Skip to content

Fix: Improve TikTok message and replied-message parsers with fallback table detection and enhanced#1416

Open
katon1731367 wants to merge 1 commit intoabrignoni:mainfrom
katon1731367:fix/tiktok-module-improvements
Open

Fix: Improve TikTok message and replied-message parsers with fallback table detection and enhanced#1416
katon1731367 wants to merge 1 commit intoabrignoni:mainfrom
katon1731367:fix/tiktok-module-improvements

Conversation

@katon1731367
Copy link

Description
This PR improves the robustness of the TikTok artifact parsers (tikTok.py and tikTokReplied.py) by adding flexible table-detection logic, fallback mechanisms, and more reliable contact extraction. These changes resolve execution failures and incomplete output when iLEAPP processes TikTok datasets where internal database schemas differ—such as missing TIMMessageKVORM, renamed message tables, or variations in contact-storage tables.

Errors Encountered
When running iLEAPP against TikTok datasets that use alternative or older database structures, the following issues were encountered:

Error 1 — Missing TIMMessageKVORM table
Some TikTok versions do not include the TIMMessageKVORM table at all.
This caused the original tikTokReplied.py parser to fail or return no replied-message results.

Example behavior:

Query against TIMMessageKVORM produced an operational error.

iLEAPP halted execution for the TikTok module.

Error 2 — Variations in message table names
Certain devices store messages in alternative tables, such as TIMMessageNewPropertyORM.
The original parser assumed a single table name, resulting in incomplete or empty output.

Error 3 — Contacts not detected consistently
TikTok stores contact and user metadata in several possible locations.
The previous implementation depended on a specific table name and could fail or return an empty contact list when this table was absent.

Dataset to Reproduce

Source: 2020 CTF – iOS
(Internal TikTok database structure in this dataset uses non-standard table names and missing cache tables.)

The Fix
This PR introduces multiple improvements to ensure compatibility across TikTok versions:

Added fallback detection for TIMMessageKVORM and alternative message tables such as TIMMessageNewPropertyORM.

Implemented wildcard table detection (AwemeContacts%) to reliably enumerate contacts regardless of schema variation.

Improved SQL query handling and error boundaries to prevent module termination when certain TikTok cache tables are missing.

Added safer message and contact extraction logic, ensuring returned artifacts remain complete even when database layouts differ across devices or versions.

Verification
Tested locally on the 2020 CTF – iOS dataset.

Before fix:

TikTok modules failed to execute when required tables were missing.

Replied messages and contacts could not be extracted.
d1206df9-b276-496b-9c77-795d136ed972

After fix:

Parsers executed successfully.

Replied messages extracted using fallback tables.

Contacts populated using expanded table-detection logic.
4ef80c0f-c514-4911-b282-8632bd105eca

…ack for missing TIMMessageKVORM, unified contacts logic
@stark4n6
Copy link
Collaborator

stark4n6 commented Jan 8, 2026

@katon1731367 can you take a look at the linter issues and see if they can be fixed?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants