public TwitterEventUserShow(SnooperExportBase exportBase, SPDYMsg spdyMsg) : base(exportBase, spdyMsg)
{
var uriParams = (spdyMsg.Header as SPDYRequestHeader).URIParameters;
this.SourceUserId = uriParams["source_id"];
this.TargetUserId = uriParams["target_id"];
}
/// <summary>
/// Processes json with messages that were loaded when user joined private chat
/// </summary>
/// <param name="strippedContent">Json used for parsing</param>
/// <param name="exportObject">For referencing LideSnooperExport from Lide object</param>
/// <param name="prvtMsgs">List where private messages are stored after parsing</param>
private static void GetLideLoadedPrivateMessage(string strippedContent, SnooperExportBase exportObject, List <LidePrivateMessage> prvtMsgs)
{
var o = JObject.Parse(strippedContent);
if (!(o.SelectToken("$.data.last_events") is JArray))
{
return;
}
var lastEvents = (JArray)o.SelectToken("$.data.last_events");
foreach (var lastEvent in lastEvents)
{
if (lastEvent.SelectToken("$.event_type")?.ToString() != "message_sent")
{
continue;
}
var privateMessage = new LidePrivateMessage(exportObject)
{
SourceId = lastEvent.SelectToken("$.user_id")?.ToString(),
TargetId = lastEvent.SelectToken("$.target_user_id")?.ToString(),
Timestamp = lastEvent.SelectToken("$.created")?.ToString(),
Text = lastEvent.SelectToken("$.message")?.ToString()
};
prvtMsgs.Add(privateMessage);
}
}
} //EF
public SIPAuthentization(SnooperExportBase exportBase) : base(exportBase)
{
this.Type = SIPEventType.Authentization;
//TimeStamp = new DateTime(2014, 1, 31, 21, 15, 07);
this.State = SipAuthenticationState.UNKNOWN;
this.RejectReason = string.Empty;
}
protected TwitterEventBase HandleEvent <TTwitterEventClass>(SnooperExportBase exportObject, IExportSource exportSource, SPDYMsg spdyMsg)
{
if (!typeof(TTwitterEventClass).IsSubclassOf(typeof(TwitterEventBase)))
{
throw new Exception("Not a TwitterEventBase subclass");
}
TwitterEventBase twitterEvent;
try {
twitterEvent = (TwitterEventBase)Activator.CreateInstance(typeof(TTwitterEventClass), new object[] { exportObject, spdyMsg });
}
catch (Exception) {
return(null);
}
this.OnAfterProtocolParsing();
this.OnBeforeDataExporting();
twitterEvent.ExportSources.Add(exportSource);
this.SnooperExport.AddExportObject(twitterEvent);
this.OnAfterDataExporting();
return(twitterEvent);
}
protected void HandleSyncMessage(SnooperExportBase exportObject, IExportSource exportSource, MNMessagesSyncClientPayload syncClientPayload, DateTime timestamp, IEnumerable <PmFrameBase> frames)
{
foreach (var syncDeltaWrapper in syncClientPayload.Deltas)
{
MessengerEventBase deltaEvent = null;
if (syncDeltaWrapper.DeltaNewMessage != null)
{
deltaEvent = new MessengerEventReceiveMessage(exportObject, syncDeltaWrapper.DeltaNewMessage);
}
else
{
continue;
}
this.OnAfterProtocolParsing();
deltaEvent.TimeStamp = timestamp;
deltaEvent.Frames.AddRange(frames);
this.OnBeforeDataExporting();
deltaEvent.ExportSources.Add(exportSource);
this.SnooperExport.AddExportObject(deltaEvent);
this.OnAfterDataExporting();
}
}
/// <summary>
/// Creates Facebook event object by parsing JSON data from content of HTTP message.
