Whatsapp parsing

[nonnogatto]

Trying the artifact on this Iphone 13 Pro Max :

BuildID 372EBB42-2AF3-11F0-90D2-821BAB17A0CD
FullVersionString Version 18.5 (Build 22F76)
ProductBuildVersion 22F76
ProductCopyright 1983-2025 Apple Inc.
ProductName iPhone OS
ProductVersion 18.5
ShortVersionString 18.5
SystemImageID A53E2900-B4CF-403A-98FA-459D7D84888D

i get this error :

Reading whatsAppMessages artifact had errors!
Error was 'dict' object has no attribute 'decode'
Exception Traceback: Traceback (most recent call last):
  File "/home/user/Scrivania/iLeapp/ileapp/ileapp.py", line 511, in crunch_artifacts
    plugin.method(files_found, category_folder, seeker, wrap_text, time_offset)
  File "/home/user/Scrivania/iLeapp/ileapp/scripts/ilapfuncs.py", line 481, in wrapper
    data_headers, data_list, source_path = func(Context)
  File "/home/user/Scrivania/iLeapp/ileapp/scripts/artifacts/whatsApp.py", line 249, in whatsAppMessages
    from_forward = f'{val_21.decode("utf-8")}' if val_21 is not None else ""
AttributeError: 'dict' object has no attribute 'decode'

as you can see i already tryied fixing the line trying to bypass the case where in db there is None instead of 21 , but still...

[JamesHabben]

can you share what version of iLEAPP you are using for this? there were some recent updates to the whatsApp module in this area that might cover the error you are getting.

[nonnogatto]

I am using the version 2.6.0 dev-0 .... i fixed with the following changes:

 try:
                decoded_data, _ = blackboxprotobuf.decode_message(metadata)    
                val_17 = decoded_data.get("17")
                number_forward = str(val_17) if val_17 is not None else ""
                raw_val_21 = decoded_data.get("21")
                if raw_val_21 is not None:
                    if isinstance(raw_val_21, bytes):
                        from_forward = raw_val_21.decode("utf-8", "replace")
                    else:
                        from_forward = str(raw_val_21)
                if contacts_db and from_forward:
                    attach_query = attach_sqlite_db_readonly(contacts_db, 'ContactsV2')
                    safe_from_forward = from_forward.replace("'", "''")
                    query_contact = f"""
                                SELECT
                                    ZWHATSAPPID,
                                    ZFULLNAME,
                                    ZPHONENUMBER
                                FROM ContactsV2.ZWAADDRESSBOOKCONTACT
                                WHERE ZWHATSAPPID = '{safe_from_forward}'
                            """
                    contact_records = get_sqlite_db_records(source_path, query_contact, attach_query)
                    if contact_records:
                        forwardedwhatsappid, fullname, phone = contact_records[0]
                        from_forward = f"{fullname} ({phone}) - ({forwardedwhatsappid})"
            except Exception:
                pass

I have made the implementation more robust by adding explicit type checks and null-value handling to prevent crashes during Protobuf decoding. Additionally, I mitigated a potential SQL Injection vulnerability by sanitizing the parameters passed into the SQLite query.
Not sure its the best implementation but works for me, no more crashes

[grzesiug]

I have the similar issue with WhatsApp extraction from iPhone OS26.2.1/23C71 (Source: appleLocationd) using 2026.01 and 2026.02.

[544/559] whatsAppMessages [whatsApp] artifact started Reading whatsAppMessages artifact had errors! Error was Invalid Message Length Exception Traceback: Traceback (most recent call last): File "ileapp.py", line 525, in crunch_artifacts File "scripts\ilapfuncs.py", line 491, in wrapper data_headers, data_list, source_path = func(Context) ~~~~^^^^^^^^^ File "C:\Users\Grzegorz\AppData\Local\Temp\_MEI130082\scripts\artifacts\whatsApp.py", line 304, in whatsAppMessages decoded_data, _ = blackboxprotobuf.decode_message(metadata) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^ File "blackboxprotobuf\lib\interface.py", line 62, in decode_message File "blackboxprotobuf\lib\types\length_delim.py", line 228, in decode_message File "blackboxprotobuf\lib\types\length_delim.py", line 294, in decode_lendelim_message File "blackboxprotobuf\lib\types\length_delim.py", line 279, in decode_message google.protobuf.message.DecodeError: Invalid Message Length

WhatApp messages ectraction works well with iLEAPP v2.5.0