Skip to content

Correct Roblox artifact metadata #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrignoni merged 1 commit into from
Jul 29, 2026
Merged

Correct Roblox artifact metadata #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions scripts/artifacts/robloxAccount.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,14 @@
"theme, subscription state and installed client version.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "Values are reported verbatim for evidentiary analysis, including "
"PlayerHydrationBlob and PlayerHydrationSignature. Output must be "
"handled as credential-bearing evidence. Timestamps are UTC.",
"PlayerHydrationBlob and PlayerHydrationSignature. These values can "
"contain sensitive account state, but the parser does not classify "
"the signature as a reusable authentication credential. Timestamps "
"are UTC.",
"paths": (
"*/Library/Roblox/LocalStorage/appStorage.json",
"*/Library/Preferences/com.roblox.RobloxPlayer.plist",
Expand All @@ -22,7 +24,6 @@
"artifact_icon": "user",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 28 rows",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 22 rows",
},
},
"robloxSettings": {
Expand All @@ -32,7 +33,7 @@
"audio, input and window settings.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "Compound XML values such as vectors are flattened into a compact "
Expand All @@ -44,7 +45,6 @@
"artifact_icon": "settings",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 74 rows",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 74 rows",
},
},
}
Expand Down
23 changes: 10 additions & 13 deletions scripts/artifacts/robloxActivity.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"version, session IDs and result state.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "memProfStorage is rolling state and generally describes the most "
Expand All @@ -19,17 +19,16 @@
"artifact_icon": "clock",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 1 row",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 1 row",
},
},
"robloxPresence": {
"name": "Roblox Presence",
"description": "Retained Roblox user-presence state from WebKit or WebView2 "
"description": "Retained Roblox user-presence state from embedded-browser "
"Local Storage, identifying users, their presence type and "
"last reported location.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "Presence type values are preserved numerically because Roblox may "
Expand All @@ -42,22 +41,21 @@
"artifact_icon": "users",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 2 rows",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 5 rows",
},
},
"robloxNotifications": {
"name": "Roblox Real-Time Notifications",
"description": "Real-time notifications retained in Roblox WebKit or "
"WebView2 Local Storage. Chat notifications can preserve the "
"sender, conversation ID and message text shown to the user.",
"description": "Real-time notifications retained in Roblox embedded-browser "
"Local Storage. Chat notifications can preserve the sender, "
"conversation ID and message text shown to the user.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "The live key is overwritten as notifications arrive. WebView2 "
"LevelDB can retain superseded versions, but this remains a partial "
"notification history.",
"notes": "Only live Local Storage versions are parsed. The key can be "
"overwritten as notifications arrive, so output is a partial "
"notification history rather than a complete message record.",
"paths": (
"*/Library/WebKit/com.roblox.RobloxPlayer/WebsiteData/*/*/*/"
"LocalStorage/localstorage.sqlite3",
Expand All @@ -66,7 +64,6 @@
"artifact_icon": "bell",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 1 row",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 1 row",
},
},
}
Expand Down
7 changes: 4 additions & 3 deletions scripts/artifacts/robloxCookies.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,13 @@
"time, flags and the complete stored value.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "All values are reported verbatim for evidentiary analysis. The "
"output can contain live authentication, anti-bot, "
"identity-verification and session credentials.",
"output can contain authentication, anti-bot, identity-verification "
"and session values; the parser does not test whether they remain "
"valid or reusable.",
"paths": (
"*/Library/HTTPStorages/com.roblox.RobloxPlayer.binarycookies",
),
Expand Down
15 changes: 7 additions & 8 deletions scripts/artifacts/robloxLogs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"RCC server addresses recorded by the client.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "UDMUX and RCC labels follow the source log. In the tested corpus "
Expand All @@ -21,7 +21,6 @@
"artifact_icon": "log-in",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 3 rows",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 2 rows",
},
},
"robloxHttpActivity": {
Expand All @@ -31,20 +30,21 @@
"server IP, elapsed time, body size and retry state.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "URLs and query parameters are reported verbatim for evidentiary "
"analysis and may contain usable credentials. Player-log URLs form "
"a partial activity record, not browser history.",
"analysis and may contain tokens or credential-like values. The "
"parser does not determine whether those values remain valid or "
"reusable. Player-log URLs form a partial activity record, not "
"browser history.",
"paths": (
"*/Library/Logs/Roblox/*_Player_*.log",
),
"output_types": ["html", "tsv", "timeline", "lava"],
"artifact_icon": "globe",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 71 rows",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 119 rows",
},
},
"robloxPlayerLog": {
Expand All @@ -54,7 +54,7 @@
"component and message.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "Long messages are limited to 10,000 characters. The first "
Expand All @@ -66,7 +66,6 @@
"artifact_icon": "file-text",
"sample_data": {
"roblox_macos": "Roblox 0.732.0.7321040 macOS | 2249 rows",
"roblox_windows": "Roblox 0.732.23.7321040 Windows | 3644 rows",
},
},
}
Expand Down
17 changes: 10 additions & 7 deletions scripts/artifacts/robloxStorage.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,14 @@