/// </summary>
/// <param name="msgJson">JSON data from content of HTTP message.</param>
/// <param name="exportObject">For referencing FacebookSnooperExport from Facebook object.</param>
/// <param name="index">Index to array inside JSON data where we can relevant data.</param>
/// <returns>Parsed event object from Facebook conversation.</returns>
private static FacebookEventRead GetFacebookEventRead(JObject msgJson, SnooperExportBase exportObject, int index)
{
var parsedToken = msgJson["ms"][index];
var fbEvent = new FacebookEventRead(exportObject)
{
EventType = (string)parsedToken["event"],
UserId = (ulong)msgJson["u"],
Timestamp = (ulong)parsedToken["timestamp"]
};
var threadIds = parsedToken["thread_fbids"] as JArray;
if (threadIds != null)
{
foreach (var threadId in threadIds)
{
fbEvent.ThreadIds.Add((ulong)threadId);
}
}
if (!(parsedToken["other_user_fbids"] is JArray))
{
return(fbEvent);
}
var targetIds = (JArray)parsedToken["other_user_fbids"];
foreach (var targetId in targetIds)
{
fbEvent.ThreadIds.Add((ulong)targetId);
}
return(fbEvent);
}
} //EF
public MessengerEventConnect(SnooperExportBase exportBase, Byte[] payload) : base(exportBase)
{
var connectMessage = new ConnectMessage();
connectMessage.Read(CompactProtocolForPayload(DecompressPayload(payload), 0));
this.UserId = connectMessage.ClientInfo.UserId.ToString();
}
public ExportVm(WindsorContainer investigationWindsorContainer, SnooperExportBase model) : base(investigationWindsorContainer, model)
{
this.Export = model;
//if (this.Export.ExportObjects == null) //no exported objects present
//this.SnooperExportedObjects = new ViewModelsIoCObservableCollection<SnooperExportedObjectBaseVm, SnooperExportedObjectBase>(new List<SnooperExportedObjectBase>(), this.InvestigationOrAppWindsorContainer);
//else this.SnooperExportedObjects = new ViewModelsIoCObservableCollection<SnooperExportedObjectBaseVm, SnooperExportedObjectBase>(this.Export.ExportObjects, this.InvestigationOrAppWindsorContainer);
//data.ExportResultUpdated += this.Data_ExportResultUpdated;
}
} //EF
public HangoutsEventTyping(SnooperExportBase exportBase, byte[] protobufData) : base(exportBase)
{
var setTypingRequest = SetTypingRequest.Parser.ParseFrom(protobufData);
this.Type = setTypingRequest.Type;
this.ConversationId = setTypingRequest.ConversationId.Id;
this.ParseRequestHeader(setTypingRequest.RequestHeader);
}
} //EF
public HangoutsEventActiveClient(SnooperExportBase exportBase, byte[] protobufData) : base(exportBase)
{
var setActiveClientRequest = SetActiveClientRequest.Parser.ParseFrom(protobufData);
this.Active = setActiveClientRequest.IsActive;
this.FullJid = setActiveClientRequest.FullJid;
this.ParseRequestHeader(setActiveClientRequest.RequestHeader);
}
} //EF
public HangoutsEventChatMessage(SnooperExportBase exportBase, byte[] protobufData) : base(exportBase)
{
var sendChatMessageRequest = SendChatMessageRequest.Parser.ParseFrom(protobufData);
this.Content = string.Join("", sendChatMessageRequest.MessageContent.Segment.Select(segment => segment.Text));
this.ConversationId = sendChatMessageRequest.EventRequestHeader.ConversationId.Id;
this.ParseRequestHeader(sendChatMessageRequest.RequestHeader);
}
public ExportVm(WindsorContainer investigationWindsorContainer, SnooperExportBase model) : base(investigationWindsorContainer, model)
{
this.Export = model;
//if (this.Export.ExportObjects == null) //no exported objects present
//this.SnooperExportedObjects = new ViewModelsIoCObservableCollection<SnooperExportedObjectBaseVm, SnooperExportedObjectBase>(new List<SnooperExportedObjectBase>(), this.InvestigationOrAppWindsorContainer);
//else this.SnooperExportedObjects = new ViewModelsIoCObservableCollection<SnooperExportedObjectBaseVm, SnooperExportedObjectBase>(this.Export.ExportObjects, this.InvestigationOrAppWindsorContainer);
//data.ExportResultUpdated += this.Data_ExportResultUpdated;
Task.Factory.StartNew(() => Messenger.Default.Register <FrameMessage>(this, this.FrameMessageActionHandler));
}
private SIPCall() { }//EF
public SIPCall(SnooperExportBase exportBase) : base(exportBase)
{
this.Type = SIPEventType.Call;
//TimeStamp = new DateTime(2014, 1, 31, 21, 15, 07);
//_end = new DateTime(2015, 2, 1, 21, 16, 07);
this.State = SipCallState.UNKNOWN;
this.RejectReason = string.Empty;
//this.ExportedPayloads = new RTPExportedPayload[0];
this.CallId = string.Empty;
}
private void OnSnooperExport(SnooperExportBase snooperExportBase)
{
//using (var dbx = this.InvestigationWindsorContainer.Resolve<NetfoxDbContext>())
//{
// dbx.SnooperExports.Add(snooperExportBase);
// dbx.SaveChanges();
//}
var exports = this.InvestigationWindsorContainer.Resolve <List <SnooperExportBase> >();
exports.Add(snooperExportBase);
}
/// <summary>
/// Creates Facebook comment by parsing JSON data from content of HTTP message.
