9/26/2023 0 Comments Open sqlite file in chrome![]() The “Transition type” is a little easier to explain this field tells Chrome how the page was arrived at. There are a few fields in the table above which are worth taking a closer look at the “State” field we’ll explore in detail later as it’s a complicated one. Those with other IDs were typically much shorter (usually around16-32 bytes in length) and did not appear to contain information which was of so much interest. During testing it was shown that it is the SessionCommand’s 8-bit ID which identifies whether the record contains this kind of data (when the ID was 1 or 6 then this data format was found). Original Request URL (for example if a redirect took place)ġ if the user-agent was overridden, otherwise 0Īs SessionCommands contents can be populated by other means, not every Session command contains data formatted as shown above. “State” (A data structure provided by the WebKit engine describing the current state of the page. UTF-16 String (32 bit Integer giving the length of the string in characters followed by a UTF-16 string of that length)īyte string (32 bit Integer giving the length of the string in bytes followed by a byte string of that length) ![]() The rest of the SessionCommand’s contents structure is described in the table below.ĪSCII String (32 bit Integer giving the length of the string in characters followed by an ASCII string of that length) The record starts with a 32 bit integer which gives the length of the data (this is in addition to the length value outside the SessionCommand). Now, neither “TabRestoreService“ ( src/chrome/browser/sessions/tab_restore_service.h) nor “SessionService” ( src/chrome/browser/sessions/session_service.h) themselves give us the information we’re after, but both of them ‘inherit’ from a common base class called “BaseSessionService” ( src/chrome/browser/sessions/base_session_) (I gave a brief overview of object oriented principals including inheritance in a previous blog post) and it is in BaseSessionService where we finally get what we’re after…īaseSessionService contains a method called “CreateUpdateTabNavigationCommand” which is responsible for writing that “arbitrary chunk of data” into the SessionCommand which eventually gets written to disk. “Both TabRestoreService and SessionService use SessionCommands to represent state on disk”Īha! So although I hadn’t quite found what I was looking for here, I have found a useful signpost pointing in the right direction. OK, so the information I wanted isn’t going to be here, but the comments go on to say: The id and chunk of data are specific to the service creating them.” “SessionCommand contains a command id and arbitrary chunk of data. SessionBackend was operating with a SessionComand object so I tracked down the source code describing this object ( src/chrome/browser/sessions/session_command.h) but was disappointed to find the following explanation in the source code’s comments: But I still had no information about the structure of those contents. ![]() file format, with the records written sequentially, one after another. So now I knew what the overview of the structure in the file was: a nice simple size, contents, size, contents, size, contents… etc. There were, however, four likely looking candidates for a quick probing in the form of the “Current Tabs”, “Current Session”, “Last Tabs” and “Last Session” files. I had also recently tackled the Chromium web-cache format for another project (the format is now also used both on Android and RIM Playbooks) and, with the pain that caused me still fresh in my mind I had no desire to revisit it. Taking a peek in my preferred browser’s (Chrome) “AppData” folder revealed that the ubiquitous-ness of SQLite as a storage format means that inspecting the data for a lot of artefacts has been made pretty simple. I’ve been on a bit of a browser artefacts kick as of late, digging around both on desktop and mobile platforms for stuff I haven’t tackled before. In this blog post Alex Caithness investigates the file format and contents of Chrome’s “Current Tabs”, “Current Session”, “Last Tabs” and “Last Session” files and discovers that, even with the original source code at your side, you can still end up getting yourself into a Pickle.Ī link to a Python script for automating the process can be found at the end of the post.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |