dissect.target.plugins.os.windows.notifications#

Module Contents#

Classes#

NotificationsPlugin

Plugin that parses the notification databases on Windows 10 machines.

Attributes#

appdb_def

c_appdb

APPDB_MAGIC

NUM_APPDB_CHUNKS

AppDBRecord

AppDBPushRecord

AppDBBadgeRecord

AppDBTileRecord

AppDBToastRecord

WpnDatabaseNotificationRecord

WpnDatabaseNotificationHandlerRecord

NOTIFICATIONS_DIR

dissect.target.plugins.os.windows.notifications.appdb_def = Multiline-String#
Show Value
"""
typedef struct {
    char     Magic[4];                 // Always b"DNPW"
    DWORD    Version;                  // Versions 1 (win8) and 3 (win10) seem to exist
    QWORD    Timestamp;                // According to some sources this is LastNotificationDate,
                                       // but that seems incorrect.
    DWORD    NextNotificationId;
    DWORD    Unknown;
    char     Padding[8];
} ChunkHeader;                         // size: 0x20

typedef struct {
    WORD     InUse;                    // ??
    WORD     NextTileWriteIndex;       // ??
    WORD     NextToastWriteIndex;      // ??
    BYTE     Flags[2];
} ChunkInfo;

typedef struct {
    QWORD    Timestamp1;               // ??
    QWORD    Timestamp2;               // Is this time to refresh?
    char     Uri[1024];                // Is this the correct size?
    char     Padding[0x818 - 0x410];
} PushDescriptor;                      // size: 0x818

typedef struct {
    DWORD    Id;
    DWORD    Zero;                     // ??
    QWORD    Timestamp;                // ??
    WORD     Unknown;
    WORD     DataLength;
    char     Data[DataLength];
    char     Padding[0x118 - 0x14 - DataLength];
} BadgeContent;                        // size: 0x118

typedef struct {
    DWORD    UniqueId;                 // ??
    DWORD    Zero;
    QWORD    ExpiryTime;               // The time this tile expires
    QWORD    ArrivalTime;              // The time this tile was set
    BYTE     Type;                     // ??
    BYTE     Index;
    WORD     ContentLength;
    wchar_t  Name[18];
} TileDescriptor;                      // size: 0x40

typedef struct {
    DWORD    UniqueId;                 // ??
    DWORD    Zero;
    QWORD    ExpiryTime;               // The time this toast expires
    QWORD    ArrivalTime;              // The time this toast was set
    BYTE     Type;                     // ??
    BYTE     Index;
    WORD     ContentLength;
    wchar_t  Name1[17];
    wchar_t  Name2[17];
} ToastDescriptor;                     // size: 0x60

typedef struct {
  char Content[0x1400];
} DataXML;                             // size: 0x1400

typedef struct {
    ChunkHeader     Header;            // Only populated for first chunk, else zeroed
    ChunkInfo       Info;
    PushDescriptor  Push;
    BadgeContent    Badge;
    TileDescriptor  Tiles[5];          // start @ 0x958
    DataXML         TileXml[5];

    // For the in use chunks, 0x14 ToastDiscriptors have an Index, but there
    // is space for more. Maybe this is used in case of deleted entries?
    ToastDescriptor Toasts[0x14];      // start @ 0x6e98
    char            Padding1[0x1e00];  // start @ 0x7618
    DataXML         ToastXml[0x14];    // start @ 0x9418
    char            Padding2[0x13f8];  // start @ 0x22418
} Chunk;                               // size: 0x23810
"""
dissect.target.plugins.os.windows.notifications.c_appdb#
dissect.target.plugins.os.windows.notifications.APPDB_MAGIC = b'DNPW'#
dissect.target.plugins.os.windows.notifications.NUM_APPDB_CHUNKS = 256#
dissect.target.plugins.os.windows.notifications.AppDBRecord#
dissect.target.plugins.os.windows.notifications.AppDBPushRecord#
dissect.target.plugins.os.windows.notifications.AppDBBadgeRecord#
dissect.target.plugins.os.windows.notifications.AppDBTileRecord#
dissect.target.plugins.os.windows.notifications.AppDBToastRecord#
dissect.target.plugins.os.windows.notifications.WpnDatabaseNotificationRecord#
dissect.target.plugins.os.windows.notifications.WpnDatabaseNotificationHandlerRecord#
dissect.target.plugins.os.windows.notifications.NOTIFICATIONS_DIR = 'AppData/Local/Microsoft/Windows/Notifications'#
class dissect.target.plugins.os.windows.notifications.NotificationsPlugin(target)#

Bases: dissect.target.plugin.Plugin

Plugin that parses the notification databases on Windows 10 machines.

__namespace__ = 'notifications'#
check_compatible() → None#

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

appdb() → Iterator[flow.record.GroupedRecord]#

Retrun the data from Windows appdb.dat file.

This file contains data presentted to the user, pushed by external sources. The appdb.dat file was used from Windows 8 to Windows 10 pre anniversary version. This plugin only supports appdb.dat version 3 from Windows 10.

References

wpndatabase()#

Returns Windows Notifications from wpndatabase.db (post Windows 10 Anniversary).

References