mirror of
https://github.com/mvt-project/mvt
synced 2025-10-21 22:42:15 +02:00
Compare commits
55 Commits
fix/tombst
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
779842567d | ||
|
|
d3cc8cf590 | ||
|
|
b8a42eaf8f | ||
|
|
62b880fbff | ||
|
|
0778d448df | ||
|
|
f020655a1a | ||
|
|
91c34e6664 | ||
|
|
b4a8dd226a | ||
|
|
88213e12c9 | ||
|
|
f75b8e186a | ||
|
|
5babc1fcf3 | ||
|
|
b723ebf28e | ||
|
|
616e870212 | ||
|
|
847b0e087b | ||
|
|
86a0772eb2 | ||
|
|
7d0be9db4f | ||
|
|
4e120b2640 | ||
|
|
dbe9e5db9b | ||
|
|
0b00398729 | ||
|
|
87034d2c7a | ||
|
|
595a2f6536 | ||
|
|
8ead44a31e | ||
|
|
5c19d02a73 | ||
|
|
14ebc9ee4e | ||
|
|
de53cc07f8 | ||
|
|
22e066fc4a | ||
|
|
242052b8ec | ||
|
|
1df61b5bbf | ||
|
|
b691de2cc0 | ||
|
|
10915f250c | ||
|
|
c60cef4009 | ||
|
|
dda798df8e | ||
|
|
ffe6ad2014 | ||
|
|
a125b20fc5 | ||
|
|
49108e67e2 | ||
|
|
883b450601 | ||
|
|
ce813568ff | ||
|
|
93303f181a | ||
|
|
bee453a090 | ||
|
|
42106aa4d6 | ||
|
|
95076c8f71 | ||
|
|
c9ac12f336 | ||
|
|
486e3e7e9b | ||
|
|
be1fc3bd8b | ||
|
|
4757cff262 | ||
|
|
61f51caf31 | ||
|
|
511063fd0e | ||
|
|
88bc5672cb | ||
|
|
0fce0acf7a | ||
|
|
61f95d07d3 | ||
|
|
3dedd169c4 | ||
|
|
e34e03d3a3 | ||
|
|
34374699ce | ||
|
|
cf5aa7c89f | ||
|
|
2766739512 |
11
.github/dependabot.yml
vendored
Normal file
11
.github/dependabot.yml
vendored
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
# To get started with Dependabot version updates, you'll need to specify which
|
||||||
|
# package ecosystems to update and where the package manifests are located.
|
||||||
|
# Please see the documentation for all configuration options:
|
||||||
|
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
|
||||||
|
|
||||||
|
version: 2
|
||||||
|
updates:
|
||||||
|
- package-ecosystem: "pip" # See documentation for possible values
|
||||||
|
directory: "/" # Location of package manifests
|
||||||
|
schedule:
|
||||||
|
interval: "weekly"
|
||||||
4
.github/workflows/tests.yml
vendored
4
.github/workflows/tests.yml
vendored
@@ -12,7 +12,7 @@ jobs:
|
|||||||
strategy:
|
strategy:
|
||||||
fail-fast: false
|
fail-fast: false
|
||||||
matrix:
|
matrix:
|
||||||
python-version: ['3.8', '3.9', '3.10'] # , '3.11']
|
python-version: ['3.10', '3.11', '3.12', '3.13']
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@v4
|
||||||
@@ -35,4 +35,4 @@ jobs:
|
|||||||
if: github.event_name == 'pull_request'
|
if: github.event_name == 'pull_request'
|
||||||
with:
|
with:
|
||||||
pytest-coverage-path: ./pytest-coverage.txt
|
pytest-coverage-path: ./pytest-coverage.txt
|
||||||
junitxml-path: ./pytest.xml
|
junitxml-path: ./pytest.xml
|
||||||
|
|||||||
@@ -103,7 +103,7 @@ RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
|
|||||||
|
|
||||||
|
|
||||||
# Create main image
|
# Create main image
|
||||||
FROM ubuntu:22.04 as main
|
FROM ubuntu:24.04 as main
|
||||||
|
|
||||||
LABEL org.opencontainers.image.url="https://mvt.re"
|
LABEL org.opencontainers.image.url="https://mvt.re"
|
||||||
LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
|
LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
|
||||||
@@ -135,8 +135,7 @@ COPY --from=build-usbmuxd /build /
|
|||||||
COPY . mvt/
|
COPY . mvt/
|
||||||
RUN apt-get update \
|
RUN apt-get update \
|
||||||
&& apt-get install -y git python3-pip \
|
&& apt-get install -y git python3-pip \
|
||||||
&& PIP_NO_CACHE_DIR=1 pip3 install --upgrade pip \
|
&& PIP_NO_CACHE_DIR=1 pip3 install --break-system-packages ./mvt \
|
||||||
&& PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
|
|
||||||
&& apt-get remove -y python3-pip git && apt-get autoremove -y \
|
&& apt-get remove -y python3-pip git && apt-get autoremove -y \
|
||||||
&& rm -rf /var/lib/apt/lists/* \
|
&& rm -rf /var/lib/apt/lists/* \
|
||||||
&& rm -rf mvt
|
&& rm -rf mvt
|
||||||
|
|||||||
2
Makefile
2
Makefile
@@ -23,7 +23,7 @@ install:
|
|||||||
python3 -m pip install --upgrade -e .
