Skip to content

Instantly share code, notes, and snippets.

@joewils
Created April 13, 2023 14:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save joewils/f251588143af4f4bd680c8539d125e19 to your computer and use it in GitHub Desktop.
Save joewils/f251588143af4f4bd680c8539d125e19 to your computer and use it in GitHub Desktop.
Ruby method to process NSMutableAttributedString blob values from iMessage chat.db.
# Parse attributedBody blob values into ASCII text.
# Grab HEX(attributedBody) from chat.db and unfark it
def unfark_imessage_attributed_body(hex_string)
wtf_string = [hex_string].pack("H*").encode('UTF-8', 'binary', invalid: :replace, undef: :replace, replace: ' ')
wtf_string.gsub!(/\s+/, ' ')
if wtf_string.include? 'NSNumber'
wtf_string = wtf_string.split('NSNumber')[0]
if wtf_string.include? 'NSString'
wtf_string = wtf_string.split('NSString')[1]
if wtf_string.include? 'NSDictionary'
wtf_string = wtf_string.split('NSDictionary')[0]
# highly suspect and brittle code to clean up the last bit of blob flotsam
if wtf_string.include? "\u0001+ \u0000"
wtf_string = wtf_string.split("\u0001+ \u0000")[1]
end
if wtf_string.include? "\u0001 \u0001+"
wtf_string = wtf_string.split("\u0001 \u0001")[1][2..]
end
if wtf_string.include? "\u0002iI\u0001"
wtf_string = wtf_string.split("\u0002iI\u0001")[0]
end
end
end
end
return wtf_string
end
@markevich
Copy link

Thanks a lot!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment