mirror of
https://github.com/mvt-project/mvt
synced 2025-10-21 22:42:15 +02:00
Compare commits
29 Commits
fix/safari
...
auto/add-n
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
779842567d | ||
|
|
d3cc8cf590 | ||
|
|
b8a42eaf8f | ||
|
|
62b880fbff | ||
|
|
0778d448df | ||
|
|
f020655a1a | ||
|
|
91c34e6664 | ||
|
|
b4a8dd226a | ||
|
|
88213e12c9 | ||
|
|
f75b8e186a | ||
|
|
5babc1fcf3 | ||
|
|
b723ebf28e | ||
|
|
616e870212 | ||
|
|
847b0e087b | ||
|
|
86a0772eb2 | ||
|
|
7d0be9db4f | ||
|
|
4e120b2640 | ||
|
|
dbe9e5db9b | ||
|
|
0b00398729 | ||
|
|
87034d2c7a | ||
|
|
595a2f6536 | ||
|
|
8ead44a31e | ||
|
|
5c19d02a73 | ||
|
|
14ebc9ee4e | ||
|
|
de53cc07f8 | ||
|
|
242052b8ec | ||
|
|
10915f250c | ||
|
|
c60cef4009 | ||
|
|
49108e67e2 |
2
Makefile
2
Makefile
@@ -23,7 +23,7 @@ install:
|
|||||||
python3 -m pip install --upgrade -e .
|
python3 -m pip install --upgrade -e .
|
||||||
|
|
||||||
test-requirements:
|
test-requirements:
|
||||||
python3 -m pip install --upgrade -r test-requirements.txt
|
python3 -m pip install --upgrade --group dev
|
||||||
|
|
||||||
generate-proto-parsers:
|
generate-proto-parsers:
|
||||||
# Generate python parsers for protobuf files
|
# Generate python parsers for protobuf files
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
mkdocs==1.6.1
|
mkdocs==1.6.1
|
||||||
mkdocs-autorefs==1.4.2
|
mkdocs-autorefs==1.4.3
|
||||||
mkdocs-material==9.6.14
|
mkdocs-material==9.6.20
|
||||||
mkdocs-material-extensions==1.3.1
|
mkdocs-material-extensions==1.3.1
|
||||||
mkdocstrings==0.29.1
|
mkdocstrings==0.30.1
|
||||||
@@ -1,13 +1,11 @@
|
|||||||
[project]
|
[project]
|
||||||
name = "mvt"
|
name = "mvt"
|
||||||
dynamic = ["version"]
|
dynamic = ["version"]
|
||||||
authors = [
|
authors = [{ name = "Claudio Guarnieri", email = "nex@nex.sx" }]
|
||||||
{name = "Claudio Guarnieri", email = "nex@nex.sx"}
|
|
||||||
]
|
|
||||||
maintainers = [
|
maintainers = [
|
||||||
{name = "Etienne Maynier", email = "tek@randhome.io"},
|
{ name = "Etienne Maynier", email = "tek@randhome.io" },
|
||||||
{name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org"},
|
{ name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org" },
|
||||||
{name = "Rory Flynn", email = "rory.flynn@amnesty.org"}
|
{ name = "Rory Flynn", email = "rory.flynn@amnesty.org" },
|
||||||
]
|
]
|
||||||
description = "Mobile Verification Toolkit"
|
description = "Mobile Verification Toolkit"
|
||||||
readme = "README.md"
|
readme = "README.md"
|
||||||
@@ -16,11 +14,11 @@ classifiers = [
|
|||||||
"Development Status :: 5 - Production/Stable",
|
"Development Status :: 5 - Production/Stable",
|
||||||
"Intended Audience :: Information Technology",
|
"Intended Audience :: Information Technology",
|
||||||
"Operating System :: OS Independent",
|
"Operating System :: OS Independent",
|
||||||
"Programming Language :: Python"
|
"Programming Language :: Python",
|
||||||
]
|
]
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"click==8.2.1",
|
"click==8.2.1",
|
||||||
"rich==14.0.0",
|
"rich==14.1.0",
|
||||||
"tld==0.13.1",
|
"tld==0.13.1",
|
||||||
"requests==2.32.4",
|
"requests==2.32.4",
|
||||||
"simplejson==3.20.1",
|
"simplejson==3.20.1",
|
||||||
@@ -29,14 +27,15 @@ dependencies = [
|
|||||||
"iOSbackup==0.9.925",
|
"iOSbackup==0.9.925",
|
||||||
"adb-shell[usb]==0.4.4",
|
"adb-shell[usb]==0.4.4",
|
||||||
"libusb1==3.3.1",
|
"libusb1==3.3.1",
|
||||||
"cryptography==45.0.5",
|
"cryptography==45.0.6",
|
||||||
"PyYAML>=6.0.2",
|
"PyYAML>=6.0.2",
|
||||||
"pyahocorasick==2.2.0",
|
"pyahocorasick==2.2.0",
|
||||||
"betterproto==1.2.5",
|
"betterproto==1.2.5",
|
||||||
"pydantic==2.11.7",
|
"pydantic==2.11.7",
|
||||||
"pydantic-settings==2.9.1",
|
"pydantic-settings==2.10.1",
|
||||||
"NSKeyedUnArchiver==1.5.2",
|
"NSKeyedUnArchiver==1.5.2",
|
||||||
"python-dateutil==2.9.0.post0",
|
"python-dateutil==2.9.0.post0",
|
||||||
|
"tzdata==2025.2",
|
||||||
]
|
]
|
||||||
requires-python = ">= 3.10"
|
requires-python = ">= 3.10"
|
||||||
|
|
||||||
@@ -45,20 +44,31 @@ homepage = "https://docs.mvt.re/en/latest/"
|
|||||||
repository = "https://github.com/mvt-project/mvt"
|
repository = "https://github.com/mvt-project/mvt"
|
||||||
|
|
||||||
[project.scripts]
|
[project.scripts]
|
||||||
mvt-ios = "mvt.ios:cli"
|
mvt-ios = "mvt.ios:cli"
|
||||||
mvt-android = "mvt.android:cli"
|
mvt-android = "mvt.android:cli"
|
||||||
|
|
||||||
|
[dependency-groups]
|
||||||
|
dev = [
|
||||||
|
"requests>=2.31.0",
|
||||||
|
"pytest>=7.4.3",
|
||||||
|
"pytest-cov>=4.1.0",
|
||||||
|
"pytest-github-actions-annotate-failures>=0.2.0",
|
||||||
|
"pytest-mock>=3.14.0",
|
||||||
|
"stix2>=3.0.1",
|
||||||
|
"ruff>=0.1.6",
|
||||||
|
"mypy>=1.7.1",
|
||||||
|
"betterproto[compiler]",
|
||||||
|
]
|
||||||
|
|
||||||
[build-system]
|
[build-system]
|
||||||
requires = ["setuptools>=61.0"]
|
requires = ["setuptools>=61.0"]
|
||||||
build-backend = "setuptools.build_meta"
|
build-backend = "setuptools.build_meta"
|
||||||
|
|
||||||
[tool.coverage.run]
|
[tool.coverage.run]
|
||||||
omit = [
|
omit = ["tests/*"]
|
||||||
"tests/*",
|
|
||||||
]
|
|
||||||
|
|
||||||
[tool.coverage.html]
|
[tool.coverage.html]
|
||||||
directory= "htmlcov"
|
directory = "htmlcov"
|
||||||
|
|
||||||
[tool.mypy]
|
[tool.mypy]
|
||||||
install_types = true
|
install_types = true
|
||||||
@@ -68,15 +78,13 @@ packages = "src"
|
|||||||
|
|
||||||
[tool.pytest.ini_options]
|
[tool.pytest.ini_options]
|
||||||
addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
|
addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
|
||||||
testpaths = [
|
testpaths = ["tests"]
|
||||||
"tests"
|
|
||||||
]
|
|
||||||
|
|
||||||
[tool.ruff.lint]
|
[tool.ruff.lint]
|
||||||
select = ["C90", "E", "F", "W"] # flake8 default set
|
select = ["C90", "E", "F", "W"] # flake8 default set
|
||||||
ignore = [
|
ignore = [
|
||||||
"E501", # don't enforce line length violations
|
"E501", # don't enforce line length violations
|
||||||
"C901", # complex-structure
|
"C901", # complex-structure
|
||||||
|
|
||||||
# These were previously ignored but don't seem to be required:
|
# These were previously ignored but don't seem to be required:
|
||||||
# "E265", # no-space-after-block-comment
|
# "E265", # no-space-after-block-comment
|
||||||
@@ -88,14 +96,14 @@ ignore = [
|
|||||||
]
|
]
|
||||||
|
|
||||||
[tool.ruff.lint.per-file-ignores]
|
[tool.ruff.lint.per-file-ignores]
|
||||||
"__init__.py" = ["F401"] # unused-import
|
"__init__.py" = ["F401"] # unused-import
|
||||||
|
|
||||||
[tool.ruff.lint.mccabe]
|
[tool.ruff.lint.mccabe]
|
||||||
max-complexity = 10
|
max-complexity = 10
|
||||||
|
|
||||||
[tool.setuptools]
|
[tool.setuptools]
|
||||||
include-package-data = true
|
include-package-data = true
|
||||||
package-dir = {"" = "src"}
|
package-dir = { "" = "src" }
|
||||||
|
|
||||||
[tool.setuptools.packages.find]
|
[tool.setuptools.packages.find]
|
||||||
where = ["src"]
|
where = ["src"]
|
||||||
@@ -104,4 +112,4 @@ where = ["src"]
|
|||||||
mvt = ["ios/data/*.json"]
|
mvt = ["ios/data/*.json"]
|
||||||
|
|
||||||
[tool.setuptools.dynamic]
|
[tool.setuptools.dynamic]
|
||||||
version = {attr = "mvt.common.version.MVT_VERSION"}
|
version = { attr = "mvt.common.version.MVT_VERSION" }
|
||||||
|
|||||||
@@ -51,11 +51,6 @@ ANDROID_DANGEROUS_SETTINGS = [
|
|||||||
"key": "send_action_app_error",
|
"key": "send_action_app_error",
|
||||||
"safe_value": "1",
|
"safe_value": "1",
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"description": "enabled installation of non Google Play apps",
|
|
||||||
"key": "install_non_market_apps",
|
|
||||||
"safe_value": "0",
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"description": "enabled accessibility services",
|
"description": "enabled accessibility services",
|
||||||
"key": "accessibility_enabled",
|
"key": "accessibility_enabled",
|
||||||
|
|||||||
@@ -53,7 +53,7 @@ class TombstoneCrashResult(pydantic.BaseModel):
|
|||||||
file_name: str
|
file_name: str
|
||||||
file_timestamp: str # We store the timestamp as a string to avoid timezone issues
|
file_timestamp: str # We store the timestamp as a string to avoid timezone issues
|
||||||
build_fingerprint: str
|
build_fingerprint: str
|
||||||
revision: int
|
revision: str
|
||||||
arch: Optional[str] = None
|
arch: Optional[str] = None
|
||||||
timestamp: str # We store the timestamp as a string to avoid timezone issues
|
timestamp: str # We store the timestamp as a string to avoid timezone issues
|
||||||
process_uptime: Optional[int] = None
|
process_uptime: Optional[int] = None
|
||||||
@@ -187,7 +187,7 @@ class TombstoneCrashArtifact(AndroidArtifact):
|
|||||||
raise ValueError(f"Expected key {key}, got {line_key}")
|
raise ValueError(f"Expected key {key}, got {line_key}")
|
||||||
|
|
||||||
value_clean = value.strip().strip("'")
|
value_clean = value.strip().strip("'")
|
||||||
if destination_key in ["uid", "revision"]:
|
if destination_key == "uid":
|
||||||
tombstone[destination_key] = int(value_clean)
|
tombstone[destination_key] = int(value_clean)
|
||||||
elif destination_key == "process_uptime":
|
elif destination_key == "process_uptime":
|
||||||
# eg. "Process uptime: 40s"
|
# eg. "Process uptime: 40s"
|
||||||
|
|||||||
@@ -107,8 +107,7 @@ class Packages(AndroidExtraction):
|
|||||||
result["matched_indicator"] = ioc
|
result["matched_indicator"] = ioc
|
||||||
self.detected.append(result)
|
self.detected.append(result)
|
||||||
|
|
||||||
@staticmethod
|
def check_virustotal(self, packages: list) -> None:
|
||||||
def check_virustotal(packages: list) -> None:
|
|
||||||
hashes = []
|
hashes = []
|
||||||
for package in packages:
|
for package in packages:
|
||||||
for file in package.get("files", []):
|
for file in package.get("files", []):
|
||||||
@@ -143,8 +142,15 @@ class Packages(AndroidExtraction):
|
|||||||
|
|
||||||
for package in packages:
|