|
python3 -m pip install --upgrade -e .
|
||||||
|
|
||||||
test-requirements:
|
test-requirements:
|
||||||
python3 -m pip install --upgrade -r test-requirements.txt
|
python3 -m pip install --upgrade --group dev
|
||||||
|
|
||||||
generate-proto-parsers:
|
generate-proto-parsers:
|
||||||
# Generate python parsers for protobuf files
|
# Generate python parsers for protobuf files
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
mkdocs==1.6.1
|
mkdocs==1.6.1
|
||||||
mkdocs-autorefs==1.2.0
|
mkdocs-autorefs==1.4.3
|
||||||
mkdocs-material==9.5.42
|
mkdocs-material==9.6.20
|
||||||
mkdocs-material-extensions==1.3.1
|
mkdocs-material-extensions==1.3.1
|
||||||
mkdocstrings==0.23.0
|
mkdocstrings==0.30.1
|
||||||
@@ -1,13 +1,11 @@
|
|||||||
[project]
|
[project]
|
||||||
name = "mvt"
|
name = "mvt"
|
||||||
dynamic = ["version"]
|
dynamic = ["version"]
|
||||||
authors = [
|
authors = [{ name = "Claudio Guarnieri", email = "nex@nex.sx" }]
|
||||||
{name = "Claudio Guarnieri", email = "nex@nex.sx"}
|
|
||||||
]
|
|
||||||
maintainers = [
|
maintainers = [
|
||||||
{name = "Etienne Maynier", email = "tek@randhome.io"},
|
{ name = "Etienne Maynier", email = "tek@randhome.io" },
|
||||||
{name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org"},
|
{ name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org" },
|
||||||
{name = "Rory Flynn", email = "rory.flynn@amnesty.org"}
|
{ name = "Rory Flynn", email = "rory.flynn@amnesty.org" },
|
||||||
]
|
]
|
||||||
description = "Mobile Verification Toolkit"
|
description = "Mobile Verification Toolkit"
|
||||||
readme = "README.md"
|
readme = "README.md"
|
||||||
@@ -16,48 +14,61 @@ classifiers = [
|
|||||||
"Development Status :: 5 - Production/Stable",
|
"Development Status :: 5 - Production/Stable",
|
||||||
"Intended Audience :: Information Technology",
|
"Intended Audience :: Information Technology",
|
||||||
"Operating System :: OS Independent",
|
"Operating System :: OS Independent",
|
||||||
"Programming Language :: Python"
|
"Programming Language :: Python",
|
||||||
]
|
]
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"click >=8.1.3",
|
"click==8.2.1",
|
||||||
"rich >=12.6.0",
|
"rich==14.1.0",
|
||||||
"tld >=0.12.6",
|
"tld==0.13.1",
|
||||||
"requests >=2.28.1",
|
"requests==2.32.4",
|
||||||
"simplejson >=3.17.6",
|
"simplejson==3.20.1",
|
||||||
"packaging >=21.3",
|
"packaging==25.0",
|
||||||
"appdirs >=1.4.4",
|
"appdirs==1.4.4",
|
||||||
"iOSbackup >=0.9.923",
|
"iOSbackup==0.9.925",
|
||||||
"adb-shell[usb] >=0.4.3",
|
"adb-shell[usb]==0.4.4",
|
||||||
"libusb1 >=3.0.0",
|
"libusb1==3.3.1",
|
||||||
"cryptography >=42.0.5",
|
"cryptography==45.0.6",
|
||||||
"pyyaml >=6.0",
|
"PyYAML>=6.0.2",
|
||||||
"pyahocorasick >= 2.0.0",
|
"pyahocorasick==2.2.0",
|
||||||
"betterproto >=1.2.0",
|
"betterproto==1.2.5",
|
||||||
"pydantic >= 2.10.0",
|
"pydantic==2.11.7",
|
||||||
"pydantic-settings >= 2.7.0",
|
"pydantic-settings==2.10.1",
|
||||||
'backports.zoneinfo; python_version < "3.9"',
|
"NSKeyedUnArchiver==1.5.2",
|
||||||
|
"python-dateutil==2.9.0.post0",
|
||||||
|
"tzdata==2025.2",
|
||||||
]
|
]
|
||||||
requires-python = ">= 3.8"
|
requires-python = ">= 3.10"
|
||||||
|
|
||||||
[project.urls]
|
[project.urls]
|
||||||
homepage = "https://docs.mvt.re/en/latest/"
|
homepage = "https://docs.mvt.re/en/latest/"
|
||||||
repository = "https://github.com/mvt-project/mvt"
|
repository = "https://github.com/mvt-project/mvt"