/// </summary>
/// <param name="msgJson">JSON data from content of HTTP message.</param>
/// <param name="exportObject">For referencing FacebookSnooperExport from Facebook object.</param>
/// <param name="index">Index to array inside JSON data where we can relevant data.</param>
/// <returns>Parsed comment from HTTP content.</returns>
private static FacebookComment GetFacebookComment(JObject msgJson, SnooperExportBase exportObject, int index)
{
var parsedComment = new FacebookComment(exportObject)
{
Text = (string)msgJson["ms"][index]["comments"][0]["body"]["text"],
SenderId = (ulong)msgJson["ms"][index]["comments"][0]["author"],
FbTimeStamp = (ulong)msgJson["ms"][index]["comments"][0]["timestamp"]["time"]
};
return(parsedComment);
}
private void OnSnooperExport(SnooperExportBase snooperExportBase)
{
//using (var dbx = this.InvestigationWindsorContainer.Resolve<NetfoxDbContext>())
//{
// dbx.SnooperExports.Add(snooperExportBase);
// dbx.SaveChanges();
//}
var exports = this.InvestigationWindsorContainer.Resolve <VirtualizingObservableDBSetPagedCollection <SnooperExportBase> >();
exports.Add(snooperExportBase);
}
private void OnSnooperExport(SnooperExportBase snooperExportBase)
{
if (this.SnooperExportCollection.IsNotifyImmidiately)
{
this.SnooperExportCollection.Add(snooperExportBase);
}
else
{
this._snooperExportCache.Add(snooperExportBase);
}
}
/// <summary>
/// Processes json with user info that was loaded when user joined discussion room
/// </summary>
/// <param name="tokenUser">Token that represents json with user info</param>
/// <param name="users">List where loaded discussion users are stored after parsing</param>
/// <param name="exportObject">For referencing LideSnooperExport from Lide object</param>
private static void GetLideUser(JToken tokenUser, List <LideUser> users, SnooperExportBase exportObject)
{
int tmpInt;
var user = new LideUser(exportObject)
{
UserId = tokenUser?.SelectToken("$.id")?.ToString(),
Nickname = tokenUser?.SelectToken("$.nickname")?.ToString(),
SexId = Int32.TryParse(tokenUser?.SelectToken("$.sex_id")?.ToString(), out tmpInt) ? tmpInt : (int?)null
};
users.Add(user);
}
public EventNewMessage(SnooperExportBase exportBase, string from, string to, string cc, string bcc, string subject, string content) : base(exportBase)
{
this.Mail = new MailMsg
{
From = @from,
To = to,
Cc = cc,
Bcc = bcc,
Subject = subject,
Body = content
};
}
} //EF
public SIPCall(SnooperExportBase exportBase) : base(exportBase)
{
this.Type = SIPEventType.Call;
//TimeStamp = new DateTime(2014, 1, 31, 21, 15, 07);
//_end = new DateTime(2015, 2, 1, 21, 16, 07);
this.State = SipCallState.UNKNOWN;
this.RejectReason = string.Empty;
//this.ExportedPayloads = new RTPExportedPayload[0];
this.CallId = string.Empty;
this.RTPAddressesString = new PersistableJsonSerializableString();
this.PossibleCodecsString = new PersistableJsonSerializableString();
}
/// <summary>
/// Processes json with discussion info that is loaded when user joins discussion
/// </summary>
/// <param name="strippedContent">Json decoded from base64-frpc format</param>
/// <param name="exportObject">For referencing LideSnooperExport from Lide object</param>
/// <param name="discussion">Object with discussion info</param>
/// <param name="discussionMsgs">List where loaded discussion messages are stored after parsing</param>
/// <param name="users">List where loaded discussion users are stored after parsing</param>
/// <param name="photos">List where loaded users photos are stored after parsing</param>
