CN114443568A

CN114443568A - Telegram series application data analysis method, terminal device and storage medium

Info

Publication number: CN114443568A
Application number: CN202111577850.4A
Authority: CN
Inventors: 李哲; 周开军; 张磊; 张辉极
Original assignee: Xiamen Meiya Pico Information Co Ltd
Current assignee: Xiamen Meiya Pico Information Co Ltd
Priority date: 2021-12-22
Filing date: 2021-12-22
Publication date: 2022-05-06

Abstract

The invention relates to a Telegram series application data analysis method, terminal equipment and a storage medium, wherein the method comprises the following steps: s1: judging whether the packet name of the data packet of the application to be analyzed contains a key field for representing the application characteristics of the Telegram, if so, entering S3; otherwise, go to S2; s2: judging whether the subdirectory under the package name directory contains the feature file of the Telegram application or not, and if so, entering S3; otherwise, ending; s3: mapping the package name and the feature file which are contained in the application to be analyzed and do not accord with the Telegram standard according to the Telegram standard; s4: mapping an accessory directory of an application to be analyzed according to a Telegram standard; s5: and analyzing the application to be analyzed according to an analysis method of the Telegram application based on the package name, the attachment directory and the feature file after application mapping. The invention can conveniently realize the rapid analysis of the target application and improve the data analysis capability of each platform.

Description

Telegram series application data analysis method, terminal device and storage medium

Technical Field

The invention relates to the field of data analysis, in particular to a Telegram series application data analysis method, terminal equipment and a storage medium.

Background

Telegram (TG for short) is cross-platform instant messaging software, and a client is free and open source code software, but a server is proprietary software. Users can exchange encryption and self-destruction messages (similar to burn after reading), send all types of files such as photos, movies, etc. The official provides multiple platform clients such as mobile Phone versions (Android, IOS, Windows Phone), desktop versions (Windows, macOS, Linux), webpage versions and the like; and also official open Application Programming Interfaces (APIs) and therefore have many clients available for selection by third parties.

The Telegram-series application is a third-party client developed based on a Telegram Application Program Interface (API) or a third-party client application realized based on source codes opened by the Telegram application. The functions are similar to Telegram, the encryption of chat contents and the powerful group chat function can be basically realized, the number of people in group chat is not limited, the functions are free, and the unique burning after reading function is favored by most people.

The powerful group chat function of the Telegram application pays attention to the powerful transmission capacity of the Telegram application, and the powerful security of chat content encryption determines that the Telegram application is also one of the applications which are used more in the world, so that the data analysis of the Telegram application is the key point of evidence obtaining analysis. However, with the development of technology and the enhancement of the striking strength of the related part, the user gradually transfers the gravity center from the Telegram application to other applications in the Telegram series to improve the concealment of behaviors, so that various Telegram series applications and application in the emulational version are endlessly developed in recent years, related cases related to similar applications frequently appear, and the difficulty is brought to the work of electronic evidence collection and law enforcement personnel. A common Telegram series of applications is shown in figure 1.

Disclosure of Invention

In order to solve the above problems, the present invention provides a Telegram series application data analysis method, a terminal device, and a storage medium, so as to quickly analyze the above small and large Telegram series applications.

The specific scheme is as follows:

a Telegram series application data analysis method includes the following steps:

s1: judging whether the packet name of the data packet of the application to be analyzed contains a key field for representing the application characteristics of the Telegram, if so, entering S3; otherwise, go to S2;

s2: judging whether the subdirectory under the package name directory contains the feature file of the Telegram application or not, and if so, entering S3; otherwise, ending;

s3: mapping package names and feature files which are contained in the application to be analyzed and do not accord with the Telegram standard according to the Telegram standard;

s4: mapping an accessory directory of an application to be analyzed according to a Telegram standard;

s5: and analyzing the application to be analyzed according to an analysis method of the Telegram application based on the package name, the attachment directory and the feature file after application mapping.

Further, in Android and IOS systems, key fields for characterizing the Telegram application include tg, Telegram, tele and gram.

Further, in the Android system, it is determined whether the subdirectory under the package name directory contains a subdirectory of a feature file of a Telegram application, where the subdirectory includes a shared _ prefs and a files directory, and the feature file corresponding to the shared _ prefs directory includes: xml and userconfig xml, and the corresponding profile under the files directory is cache4. db.

Further, in the IOS system, it is determined whether the subdirectory under the PACKAGE NAME directory contains a subdirectory of the feature file of the Telegram application as a Documents directory, and the corresponding feature file includes an account data cache directory PACKAGE _ NAME \ Documents \ account-, and an account data cache database file PACKAGE _ NAME \ Documents \ accounts \ account- \ postbox \ db \ db _ sqlite.

Further, in the Android system, when the packet name is mapped, the packet name is mapped to a standard packet name org.

Further, in the Android system, when the feature file is mapped, the logininfo x xml file is mapped into a logininfo2.xml file; and mapping the Uerconfig and the xml into a Uerconfig 1.xml file or a Uerconfig 2.xml file, wherein the suffixes in the file names are sequentially accumulated according to the number of the files.

Further, in the IOS system, when mapping the package name, the package name is mapped to the standard package name ph.

Further, in step S4, in the case of the Android system, before performing the directory mapping, the method further includes backing up the attachment directory to the attachment subdirectory of the package directory corresponding to the Telegram.

Further, in step S4, in the case of the Android system, when mapping the accessory directory, the accessory directory is mapped to an accessory directory of a corresponding type according to the type of the accessory, and the mapped accessory directory includes Telegram Audio, Telegram Documents, Telegram Images, and Telegram Video.

Further, in step S5, in the case of the Android system, the account information is parsed from the userconfing.xml file; friend information and chat information are analyzed from the cache4.db file; and the cache4.db file completes the analysis of each data field according to the read-write interface of the database.

A Telegram-series application data analysis terminal device, comprising a processor, a memory and a computer program stored in the memory and operable on the processor, wherein the processor implements the steps of the method according to the embodiment of the present invention when executing the computer program.

A computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, carries out the steps of the method as described above for an embodiment of the invention.

According to the technical scheme, the Telegram series application and the Telegram application have the same data structure and file structure characteristics, the supportable analysis degree is determined by comparing the similarity of data in the applications, then the data packet format of the target application is mapped and arranged according to the Telegram data packet format, the attachment file is backed up to the fixed attachment directory for attachment association of target application data analysis, and finally a complete electronic data evidence obtaining result is formed for case detection and data analysis.

Drawings

FIG. 1 is a schematic diagram showing a common Telegram series application.

Fig. 2 is a flowchart illustrating a first embodiment of the present invention.

Fig. 3 is a schematic diagram showing the comparison effect of the Telegram series application data directory in this embodiment.

Detailed Description

To further illustrate the various embodiments, the invention provides the accompanying drawings. The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the embodiments. Those skilled in the art will appreciate still other possible embodiments and advantages of the present invention with reference to these figures.

The invention will now be further described with reference to the accompanying drawings and detailed description.

The first embodiment is as follows:

an embodiment of the present invention provides a Telegram series application data analysis method, as shown in fig. 2, the method includes the following steps:

s1: judging whether the packet name of the data packet of the application to be analyzed contains a key field for representing the application characteristics of the Telegram, if so, entering S3; otherwise, the process proceeds to S2.

S2: judging whether the subdirectory under the package name directory contains the feature file of the telegram application or not, and if so, entering S3; otherwise, ending.

S3: and mapping the package name and the feature file which are contained in the application to be analyzed and do not accord with the Telegram standard according to the Telegram standard.

S4: and mapping the accessory directory of the application to be analyzed according to a Telegram standard.

In order to ensure the integrity of data, data directory backup is carried out before Telegram series application data analysis, so that it is ensured that an iPhone mobile phone breaks prison and an Android mobile phone has root to possibly backup a complete data packet. The data packet backup method has various modes, and can be completed through third-party mobile phone management software, a self-contained backup function of a mobile phone, an official tool of the mobile phone and an adb command of Android. The NAME of the application PACKAGE that has been backed up is named PACKAGE _ NAME in this embodiment. The following respectively introduces a general analysis method of Telegram series application data packets on two platforms by using Android and IOS systems.