for package in packages:
|
||||||
for file in package.get("files", []):
|
for file in package.get("files", []):
|
||||||
row = [package["package_name"], file["path"]]
|
if "package_name" in package:
|
||||||
|
row = [package["package_name"], file["path"]]
|
||||||
|
elif "name" in package:
|
||||||
|
row = [package["name"], file["path"]]
|
||||||
|
else:
|
||||||
|
self.log.error(
|
||||||
|
f"Package {package} has no name or package_name. packages.json or apks.json is malformed"
|
||||||
|
)
|
||||||
|
continue
|
||||||
if file["sha256"] in detections:
|
if file["sha256"] in detections:
|
||||||
detection = detections[file["sha256"]]
|
detection = detections[file["sha256"]]
|
||||||
positives = detection.split("/")[0]
|
positives = detection.split("/")[0]
|
||||||
|
|||||||
@@ -895,6 +895,10 @@
|
|||||||
"version": "15.8.4",
|
"version": "15.8.4",
|
||||||
"build": "19H390"
|
"build": "19H390"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"version": "15.8.5",
|
||||||
|
"build": "19H394"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"build": "20A362",
|
"build": "20A362",
|
||||||
"version": "16.0"
|
"version": "16.0"
|
||||||
@@ -1000,6 +1004,10 @@
|
|||||||
"version": "16.7.11",
|
"version": "16.7.11",
|
||||||
"build": "20H360"
|
"build": "20H360"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"version": "16.7.12",
|
||||||
|
"build": "20H364"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"version": "17.0",
|
"version": "17.0",
|
||||||
"build": "21A327"
|
"build": "21A327"
|
||||||
@@ -1131,5 +1139,29 @@
|
|||||||
{
|
{
|
||||||
"version": "18.5",
|
"version": "18.5",
|
||||||
"build": "22F76"
|
"build": "22F76"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.6",
|
||||||
|
"build": "22G86"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.6.1",
|
||||||
|
"build": "22G90"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.6.2",
|
||||||
|
"build": "22G100"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.7",
|
||||||
|
"build": "22H20"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "26",
|
||||||
|
"build": "23A341"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "26.0.1",
|
||||||
|
"build": "23A355"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
@@ -116,13 +116,16 @@ class TCC(IOSExtraction):
|
|||||||
)
|
)
|
||||||
db_version = "v2"
|
db_version = "v2"
|
||||||
except sqlite3.OperationalError:
|
except sqlite3.OperationalError:
|
||||||
cur.execute(
|
try:
|
||||||
"""SELECT
|
cur.execute(
|
||||||
service, client, client_type, allowed,
|
"""SELECT
|
||||||
prompt_count
|
service, client, client_type, allowed,
|
||||||
FROM access;"""
|
prompt_count
|
||||||
)
|
FROM access;"""
|
||||||
db_version = "v1"
|
)
|
||||||
|
db_version = "v1"
|
||||||
|
except sqlite3.OperationalError as e:
|
||||||
|
self.log.error(f"Error parsing TCC database: {e}")
|
||||||
|
|
||||||
for row in cur:
|
for row in cur:
|
||||||
service = row[0]
|
service = row[0]
|
||||||
|
|||||||
@@ -1,9 +0,0 @@
|
|||||||
requests>=2.31.0
|
|
||||||
pytest>=7.4.3
|
|
||||||
pytest-cov>=4.1.0
|
|
||||||
pytest-github-actions-annotate-failures>=0.2.0
|
|
||||||
pytest-mock>=3.14.0
|
|
||||||
stix2>=3.0.1
|
|
||||||
ruff>=0.1.6
|
|
||||||
mypy>=1.7.1
|
|
||||||
betterproto[compiler]
|
|
||||||
Reference in New Issue
Block a user