private static void ProcessLideDiscussionInfo(string strippedContent, SnooperExportBase exportObject, ref LideDiscussion discussion, List <LideDiscussionMessage> discussionMsgs, List <LideUser> users, List <LidePhoto> photos)
{
int temp;
var o = JObject.Parse(strippedContent);
discussion = new LideDiscussion(exportObject) //Parsing of discussion info
{
Name = o.SelectToken("$.data.discussion.name")?.ToString(),
Description = o.SelectToken("$.data.discussion.description")?.ToString(),
DiscussionId = Int32.TryParse(o.SelectToken("$.data.discussion.id")?.ToString(), out temp) ? temp : (int?)null
};
if (o.SelectToken("$.data.contributions") is JArray) //Parsing messages that already were in discussion when user joined
{
var messageArray = (JArray)o.SelectToken("$.data.contributions");
foreach (var message in messageArray)
{
GetLideLoadedDiscussionMessage(message, discussionMsgs, exportObject);
if (!(message.SelectToken("$.contributions") is JArray)) //If message contains nested messages
{
continue;
}
var nestedMessageArray = (JArray)message.SelectToken("$.contributions");
foreach (var nestedMessage in nestedMessageArray)
{
GetLideLoadedDiscussionMessage(nestedMessage, discussionMsgs, exportObject);
}
}
}
if (string.IsNullOrEmpty(o.SelectToken("$.data.contributing_users")?.ToString())) //If Json does not contain informations about users
{
return;
}
var contributingUsers = o.SelectToken("$.data.contributing_users");
foreach (var user in contributingUsers.Children())
{
if (!(user is JProperty))
{
continue;
}
var usrProperty = (JProperty)user;
GetLideUser(usrProperty.Value, users, exportObject);
GetLidePhoto(usrProperty.Value, photos, users[users.Count - 1].Nickname, exportObject);
}
}
public MessengerEventTyping(SnooperExportBase exportBase, Byte[] payload) : base(exportBase)
{
/*
* {
* "to" : "100010419973288",
* "state" : 1
* }
*/
var jsonPayload = DecompressJSONPayload(payload);
this.To = (string)jsonPayload["to"];
this.State = (int)jsonPayload["state"];
}
/// <summary>
/// Creates Facebook event object by parsing JSON data from content of HTTP message.
/// </summary>
/// <param name="msgJson">JSON data from content of HTTP message.</param>
/// <param name="exportObject">For referencing FacebookSnooperExport from Facebook object.</param>
/// <param name="index">Index to array inside JSON data where we can relevant data.</param>
/// <returns>Parsed event object from Facebook conversation.</returns>
private static FacebookEventTyping GetFacebookEventTyping(JObject msgJson, SnooperExportBase exportObject, int index)
{
var parsedToken = msgJson["ms"][index];
var fbEvent = new FacebookEventTyping(exportObject)
{
EventType = (string)parsedToken["type"],
UserId = (ulong)msgJson["u"],
ThreadId = (ulong)parsedToken["thread_fbid"],
SenderId = (ulong)parsedToken["from"]
};
return(fbEvent);
}
public TwitterEventCreateTweet(SnooperExportBase exportBase, SPDYMsg spdyMsg) : base(exportBase, spdyMsg)
{
var spdyMsgContent = spdyMsg.Content;
if (spdyMsgContent == null)
{
throw new Exception("Missing message body");
}
var fields = spdyMsgContent.GetFormUrlEncodedData();
this.Text = fields["status"];
}
} //EF
public MessengerEventForegroundState(SnooperExportBase exportBase, Byte[] payload) : base(exportBase)
{
/*
* {
* "foreground" : 1,
* "keepalive_timeout" : 60
* }
*/
var jsonPayload = DecompressJSONPayload(payload);
this.ForegroundState = (int)jsonPayload["foreground"];
this.KeepaliveTimeout = (int)jsonPayload["keepalive_timeout"];
}
/// <summary>
/// Creates Facebook message by parsing JSON data from content of HTTP message.