(1) For the Telegram series application of the Android system, because the application is realized based on a Telegram open source code or an API (application programming interface) of the Telegram, the similarity degree can be identified from the feature files according to the similarity realized by the application, then the universal analysis file mapping is carried out, the package names, the catalogues and the file names of the analysis files of different applications are mapped into a standard Telegram analysis file, then the attachments cached on the SD card are associated to the standard analysis catalog corresponding to the Telegram, and finally the analysis is carried out according to the Telegram standard application, so that the universal analysis of the application can be realized.

In this embodiment, the PACKAGE NAME of the application is set to PACKAGE _ NAME, and the PACKAGE NAMEs of the data PACKAGEs of the Telegram series applications of most Android all contain the characteristic fields of the Telegram applications, such as tg, Telegram, tele, gram, and the like, so these characteristic fields are set as the key fields for characterizing the application of the Telegram in this embodiment. It should be noted that the case is ignored when matching is performed.

The feature file exists in two subdirectories of shared _ prefs and files under the package name directory under the Android system, and the two subdirectories are respectively as follows: xml and userconfig xml files in the PACKAGE _ NAME \ shared _ prefs directory, and cache4.db files in the PACKAGE _ NAME \ files \ directory. If the two subdirectories contain corresponding feature files, the subsequent steps can be continued so as to analyze according to a Telegram series application general analysis method, and if the two subdirectories do not contain the feature files, the application to be analyzed is judged not to be capable of general analysis. Fig. 3 is a schematic diagram illustrating the comparison effect of a data directory of a Telegram-series application, and it can be seen that the directory of the Telegram-series application includes the three feature files.

When a general Telegram parsing method is used, PACKAGE NAMEs and feature files which do not meet the telgram standard need to be mapped to Android-version telgram series applications to become standard telgram data PACKAGEs under an Android platform, so that uniform parsing can be performed, and therefore in the embodiment, the PACKAGE NAMEs PACKAGE _ NAME are mapped to the standard data PACKAGE NAMEs org.telgram.messenger, and the PACKAGE NAME mapping of other applications is shown in table 1.

TABLE 1

Application name	Original package name	Mapped package name
			Telegreat	xxx.sean.telegram.messenger.beta	org.telegram.messenger
BiYong	org.telegram.btcchat	org.telegram.messenger
			vidogram	org.vidogram.messenger	org.telegram.messenger
Plus	org.telegram.plus	org.telegram.messenger
			Aka	org.aka.messenger	org.telegram.messenger
……	……	……

Mapping a logininfo-xml file into a logininfo 2-xml file in a feature file mapping of an Android system; and mapping the Uerconfig and xml into files such as Uerconfig 1.xml, Uerconfig 2.xml … and the like, wherein the suffixed numbers in the file names are sequentially accumulated according to the number of the files, and the plurality of files correspond to a plurality of accounts.

Because the attachment of the Telegram series application in the Android system is stored in an sdcard directory, and the storage location is sdcard \ appname, only a small number of thumbnails, head portraits and voice files can be cached in the local data directory. A large number of attachment files transmitted by friends are in the sdcard directory, so the sdcard directory needs to be backed up to the attachment subdirectory org.

The mapping of the directory name is performed after the accessory directory is backed up, and the specific mapping is shown in table 2.

TABLE 2

Original attachment catalog	Mapped file directory
		sdcard\appname\*Audio	Telegram Audio
sdcard\appname\*Documents	Telegram Documents
		sdcard\appname\*Images	Telegram Images
sdcard\appname\*Video	Telegram Video

And after the application package name, the attachment directory and the feature file are mapped, performing data analysis by using a Telegram application general analysis plug-in of the Android system. Resolving account information from a shared _ prefs \ userconfing.xml file; and (4) analyzing friend information and chat information from the files \ cache4.db file. And (5) resolving the xml file according to standard xml resolution. And the cache4.db file is a standard sqlit database, and the analysis of each data field is completed according to a read-write interface of the database. The data field stores friend information, chat information, group information and group chat information, the data field is hexadecimal data stream, and final plaintext data information can be obtained by analyzing according to the data stream storage rule according to bits.