|
||||||
|
|
||||||
[project.scripts]
|
[project.scripts]
|
||||||
mvt-ios = "mvt.ios:cli"
|
mvt-ios = "mvt.ios:cli"
|
||||||
mvt-android = "mvt.android:cli"
|
mvt-android = "mvt.android:cli"
|
||||||
|
|
||||||
|
[dependency-groups]
|
||||||
|
dev = [
|
||||||
|
"requests>=2.31.0",
|
||||||
|
"pytest>=7.4.3",
|
||||||
|
"pytest-cov>=4.1.0",
|
||||||
|
"pytest-github-actions-annotate-failures>=0.2.0",
|
||||||
|
"pytest-mock>=3.14.0",
|
||||||
|
"stix2>=3.0.1",
|
||||||
|
"ruff>=0.1.6",
|
||||||
|
"mypy>=1.7.1",
|
||||||
|
"betterproto[compiler]",
|
||||||
|
]
|
||||||
|
|
||||||
[build-system]
|
[build-system]
|
||||||
requires = ["setuptools>=61.0"]
|
requires = ["setuptools>=61.0"]
|
||||||
build-backend = "setuptools.build_meta"
|
build-backend = "setuptools.build_meta"
|
||||||
|
|
||||||
[tool.coverage.run]
|
[tool.coverage.run]
|
||||||
omit = [
|
omit = ["tests/*"]
|
||||||
"tests/*",
|
|
||||||
]
|
|
||||||
|
|
||||||
[tool.coverage.html]
|
[tool.coverage.html]
|
||||||
directory= "htmlcov"
|
directory = "htmlcov"
|
||||||
|
|
||||||
[tool.mypy]
|
[tool.mypy]
|
||||||
install_types = true
|
install_types = true
|
||||||
@@ -67,15 +78,13 @@ packages = "src"
|
|||||||
|
|
||||||
[tool.pytest.ini_options]
|
[tool.pytest.ini_options]
|
||||||
addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
|
addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
|
||||||
testpaths = [
|
testpaths = ["tests"]
|
||||||
"tests"
|
|
||||||
]
|
|
||||||
|
|
||||||
[tool.ruff.lint]
|
[tool.ruff.lint]
|
||||||
select = ["C90", "E", "F", "W"] # flake8 default set
|
select = ["C90", "E", "F", "W"] # flake8 default set
|
||||||
ignore = [
|
ignore = [
|
||||||
"E501", # don't enforce line length violations
|
"E501", # don't enforce line length violations
|
||||||
"C901", # complex-structure
|
"C901", # complex-structure
|
||||||
|
|
||||||
# These were previously ignored but don't seem to be required:
|
# These were previously ignored but don't seem to be required:
|
||||||
# "E265", # no-space-after-block-comment
|
# "E265", # no-space-after-block-comment
|
||||||
@@ -87,14 +96,14 @@ ignore = [
|
|||||||
]
|
]
|
||||||
|
|
||||||
[tool.ruff.lint.per-file-ignores]
|
[tool.ruff.lint.per-file-ignores]
|
||||||
"__init__.py" = ["F401"] # unused-import
|
"__init__.py" = ["F401"] # unused-import
|
||||||
|
|
||||||
[tool.ruff.lint.mccabe]
|
[tool.ruff.lint.mccabe]
|
||||||
max-complexity = 10
|
max-complexity = 10
|
||||||
|
|
||||||
[tool.setuptools]
|
[tool.setuptools]
|
||||||
include-package-data = true
|
include-package-data = true
|
||||||
package-dir = {"" = "src"}
|
package-dir = { "" = "src" }
|
||||||
|
|
||||||
[tool.setuptools.packages.find]
|
[tool.setuptools.packages.find]
|
||||||
where = ["src"]
|
where = ["src"]
|
||||||
@@ -103,4 +112,4 @@ where = ["src"]
|
|||||||
mvt = ["ios/data/*.json"]
|
mvt = ["ios/data/*.json"]
|
||||||
|
|
||||||
[tool.setuptools.dynamic]
|
[tool.setuptools.dynamic]
|
||||||
version = {attr = "mvt.common.version.MVT_VERSION"}
|
version = { attr = "mvt.common.version.MVT_VERSION" }
|
||||||
|
|||||||
@@ -4,6 +4,7 @@
|
|||||||
# https://license.mvt.re/1.1/
|
# https://license.mvt.re/1.1/
|
||||||
|
|
||||||
import base64
|
import base64
|
||||||
|
import binascii
|
||||||
import hashlib
|
import hashlib
|
||||||
|
|
||||||
from .artifact import AndroidArtifact
|
from .artifact import AndroidArtifact
|
||||||
@@ -89,11 +90,16 @@ class DumpsysADBArtifact(AndroidArtifact):
|
