macos-dumpNotificationDB.py

# https://www.patreon.com/posts/when-messages-18714633 

import os
import sys
import sqlite3
import datetime
import platform
import tempfile
import Foundation

#check os version
# for now, only H. Sierra (10.13)
ver, _, _ = platform.mac_ver()
if 10.13 != float('.'.join(ver.split('.')[:2])):
	print '\nERROR: ' + ver + ' is unsupported\n'
	sys.exit(-1)


#build path to db
notificationDB = os.path.realpath(tempfile.gettempdir() + '/../0/com.apple.notificationcenter/db2/db')

#dbg msg
print '\nnotification database path:\n %s' % notificationDB

#open db
try:
	conn = sqlite3.connect(notificationDB)
except:
	print 'ERROR: %s' % sys.exc_info()[0]
	sys.exit(-1)

#dbg msg
print '\nsuccessfully opened database (\'db\')\n...now dumping all notification records'

#get data
try:
	conn.row_factory = sqlite3.Row
	cursor = conn.execute("SELECT data from record");
except:
	print 'ERROR: %s' % sys.exc_info()[0]
	sys.exit(-1)


#parse/dump all records
for row in cursor:

	print '\nNOTIFICATION RECORD: \n'

	try:
		#convert to plist
		plist, fmt, err = Foundation.NSPropertyListSerialization.propertyListFromData_mutabilityOption_format_errorDescription_(buffer(row[0]), Foundation.NSPropertyListMutableContainers, None, None)
		if err is not None:
			#skip
			continue


		#parse plist
		for key, value in plist.iteritems() :
			print key + ": ",

			#data
			if isinstance(value, Foundation.NSData):
				print ':'.join(x.encode('hex') for x in value.bytes())

			#date
			elif key == 'date':
				print Foundation.NSDate.alloc().initWithTimeIntervalSinceReferenceDate_(value)

			else:
				print value,

			print ""
	except:
		print 'ERROR: %s' % sys.exc_info()[0]
		sys.exit(-1)