Bumped version

Update docker.md

.github/workflows/python-package.yml

@@ -16,7 +16,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: [3.7, 3.8, 3.9]
+        # python-version: [3.7, 3.8, 3.9]
+        python-version: [3.8, 3.9]
 
     steps:
     - uses: actions/checkout@v2
@@ -27,8 +28,9 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        python -m pip install flake8 pytest safety
+        python -m pip install flake8 pytest safety stix2
         if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+        python -m pip install .
     - name: Lint with flake8
       run: |
         # stop the build if there are Python syntax errors or undefined names
@@ -37,7 +39,5 @@ jobs:
         flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
     - name: Safety checks
       run: safety check
-
-    # - name: Test with pytest
-    #   run: |
-    #     pytest
+    - name: Test with pytest
+      run: pytest

.gitignore

@@ -131,3 +131,6 @@ dmypy.json
 
 # Temporal files
 *~
+
+# IDEA Dev Environment
+.idea

Dockerfile

@@ -38,12 +38,15 @@ RUN apt update \
 # Build libimobiledevice
 # ----------------------
 RUN git clone https://github.com/libimobiledevice/libplist \
+  && git clone https://github.com/libimobiledevice/libimobiledevice-glue \
   && git clone https://github.com/libimobiledevice/libusbmuxd \
   && git clone https://github.com/libimobiledevice/libimobiledevice \
   && git clone https://github.com/libimobiledevice/usbmuxd \
 
   && cd libplist && ./autogen.sh && make && make install && ldconfig \
 
+  && cd ../libimobiledevice-glue && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr && make && make install && ldconfig \
+
   && cd ../libusbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh && make && make install && ldconfig \
 
   && cd ../libimobiledevice && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --enable-debug && make && make install && ldconfig \
@@ -51,7 +54,7 @@ RUN git clone https://github.com/libimobiledevice/libplist \
   && cd ../usbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make && make install \
 
   # Clean up.
-  && cd .. && rm -rf libplist libusbmuxd libimobiledevice usbmuxd
+  && cd .. && rm -rf libplist libimobiledevice-glue libusbmuxd libimobiledevice usbmuxd
 
 # Installing MVT
 # --------------

README.md

@@ -15,15 +15,15 @@ It has been developed and released by the [Amnesty International Security Lab](h
 
 ## Installation
 
-MVT can be installed from sources or from [PyPi](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install.html)):
+MVT can be installed from sources or from [PyPi](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
 
 ```
 pip3 install mvt
 ```
 
-Alternatively, you can decide to run MVT and all relevant tools through a [Docker container](https://docs.mvt.re/en/latest/docker.html).
+Alternatively, you can decide to run MVT and all relevant tools through a [Docker container](https://docs.mvt.re/en/latest/docker/).
 
-**Please note:** MVT is best run on Linux or Mac systems. [It does not currently support running natively on Windows.](https://docs.mvt.re/en/latest/install.html#mvt-on-windows)
+**Please note:** MVT is best run on Linux or Mac systems. [It does not currently support running natively on Windows.](https://docs.mvt.re/en/latest/install/#mvt-on-windows)
 
 ## Usage
 
@@ -31,4 +31,4 @@ MVT provides two commands `mvt-ios` and `mvt-android`. [Check out the documentat
 
 ## License
 
-The purpose of MVT is to facilitate the ***consensual forensic analysis*** of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals.  In order to achieve this, MVT is released under its own license. [Read more here.](https://docs.mvt.re/en/latest/license.html)
+The purpose of MVT is to facilitate the ***consensual forensic analysis*** of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals.  In order to achieve this, MVT is released under its own license. [Read more here.](https://docs.mvt.re/en/latest/license/)

dev/mvt-android

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

dev/mvt-ios

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

docs/android/backup.md

@@ -22,7 +22,7 @@ adb backup -all
 
 ## Unpack the backup
 
-In order to reliable unpack th [Android Backup Extractor (ABE)](https://github.com/nelenkov/android-backup-extractor) to convert it to a readable file format. Make sure that java is installed on your system and use the following command:
+In order to unpack the backup, use [Android Backup Extractor (ABE)](https://github.com/nelenkov/android-backup-extractor) to convert it to a readable file format. Make sure that java is installed on your system and use the following command:
 
 ```bash
 java -jar ~/path/to/abe.jar unpack backup.ab backup.tar
@@ -31,6 +31,8 @@ tar xvf backup.tar
 
 If the backup is encrypted, ABE will prompt you to enter the password.
 
+Alternatively, [ab-decrypt](https://github.com/joernheissler/ab-decrypt) can be used for that purpose.
+
 ## Check the backup
 
 You can then extract SMSs containing links with MVT:

docs/android/methodology.md

@@ -8,7 +8,7 @@ However, not all is lost.
 
 Because malware attacks over Android typically take the form of malicious or backdoored apps, the very first thing you might want to do is to extract and verify all installed Android packages and triage quickly if there are any which stand out as malicious or which might be atypical.
 
-While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly lookup services such as [VirusTotal](https://www.virustotal.com) or [Koodous](https://www.koodous.com) which might quickly indicate known bad apps.
+While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly lookup services such as [VirusTotal](https://www.virustotal.com) or [Koodous](https://koodous.com) which might quickly indicate known bad apps.
 
 
 ## Check the device over Android Debug Bridge

docs/docker.md

@@ -10,6 +10,11 @@ cd mvt
 docker build -t mvt .
 ```
 
+Optionally, you may need to specify your platform to Docker in order to build successfully (Apple M1)
+```bash
+docker build --platform amd64 -t mvt .
+```
+
 Test if the image was created successfully:
 
 ```bash

docs/iocs.md

@@ -28,9 +28,19 @@ The `--iocs` option can be invoked multiple times to let MVT import multiple STI
 mvt-ios check-backup --iocs ~/iocs/malware1.stix --iocs ~/iocs/malware2.stix2 /path/to/backup
 ```
 
+It is also possible to load STIX2 files automatically from the environment variable `MVT_STIX2`:
+
+```bash
+export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
+```
+
 ## Known repositories of STIX2 IOCs
 
 - The [Amnesty International investigations repository](https://github.com/AmnestyTech/investigations) contains STIX-formatted IOCs for:
     - [Pegasus](https://en.wikipedia.org/wiki/Pegasus_(spyware)) ([STIX2](https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/pegasus.stix2))
+    - [Predator from Cytrox](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/) ([STIX2](https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-12-16_cytrox/cytrox.stix2))
+- [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/stalkerware.stix2).
+
+You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators listed [here](https://github.com/mvt-project/mvt/blob/main/public_indicators.json) and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by mvt.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.

docs/ios/install.md

@@ -1,6 +1,6 @@
 # Install libimobiledevice
 
-Before proceeding with doing any acquisition of iOS devices we recommend installing [libimobiledevice](https://www.libimobiledevice.org/) utilities. These utilities will become useful when extracting crash logs and generating iTunes backups. Because the utilities and its libraries are subject to frequent changes in response to new versions of iOS, you might want to consider compiling libimobiledevice utilities from sources. Otherwise, if available, you can try installing packages available in your distribution:
+Before proceeding with doing any acquisition of iOS devices we recommend installing [libimobiledevice](https://libimobiledevice.org/) utilities. These utilities will become useful when extracting crash logs and generating iTunes backups. Because the utilities and its libraries are subject to frequent changes in response to new versions of iOS, you might want to consider compiling libimobiledevice utilities from sources. Otherwise, if available, you can try installing packages available in your distribution:
 
 ```bash
 sudo apt install libimobiledevice-utils

docs/ios/records.md

@@ -4,10 +4,22 @@ In this page you can find a (reasonably) up-to-date breakdown of the files creat
 
 ## Records extracted by `check-fs` or `check-backup`
 
+### `analytics.json`
+
+!!! info "Availability"
+    Backup (if encrypted): :material-close:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `Analytics` module. The module extracts records from the plists inside the SQLite databases located at *private/var/Keychains/Analytics/\*.db*, which contain various analytics information regarding networking, certificate-pinning, TLS, etc. failures.
+
+If indicators are provided through the command-line, processes and domains are checked against all fields of the plist. Any matches are stored in *analytics_detected.json*.
+
+---
+
 ### `backup_info.json`
 
 !!! info "Availabiliy"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-close:
 
 This JSON file is created by mvt-ios' `BackupInfo` module. The module extracts some details about the backup and the device, such as name, phone number, IMEI, product type and version.
@@ -17,7 +29,7 @@ This JSON file is created by mvt-ios' `BackupInfo` module. The module extracts s
 ### `cache_files.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `CacheFiles` module. The module extracts records from all SQLite database files stored on disk with the name *Cache.db*. These databases typically contain data from iOS' [internal URL caching](https://developer.apple.com/documentation/foundation/nsurlcache). Through this module you might be able to recover records of HTTP requests and responses performed my applications as well as system services, that would otherwise be unavailable. For example, you might see HTTP requests part of an exploitation chain performed by an iOS service attempting to download a first stage malicious payload.
@@ -29,7 +41,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `calls.json`
 
 !!! info "Availability"
-    Backup (if encrypted): :material-check:  
+    Backup (if encrypted): :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `Calls` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/CallHistoryDB/CallHistory.storedata*, which contains records of incoming and outgoing calls, including from messaging apps such as WhatsApp or Skype.
@@ -39,7 +51,7 @@ This JSON file is created by mvt-ios' `Calls` module. The module extracts record
 ### `chrome_favicon.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `ChromeFavicon` module. The module extracts records from a SQLite database located at */private/var/mobile/Containers/Data/Application/\*/Library/Application Support/Google/Chrome/Default/Favicons*, which contains a mapping of favicons' URLs and the visited URLs which loaded them.
@@ -51,29 +63,31 @@ If indicators are provided through the command-line, they are checked against bo
 ### `chrome_history.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `ChromeHistory` module. The module extracts records from a SQLite database located at */private/var/mobile/Containers/Data/Application/\*/Library/Application Support/Google/Chrome/Default/History*, which contains a history of URL visits.
 
-If indicators a provided through the command-line, they are checked against the visited URL. Any matches are stored in *chrome_history_detected.json*.
+If indicators are provided through the command-line, they are checked against the visited URL. Any matches are stored in *chrome_history_detected.json*.
 
 ---
 
 ### `configuration_profiles.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-close:
 
 This JSON file is created by mvt-ios' `ConfigurationProfiles` module. The module extracts details about iOS configuration profiles that have been installed on the device. These should include both default iOS as well as third-party profiles.
 
+If indicators are provided through the command-line, they are checked against the configuration profile UUID to identify any known malicious profiles. Any matches are stored in *configuration_profiles_detected.json*.
+
 ---
 
 ### `contacts.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `Contacts` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/AddressBook/AddressBook.sqlitedb*, which contains records from the phone's address book. While this database obviously would not contain any malicious indicators per se, you might want to use it to compare records from other apps (such as iMessage, SMS, etc.) to filter those originating from unknown origins.
@@ -83,7 +97,7 @@ This JSON file is created by mvt-ios' `Contacts` module. The module extracts rec