|||||||
else:
|
else:
|
||||||
key_base64, user = user_key, b""
|
key_base64, user = user_key, b""
|
||||||
|
|
||||||
key_raw = base64.b64decode(key_base64)
|
try:
|
||||||
key_fingerprint = hashlib.md5(key_raw).hexdigest().upper()
|
key_raw = base64.b64decode(key_base64)
|
||||||
key_fingerprint_colon = ":".join(
|
key_fingerprint = hashlib.md5(key_raw).hexdigest().upper()
|
||||||
[key_fingerprint[i : i + 2] for i in range(0, len(key_fingerprint), 2)]
|
key_fingerprint_colon = ":".join(
|
||||||
)
|
[key_fingerprint[i : i + 2] for i in range(0, len(key_fingerprint), 2)]
|
||||||
|
)
|
||||||
|
except binascii.Error:
|
||||||
|
# Impossible to parse base64
|
||||||
|
key_fingerprint_colon = ""
|
||||||
|
|
||||||
return {
|
return {
|
||||||
"user": user.decode("utf-8"),
|
"user": user.decode("utf-8"),
|
||||||
"fingerprint": key_fingerprint_colon,
|
"fingerprint": key_fingerprint_colon,
|
||||||
|
|||||||
@@ -51,11 +51,6 @@ ANDROID_DANGEROUS_SETTINGS = [
|
|||||||
"key": "send_action_app_error",
|
"key": "send_action_app_error",
|
||||||
"safe_value": "1",
|
"safe_value": "1",
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"description": "enabled installation of non Google Play apps",
|
|
||||||
"key": "install_non_market_apps",
|
|
||||||
"safe_value": "0",
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"description": "enabled accessibility services",
|
"description": "enabled accessibility services",
|
||||||
"key": "accessibility_enabled",
|
"key": "accessibility_enabled",
|
||||||
|
|||||||
@@ -8,6 +8,7 @@ from typing import List, Optional, Union
|
|||||||
|
|
||||||
import pydantic
|
import pydantic
|
||||||
import betterproto
|
import betterproto
|
||||||
|
from dateutil import parser
|
||||||
|
|
||||||
from mvt.common.utils import convert_datetime_to_iso
|
from mvt.common.utils import convert_datetime_to_iso
|
||||||
from mvt.android.parsers.proto.tombstone import Tombstone
|
from mvt.android.parsers.proto.tombstone import Tombstone
|
||||||
@@ -52,7 +53,7 @@ class TombstoneCrashResult(pydantic.BaseModel):
|
|||||||
file_name: str
|
file_name: str
|
||||||
file_timestamp: str # We store the timestamp as a string to avoid timezone issues
|
file_timestamp: str # We store the timestamp as a string to avoid timezone issues
|
||||||
build_fingerprint: str
|
build_fingerprint: str
|
||||||
revision: int
|
revision: str
|
||||||
arch: Optional[str] = None
|
arch: Optional[str] = None
|
||||||
timestamp: str # We store the timestamp as a string to avoid timezone issues
|
timestamp: str # We store the timestamp as a string to avoid timezone issues
|
||||||
process_uptime: Optional[int] = None
|
process_uptime: Optional[int] = None
|
||||||
@@ -62,7 +63,7 @@ class TombstoneCrashResult(pydantic.BaseModel):
|
|||||||
process_name: Optional[str] = None
|
process_name: Optional[str] = None
|
||||||
binary_path: Optional[str] = None
|
binary_path: Optional[str] = None
|
||||||
selinux_label: Optional[str] = None
|
selinux_label: Optional[str] = None
|
||||||
uid: Optional[int] = None
|
uid: int
|
||||||
signal_info: SignalInfo
|
signal_info: SignalInfo
|
||||||
cause: Optional[str] = None
|
cause: Optional[str] = None
|
||||||
extra: Optional[str] = None
|
extra: Optional[str] = None
|
||||||
@@ -124,7 +125,9 @@ class TombstoneCrashArtifact(AndroidArtifact):
|
|||||||
Parse Android tombstone crash files from a protobuf object.
|
Parse Android tombstone crash files from a protobuf object.
|
||||||
"""
|
"""
|
||||||
tombstone_pb = Tombstone().parse(data)
|
tombstone_pb = Tombstone().parse(data)
|
||||||
tombstone_dict = tombstone_pb.to_dict(betterproto.Casing.SNAKE)
|
tombstone_dict = tombstone_pb.to_dict(
|
||||||
|
betterproto.Casing.SNAKE, include_default_values=True
|
||||||
|
)
|
||||||
|
|
||||||
# Add some extra metadata
|
# Add some extra metadata
|
||||||
tombstone_dict["timestamp"] = self._parse_timestamp_string(
|
tombstone_dict["timestamp"] = self._parse_timestamp_string(
|
||||||
@@ -184,7 +187,7 @@ class TombstoneCrashArtifact(AndroidArtifact):
|
|||||||
raise ValueError(f"Expected key {key}, got {line_key}")
|
raise ValueError(f"Expected key {key}, got {line_key}")
|
||||||
|
|
||||||
value_clean = value.strip().strip("'")
|
value_clean = value.strip().strip("'")
|
||||||
if destination_key in ["uid", "revision"]:
|
if destination_key == "uid":
|
||||||
tombstone[destination_key] = int(value_clean)
|
tombstone[destination_key] = int(value_clean)
|
||||||
elif destination_key == "process_uptime":
|
elif destination_key == "process_uptime":
|
||||||
# eg. "Process uptime: 40s"
|
# eg. "Process uptime: 40s"
|
||||||
@@ -252,12 +255,7 @@ class TombstoneCrashArtifact(AndroidArtifact):
|
|||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def _parse_timestamp_string(timestamp: str) -> str:
|
def _parse_timestamp_string(timestamp: str) -> str:
|
||||||
timestamp_date, timezone = timestamp.split("+")
|
timestamp_parsed = parser.parse(timestamp)
|
||||||
# Truncate microseconds before parsing
|
|
||||||
timestamp_without_micro = timestamp_date.split(".")[0] + "+" + timezone
|
|
||||||
timestamp_parsed = datetime.datetime.strptime(
|
|
||||||
timestamp_without_micro, "%Y-%m-%d %H:%M:%S%z"
|
|
||||||
)
|
|
||||||
|
|
||||||
# HACK: Swap the local timestamp to UTC, so keep the original time and avoid timezone conversion.
|
# HACK: Swap the local timestamp to UTC, so keep the original time and avoid timezone conversion.
|
||||||
local_timestamp = timestamp_parsed.replace(tzinfo=datetime.timezone.utc)
|
local_timestamp = timestamp_parsed.replace(tzinfo=datetime.timezone.utc)
|
||||||
|
|||||||
@@ -107,8 +107,7 @@ class Packages(AndroidExtraction):
|
|||||||
result["matched_indicator"] = ioc
|
result["matched_indicator"] = ioc
|
||||||
self.detected.append(result)
|
self.detected.append(result)
|
||||||
|
|
||||||
@staticmethod
|
def check_virustotal(self, packages: list) -> None:
|
||||||
def check_virustotal(packages: list) -> None:
|
|
||||||
hashes = []
|
hashes = []
|
||||||
for package in packages:
|
for package in packages:
|
||||||
for file in package.get("files", []):
|
for file in package.get("files", []):
|
||||||
@@ -143,8 +142,15 @@ class Packages(AndroidExtraction):
|
|||||||
|
|
||||||
for package in packages:
|
for package in packages:
|
||||||
for file in package.get("files", []):
|
for file in package.get("files", []):
|
||||||
row = [package["package_name"], file["path"]]
|
if "package_name" in package:
|
||||||
|
row = [package["package_name"], file["path"]]
|
||||||
|
elif "name" in package:
|
||||||
|
row = [package["name"], file["path"]]
|
||||||
|
else:
|
||||||
|
self.log.error(
|
||||||
|
f"Package {package} has no name or package_name. packages.json or apks.json is malformed"
|
||||||
|
)
|
||||||
|
continue
|
||||||
if file["sha256"] in detections:
|
if file["sha256"] in detections:
|
||||||
detection = detections[file["sha256"]]
|
detection = detections[file["sha256"]]
|
||||||
positives = detection.split("/")[0]
|
positives = detection.split("/")[0]
|
||||||
|
|||||||
@@ -231,6 +231,7 @@ def parse_sms_file(data):
|
|||||||
entry.pop("mms_body")
|
entry.pop("mms_body")
|
||||||
|
|
||||||
body = entry.get("body", None)
|
body = entry.get("body", None)
|
||||||
|
message_links = None
|
||||||
if body:
|
if body:
|
||||||
message_links = check_for_links(entry["body"])
|
message_links = check_for_links(entry["body"])
|
||||||
|
|
||||||
|
|||||||
@@ -65,6 +65,10 @@ class CmdCheckIOCS(Command):
|
|||||||
m = iocs_module.from_json(
|
m = iocs_module.from_json(
|
||||||
file_path, log=logging.getLogger(iocs_module.__module__)
|
file_path, log=logging.getLogger(iocs_module.__module__)
|
||||||
)
|
)
|
||||||
|
if not m:
|
||||||
|
log.warning("No result from this module, skipping it")
|
||||||
|
continue
|
||||||
|
|
||||||
if self.iocs.total_ioc_count > 0:
|
if self.iocs.total_ioc_count > 0:
|
||||||
m.indicators = self.iocs
|
m.indicators = self.iocs
|
||||||
m.indicators.log = m.log
|
m.indicators.log = m.log
|
||||||
|
|||||||
@@ -69,10 +69,14 @@ class MVTModule:
|
|||||||
@classmethod
|
@classmethod
|
||||||
def from_json(cls, json_path: str, log: logging.Logger):
|
def from_json(cls, json_path: str, log: logging.Logger):
|
||||||
with open(json_path, "r", encoding="utf-8") as handle:
|
with open(json_path, "r", encoding="utf-8") as handle:
|
||||||
results = json.load(handle)
|
try:
|
||||||
if log:
|
results = json.load(handle)
|
||||||
log.info('Loaded %d results from "%s"', len(results), json_path)
|
if log:
|
||||||
return cls(results=results, log=log)
|
log.info('Loaded %d results from "%s"', len(results), json_path)
|
||||||
|
return cls(results=results, log=log)
|
||||||
|
except json.decoder.JSONDecodeError as err:
|
||||||
|