/// </summary>
/// <param name="msgJson">JSON data from content of HTTP message.</param>
/// <param name="exportObject">For referencing FacebookSnooperExport from Facebook object.</param>
/// <param name="index">Index to array inside JSON data where we can relevant data.</param>
/// <returns>Parsed message from Facebook conversation.</returns>
private static FacebookMessage GetFacebookMessage(JObject msgJson, SnooperExportBase exportObject, int index)
{
var parsedMessage = new FacebookMessage(exportObject)
{
Text = (string)msgJson["ms"][index]["message"]["body"],
SourceType = (string)msgJson["ms"][index]["message"]["source"],
SenderId = (ulong)msgJson["ms"][index]["message"]["sender_fbid"],
FbTimeStamp = (ulong)msgJson["ms"][index]["message"]["timestamp"]
};
var userId = (ulong)msgJson["u"];
parsedMessage.TargetId = userId == parsedMessage.SenderId ? (ulong)msgJson["ms"][index]["message"]["other_user_fbid"] : userId;
return(parsedMessage);
}
} //EF
public MessengerEventSendMessage(SnooperExportBase exportBase, Byte[] payload) : base(exportBase)
{
var sendMessageRequest = new SendMessageRequest();
sendMessageRequest.Read(CompactProtocolForPayload(DecompressPayload(payload)));
this.To = sendMessageRequest.To;
this.Body = sendMessageRequest.Body;
this.Attachement = sendMessageRequest.ObjectAttachement;
var locationAttachementCoordinates = sendMessageRequest.LocationAttachement?.Coordinates;
if (locationAttachementCoordinates != null)
{
this.LocationAttachement = locationAttachementCoordinates.Longitude + " " + locationAttachementCoordinates.Latitude;
}
}
/// <summary>
/// Creates Facebook status by parsing content of HTTP message.
/// </summary>
/// <param name="msg">Content of HTTP message.</param>
/// <param name="exportObject">For referencing FacebookSnooperExport from Facebook object.</param>
/// <returns>Parsed comment from HTTP content.</returns>
private static FacebookStatus GetFacebookStatus(HTTPMsg msg, SnooperExportBase exportObject)
{
var httpContent = msg.HTTPContent.Content;
var strippedContent = Encoding.Default.GetString(httpContent);
// parses urlencoded data
var parsedUrl = HttpUtility.ParseQueryString(strippedContent);
var status = new FacebookStatus(exportObject)
{
FacebookStatusTimestamp = parsedUrl["ttstamp"],
SenderId = parsedUrl["__user"],
TargetId = parsedUrl["xhpc_targetid"],
StatusText = parsedUrl["xhpc_message_text"]
};
return(status);
}
// Handle event of given event class
protected MessengerEventBase HandleEvent <THangoutsEventClass>(SnooperExportBase exportObject, IExportSource exportSource, byte[] payload)
{
if (!typeof(THangoutsEventClass).IsSubclassOf(typeof(MessengerEventBase)))
{
throw new Exception("Not a MessengerEventBase subclass");
}
// try, except create report
var messengerEvent = (MessengerEventBase)Activator.CreateInstance(typeof(THangoutsEventClass), new object[] { exportObject, payload });
this.OnAfterProtocolParsing();
this.OnBeforeDataExporting();
messengerEvent.ExportSources.Add(exportSource);
this.SnooperExport.AddExportObject(messengerEvent);
this.OnAfterDataExporting();
return(messengerEvent);
}
public TwitterEventSendMessage(SnooperExportBase exportBase, SPDYMsg spdyMsg) : base(exportBase, spdyMsg)
{
var spdyMsgContent = spdyMsg.Content;
if (spdyMsgContent == null)
{
throw new Exception("Missing message body");
}
var fields = spdyMsgContent.GetFormUrlEncodedData();
// ConversationID is in format of RecipientID-SenderID
var conversationId = fields["conversation_id"];
var participants = conversationId.Split('-');
this.Recipient = participants[0];
this.Sender = participants[1];
this.Text = fields["text"];
}
