Skip to content

Fix TikTok artifacts SQL parsing and add robust error handling #1396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AdityaS207 wants to merge 2 commits into
base: main
Choose a base branch
from
+58 −48
Open

Fix TikTok artifacts SQL parsing and add robust error handling #1396

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
431467f
Fix TikTok artifacts SQL parsing and add error handling
AdityaS207 Dec 8, 2025
9247e72
remove debugging file
AdityaS207 Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 47 additions & 42 deletions scripts/artifacts/tikTok.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,39 +40,44 @@ def get_tikTok(files_found, report_folder, seeker, wrap_text, timezone_offset):
for table in contacts_tables:
contacts_subqueries.append(f'SELECT uid, customid, nickname, url1 FROM {table}')

contacts_subquery = '''
UNION ALL
'''.join(contacts_subqueries)

cursor.execute(f'''
select
datetime(localcreatedat, 'unixepoch') as Local_Create_Time,
sender,
customid,
nickname,
CASE
WHEN json_valid(content) THEN json_extract(content, '$.text')
END message,
CASE
WHEN json_valid(content) THEN json_extract(content, '$.tips')
END localresponse,
CASE
WHEN json_valid(content) THEN json_extract(content,'$.display_name')
END links_display_name,
CASE
WHEN json_valid(content) THEN json_extract(content, '$.url.url_list[0]')
END links_gifs_urls,
case
when servercreatedat > 1 then datetime(servercreatedat, 'unixepoch')
else servercreatedat
end servercreatedat,
url1 as profilepicURL
from TIMMessageORM
left join ({contacts_subquery}) as contacts on contacts.uid = sender
order by Local_Create_Time
''')

all_rows = cursor.fetchall()
if contacts_subqueries:
contacts_subquery = ' UNION ALL '.join(contacts_subqueries)
else:
contacts_subquery = "SELECT NULL as uid, NULL as customid, NULL as nickname, NULL as url1 WHERE 0"

try:
cursor.execute(f'''
select
datetime(localcreatedat, 'unixepoch') as Local_Create_Time,
sender,
customid,
nickname,
CASE
WHEN json_valid(content) THEN json_extract(content, '$.text')
END message,
CASE
WHEN json_valid(content) THEN json_extract(content, '$.tips')
END localresponse,
CASE
WHEN json_valid(content) THEN json_extract(content,'$.display_name')
END links_display_name,
CASE
WHEN json_valid(content) THEN json_extract(content, '$.url.url_list[0]')
END links_gifs_urls,
case
when servercreatedat > 1 then datetime(servercreatedat, 'unixepoch')
else servercreatedat
end servercreatedat,
url1 as profilepicURL
from TIMMessageORM
left join ({contacts_subquery}) as contacts on contacts.uid = sender
order by Local_Create_Time
''')

all_rows = cursor.fetchall()
except sqlite3.OperationalError as e:
logfunc(f'Reading TikTok messages had SQL error: {e}')
all_rows = []
logfunc(f'all rows length {len(all_rows)}')
if len(all_rows) > 0:
for row in all_rows:
Expand Down Expand Up @@ -101,23 +106,23 @@ def get_tikTok(files_found, report_folder, seeker, wrap_text, timezone_offset):
case
when latestchattimestamp > 1 then datetime(latestchattimestamp, 'unixepoch')
else latestchattimestamp
end
latestchattimestamp,
end as latestchattimestamp,
nickname,
uid,
customID,
url1,
'{table}'
'{table}' as table_name
from {table}
''')

contacts_query = '''
UNION ALL
'''.join(contacts_queries)
contacts_query = ' UNION ALL '.join(contacts_queries)

cursor.execute(contacts_query)

all_rows1 = cursor.fetchall()
try:
cursor.execute(contacts_query)
all_rows1 = cursor.fetchall()
except sqlite3.OperationalError as e:
logfunc(f'Reading TikTok contacts had SQL error: {e}')
all_rows1 = []
data_list1 = []
if len(all_rows) > 0:
description = 'Timestamp corresponds to latest chat if available'
Expand Down
17 changes: 11 additions & 6 deletions scripts/artifacts/tikTokReplied.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
}

from os.path import dirname, basename
import sqlite3
from scripts.ilapfuncs import logfunc, open_sqlite_db_readonly, attach_sqlite_db_readonly, artifact_processor

@artifact_processor
Expand Down Expand Up @@ -59,9 +60,10 @@ def tiktok_replied(files_found, report_folder, seeker, wrap_text, timezone_offse
for table in contacts_tables:
contacts_subqueries.append(f'SELECT uid, customid, nickname, url1, "{table}" as t FROM AwemeIM.{table}')

contacts_subquery = '''
UNION ALL
'''.join(contacts_subqueries)
if contacts_subqueries:
contacts_subquery = ' UNION ALL '.join(contacts_subqueries)
else:
contacts_subquery = "SELECT NULL as uid, NULL as customid, NULL as nickname, NULL as url1, '' as t WHERE 0"

# wrap subquery to select only a single record per contact
contacts_subquery = f'''
Expand Down Expand Up @@ -126,9 +128,12 @@ def tiktok_replied(files_found, report_folder, seeker, wrap_text, timezone_offse
left join DeduplicatedContacts as reply_sender on replySender = reply_sender.uid
'''

cursor.execute(full_query)

all_rows = cursor.fetchall()
try:
cursor.execute(full_query)
all_rows = cursor.fetchall()
except sqlite3.OperationalError as e:
logfunc(f'Reading tiktok_replied had SQL error: {e}')
all_rows = []

for row in all_rows:
data_list.append((row[0], row[1], row[2], row[3], row[4], row[5], row[6], row[7], row[8], row[9],
Expand Down