terminal device may further include an input/output device, a network access device, a bus, and the like, which is not limited by the embodiment of the present invention.

Further, as an executable scheme, the Processor may be a central processing unit (Central Processing Unit, CPU), other general purpose Processor, digital signal Processor (DIGITAL SIGNAL Processor, DSP), application SPECIFIC INTEGRATED Circuit (ASIC), field-Programmable gate array (Field-Programmable GATE ARRAY, FPGA) or other Programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc. The general processor may be a microprocessor or the processor may be any conventional processor, etc., and the processor is a control center of the Telegram series application data analysis terminal device, and connects various parts of the whole Telegram series application data analysis terminal device by using various interfaces and lines.

The memory may be used to store the computer program and/or module, and the processor may implement the various functions of the Telegram-series application data-parsing terminal device by running or executing the computer program and/or module stored in the memory, and invoking data stored in the memory. The memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, at least one application program required for a function; the storage data area may store data created according to the use of the cellular phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as a hard disk, memory, plug-in hard disk, smart memory card (SMART MEDIA CARD, SMC), secure Digital (SD) card, flash memory card (FLASH CARD), at least one disk storage device, flash memory device, or other volatile solid-state storage device.

The present invention also provides a computer readable storage medium storing a computer program which when executed by a processor implements the steps of the above-described method of an embodiment of the present invention.

The Telegram series of modules/units integrated with the application data-parsing terminal device may be stored in a computer-readable storage medium if implemented in the form of software functional units and sold or used as a separate product. Based on such understanding, the present invention may implement all or part of the flow of the method of the above embodiment, or may be implemented by a computer program to instruct related hardware, where the computer program may be stored in a computer readable storage medium, and when the computer program is executed by a processor, the computer program may implement the steps of each of the method embodiments described above. Wherein the computer program comprises computer program code which may be in source code form, object code form, executable file or some intermediate form etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a software distribution medium, and so forth.

While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims

1. A Telegram series application data parsing method, characterized in that it includes the following steps:

S1: Determine whether the package name of the data packet of the application to be parsed contains the key field representing the characteristics of the Telegram application. If so, enter S3; otherwise, enter S2;

S2: Determine whether the subdirectory under the package name directory contains the feature file of the Telegram application. If so, proceed to S3; otherwise, end.

S3: Map the package names and feature files that do not conform to the Telegram standard and are contained in the application to be analyzed according to the Telegram standard;

S4: Map the attachment directory of the application to be parsed according to the Telegram standard;

S5: Based on the package name, attachment directory and feature file after the application is mapped, the application to be analyzed is analyzed according to the analysis method of the Telegram application.

2. The Telegram series application data parsing method according to claim 1 is characterized in that: in Android and IOS systems, the key fields characterizing the Telegram application features all include tg, telegram, tele and gram.

3. The Telegram series application data parsing method according to claim 1 is characterized in that: in the Android system, the subdirectory under the package name directory that determines whether the subdirectory contains the feature file of the Telegram application includes the shared_prefs and files directories, and the corresponding feature files under the shared_prefs directory include: userconfing*.xml and userconfig*.xml, and the corresponding feature file under the files directory is cache4.db.

4. The Telegram series application data parsing method according to claim 1 is characterized in that: in the IOS system, the subdirectory under the package name directory is judged to contain the feature file of the Telegram application, which is the Documents directory, and its corresponding feature file includes the account data cache directory PACKAGE_NAME\Documents\account-* and the account data cache database file PACKAGE_NAME\Documents\account-*\postbox\db\db_sqlite.

5. The Telegram series application data parsing method according to claim 1 is characterized in that: in the Android system, when mapping the package name, the package name is mapped to the standard data packet name org.telegram.messenger.

6. The Telegram series application data parsing method according to claim 1 is characterized in that: in the Android system, when mapping the feature file, the logininfo*.xml file is mapped to the logininfo2.xml file; the userconfig*.xml is mapped to the userconfig1.xml file or the userconfig2.xml file, and the suffix numbers in the file names are accumulated in sequence according to the number of files.

7. The Telegram series application data parsing method according to claim 1 is characterized in that: in the IOS system, when mapping the package name, the package name is mapped to the standard data packet name ph.telegra.Telegraph.

8. The Telegram series application data parsing method according to claim 1 is characterized in that: in step S4, when it is an Android system, before performing directory mapping, it also includes backing up the attachment directory to the attachment subdirectory of the data packet directory corresponding to Telegram.

9. The Telegram series application data parsing method according to claim 1, characterized in that: in step S4, when it is an Android system, when mapping the attachment directory, the attachment directory of the corresponding type is mapped according to the type of the attachment, and the mapped attachment directory includes Telegram Audio, Telegram Documents, Telegram Images and Telegram Video.

10. The Telegram series application data parsing method according to claim 1 is characterized in that: in step S5, when it is an Android system, account information is parsed from the userconfing.xml file; friend information and chat information are parsed from the cache4.db file; wherein the cache4.db file completes the parsing of each data field according to the read and write interface of the database.

11. A Telegram series application data parsing terminal device, characterized in that it comprises a processor, a memory, and a computer program stored in the memory and running on the processor, and when the processor executes the computer program, the steps of the method as claimed in any one of claims 1 to 10 are implemented.

12. A computer-readable storage medium storing a computer program, wherein the computer program implements the steps of any one of the methods of claims 1 to 10 when executed by a processor.