 ### `firefox_favicon.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `FirefoxFavicon` module. The module extracts records from a SQLite database located at */private/var/mobile/profile.profile/browser.db*, which contains a mapping of favicons' URLs and the visited URLs which loaded them.
@@ -95,19 +109,19 @@ If indicators are provided through the command-line, they are checked against bo
 ### `firefox_history.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `FirefoxHistory` module. The module extracts records from a SQLite database located at */private/var/mobile/profile.profile/browser.db*, which contains a history of URL visits.
 
-If indicators a provided through the command-line, they are checked against the visited URL. Any matches are stored in *firefox_history_detected.json*.
+If indicators are provided through the command-line, they are checked against the visited URL. Any matches are stored in *firefox_history_detected.json*.
 
 ---
 
 ### `id_status_cache.json`
 
 !!! info "Availability"
-    Backup (before iOS 14.7): :material-check:  
+    Backup (before iOS 14.7): :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `IDStatusCache` module. The module extracts records from a plist file located at */private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist*, which contains a cache of Apple user ID authentication. This chance will indicate when apps like Facetime and iMessage first established contacts with other registered Apple IDs. This is significant because it might contain traces of malicious accounts involved in exploitation of those apps.
@@ -116,10 +130,20 @@ Starting from iOS 14.7.0, this file is empty or absent.
 
 ---
 
+### `shortcuts.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `Shortcuts` module. The module extracts records from an SQLite database located at */private/var/mobile/Library/Shortcuts/Shortcuts.sqlite*, which contains records about the Shortcuts application. Shortcuts are a built-in iOS feature which allows users to automation certain actions on their device. In some cases the legitimate Shortcuts app may be abused by spyware to maintain persistence on an infected devices.
+
+---
+
 ### `interaction_c.json`
 
 !!! info "Availability"
-    Backup (if encrypted): :material-check:  
+    Backup (if encrypted): :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `InteractionC` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/CoreDuet/People/interactionC.db*, which contains details about user interactions with installed apps.
@@ -129,7 +153,7 @@ This JSON file is created by mvt-ios' `InteractionC` module. The module extracts
 ### `locationd_clients.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `LocationdClients` module. The module extracts records from a plist file located at */private/var/mobile/Library/Caches/locationd/clients.plist*, which contains a cache of apps which requested access to location services.
@@ -139,7 +163,7 @@ This JSON file is created by mvt-ios' `LocationdClients` module. The module extr
 ### `manifest.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-close:
 
 This JSON file is created by mvt-ios' `Manifest` module. The module extracts records from the SQLite database *Manifest.db* contained in iTunes backups, and which indexes the locally backed-up files to the original paths on the iOS device.
@@ -148,10 +172,22 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
+### `os_analytics_ad_daily.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `OSAnalyticsADDaily` module. The module extracts records from a plist located *private/var/mobile/Library/Preferences/com.apple.osanalytics.addaily.plist*, which contains a history of data usage by processes running on the system. Besides the network statistics, these records are particularly important because they might show traces of malicious process executions and the relevant timeframe.
+
+If indicators are provided through the command-line, they are checked against the process names. Any matches are stored in *os_analytics_ad_daily_detected.json*.
+
+---
+
 ### `datausage.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `Datausage` module. The module extracts records from a SQLite database located */private/var/wireless/Library/Databases/DataUsage.sqlite*, which contains a history of data usage by processes running on the system. Besides the network statistics, these records are particularly important because they might show traces of malicious process executions and the relevant timeframe. In particular, processes which do not have a valid bundle ID might require particular attention.
@@ -163,7 +199,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `netusage.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `Netusage` module. The module extracts records from a SQLite database located */private/var/networkd/netusage.sqlite*, which contains a history of data usage by processes running on the system. Besides the network statistics, these records are particularly important because they might show traces of malicious process executions and the relevant timeframe. In particular, processes which do not have a valid bundle ID might require particular attention.
@@ -175,7 +211,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `profile_events.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-close:
 
 This JSON file is created by mvt-ios' `ProfileEvents` module. The module extracts a timeline of configuration profile operations. For example, it should indicate when a new profile was installed from the Settings app, or when one was removed.
@@ -185,19 +221,19 @@ This JSON file is created by mvt-ios' `ProfileEvents` module. The module extract
 ### `safari_browser_state.json`
 
 !!! info "Availability"
-    Backup (if encrypted): :material-check:  
+    Backup (if encrypted): :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `SafariBrowserState` module. The module extracts records from the SQLite databases located at */private/var/mobile/Library/Safari/BrowserState.db* or */private/var/mobile/Containers/Data/Application/\*/Library/Safari/BrowserState.db*, which contain records of opened tabs.
 
-If indicators a provided through the command-line, they are checked against the visited URL. Any matches are stored in *safari_browser_state_detected.json*.
+If indicators are provided through the command-line, they are checked against the visited URL. Any matches are stored in *safari_browser_state_detected.json*.
 
 ---
 
 ### `safari_favicon.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `SafariFavicon` module. The module extracts records from the SQLite databases located at */private/var/mobile/Library/Image Cache/Favicons/Favicons.db* or */private/var/mobile/Containers/Data/Application/\*/Library/Image Cache/Favicons/Favicons.db*, which contain mappings of favicons' URLs and the visited URLs which loaded them.
@@ -209,7 +245,7 @@ If indicators are provided through the command-line, they are checked against bo
 ### `safari_history.json`
 
 !!! info "Availability"
-    Backup (if encrypted): :material-check:  
