Add Ford Sync G4 and BMW connected device artifacts - #153
Merged
Conversation
abrignoni
changed the title
Three artifacts for Ford Sync G4 head units. Diagnostic Events and Diagnostic Upload Errors read events_metadata and upload_errors from diagnostics_slave.sqlite. The uploaded column is declared INTEGER but holds a date string once an event has uploaded, so both the parsed value and the string as stored are reported. create_time is not reported as a clock because nothing establishes what it counts. Power and Reset History reads the Reset Details blocks of reset-history.txt: shutdown time, power-on time, boot count, wake source and target mode per cycle. Wake source is reported as stored, since some values are words and others are undocumented numbers. The file holds a fixed window rather than a complete record. Neither source records a timezone, so timestamps are taken as written. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Six more artifacts for Ford Sync G4 head units. Installed Software reads the packages table in pacman.db. The table records no install time, so it is an inventory rather than a history. The asset packages are map regions, which bounds where the built-in navigation could route. Navigation User Settings and Navigation Global Settings read user_setting and global_setting from the navigation application's data_manager.sqlite. Values are reported as stored. Last Shutdown and Last Reset Reason read the two single-record files beside reset-history.txt. Both carry a millisecond epoch, divided at the call site. Diagnostic Identifiers reads the three identifier files beside the diagnostics configuration. Each holds a 64 character hex value. The VIN in the same folder was tested as a preimage in several spellings and did not match, so no derivation is asserted. Notes now record where two stores can be read against each other: the reset reason and the first navigation settings write fall 22 seconds apart, and the diagnostics boot counts fall inside the window the reset history covers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The head unit's HMI applications are Chromium based and keep state in Local Storage, which is a LevelDB store. Adds scripts/ccl with ccl_leveldb and ccl_simplesnappy, matching the copies already carried by the sibling extractors, so the store is read through a real reader. This matters for correctness, not tidiness. LevelDB table blocks are Snappy compressed, so scanning the raw files sees only the uncompressed write-ahead log, cannot recover the key a value belonged to, and cannot separate a live record from a superseded one. HMI Local Storage reports every version of every key with the time of the write batch it belonged to, taken from the store's own META records. On the tested image one application holds 30 versions of its profile list spanning 2023-05-22 to 2024-03-27. Output was checked against ccl_chromium_reader 0.3.18: same 35 records, same keys, no value differences and no timestamp differences to the second. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two artifacts for BMW head units, from the iAP2 stores the unit keeps under its entertainment database directory. Connected Apple Devices reports one row per media library per device, with the identifier the unit named the store by and the device UDID held inside it, so the two can be compared rather than one inferred from the other. Connected Device Media reports the indexed media items joined to their artist, album, genre and composer. These record what was available to play, not what was played; the store carries no play count and no last played time. The store directory name carries a colon that the seeker rewrites to an underscore when staging, so the identifier is parsed with either separator. Only backup copies of these stores were present on the tested image. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
abrignoni
force-pushed
the
feat/ford-diagnostics-power
branch
from
August 27, 2026 06:18
8019f8b to
89d0fa9
Compare
abrignoni
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds twelve artifacts across two vehicle platforms, plus the LevelDB reader they need.
Ford Sync G4:
BMW:
Adds scripts/ccl with ccl_leveldb and ccl_simplesnappy, matching the copies already carried by the sibling extractors, so Local Storage is read through a real reader rather than scanned. Its output was checked against ccl_chromium_reader 0.3.18 with no differences in keys or values and none in timestamps to the second.
Undocumented integers, wake sources and identifier values are reported as stored. The text sources record no timezone, so those timestamps are taken as written. The reset history holds a fixed window, not a complete record.