log.error('Error to decode the json "%s" file: "%s"', json_path, err)
|
||||||
|
return None
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def get_slug(cls) -> str:
|
def get_slug(cls) -> str:
|
||||||
|
|||||||
@@ -3,4 +3,4 @@
|
|||||||
# Use of this software is governed by the MVT License 1.1 that can be found at
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
||||||
# https://license.mvt.re/1.1/
|
# https://license.mvt.re/1.1/
|
||||||
|
|
||||||
MVT_VERSION = "2.6.0"
|
MVT_VERSION = "2.6.1"
|
||||||
|
|||||||
@@ -891,6 +891,14 @@
|
|||||||
"version": "15.8.2",
|
"version": "15.8.2",
|
||||||
"build": "19H384"
|
"build": "19H384"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"version": "15.8.4",
|
||||||
|
"build": "19H390"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "15.8.5",
|
||||||
|
"build": "19H394"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"build": "20A362",
|
"build": "20A362",
|
||||||
"version": "16.0"
|
"version": "16.0"
|
||||||
@@ -992,6 +1000,14 @@
|
|||||||
"version": "16.7.8",
|
"version": "16.7.8",
|
||||||
"build": "20H343"
|
"build": "20H343"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"version": "16.7.11",
|
||||||
|
"build": "20H360"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "16.7.12",
|
||||||
|
"build": "20H364"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"version": "17.0",
|
"version": "17.0",
|
||||||
"build": "21A327"
|
"build": "21A327"
|
||||||
@@ -1076,6 +1092,10 @@
|
|||||||
"version": "17.6.1",
|
"version": "17.6.1",
|
||||||
"build": "21G101"
|
"build": "21G101"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"version": "17.7.7",
|
||||||
|
"build": "21H433"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"version": "18",
|
"version": "18",
|
||||||
"build": "22A3354"
|
"build": "22A3354"
|
||||||
@@ -1107,5 +1127,41 @@
|
|||||||
{
|
{
|
||||||
"version": "18.3.1",
|
"version": "18.3.1",
|
||||||
"build": "22D72"
|
"build": "22D72"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.4",
|
||||||
|
"build": "22E240"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.4.1",
|
||||||
|
"build": "22E252"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.5",
|
||||||
|
"build": "22F76"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.6",
|
||||||
|
"build": "22G86"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.6.1",
|
||||||
|
"build": "22G90"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.6.2",
|
||||||
|
"build": "22G100"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "18.7",
|
||||||
|
"build": "22H20"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "26",
|
||||||
|
"build": "23A341"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "26.0.1",
|
||||||
|
"build": "23A355"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
@@ -43,6 +43,8 @@ class GlobalPreferences(IOSExtraction):
|
|||||||
self.log.warning("Lockdown mode enabled")
|
self.log.warning("Lockdown mode enabled")
|
||||||
else:
|
else:
|
||||||
self.log.warning("Lockdown mode disabled")
|
self.log.warning("Lockdown mode disabled")
|
||||||
|
return
|
||||||
|
self.log.warning("Lockdown mode disabled")
|
||||||
|
|
||||||
def process_file(self, file_path: str) -> None:
|
def process_file(self, file_path: str) -> None:
|
||||||
with open(file_path, "rb") as handle:
|
with open(file_path, "rb") as handle:
|
||||||
|
|||||||
@@ -95,14 +95,17 @@ class SafariBrowserState(IOSExtraction):
|
|||||||
)
|
)
|
||||||
except sqlite3.OperationalError:
|
except sqlite3.OperationalError:
|
||||||
# Old version iOS <12 likely
|
# Old version iOS <12 likely
|
||||||
cur.execute(
|
try:
|
||||||
|
cur.execute(
|
||||||
|
"""
|
||||||
|
SELECT
|
||||||
|
title, url, user_visible_url, last_viewed_time, session_data
|
||||||
|
FROM tabs
|
||||||
|
ORDER BY last_viewed_time;
|
||||||
"""
|
"""
|
||||||
SELECT
|
)
|
||||||
title, url, user_visible_url, last_viewed_time, session_data
|
except sqlite3.OperationalError as e:
|
||||||
FROM tabs
|
self.log.error(f"Error executing query: {e}")
|
||||||
ORDER BY last_viewed_time;
|
|
||||||
"""
|
|
||||||
)
|
|
||||||
|
|
||||||
for row in cur:
|
for row in cur:
|
||||||
session_entries = []
|
session_entries = []
|
||||||
|
|||||||
@@ -116,13 +116,16 @@ class TCC(IOSExtraction):
|
|||||||
)
|
)
|
||||||
db_version = "v2"
|
db_version = "v2"
|
||||||
except sqlite3.OperationalError:
|
except sqlite3.OperationalError:
|
||||||
cur.execute(
|
try:
|
||||||
"""SELECT
|
cur.execute(
|
||||||
service, client, client_type, allowed,
|
"""SELECT
|
||||||
prompt_count
|
service, client, client_type, allowed,
|
||||||
FROM access;"""
|
prompt_count
|
||||||
)
|
FROM access;"""
|
||||||
db_version = "v1"
|
)
|
||||||
|
db_version = "v1"
|
||||||
|
except sqlite3.OperationalError as e:
|
||||||
|
self.log.error(f"Error parsing TCC database: {e}")
|
||||||
|
|
||||||
for row in cur:
|
for row in cur:
|
||||||
service = row[0]
|
service = row[0]
|
||||||
|
|||||||
@@ -1,9 +0,0 @@
|
|||||||
requests>=2.31.0
|
|
||||||
pytest>=7.4.3
|
|
||||||
pytest-cov>=4.1.0
|
|
||||||
pytest-github-actions-annotate-failures>=0.2.0
|
|
||||||
pytest-mock>=3.14.0
|
|
||||||
stix2>=3.0.1
|
|
||||||
ruff>=0.1.6
|
|
||||||
mypy>=1.7.1
|
|
||||||
betterproto[compiler]
|
|
||||||
@@ -64,4 +64,4 @@ class TestTombstoneCrashArtifact:
|
|||||||
# We often don't know the time offset for a log entry and so can't convert everything to UTC.
|
# We often don't know the time offset for a log entry and so can't convert everything to UTC.
|
||||||
# MVT should output the local time only:
|
# MVT should output the local time only:
|
||||||
# So original 2023-04-12 12:32:40.518290770+0200 -> 2023-04-12 12:32:40.000000
|
# So original 2023-04-12 12:32:40.518290770+0200 -> 2023-04-12 12:32:40.000000
|
||||||
assert tombstone_result.get("timestamp") == "2023-04-12 12:32:40.000000"
|
assert tombstone_result.get("timestamp") == "2023-04-12 12:32:40.518290"
|
||||||
|
|||||||
@@ -9,6 +9,7 @@ from pathlib import Path
|
|||||||
from mvt.android.modules.bugreport.appops import Appops
|
from mvt.android.modules.bugreport.appops import Appops
|
||||||
from mvt.android.modules.bugreport.getprop import Getprop
|
from mvt.android.modules.bugreport.getprop import Getprop
|
||||||
from mvt.android.modules.bugreport.packages import Packages
|
from mvt.android.modules.bugreport.packages import Packages
|
||||||
|
from mvt.android.modules.bugreport.tombstones import Tombstones
|
||||||
from mvt.common.module import run_module
|
from mvt.common.module import run_module
|
||||||
|
|
||||||
from ..utils import get_artifact_folder
|
from ..utils import get_artifact_folder
|
||||||
@@ -54,3 +55,8 @@ class TestBugreportAnalysis:
|
|||||||
def test_getprop_module(self):
|
def test_getprop_module(self):
|
||||||
m = self.launch_bug_report_module(Getprop)
|
m = self.launch_bug_report_module(Getprop)
|
||||||
assert len(m.results) == 0
|
assert len(m.results) == 0
|
||||||
|
|
||||||
|
def test_tombstones_modules(self):
|
||||||
|
m = self.launch_bug_report_module(Tombstones)
|
||||||
|
assert len(m.results) == 2
|
||||||
|
assert m.results[1]["pid"] == 3559
|
||||||
|
|||||||
@@ -0,0 +1,27 @@
|
|||||||
|
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
||||||
|
Build fingerprint: 'samsung/a10eea/a10:10/.190711.020/A105:user/release-keys'
|
||||||
|
Revision: '5'
|
||||||
|
ABI: 'arm'
|
||||||
|
Timestamp: 2021-09-29 17:43:49+0200
|
||||||
|
pid: 9850, tid: 9893, name: UsbFfs-worker >>> /system/bin/adbd <<<
|
||||||
|
uid: 2000
|
||||||
|
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
|
||||||
|
Abort message: 'Check failed: payload.size() <= bytes_left (payload.size()=99, bytes_left=51) '
|
||||||
|
r0 00000000 r1 000026a5 r2 00000006 r3 f11fad98
|
||||||
|
r4 f11fadac r5 f11fad90 r6 0000267a r7 0000016b
|
||||||
|
r8 f11fada8 r9 f11fad98 r10 f11fadc8 r11 f11fadb8
|
||||||
|
ip 000026a5 sp f11fad68 lr f20c23b7 pc f20c23ca
|
||||||
|
|
||||||
|
backtrace:
|
||||||
|
#00 pc 000603ca /apex/com.android.runtime/lib/bionic/libc.so (abort+166) (BuildId: 320fbdc2a1289fadd7dacae7f2eb77a3)
|
||||||
|
#01 pc 00007e23 /system/lib/libbase.so (android::base::DefaultAborter(char const*)+6) (BuildId: a28585ee446ea17e3e6fcf9c907fff2a)
|
||||||
|
#02 pc 0000855f /system/lib/libbase.so (android::base::LogMessage::~LogMessage()+406) (BuildId: a28585ee446ea17e3e6fcf9c907fff2a)
|
||||||
|
#03 pc 000309cf /system/lib/libadbd.so (UsbFfsConnection::ProcessRead(IoBlock*)+814) (BuildId: 3645b175977ae210c156a57b25dfa599)
|
||||||
|
#04 pc 00030459 /system/lib/libadbd.so (UsbFfsConnection::HandleRead(TransferId, long long)+84) (BuildId: 3645b175977ae210c156a57b25dfa599)
