Fix Mobile Installation parsing and Biome App.Install decoding - #2059
Merged
Conversation
Mobile Installation log: - Match "Install successful for" as well as "Install Successful for". The tested iOS 26 images write only the lowercase form, so every explicit successful install was being missed on those images. - Stop the bundle ID capture at the first ")". A greedy match swallowed a trailing "[Distributor: (null)]", which put a malformed bundle ID in the report on 542 of 2510 successful-install lines across the test corpora. - Read the "Destroying container <id> with persona <persona> at <path>" form used from iOS 16 on. The previous pattern only read the older "with identifier" form and returned an empty bundle ID for the newer one. - Parse Parallel and ParallelWithArchives patch attempts alongside Delta. - Parse the "Installing <MIInstallableBundle ...>" lines, which carry the bundle ID, version and short version. - Set installed and uninstalled state only from an installer-reported outcome. Container bookkeeping stays in the historical artifact. A new Source Event column names the line that set the state. - Add Persona, Version, Short Version and From Version columns to the historical artifact. Biome: - App.Install and _DKEvent.App.Install carry different record layouts. One typedef was applied to both, so no App.Install record had ever decoded. The stream directory now selects the layout, and a Stream column names the source stream for each row. - Pin the field types for the version and 16 byte values in App.Installation. An inferring decode read some of those as nested messages and reported the column as empty. Also adds an artifact for UninstalledApplications.plist, and records in the Application State notes that an application identifier with no compatibilityInfo is left out of that table. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bundle IDs that the log mentions only through container or patch activity, with no "Install successful", "Uninstalling identifier" or "Destroying container" line anywhere in the retained window. These used to be listed under Apps - Installed on the strength of a container event, which does not record an installation. They are now reported separately, with the line that last mentioned them in a Source Event column. Parent Bundle ID (by prefix) is filled in when another bundle ID in the same log is a dotted prefix of this one, which is Apple's convention for an extension and its host app. Across the sixteen test images 2631 of 2957 rows carry a parent, so an examiner can sort the extensions away from the 326 standalone bundle IDs. Apps - Historical Combined is unchanged and still carries every container event; this artifact aggregates it per bundle. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Both artifacts skip paths containing "tombstone". The notes now say what is in those files, so the question does not have to be re-answered: across the tested images they hold the Biome daemons' own record of retired stream files, naming the file, a byte size and a record count. No record carried a bundle identifier or an application event. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Mobile Installation log parsing and Biome App.Install decoding.
Undocumented integers are reported as stored. Row counts in sample_data are from runs against sixteen registered images.