First test structure

tests/ios/test_backup_info.py

@@ -0,0 +1,20 @@
+import pytest
+import logging
+import os
+from ..utils import get_artifact, get_artifact_folder, init_setup
+from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.ios.modules.backup.backup_info import BackupInfo
+from mvt.common.module import run_module
+
+
+class TestBackupInfoModule:
+    @pytest.fixture(scope="session", autouse=True)
+    def set(self):
+        init_setup()
+
+    def test_manifest(self):
+        m = BackupInfo(base_folder=get_artifact_folder(), log=logging)
+        run_module(m)
+        assert m.results["Build Version"] == "18C66"
+        assert m.results["IMEI"] == '42'
+

tests/ios/test_datausage.py

@@ -0,0 +1,32 @@
+import pytest
+import logging
+import os
+from ..utils import get_artifact, get_artifact_folder, init_setup
+from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.ios.modules.mixed.net_datausage import Datausage
+from mvt.common.module import run_module
+
+
+class TestDatausageModule:
+    @pytest.fixture(scope="session", autouse=True)
+    def set(self):
+        init_setup()
+
+    def test_datausage(self):
+        m = Datausage(base_folder=get_artifact_folder(), log=logging)
+        run_module(m)
+        assert len(m.results) == 42
+        assert len(m.timeline) == 60
+        assert len(m.detected) == 0
+
+    def test_detection(self):
+        m = Datausage(base_folder=get_artifact_folder(), log=logging)
+        ind = Indicators(log=logging)
+        ind.parse_stix2(get_artifact("test.stix2"))
+        # Adds a file that exists in the manifest
+        ind.ioc_processes[0] = "CumulativeUsageTracker"
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 4
+
+

tests/ios/test_manifest.py

@@ -0,0 +1,32 @@
+import pytest
+import logging
+import os
+from ..utils import get_artifact, get_artifact_folder, init_setup
+from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.ios.modules.backup.manifest import Manifest
+from mvt.common.module import run_module
+
+
+class TestManifestModule:
+    @pytest.fixture(scope="session", autouse=True)
+    def set(self):
+        init_setup()
+
+    def test_manifest(self):
+        m = Manifest(base_folder=get_artifact_folder(), log=logging)
+        run_module(m)
+        assert len(m.results) == 3721
+        assert len(m.timeline) == 5881
+        assert len(m.detected) == 0
+
+    def test_detection(self):
+        m = Manifest(base_folder=get_artifact_folder(), log=logging)
+        ind = Indicators(log=logging)
+        ind.parse_stix2(get_artifact("test.stix2"))
+        # Adds a file that exists in the manifest
+        ind.ioc_files[0] = "com.apple.CoreBrightness.plist"
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 2
+
+

tests/ios/test_tcc.py

@@ -0,0 +1,23 @@
+import pytest
+import logging
+import os
+from ..utils import get_artifact_folder, init_setup
+from mvt.ios.modules.mixed.tcc import TCC
+from mvt.common.module import run_module
+
+
+class TestManifestModule:
+    @pytest.fixture(scope="session", autouse=True)
+    def set(self):
+        init_setup()
+
+    def test_manifest(self):
+        m = TCC(base_folder=get_artifact_folder(), log=logging)
+        run_module(m)
+        assert len(m.results) == 11
+        # FIXME: TCC should suport timeline
+        assert len(m.timeline) == 0
+        assert len(m.detected) == 0
+        assert m.results[0]["service"] == "kTCCServiceUbiquity"
+        assert m.results[0]["auth_value"] == "allowed"
+