(2) For the Telegram series applications of the IOS system, the total number is much smaller than the number scale of the Android platforms. But the data parsing process is similar to that of the Android platform.

The key fields of the packet names in the IOS system are the same as those of Android, and are tg, telegram, tele and gram.

The feature files in the IOS system are stored in the Documents subdirectory under the PACKAGE NAME directory, and the contained feature files comprise an account data cache directory PACKAGE _ NAME \ Documents \ account \, and database files PACKAGE _ NAME \ Documents \ account \ postbox \ db \ _ sqlite of account data cache.

The mapping of package names and feature files of the IOS system is similar to that of the Android system, and package names and feature files of Telegram series applications under the IOS system, which do not meet Telegram standards, need to be mapped to become Telegram data packages under the IOS system. In this embodiment, the packet NAME packet _ NAME is mapped to the standard packet NAME ph. telegraph, and the mapping result of the packet NAME corresponding to other applications is shown in table 3.

TABLE 3

Application name	Original package name	Mapping package names
			Btok	com.biyong.biyongApp	ph.telegra.Telegraph
Nicegram	com.nicegram.Telegram-iOS	ph.telegra.Telegraph
			……	……	……

The attachment directory applied in the IOS system is \ PACKAGE _ NAME \ Documents \ account \ postbox \ media, and because the attachments applied in the Telegram series in the IOS system are all cached in the data packet directory of the application, backup of the attachment directory in an Android system is not needed, and the attachments can be associated and analyzed only by mapping the packet NAME PACKAGE _ NAME into a standard data packet NAME ph.

And after the mapping of the package name, the attachment directory and the feature file of the application is completed, data analysis can be performed through a Telegram application general analysis plug-in of the IOS system. Data of the Telegram series application under the IOS system are basically cached in a PACKAGE _ NAME \ Documents \ accounting- \ postbox \ db \ db _ sqlite database file, which is a standard Sqlite database file. And analyzing the db _ sqlite database to obtain Telegram series application local cache data.

The method is suitable for mainstream Android platforms and IOS platforms, can analyze data of modified and upgraded application based on Telegram application or Telegram non-legal-version emulational mountain application and different Hannization version applications of the applications, completes data output according to data requirements of electronic data evidence obtaining standards, and is used for character attribute depiction, key data analysis and related character relation analysis.

The method is simple and efficient in technical implementation, can realize a universal analysis plug-in for Telegram series instant messaging application simultaneously supporting Android and IOS platforms by means of Telegram series application data analysis interfaces on the Android and IOS platforms, can conveniently realize rapid analysis of target application, can be integrated into each evidence obtaining analysis platform in a plug-in mode, and improves data analysis capability of each platform.

In addition, the method of the embodiment may also be popularized to Telegram series application data analysis of other system platforms besides Android and IOS, which is not limited herein.

Example two:

the invention also provides a Telegram series application data analysis terminal device, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the computer program to realize the steps of the method embodiment of the first embodiment of the invention.

Further, as an executable scheme, the Telegram-series application data parsing terminal device may be a computing device such as a desktop computer, a notebook, a palm computer, and a cloud server. The Telegram-series application data parsing terminal device can include, but is not limited to, a processor and a memory. Those skilled in the art will understand that the above-mentioned composition structure of the Telegram series application data parsing terminal device is only an example of the Telegram series application data parsing terminal device, and does not constitute a limitation on the Telegram series application data parsing terminal device, and may include more or less components than the above, or combine some components, or different components, for example, the Telegram series application data parsing terminal device may further include an input and output device, a network access device, a bus, and the like, which is not limited in this embodiment of the present invention.

Further, as an executable solution, the Processor may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a discrete Gate or transistor logic device, a discrete hardware component, and the like. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor, and the processor is a control center of the Telegram series application data analysis terminal device, and various interfaces and lines are used to connect various parts of the whole Telegram series application data analysis terminal device.

The memory can be used for storing the computer program and/or the module, and the processor can realize various functions of the Telegram-series application data analysis terminal device by running or executing the computer program and/or the module stored in the memory and calling the data stored in the memory. The memory can mainly comprise a program storage area and a data storage area, wherein the program storage area can store an operating system and an application program required by at least one function; the storage data area may store data created according to the use of the mobile phone, and the like. In addition, the memory may include high speed random access memory, and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), at least one magnetic disk storage device, a Flash memory device, or other volatile solid state storage device.

The invention also provides a computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, carries out the steps of the above-mentioned method of an embodiment of the invention.

The Telegram series application data analysis terminal device integrated module/unit can be stored in a computer readable storage medium if it is realized in the form of software functional unit and sold or used as an independent product. Based on such understanding, all or part of the flow of the method according to the embodiments of the present invention may also be implemented by a computer program, which may be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method embodiments may be implemented. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), software distribution medium, and the like.

While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims

1. A Telegram series application data analysis method is characterized by comprising the following steps:

s3: mapping the package name and the feature file which are contained in the application to be analyzed and do not accord with the Telegram standard according to the Telegram standard;

2. The Telegram-series application data parsing method according to claim 1, characterized in that: in Android and IOS systems, key fields for characterizing Telegram application characteristics all include tg, Telegram, tele and gram.

3. The Telegram-series application data parsing method according to claim 1, characterized in that: in an Android system, judging whether subdirectories under package name directories contain subdirectories of feature files applied by Telegram and include shared _ prefs and file directories, wherein the feature files corresponding to the shared _ prefs directories include: xml and userconfig xml, and the corresponding profile under the files directory is cache4. db.

4. The Telegram-series application data parsing method according to claim 1, characterized in that: in the IOS system, judging whether a subdirectory containing the feature file of the Telegram application in the subdirectory under the PACKAGE NAME directory is a Documents directory, wherein the corresponding feature file comprises an account data cache directory PACKAGE _ NAME \ Documents \ accounts and a database file PACKAGE _ NAME \ Documents \ accounts \ db _ sqlite of the account data cache.

5. The Telegram-series application data parsing method according to claim 1, characterized in that: in the Android system, when the packet name is mapped, the packet name is mapped to a standard packet name org.

6. The Telegram-series application data parsing method according to claim 1, characterized in that: in the Android system, when mapping a feature file, mapping the loginnfo x xml file into a loginnfo 2 xml file; and mapping the Uerconfig and the xml into a Uerconfig 1.xml file or a Uerconfig 2.xml file, wherein the suffixes in the file names are sequentially accumulated according to the number of the files.

7. The Telegram-series application data parsing method according to claim 1, characterized in that: in the IOS system, when the packet name is mapped, the packet name is mapped to a standard packet name ph.

8. The Telegram-series application data parsing method according to claim 1, characterized in that: in step S4, in the case of the Android system, before performing the directory mapping, the method further includes backing up the attachment directory to the attachment subdirectory of the package directory corresponding to the Telegram.

9. The Telegram-series application data parsing method according to claim 1, characterized in that: in step S4, when the attachment directory is an Android system and is mapped, the attachment directory is mapped to an attachment directory of a corresponding type according to the type of the attachment, and the mapped attachment directory includes Telegram Audio, Telegram Documents, Telegram Images, and Telegram Video.

10. The Telegram-series application data parsing method according to claim 1, characterized in that: in step S5, when the system is an Android system, the account information is parsed from a userconfing.xml file; friend information and chatting information are analyzed from the cache4.db file; and the cache4.db file completes the analysis of each data field according to the read-write interface of the database.

11. A Telegram series application data analysis terminal device is characterized in that: comprising a processor, a memory and a computer program stored in the memory and running on the processor, the processor implementing the steps of the method according to any one of claims 1 to 10 when executing the computer program.

12. A computer-readable storage medium storing a computer program, characterized in that: the computer program when executed by a processor implementing the steps of the method as claimed in any one of claims 1 to 10.