|
||||||
|
#05 pc 00030349 /system/lib/libadbd.so (UsbFfsConnection::ReadEvents()+92) (BuildId: 3645b175977ae210c156a57b25dfa599)
|
||||||
|
#06 pc 00030169 /system/lib/libadbd.so (_ZZN16UsbFfsConnection11StartWorkerEvENKUlvE_clEv+504) (BuildId: 3645b175977ae210c156a57b25dfa599)
|
||||||
|
#07 pc 0002ff53 /system/lib/libadbd.so (_ZNSt3__114__thread_proxyINS_5tupleIJNS_10unique_ptrINS_15__thread_structENS_14default_deleteIS3_EEEEZN16UsbFfsConnection11StartWorkerEvEUlvE_EEEEEPvSA_+26) (BuildId: 3645b175977ae210c156a57b25dfa599)
|
||||||
|
#08 pc 000a75b3 /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+20) (BuildId: 320fbdc2a1289fadd7dacae7f2eb77a3)
|
||||||
|
#09 pc 00061b33 /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30) (BuildId: 320fbdc2a1289fadd7dacae7f2eb77a3)
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
||||||
|
Build fingerprint: 'samsung/a10eea/a10:11/RP1A.200720.012/A105:user/release-keys'
|
||||||
|
Revision: '5'
|
||||||
|
ABI: 'arm'
|
||||||
|
Timestamp: 2023-08-21 23:28:59-0400
|
||||||
|
pid: 3559, tid: 3568, name: tzts_daemon >>> /vendor/bin/tzts_daemon <<<
|
||||||
|
uid: 1000
|
||||||
|
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xe8b4d14c
|
||||||
|
r0 e8b4d14c r1 e8b4d14c r2 0000002b r3 00000004
|
||||||
|
r4 00000000 r5 e8b4d14c r6 00000000 r7 00000000
|
||||||
|
r8 e7ef78b0 r9 0000002b r10 e7ef7dad r11 e7ef7400
|
||||||
|
ip 00000000 sp e7ef7208 lr e89f4b01 pc e89c273a
|
||||||
|
|
||||||
|
backtrace:
|
||||||
|
#00 pc 0005f73a /apex/com.android.runtime/lib/bionic/libc.so (strlen_a15+54) (BuildId: fef5b751123147ea65bf3f4f798c9518)
|
||||||
|
#01 pc 00091afd /apex/com.android.runtime/lib/bionic/libc.so (__vfprintf+3364) (BuildId: fef5b751123147ea65bf3f4f798c9518)
|
||||||
|
#02 pc 000a68e5 /apex/com.android.runtime/lib/bionic/libc.so (vsnprintf+152) (BuildId: fef5b751123147ea65bf3f4f798c9518)
|
||||||
|
#03 pc 000051cf /system/lib/liblog.so (__android_log_vprint+74) (BuildId: 3fcead474cd0ecbdafb529ff176b0d13)
|
||||||
|
#04 pc 000012e8 /vendor/bin/tzts_daemon
|
||||||
|
|
||||||
|
memory near r0:
|
||||||
|
e8b4d12c -------- -------- -------- -------- ................
|
||||||
|
e8b4d13c -------- -------- -------- -------- ................
|
||||||
|
e8b4d14c -------- -------- -------- -------- ................
|
||||||
|
e8b4d15c -------- -------- -------- -------- ................
|
||||||
|
e8b4d16c -------- -------- -------- -------- ................
|
||||||
|
e8b4d17c -------- -------- -------- -------- ................
|
||||||
|
e8b4d18c -------- -------- -------- -------- ................
|
||||||
|
e8b4d19c -------- -------- -------- -------- ................
|
||||||
|
e8b4d1ac -------- -------- -------- -------- ................
|
||||||
|
e8b4d1bc -------- -------- -------- -------- ................
|
||||||
|
e8b4d1cc -------- -------- -------- -------- ................
|
||||||
|
e8b4d1dc -------- -------- -------- -------- ................
|
||||||
|
e8b4d1ec -------- -------- -------- -------- ................
|
||||||
|
e8b4d1fc -------- -------- -------- -------- ................
|
||||||
|
e8b4d20c -------- -------- -------- -------- ................
|
||||||
|
e8b4d21c -------- -------- -------- -------- ................
|
||||||
|
|
||||||
Reference in New Issue
Block a user