Sam: /* Truxton 4.3.1.50421 */

2025-04-22T19:25:29Z

Truxton 4.3.1.50421

Sam: Created page with "=Truxton 4.3.1.50421= << Released 2025? >> ==Improvements== # Generic SQLite exploitation. You can add your o..."

2025-04-22T19:23:23Z

Created page with "=Truxton 4.3.1.50421= << Released 2025? >> ==Improvements== # Generic SQLite exploitation. You can add your o..."

New page

=Truxton 4.3.1.50421=
[[Release 2024-09-10|<<]] Released 2025? [[Next Release|>>]]

==Improvements==
# Generic [[Type_SQLite_Database|SQLite]] exploitation. You can add your own [[Type_SQLite_Database|SQLite]] exploitation scripts to Truxton and it will run them against every [[Type_SQLite_Database|SQLite]] database it finds. Truxton includes all of the scripts from project [https://github.com/mac4n6/APOLLO APOLLO]
# Beginning to exploit [[Type_Apple_SEGB|Apple SEGB]] files. For now, we mostly just convert them to [[Type_Apple_SEGB_XML|SEGB XML]].
# Better [[Type_Binary_PList|PList]] and [[Type_Protocol_Buffer|protocol buffer]] conversion to XML. When a field looks like it may contain a timestamp, Truxton decodes and outputs a human-readable timestamp.
# Better [[Type_MPEG2TransportStreamVideo|MPEG 2 Stream]] carving.
# Truxton no longer pollutes the Camera Information section with Quicktime information.
# In the GUI, when viewing a geographic location on an external map URL link, a label for that location is now included instead of just "You are here"
# Better [https://datapilot.com/ DataPilot] integration
# We now extract the [https://support.microsoft.com/en-us/windows/general-privacy-settings-in-windows-7c7f6a09-cebd-5589-c376-7f505e5bf65a#:~:text=Windows%20generates%20a%20unique%20advertising,with%20third%2Dparty%20ad%20providers. Windows Advertising ID] (WAID) from Windows machines.
# Use PostgreSQL 17.4.1
# Updated to Python 3.13.2
# Fixed a high-compression ratio bug in [[Type_Apple_KTX|KTX]] conversion.
# We now pull contacts from [[Type_Apple_Calendar_Database|Apple Calendar Databases]].
# Fixed a bug where duplicate Subjects were being displayed in communications display
# Exploit [[Type_AlpineQuest_Track|AlpineQuest track logs]]. The tracks are written to the geographic report KMZ.
# EXIF information was not being extracted from very large images.
# Improved exploitation of [[Type_Android_Accounts_Database|Android Accounts]]
# Fixed a bug where relationships with Subjects was not being deleted in the [[truxton_delete_subject]]() C API.
# When expanding [[Type_Protocol_Buffer|Protocol Buffers]], if a file is found in an array field, it will become a child of the protocol buffer file. Usually these are [[Type_JPEG|JPG]] or [[Type_PNG|PNG]] files.
# Extract more contact information from [[Type_Skype_Main|Skype]] database
# Fixed a bug in the [[Type_Windows_XML_Event_Log|Windows Event Log]] parser
# Added the following C APIs
## [[truxton_delete_artifact_type]]
## [[truxton_delete_event_type]]
## [[truxton_delete_investigation_by_name]]
## [[truxton_delete_media_by_name]]
## [[truxton_delete_subject]]
## [[truxton_delete_tag]]
# Added the following Python APIs
## [[TruxtonObject#deleteartifacttype.28typeid:_int.29_-.3E_boolean|deleteartifacttype]]
## [[TruxtonObject#deleteeventtype.28typeid:_int.29_-.3E_boolean|deleteeventtype]]
## [[TruxtonObject#deleteinvestigationbyname.28name:_str.29_-.3E_boolean|deleteinvestigationbyname]]
## [[TruxtonObject#deletemediabyname.28name:_str.29_-.3E_boolean|deletemediabyname]]
## [[TruxtonObject#deletesubject.28subject_id:_str_.7C_UUID.29_-.3E_boolean|deletesubject]]
## [[TruxtonObject#deletetag.28tagname:_str.29_-.3E_boolean|deletetag]]
# Fixed a bug where suspects in an investigation were not being deleted
# Added [[Type_ELF_Executable|ELF]] file carving
# Better exploitation of prefetch files to include which files were opened by the application
# Better exploitation of the UserAssist registry key. Better translation of GUIDs to something humanly readable.
# Better exploitation of [[Type_Cellebrite_2|Cellebrite reports]]
# Exploit [[Type_Samsung_CMH|Samsung CMH]] databases to produce geographic coordinates
# The Maintenance ETL will clean up the database at 11pm nightly
# Added more map providers to the Client:
## [https://geohack.toolforge.org/geohack.php?pagename=CHS&params=39.038287;-77.304136 GeoHack]
## [https://www.openstreetmap.org/?mlat=39.038287&mlon=-77.304136#map=18/39.038287/-77.304136 OpenStreetMap]
# Fixed a bug in KMZ Report Generator where [[Location Types|EXIF location types]] coming from [[Type_Cellebrite_2|Cellebrite Reports]] were producing a red X.
# Fixed a bug where video contact sheets weren't being produced (ffmpeg update broke things)

