abrignoni/aleappAndroid Logs Events And Protobuf Parser
If you want to contribute hit me up here: https://abrignoni.github.io
Blog posts here: https://leapps.org/blog
Pre-built releases need no Python installation: ALEAPP GitHub Releases, or LEAPPs Releases for the whole LEAPP family.
| Platform | Download |
|---|---|
| Windows (Intel/AMD) | ALEAPP-*-windows-x64-portable.zip |
| Windows (ARM) | ALEAPP-*-windows-arm64-portable.zip |
| macOS (Apple Silicon) | ALEAPP-*-macos-arm64.dmg |
| macOS (Intel) | ALEAPP-*-macos-x64.dmg |
| Linux (Intel/AMD) | ALEAPP-*-linux-x64.AppImage |
| Linux (ARM) | ALEAPP-*-linux-arm64.AppImage |
Each download holds one program, aleapp. SHA256SUMS.txt in each release lets you check a download.
GUI: open ALEAPP the usual way: by double-clicking aleapp.exe from the zip on
Windows, ALEAPP in Applications on macOS, or the AppImage on Linux. Started without
arguments, it opens the window.
CLI: give aleapp arguments in a terminal and it runs as a command line instead. The
output folder must already exist. On Windows, use aleapp.exe from the zip.
aleapp.exe -t zip -i C:\path\to\extraction.zip -o C:\path\to\output\
On Linux, run the AppImage with the same arguments. On macOS it is inside the app; to
type just aleapp in a terminal, link it onto your PATH once:
sudo ln -s /Applications/ALEAPP.app/Contents/MacOS/aleapp /usr/local/bin/aleapp
Python 3.10 or above
Dependencies for your python environment are listed in requirements.txt. Install them using the below command. Ensure
the py part is correct for your environment, eg py, python, or python3, etc.
py -m pip install -r requirements.txt
or
pip3 install -r requirements.txt
For the exact mister_skinnylegs dependency chain the releases are built with, install
requirements-msl-lock.txt over that, without dependencies:
pip3 install --no-deps -r requirements-msl-lock.txt
To run on Linux, you will also need to install tkinter separately like so:
sudo apt-get install python3-tk
packaging/build.py builds aleapp with PyInstaller for the machine it runs on, from the
same virtual environment. It installs requirements.txt, the pinned build tools and
requirements-msl-lock.txt first.
python packaging/build.py exe # dist/ALEAPP/, and dist/ALEAPP.app on macOS
python packaging/build.py smoke # run what it built, without opening a window
python packaging/build.py installer # Windows: Inno Setup installer; macOS: .dmg; Linux: AppImage
exe --onefile makes dist/aleapp (dist\aleapp.exe on Windows) as a single file
instead. The Windows installer needs Inno Setup; on
Linux, smoke needs a display, which xvfb-run provides. python packaging/build.py --help
has the rest.
$ python aleapp.py -t <zip | tar | fs | gz | raw> -i <path_to_extraction> -o <path_for_report_output>
raw reads a disk image (.img, .dd, .bin, or any numbered .001 segment of
a split set), or an acquisition and the segments or files beside it (EnCase/EWF
.E01, SMART .s01, EWF2 .Ex01, AFF .aff, AFM .afm, any .aff in an AFD folder,
AFF4 .aff4, an Apple .dmg, with any .dmgpart files beside it, .sparseimage or
.sparsebundle folder, or a virtual machine disk, .vhd, .vhdx, .vmdk or .qcow2), in
place: no mounting and no administrator rights. Its NTFS, FAT32, FAT16, FAT12, exFAT, ext2/3/4,
F2FS, HFS+, APFS, QNX6, QNX4, ETFS, EFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS and QNX IFS
volumes are searched directly (and a U-Boot environment or Belkin NVRM store is read as one
file), and
only the files an artifact asks for are read out of the image. Logical evidence, an
EnCase .L01 or an FTK Imager .ad1, is read as the files it holds. The GUI picks
raw on its own for those extensions, and for a sparse bundle or AFD folder chosen with
its folder button. See admin/docs/raw_image_input.md.
An encrypted image opens with its password (--image_password_file or
--image_password_env), or, when it is sealed to a certificate, with that certificate's
RSA private key (--image_private_key). A BitLocker volume in an image opens with its
password or recovery password, given the same way, or its startup key
(--bitlocker_key, repeatable), an APFS volume macOS encrypted in software with its
password or personal recovery key, and a LUKS container with its passphrase, each given
the same way. At a terminal whatever is missing is asked for, and the GUI asks in dialogs;
a BitLocker, APFS or LUKS volume nothing opens is reported and not searched.
The disk images of a Linux software RAID set (md, or LVM2 across disks) are read
together: give them all to -i with -t raw, or pick them together in the GUI's file
dialog. Given one image that holds a member, the other members are looked for in its
folder by what each file records about itself, not by its name; the command line lists
what it found and what it left out and why before reading the set (--no-find-members
reads only the image given), and the GUI asks before reading files it found. The report
names every image read and marks the ones found automatically. One image that holds an
md member is read with its arrays too: a lone RAID1 member with metadata 1.1 or 1.2
now reads its filesystem through the array, and its volume names gain the image's or
the array's name in front. One disk given twice is read once. An image in which no
RAID metadata is found is read as before; see admin/docs/raw_image_input.md for what
qnxprobe 1.71 does with DDF, IMSM and md member images read alone.
tar also reads an xz-compressed tar (.tar.xz), and the GUI picks tar for that
extension. A compressed tar, .tar.gz included, is decompressed once into the report folder
before any file is read, so the run needs free space there for the uncompressed tar. The
copy is deleted when the run ends, and the run log says how long the step took.
$ python aleappGUI.py
$ python aleapp.py --help
Artifact modules live in scripts/artifacts/ and are loaded each time ALEAPP runs.
New modules: start with How to Write an iLEAPP Module. It uses iLEAPP as its reference, and ALEAPP modules use the same __artifacts_v2__ block and @artifact_processor decorator. The helpers are not identical across the tools, so check that one exists in ALEAPP's scripts/ilapfuncs.py before you import it.
The helper functions a module calls to find files, read SQLite, check in media and convert timestamps are described in Helper Functions for Artifact Modules.
A module has two parts: an __artifacts_v2__ dictionary at the top of the file, and one function per artifact decorated with @artifact_processor. For example:
__artifacts_v2__ = {
"get_cool_messages": {
"name": "Cool App Messages",
"description": "Messages from the Cool App database",
"author": "@username",
"creation_date": "2026-10-14",
"last_update_date": "2026-10-14",
"requirements": "none",
"category": "Cool App",
"notes": "",
"paths": ('*/CoolApp/cool.db*',),
"output_types": "standard",
"artifact_icon": "message",
}
}
from scripts.ilapfuncs import (
artifact_processor, convert_unix_ts_to_utc, get_file_path, get_sqlite_db_records)