+    Backup (if encrypted): :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `SafariHistory` module. The module extracts records from the SQLite databases located at */private/var/mobile/Library/Safari/History.db* or */private/var/mobile/Containers/Data/Application/\*/Library/Safari/History.db*, which contain a history of URL visits.
@@ -218,10 +254,22 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
+### `shutdown_log.json`
+
+!!! info "Availability"
+    Backup (if encrypted): :material-close:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `ShutdownLog` module. The module extracts records from the shutdown log located at *private/var/db/diagnostics/shutdown.log*. When shutting down an iPhone, a SIGTERM will be sent to all processes runnning. The `shutdown.log` file will log any process (with its pid and path) that did not shut down after the SIGTERM was sent.
+
+If indicators are provided through the command-line, they are checked against the paths. Any matches are stored in *shutdown_log_detected.json*.
+
+---
+
 ### `sms.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `SMS` module. The module extracts a list of SMS messages containing HTTP links from the SQLite database located at */private/var/mobile/Library/SMS/sms.db*.
@@ -233,17 +281,27 @@ If indicators are provided through the command-line, they are checked against th
 ### `sms_attachments.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `SMSAttachments` module. The module extracts details about attachments sent via SMS or iMessage from the same database used by the `SMS` module. These records might be useful to indicate unique patterns that might be indicative of exploitation attempts leveraging potential vulnerabilities in file format parsers or other forms of file handling by the Messages app.
 
 ---
 
+### `tcc.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `TCC` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/TCC/TCC.db*, which contains a list of which services such as microphone, camera, or location, apps have been granted or denied access to.
+
+---
+
 ### `version_history.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `IOSVersionHistory` module. The module extracts records of iOS software updates from analytics plist files located at */private/var/db/analyticsd/Analytics-Journal-\*.ips*.
@@ -253,7 +311,7 @@ This JSON file is created by mvt-ios' `IOSVersionHistory` module. The module ext
 ### `webkit_indexeddb.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `WebkitIndexedDB` module. The module extracts a list of file and folder names located at the following path */private/var/mobile/Containers/Data/Application/\*/Library/WebKit/WebsiteData/IndexedDB*, which contains IndexedDB files created by any app installed on the device.
@@ -265,7 +323,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `webkit_local_storage.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `WebkitLocalStorage` module. The module extracts a list of file and folder names located at the following path */private/var/mobile/Containers/Data/Application/\*/Library/WebKit/WebsiteData/LocalStorage/*, which contains local storage files created by any app installed on the device.
@@ -277,7 +335,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `webkit_resource_load_statistics.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios `WebkitResourceLoadStatistics` module. The module extracts records from available WebKit ResourceLoadStatistics *observations.db* SQLite3 databases. These records should indicate domain names contacted by apps, including a timestamp.
@@ -289,7 +347,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `webkit_safari_view_service.json`
 
 !!! info "Availability"
-    Backup: :material-close:  
+    Backup: :material-close:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `WebkitSafariViewService` module. The module extracts a list of file and folder names located at the following path */private/var/mobile/Containers/Data/Application/\*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/*, which contains files cached by SafariVewService.
@@ -301,7 +359,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `webkit_session_resource_log.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `WebkitSessionResourceLog` module. The module extracts records from plist files with the name *full_browsing_session_resourceLog.plist*, which contain records of resources loaded by different domains visited.
@@ -313,7 +371,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `whatsapp.json`
 
 !!! info "Availability"
-    Backup: :material-check:  
+    Backup: :material-check:
     Full filesystem dump: :material-check:
 
 This JSON file is created by mvt-ios' `WhatsApp` module. The module extracts a list of WhatsApp messages containing HTTP links from the SQLite database located at *private/var/mobile/Containers/Shared/AppGroup/\*/ChatStorage.sqlite*.

docs/requirements.txt

@@ -1,4 +1,4 @@
-mkdocs==1.2.1
+mkdocs==1.2.3
 mkdocs-autorefs
 mkdocs-material
 mkdocs-material-extensions

mvt/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/cli.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -9,8 +9,10 @@ import os
 import click
 from rich.logging import RichHandler
 
-from mvt.common.help import *
-from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.common.help import (HELP_MSG_FAST, HELP_MSG_IOC,
+                             HELP_MSG_LIST_MODULES, HELP_MSG_MODULE,
+                             HELP_MSG_OUTPUT, HELP_MSG_SERIAL)
+from mvt.common.indicators import Indicators, download_indicators_files
 from mvt.common.logo import logo
 from mvt.common.module import run_module, save_timeline
 
@@ -26,6 +28,7 @@ logging.basicConfig(level="INFO", format=LOG_FORMAT, handlers=[
     RichHandler(show_path=False, log_time_format="%X")])
 log = logging.getLogger(__name__)
 
+
 #==============================================================================
 # Main
 #==============================================================================
@@ -34,6 +37,14 @@ def cli():
     logo()
 
 
+#==============================================================================
+# Command: version
+#==============================================================================
+@cli.command("version", help="Show the currently installed version of MVT")
+def version():
+    return
+
+
 #==============================================================================
 # Download APKs
 #==============================================================================
@@ -96,10 +107,11 @@ def download_apks(ctx, all_apks, virustotal, koodous, all_checks, output, from_f
               default=[], help=HELP_MSG_IOC)
 @click.option("--output", "-o", type=click.Path(exists=False),
               help=HELP_MSG_OUTPUT)
+@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
 @click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
 @click.option("--module", "-m", help=HELP_MSG_MODULE)
 @click.pass_context
-def check_adb(ctx, iocs, output, list_modules, module, serial):
+def check_adb(ctx, iocs, output, fast, list_modules, module, serial):
     if list_modules:
         log.info("Following is the list of available check-adb modules:")
         for adb_module in ADB_MODULES:
@@ -117,13 +129,7 @@ def check_adb(ctx, iocs, output, list_modules, module, serial):
             ctx.exit(1)
 
     indicators = Indicators(log=log)
-    for ioc_path in iocs:
-        try:
-            indicators.parse_stix2(ioc_path)
-        except IndicatorsFileBadFormat as e:
-            log.critical(e)
-            ctx.exit(1)
-    log.info("Loaded a total of %d indicators", indicators.ioc_count)
+    indicators.load_indicators_files(iocs)
 
     timeline = []
     timeline_detected = []
@@ -131,14 +137,14 @@ def check_adb(ctx, iocs, output, list_modules, module, serial):
         if module and adb_module.__name__ != module:
             continue
 
-        m = adb_module(output_folder=output, log=logging.getLogger(adb_module.__module__))
+        m = adb_module(output_folder=output, fast_mode=fast,
+                       log=logging.getLogger(adb_module.__module__))
+        if indicators.total_ioc_count:
+            m.indicators = indicators
+            m.indicators.log = m.log
         if serial:
             m.serial = serial
 
-        if iocs:
-            indicators.log = m.log
-            m.indicators = indicators
-
         run_module(m)
         timeline.extend(m.timeline)
         timeline_detected.extend(m.timeline_detected)
@@ -171,31 +177,97 @@ def check_backup(ctx, iocs, output, backup_path, serial):
             ctx.exit(1)
 
     indicators = Indicators(log=log)
-    for ioc_path in iocs:
-        try:
-            indicators.parse_stix2(ioc_path)
-        except IndicatorsFileBadFormat as e:
-            log.critical(e)
-            ctx.exit(1)
-    log.info("Loaded a total of %d indicators", indicators.ioc_count)
+    indicators.load_indicators_files(iocs)
 
     if os.path.isfile(backup_path):
         log.critical("The path you specified is a not a folder!")
 
         if os.path.basename(backup_path) == "backup.ab":
-            log.info("You can use ABE (https://github.com/nelenkov/android-backup-extractor) " \
+            log.info("You can use ABE (https://github.com/nelenkov/android-backup-extractor) "
                      "to extract 'backup.ab' files!")
         ctx.exit(1)
 
     for module in BACKUP_MODULES:
         m = module(base_folder=backup_path, output_folder=output,
                    log=logging.getLogger(module.__module__))
-
+        if indicators.total_ioc_count:
+            m.indicators = indicators
+            m.indicators.log = m.log
         if serial:
             m.serial = serial
 
-        if iocs:
-            indicators.log = m.log
-            m.indicators = indicators
-
         run_module(m)
+
+
+#==============================================================================
+# Command: check-iocs
+#==============================================================================
+@cli.command("check-iocs", help="Compare stored JSON results to provided indicators")
+@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
+              default=[], help=HELP_MSG_IOC)
+@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
+@click.option("--module", "-m", help=HELP_MSG_MODULE)
+@click.argument("FOLDER", type=click.Path(exists=True))
+@click.pass_context
+def check_iocs(ctx, iocs, list_modules, module, folder):
+    all_modules = []
+    for entry in BACKUP_MODULES + ADB_MODULES:
+        if entry not in all_modules:
+            all_modules.append(entry)
+
+    if list_modules:
+        log.info("Following is the list of available check-iocs modules:")
+        for iocs_module in all_modules:
+            log.info(" - %s", iocs_module.__name__)
+
+        return
+
+    log.info("Checking stored results against provided indicators...")
+
+    indicators = Indicators(log=log)
+    indicators.load_indicators_files(iocs)
+
+    total_detections = 0
+    for file_name in os.listdir(folder):
+        name_only, ext = os.path.splitext(file_name)
+        file_path = os.path.join(folder, file_name)
+
+        # TODO: Skipping processing of result files that are not json.
+        #       We might want to revisit this eventually.
+        if ext != ".json":
+            continue
+
+        for iocs_module in all_modules:
+            if module and iocs_module.__name__ != module:
+                continue
+
+            if iocs_module().get_slug() != name_only:
+                continue
+
+            log.info("Loading results from \"%s\" with module %s", file_name,
+                     iocs_module.__name__)
+
+            m = iocs_module.from_json(file_path,
+                                      log=logging.getLogger(iocs_module.__module__))
+            if indicators.total_ioc_count > 0:
+                m.indicators = indicators
+                m.indicators.log = m.log
+
+            try:
+                m.check_indicators()
+            except NotImplementedError:
+                continue
+            else:
+                total_detections += len(m.detected)
+
+    if total_detections > 0:
+        log.warning("The check of the results produced %d detections!",
+                    total_detections)
+
+
+#==============================================================================
+# Command: download-iocs
+#==============================================================================
+@cli.command("download-iocs", help="Download public STIX2 indicators")
+def download_indicators():
+    download_indicators_files(log)

mvt/android/download_apks.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -7,17 +7,16 @@ import json
 import logging
 import os
 
-import pkg_resources
 from tqdm import tqdm
 
 from mvt.common.module import InsufficientPrivileges
-from mvt.common.utils import get_sha256_from_file_path
 
 from .modules.adb.base import AndroidExtraction
 from .modules.adb.packages import Packages
 
 log = logging.getLogger(__name__)
 
+
 # TODO: Would be better to replace tqdm with rich.progress to reduce
 #       the number of dependencies. Need to investigate whether
 #       it's possible to have a similar callback system.
@@ -32,7 +31,10 @@ class PullProgress(tqdm):
 
 class DownloadAPKs(AndroidExtraction):
     """DownloadAPKs is the main class operating the download of APKs
-    from the device."""
+    from the device.
+
+
+    """
 
     def __init__(self, output_folder=None, all_apks=False, log=None,
                  packages=None):
@@ -51,17 +53,21 @@ class DownloadAPKs(AndroidExtraction):
     @classmethod
     def from_json(cls, json_path):
         """Initialize this class from an existing apks.json file.
+
         :param json_path: Path to the apks.json file to parse.
+
         """
-        with open(json_path, "r") as handle:
+        with open(json_path, "r", encoding="utf-8") as handle:
             packages = json.load(handle)
             return cls(packages=packages)
 
     def pull_package_file(self, package_name, remote_path):
         """Pull files related to specific package from the device.
+
         :param package_name: Name of the package to download
         :param remote_path: Path to the file to download
         :returns: Path to the local copy
+
         """
         log.info("Downloading %s ...", remote_path)
 
@@ -101,6 +107,8 @@ class DownloadAPKs(AndroidExtraction):
     def get_packages(self):
         """Use the Packages adb module to retrieve the list of packages.
         We reuse the same extraction logic to then download the APKs.
+
+
         """
         self.log.info("Retrieving list of installed packages...")
 
@@ -111,8 +119,7 @@ class DownloadAPKs(AndroidExtraction):
         self.packages = m.results
 
     def pull_packages(self):
-        """Download all files of all selected packages from the device.
-        """
+        """Download all files of all selected packages from the device."""
         log.info("Starting extraction of installed APKs at folder %s", self.output_folder)
 
         if not os.path.exists(self.output_folder):
@@ -131,7 +138,7 @@ class DownloadAPKs(AndroidExtraction):
                     packages_selection.append(package)
 
             log.info("Selected only %d packages which are not marked as system",
-                len(packages_selection))
+                     len(packages_selection))
 
         if len(packages_selection) == 0:
             log.info("No packages were selected for download")
@@ -150,50 +157,27 @@ class DownloadAPKs(AndroidExtraction):
             log.info("[%d/%d] Package: %s", counter, len(packages_selection),
                      package["package_name"])
 
-            # Get the file path for the specific package.
-            try:
-                output = self._adb_command(f"pm path {package['package_name']}")
-                output = output.strip().replace("package:", "")
-                if not output:
-                    continue
-            except Exception as e:
-                log.exception("Failed to get path of package %s: %s",
-                              package["package_name"], e)
-                self._adb_reconnect()
-                continue
-
             # Sometimes the package path contains multiple lines for multiple apks.
             # We loop through each line and download each file.
-            for path in output.split("\n"):
-                device_path = path.strip()
-                file_path = self.pull_package_file(package["package_name"],
-                                                   device_path)
-                if not file_path:
+            for package_file in package["files"]:
+                device_path = package_file["path"]
+                local_path = self.pull_package_file(package["package_name"],
+                                                    device_path)
+                if not local_path:
                     continue
 
-                file_info = {
-                    "path": device_path,
-                    "local_name": file_path,
-                    "sha256": get_sha256_from_file_path(file_path),
-                }
-
-                if "files" not in package:
-                    package["files"] = [file_info,]
-                else:
-                    package["files"].append(file_info)
+                package_file["local_path"] = local_path
 
         log.info("Download of selected packages completed")
 
     def save_json(self):
-        """Save the results to the package.json file.
-        """
+        """Save the results to the package.json file."""
         json_path = os.path.join(self.output_folder, "apks.json")
-        with open(json_path, "w") as handle:
+        with open(json_path, "w", encoding="utf-8") as handle:
             json.dump(self.packages, handle, indent=4)
 
     def run(self):
-        """Run all steps of fetch-apk.
-        """
+        """Run all steps of fetch-apk."""
         self.get_packages()
         self._adb_connect()
         self.pull_packages()

mvt/android/lookups/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/lookups/koodous.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -13,6 +13,7 @@ from rich.text import Text
 
 log = logging.getLogger(__name__)
 
+
 def koodous_lookup(packages):
     log.info("Looking up all extracted files on Koodous (www.koodous.com)")
     log.info("This might take a while...")
@@ -32,7 +33,7 @@ def koodous_lookup(packages):
             res = requests.get(url)
             report = res.json()
 
-            row = [package["package_name"], file["local_name"]]
+            row = [package["package_name"], file["path"]]
 
             if "package_name" in report:
                 trusted = "no"

mvt/android/lookups/virustotal.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -13,6 +13,7 @@ from rich.text import Text
 
 log = logging.getLogger(__name__)
 
+
 def get_virustotal_report(hashes):
     apikey = "233f22e200ca5822bd91103043ccac138b910db79f29af5616a9afe8b6f215ad"
     url = f"https://www.virustotal.com/partners/sysinternals/file-reports?apikey={apikey}"
@@ -36,7 +37,12 @@ def get_virustotal_report(hashes):
         log.error("Unexpected response from VirusTotal: %s", res.status_code)
         return None
 
+
 def virustotal_lookup(packages):
+    # NOTE: This is temporary, until we resolved the issue.
+    log.error("Unfortunately VirusTotal lookup is disabled until further notice, due to unresolved issues with the API service.")
+    return
+
     log.info("Looking up all extracted files on VirusTotal (www.virustotal.com)")
 
     unique_hashes = []
@@ -48,6 +54,7 @@ def virustotal_lookup(packages):
     total_unique_hashes = len(unique_hashes)
 
     detections = {}
+
     def virustotal_query(batch):
         report = get_virustotal_report(batch)
         if not report:
@@ -75,7 +82,7 @@ def virustotal_lookup(packages):
 
     for package in packages:
         for file in package.get("files", []):
-            row = [package["package_name"], file["local_name"]]
+            row = [package["package_name"], file["path"]]
 
             if file["sha256"] in detections:
                 detection = detections[file["sha256"]]

mvt/android/modules/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/modules/adb/__init__.py

@@ -1,23 +1,27 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 from .chrome_history import ChromeHistory
-from .dumpsys_batterystats import DumpsysBatterystats
+from .dumpsys_accessibility import DumpsysAccessibility
+from .dumpsys_activities import DumpsysActivities
+from .dumpsys_battery_daily import DumpsysBatteryDaily
+from .dumpsys_battery_history import DumpsysBatteryHistory
+from .dumpsys_dbinfo import DumpsysDBInfo
 from .dumpsys_full import DumpsysFull
-from .dumpsys_packages import DumpsysPackages
-from .dumpsys_procstats import DumpsysProcstats
 from .dumpsys_receivers import DumpsysReceivers
 from .files import Files
+from .getprop import Getprop
 from .logcat import Logcat
 from .packages import Packages
 from .processes import Processes
-from .rootbinaries import RootBinaries
+from .root_binaries import RootBinaries
+from .settings import Settings
 from .sms import SMS
 from .whatsapp import Whatsapp
 
-ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes,
-               DumpsysBatterystats, DumpsysProcstats,
-               DumpsysPackages, DumpsysReceivers, DumpsysFull,
-               Packages, RootBinaries, Logcat, Files]
+ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes, Getprop, Settings,
+               DumpsysBatteryHistory, DumpsysBatteryDaily, DumpsysReceivers,
+               DumpsysActivities, DumpsysAccessibility, DumpsysDBInfo,
+               DumpsysFull, Packages, RootBinaries, Logcat, Files]

mvt/android/modules/adb/base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -15,7 +15,7 @@ from adb_shell.adb_device import AdbDeviceTcp, AdbDeviceUsb
 from adb_shell.auth.keygen import keygen, write_public_keyfile
 from adb_shell.auth.sign_pythonrsa import PythonRSASigner
 from adb_shell.exceptions import (AdbCommandFailureException, DeviceAuthError,
-                                  UsbReadFailedError)
+                                  UsbDeviceNotFoundError, UsbReadFailedError)
 from usb1 import USBErrorAccess, USBErrorBusy
 
 from mvt.common.module import InsufficientPrivileges, MVTModule
@@ -25,6 +25,7 @@ log = logging.getLogger(__name__)
 ADB_KEY_PATH = os.path.expanduser("~/.android/adbkey")
 ADB_PUB_KEY_PATH = os.path.expanduser("~/.android/adbkey.pub")
 
+
 class AndroidExtraction(MVTModule):
     """This class provides a base for all Android extraction modules."""
 
@@ -39,10 +40,9 @@ class AndroidExtraction(MVTModule):
 
     @staticmethod
     def _adb_check_keys():
-        """Make sure Android adb keys exist.
-        """
+        """Make sure Android adb keys exist."""
         if not os.path.isdir(os.path.dirname(ADB_KEY_PATH)):
-            os.path.makedirs(os.path.dirname(ADB_KEY_PATH))
+            os.makedirs(os.path.dirname(ADB_KEY_PATH))
 
         if not os.path.exists(ADB_KEY_PATH):
             keygen(ADB_KEY_PATH)
@@ -51,19 +51,25 @@ class AndroidExtraction(MVTModule):
             write_public_keyfile(ADB_KEY_PATH, ADB_PUB_KEY_PATH)
 
     def _adb_connect(self):
-        """Connect to the device over adb.
-        """
+        """Connect to the device over adb."""
         self._adb_check_keys()
 
         with open(ADB_KEY_PATH, "rb") as handle:
             priv_key = handle.read()
 
-        signer = PythonRSASigner("", priv_key)
+        with open(ADB_PUB_KEY_PATH, "rb") as handle:
+            pub_key = handle.read()
+
+        signer = PythonRSASigner(pub_key, priv_key)
 
         # If no serial was specified or if the serial does not seem to be
         # a HOST:PORT definition, we use the USB transport.
         if not self.serial or ":" not in self.serial:
-            self.device = AdbDeviceUsb(serial=self.serial)
+            try:
+                self.device = AdbDeviceUsb(serial=self.serial)
+            except UsbDeviceNotFoundError:
+                log.critical("No device found. Make sure it is connected and unlocked.")
+                sys.exit(-1)
         # Otherwise we try to use the TCP transport.
         else:
             addr = self.serial.split(":")
@@ -88,53 +94,59 @@ class AndroidExtraction(MVTModule):
             except OSError as e:
                 if e.errno == 113 and self.serial:
                     log.critical("Unable to connect to the device %s: did you specify the correct IP addres?",
-                              self.serial)
+                                 self.serial)
                     sys.exit(-1)
             else:
                 break
 
     def _adb_disconnect(self):
-        """Close adb connection to the device.
-        """
+        """Close adb connection to the device."""
         self.device.close()
 
     def _adb_reconnect(self):
-        """Reconnect to device using adb.
-        """
+        """Reconnect to device using adb."""
         log.info("Reconnecting ...")
         self._adb_disconnect()
         self._adb_connect()
 
     def _adb_command(self, command):
         """Execute an adb shell command.
+
         :param command: Shell command to execute
         :returns: Output of command
+
         """
-        return self.device.shell(command)
+        return self.device.shell(command, read_timeout_s=200.0)
 
     def _adb_check_if_root(self):
         """Check if we have a `su` binary on the Android device.
+
+
         :returns: Boolean indicating whether a `su` binary is present or not
+
         """
         return bool(self._adb_command("command -v su"))
 
     def _adb_root_or_die(self):
-        """Check if we have a `su` binary, otherwise raise an Exception.
-        """
+        """Check if we have a `su` binary, otherwise raise an Exception."""
         if not self._adb_check_if_root():
             raise InsufficientPrivileges("This module is optionally available in case the device is already rooted. Do NOT root your own device!")
 
     def _adb_command_as_root(self, command):
         """Execute an adb shell command.
+
         :param command: Shell command to execute as root
         :returns: Output of command
+
         """
         return self._adb_command(f"su -c {command}")
-    
+
     def _adb_check_file_exists(self, file):
         """Verify that a file exists.
+
         :param file: Path of the file
         :returns: Boolean indicating whether the file exists or not
+
         """
 
         # TODO: Need to support checking files without root privileges as well.
@@ -148,9 +160,12 @@ class AndroidExtraction(MVTModule):
 
     def _adb_download(self, remote_path, local_path, progress_callback=None, retry_root=True):
         """Download a file form the device.
+
         :param remote_path: Path to download from the device
         :param local_path: Path to where to locally store the copy of the file
-        :param progress_callback: Callback for download progress bar
+        :param progress_callback: Callback for download progress bar (Default value = None)
+        :param retry_root: Default value = True)
+
         """
         try:
             self.device.pull(remote_path, local_path, progress_callback)
@@ -159,7 +174,7 @@ class AndroidExtraction(MVTModule):
                 self._adb_download_root(remote_path, local_path, progress_callback)
             else:
                 raise Exception(f"Unable to download file {remote_path}: {e}")
-    
+