"locale data and identity-verification state.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "UTF-16 values are decoded and JSON is normalized. Values are "
"reported in full and may contain usable credentials. JSON "
"normalization can change whitespace without changing its data.",
"reported in full and may contain tokens or credential-like data; "
"the parser does not determine whether they remain valid or "
"reusable. JSON normalization can change whitespace without "
"changing its data.",
"paths": (
"*/Library/WebKit/com.roblox.RobloxPlayer/WebsiteData/*/*/*/"
"LocalStorage/localstorage.sqlite3",
Expand All @@ -31,13 +33,14 @@
"for follow-up analysis.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "WebKit uses a binary structured-clone encoding. This parser does "
"not fully deserialize every JavaScript value type; it extracts "
"embedded readable strings and limits each preview to 5,000 "
"characters. Preview output may contain usable credentials.",
"characters. Preview output may contain tokens or credential-like "
"data whose validity and reusability are not assessed.",
"paths": (
"*/Library/WebKit/com.roblox.RobloxPlayer/WebsiteData/*/*/*/"
"IndexedDB/*/IndexedDB.sqlite3",
Expand All @@ -57,7 +60,7 @@
"signatures.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "The 16-byte IDs are opaque cache keys. Atime behaves as Unix "
Expand All @@ -78,7 +81,7 @@
"metadata, record size and any companion blob size.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (macOS)",
"notes": "WebKit's cache is an internal, versioned implementation format. "
Expand Down
48 changes: 28 additions & 20 deletions scripts/artifacts/robloxWebView2.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"and complete DPAPI-protected blob.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "CookiesData is encrypted with Windows DPAPI and cannot be decrypted "
Expand All @@ -25,7 +25,7 @@
"Windows WebView2 profile.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Chromium v10 cookie values depend on the WebView2 Local State "
Expand All @@ -48,12 +48,13 @@
"and referring visit identifiers.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "URLs and query parameters are reported in full and may contain "
"challenge tokens or other credentials. History is a retained "
"partial record and can include repeated visits.",
"challenge tokens or credential-like values. The parser does not "
"determine whether those values remain valid or reusable. History "
"is a retained partial record and can include repeated visits.",
"paths": (
"*/AppData/Local/Roblox/UniversalApp/WebView2/EBWebView/Default/History",
),
Expand All @@ -69,12 +70,13 @@
"recovered from Roblox's Windows WebView2 LevelDB.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "LevelDB table and log files preserve historical versions. Values "
"are reported in full; JSON is compacted and may contain usable "
"credentials, notifications and account state.",
"are reported in full; JSON is compacted and may contain tokens, "
"notifications and account state. The parser does not determine "
"whether token-like values remain valid or reusable.",
"paths": (
"*/AppData/Local/Roblox/UniversalApp/WebView2/EBWebView/Default/"
"Local Storage/leveldb/*",
Expand All @@ -92,7 +94,7 @@
"origin, map, key and sequence attribution.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Chromium Session Storage namespaces map origins to numbered maps. "
Expand All @@ -117,12 +119,14 @@
"Roblox's Windows WebView2 IndexedDB LevelDB.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "The vendored Chromium IndexedDB reader returns decoded JavaScript "
"values where supported and explicit placeholders otherwise. "
"Historical versions can repeat. Output may contain credentials.",
"Historical versions can repeat. Output may contain tokens or "
"credential-like values whose validity and reusability are not "
"assessed.",
"paths": (
"*/AppData/Local/Roblox/UniversalApp/WebView2/EBWebView/Default/"
"IndexedDB/https_www.roblox.com_0.indexeddb.leveldb/*",
Expand All @@ -141,13 +145,14 @@
"storage details.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Parses Chromium v3 index, data_N blocks and f_XXXXXX streams using "
"the published blockfile format. URLs and headers are reported in "
"full. The cache is partial and can contain credential-bearing "
"query parameters.",
"full. The cache is partial and can contain tokens or "
"credential-like query values; their validity and reusability are "
"not assessed.",
"paths": (
"*/AppData/Local/Roblox/UniversalApp/WebView2/EBWebView/Default/"
"Cache/Cache_Data/*",
Expand All @@ -165,7 +170,7 @@
"from cached Roblox API responses.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Only user-specific API endpoints are included; general feature "
Expand All @@ -190,7 +195,7 @@
"cached Roblox API responses.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "One row is emitted per relationship, membership or search action. "
Expand All @@ -215,7 +220,7 @@
"Storage.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Purchase-flow telemetry documents page views, available products "
Expand All @@ -242,13 +247,16 @@
"Roblox API responses.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Only records containing an actual user-linked item or wall post "
"are emitted. Empty lists, endpoint errors, category catalogs, "
"feature metadata and settings-option catalogs are excluded. "
"Identical retained response versions are deduplicated.",
"Identical retained response versions are deduplicated. The tested "
"Windows corpus produced zero rows, so the supported endpoint "
"schemas are parser capabilities rather than observed sample "
"evidence.",
"paths": (
"*/AppData/Local/Roblox/UniversalApp/WebView2/EBWebView/Default/"
"Cache/Cache_Data/*",
Expand All @@ -264,7 +272,7 @@
"HTML body, created and updated times, and read/system state.",
"author": "@AlexisBrignoni, Codex",
"creation_date": "2026-07-28",
"last_update_date": "2026-07-28",
"last_update_date": "2026-07-29",
"requirements": "none",
"category": "Roblox (Windows)",
"notes": "Recovered from retained privatemessages.roblox.com response bodies. "
Expand Down
Loading
Loading