==New Types==
===File===
# [[Type_Generic_SQLite_Script_Results]]
# [[Type_Generic_SQLite_Script_Details]]
# [[Type_Apple_SEGB]]
# [[Type_Apple_Icon_Cache]]
# [[Type_Material_Exchange_Format]]
# [[Type_ECW]]
# [[Type_NetXray]]
# [[Type_Waze_Roadmap_Data]]
# [[Type_Maps_With_Me]]
# [[Type_Apple_Encrypted_Archive]]
# [[Type_Apple_SEGB_XML]]
# [[Type_DataPilot_Database]]
# [[Type_Numerical_Control]]
# [[Type_NetCDF]]
# [[Type_Android_Call_Log_Backup]]
# [[Type_WebAssembly]]
# [[Type_CPBitmap]]
# [[Type_Protocol_Buffer_Archive]]
# [[Type_Paint_Dot_Net]]
# [[Type_Outlook_Express_DBT]]
# [[Type_Discord_User_Information]]
# [[Type_Discord_Message_Dump]]
# [[Type_Olympus_Raw_Image]]
# [[Type_EFTS]]
# [[Type_Fuji_Raw_Image]]
# [[Type_AlpineQuest_Track]]
# [[Type_DEX]]
# [[Type_FTK_Image]]
# [[Type_Windows_Diagnostic_Telemetry]]
# [[Type_Samsung_CMH]]
# [[Type_Google_Takeout_My_Activity]]
# [[Type_Gemini_Activity]]
# [[Type_TensorFlow_Lite]]

===Entity Types===
# [[Entity Types|ENTITY_TYPE_WAID]] - An [https://support.microsoft.com/en-us/windows/privacy-settings-for-recommendations-offers-in-windows-11-807608ee-3de2-4498-8e7c-eb10d655567f identifier] used by Microsoft Windows to target you with advertising.
# [[Entity Types|ENTITY_TYPE_DISCORD_ACCOUNT_ID]] - An identifier for a Discord account
# [[Entity Types|ENTITY_TYPE_REDDIT_ACCOUNT_ID]] - An identifier for a Reddit account
# [[Entity Types|ENTITY_TYPE_AI_PROMPT]] - An AI prompt, user AI query
# [[Entity Types|ENTITY_TYPE_UBER_ACCOUNT_ID]] - An Uber account identifier
# [[Entity Types|ENTITY_TYPE_WAZE_ACCOUNT_ID]] - A Waze account identifier

===Event Types===
# [[Event Types|EVENT_TYPE_DEVICE_LOCKED]] - When a device enters a locked state
# [[Event Types|EVENT_TYPE_DEVICE_UNLOCKED]] - When a device has been unlocked
# [[Event Types|EVENT_TYPE_FAILED_LOGON]] - Someone tried and failed to log on
# [[Event Types|EVENT_TYPE_MEETING]] - A meeting

===Location Type===
# [[Location Types|LOCATION_TYPE_NETWORK_CONNECTION]] - When we know the location of a network that a user connected to.
# [[Location Types|LOCATION_TYPE_ALPINEQUEST_STARTING_POINT]] - AlpineQuest Starting Point.
# [[Location Types|LOCATION_TYPE_POINT_OF_INTEREST]] - Point of Interest (POI).

===Message Type===
# [[Message Types|MESSAGE_TYPE_LYNC]] - A Lync message

@@ Line 1: / Line 1: @@
 =Truxton 4.3.1.50421=
-[[Release 2024-09-10|<<]] Released 2025? [[Next Release|>>]]
+[[Release 2024-09-10|<<]] Released 2025-04-22 [[Next Release|>>]]
 ==Improvements==

Release 2025-04-21 - Revision history

Sam: /* Truxton 4.3.1.50421 */

Sam: Created page with "=Truxton 4.3.1.50421= << Released 2025? >> ==Improvements== # Generic SQLite exploitation. You can add your o..."