In the protobuf: web browser artefacts using Google’s data interchange format

The blog post hosted by IBM documents original research performed for a customer to work out why their EDR tool was alerting on one specific Network Action Predictor database across their environment.

It gives an overview of the type of artefacts already accessible with a copy of DB Browser for SQLite (DB4S), before diving into the protobuf data.

Protobuf data is found in four of the six tables in a Network Action Predictor database:

• lcp_critical_path_predictor
• lcp_critical_path_predictor_initiator_origin
• resource_prefetch_predictor_host_redirect
• resource_prefetch_predictor_origin

Check out the blog post hosted by IBM for how to build it yourself, but if you just want to read the files you can use the definitions below in CyberChef or grab the python script from my RPP GitHub repo.

syntax = "proto2";

message RedirectData {
  optional string primary_key = 1;
  optional uint64 last_visit_time = 2;
  repeated RedirectStat redirect_endpoints = 3;
}

message RedirectStat {
  optional string url = 1;
  optional uint32 number_of_hits = 2;
  optional uint32 number_of_misses = 3;
  optional uint32 consecutive_misses = 4;
  optional string url_scheme = 5;
  optional int32 url_port = 6;
}

syntax = "proto2";

message OriginData {
  optional string host = 1;
  optional uint64 last_visit_time = 2;
  repeated OriginStat origins = 3;
}

message OriginStat {
  optional string origin = 1;
  optional uint32 number_of_hits = 2;
  optional uint32 number_of_misses = 3;
  optional uint32 consecutive_misses = 4;
  optional double average_position = 5;
  optional bool always_access_network = 6;
  optional bool accessed_network = 7;
}

This was the last python script I’ve written without any kind of AI assistance. If you want a python function to convert timestamps from Chromium epoch timestamps into human-readable timestamps, I’ll save you the tokens:

import datetime
#[...]
def parse_webkit_timestamp(timestamp):
    time = datetime.timedelta(microseconds=int(timestamp))
    time = datetime.datetime(1601, 1, 1) + time
    return time

About the author: Chris Tappin is the Managing Director of 5∩6, a Digital Forensics and Incident Response consultancy in Sydney, Australia.