First structure for mvt-ios check-usb

tests/ios_backup/test_backup_info.py

@@ -0,0 +1,20 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.module import run_module
+from mvt.ios.modules.backup.backup_info import BackupInfo
+
+from ..utils import get_ios_backup_folder
+
+
+class TestBackupInfoModule:
+
+    def test_manifest(self):
+        m = BackupInfo(target_path=get_ios_backup_folder(), log=logging)
+        run_module(m)
+        assert m.results["Build Version"] == "18C66"
+        assert m.results["IMEI"] == "42"

tests/ios_backup/test_datausage.py

@@ -0,0 +1,32 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.indicators import Indicators
+from mvt.common.module import run_module
+from mvt.ios.modules.mixed.net_datausage import Datausage
+
+from ..utils import get_ios_backup_folder
+
+
+class TestDatausageModule:
+
+    def test_datausage(self):
+        m = Datausage(target_path=get_ios_backup_folder(), log=logging, results=[])
+        run_module(m)
+        assert len(m.results) == 42
+        assert len(m.timeline) == 60
+        assert len(m.detected) == 0
+
+    def test_detection(self, indicator_file):
+        m = Datausage(target_path=get_ios_backup_folder(), log=logging, results=[])
+        ind = Indicators(log=logging)
+        ind.parse_stix2(indicator_file)
+        # Adds a file that exists in the manifest.
+        ind.ioc_collections[0]["processes"].append("CumulativeUsageTracker")
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 2

tests/ios_backup/test_manifest.py

@@ -0,0 +1,31 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.indicators import Indicators
+from mvt.common.module import run_module
+from mvt.ios.modules.backup.manifest import Manifest
+
+from ..utils import get_ios_backup_folder
+
+
+class TestManifestModule:
+
+    def test_manifest(self):
+        m = Manifest(target_path=get_ios_backup_folder(), log=logging, results=[])
+        run_module(m)
+        assert len(m.results) == 3721
+        assert len(m.timeline) == 5881
+        assert len(m.detected) == 0
+
+    def test_detection(self, indicator_file):
+        m = Manifest(target_path=get_ios_backup_folder(), log=logging, results=[])
+        ind = Indicators(log=logging)
+        ind.parse_stix2(indicator_file)
+        ind.ioc_collections[0]["file_names"].append("com.apple.CoreBrightness.plist")
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 1

tests/ios_backup/test_safari_browserstate.py

@@ -0,0 +1,37 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.indicators import Indicators
+from mvt.common.module import run_module
+from mvt.ios.modules.mixed.safari_browserstate import SafariBrowserState
+
+from ..utils import get_ios_backup_folder
+
+
+class TestSafariBrowserStateModule:
+
+    def test_parsing(self):
+        m = SafariBrowserState(target_path=get_ios_backup_folder(), log=logging, results=[])
+        m.is_backup = True
+        run_module(m)
+        assert m.file_path is not None
+        assert len(m.results) == 1
+        assert len(m.timeline) == 1
+        assert len(m.detected) == 0
+
+    def test_detection(self, indicator_file):
+        m = SafariBrowserState(target_path=get_ios_backup_folder(), log=logging, results=[])
+        m.is_backup = True
+        ind = Indicators(log=logging)
+        ind.parse_stix2(indicator_file)
+        # Adds a file that exists in the manifest.
+        ind.ioc_collections[0]["domains"].append("en.wikipedia.org")
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 1
+        assert len(m.results) == 1
+        assert m.results[0]["tab_url"] == "https://en.wikipedia.org/wiki/NSO_Group"

tests/ios_backup/test_sms.py

@@ -0,0 +1,32 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.indicators import Indicators
+from mvt.common.module import run_module
+from mvt.ios.modules.mixed.sms import SMS
+
+from ..utils import get_ios_backup_folder
+
+
+class TestSMSModule:
+
+    def test_sms(self):
+        m = SMS(target_path=get_ios_backup_folder(), log=logging, results=[])
+        run_module(m)
+        assert len(m.results) == 1
+        assert len(m.timeline) == 1
+        assert len(m.detected) == 0
+
+    def test_detection(self, indicator_file):
+        m = SMS(target_path=get_ios_backup_folder(), log=logging, results=[])
+        ind = Indicators(log=logging)
+        ind.parse_stix2(indicator_file)
+        # Adds a file that exists in the manifest.
+        ind.ioc_collections[0]["domains"].append("badbadbad.example.org")
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 1

tests/ios_backup/test_tcc.py

@@ -0,0 +1,37 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.indicators import Indicators
+from mvt.common.module import run_module
+from mvt.ios.modules.mixed.tcc import TCC
+
+from ..utils import get_ios_backup_folder
+
+
+class TestTCCtModule:
+
+    def test_tcc(self):
+        m = TCC(target_path=get_ios_backup_folder(), log=logging, results=[])
+        run_module(m)
+        assert len(m.results) == 11
+        assert len(m.timeline) == 11
+        assert len(m.detected) == 0
+        assert m.results[0]["service"] == "kTCCServiceUbiquity"
+        assert m.results[0]["client"] == "com.apple.Preferences"
+        assert m.results[0]["auth_value"] == "allowed"
+
+    def test_tcc_detection(self, indicator_file):
+        m = TCC(target_path=get_ios_backup_folder(), log=logging, results=[])
+        ind = Indicators(log=logging)
+        ind.parse_stix2(indicator_file)
+        m.indicators = ind
+        run_module(m)
+        assert len(m.results) == 11
+        assert len(m.timeline) == 11
+        assert len(m.detected) == 1
+        assert m.detected[0]["service"] == "kTCCServiceLiverpool"
+        assert m.detected[0]["client"] == "Launch"