     def _adb_download_root(self, remote_path, local_path, progress_callback=None):
         try:
             # Check if we have root, if not raise an Exception.
@@ -184,16 +199,18 @@ class AndroidExtraction(MVTModule):
 
             # Delete the copy on /sdcard/.
             self._adb_command(f"rm -rf {new_remote_path}")
-            
+
         except AdbCommandFailureException as e:
             raise Exception(f"Unable to download file {remote_path}: {e}")
 
     def _adb_process_file(self, remote_path, process_routine):
         """Download a local copy of a file which is only accessible as root.
         This is a wrapper around process_routine.
+
         :param remote_path: Path of the file on the device to process
         :param process_routine: Function to be called on the local copy of the
                                 downloaded file
+
         """
         # Connect to the device over adb.
         self._adb_connect()
@@ -227,6 +244,5 @@ class AndroidExtraction(MVTModule):
         self._adb_disconnect()
 
     def run(self):
-        """Run the main procedure.
-        """
+        """Run the main procedure."""
         raise NotImplementedError

mvt/android/modules/adb/chrome_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -16,6 +16,7 @@ log = logging.getLogger(__name__)
 
 CHROME_HISTORY_PATH = "data/data/com.android.chrome/app_chrome/Default/History"
 
+
 class ChromeHistory(AndroidExtraction):
     """This module extracts records from Android's Chrome browsing history."""
 
@@ -33,9 +34,19 @@ class ChromeHistory(AndroidExtraction):
             "data": f"{record['id']} - {record['url']} (visit ID: {record['visit_id']}, redirect source: {record['redirect_source']})"
         }
 
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            if self.indicators.check_domain(result["url"]):
+                self.detected.append(result)
+
     def _parse_db(self, db_path):
         """Parse a Chrome History database file.
+
         :param db_path: Path to the History database to process.
+
         """
         conn = sqlite3.connect(db_path)
         cur = conn.cursor()

mvt/android/modules/adb/dumpsys_accessibility.py

@@ -0,0 +1,67 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysAccessibility(AndroidExtraction):
+    """This module extracts stats on accessibility."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    @staticmethod
+    def parse_accessibility(output):
+        results = []
+
+        in_services = False
+        for line in output.split("\n"):
+            if line.strip().startswith("installed services:"):
+                in_services = True
+                continue
+
+            if not in_services:
+                continue
+
+            if line.strip() == "}":
+                break
+
+            service = line.split(":")[1].strip()
+            log.info("Found installed accessibility service \"%s\"", service)
+
+            results.append({
+                "package_name": service.split("/")[0],
+                "service": service,
+            })
+
+        return results
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys accessibility")
+        self.results = self.parse_accessibility(output)
+
+        self.log.info("Identified a total of %d accessibility services", len(self.results))
+
+        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_activities.py

@@ -0,0 +1,98 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysActivities(AndroidExtraction):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = results if results else {}
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for intent, activities in self.results.items():
+            for activity in activities:
+                ioc = self.indicators.check_app_id(activity["package_name"])
+                if ioc:
+                    activity["matched_indicator"] = ioc
+                    self.detected.append({intent: activity})
+                    continue
+
+    @staticmethod
+    def parse_activity_resolver_table(output):
+        results = {}
+
+        in_activity_resolver_table = False
+        in_non_data_actions = False
+        intent = None
+        for line in output.split("\n"):
+            if line.startswith("Activity Resolver Table:"):
+                in_activity_resolver_table = True
+                continue
+
+            if not in_activity_resolver_table:
+                continue
+
+            if line.startswith("  Non-Data Actions:"):
+                in_non_data_actions = True
+                continue
+
+            if not in_non_data_actions:
+                continue
+
+            # If we hit an empty line, the Non-Data Actions section should be
+            # finished.
+            if line.strip() == "":
+                break
+
+            # We detect the action name.
+            if line.startswith(" " * 6) and not line.startswith(" " * 8) and ":" in line:
+                intent = line.strip().replace(":", "")
+                results[intent] = []
+                continue
+
+            # If we are not in an intent block yet, skip.
+            if not intent:
+                continue
+
+            # If we are in a block but the line does not start with 8 spaces
+            # it means the block ended a new one started, so we reset and
+            # continue.
+            if not line.startswith(" " * 8):
+                intent = None
+                continue
+
+            # If we got this far, we are processing receivers for the
+            # activities we are interested in.
+            activity = line.strip().split(" ")[1]
+            package_name = activity.split("/")[0]
+
+            results[intent].append({
+                "package_name": package_name,
+                "activity": activity,
+            })
+
+        return results
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys package")
+        self.results = self.parse_activity_resolver_table(output)
+
+        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_battery_daily.py

@@ -0,0 +1,93 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysBatteryDaily(AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["from"],
+            "module": self.__class__.__name__,
+            "event": "battery_daily",
+            "data": f"Recorded update of package {record['package_name']} with vers {record['vers']}"
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    @staticmethod
+    def parse_battery_history(output):
+        results = []
+        daily = None
+        daily_updates = []
+        for line in output.split("\n")[1:]:
+            if line.startswith("  Daily from "):
+                timeframe = line[13:].strip()
+                date_from, date_to = timeframe.strip(":").split(" to ", 1)
+                daily = {"from": date_from[0:10], "to": date_to[0:10]}
+
+            if not daily:
+                continue
+
+            if line.strip() == "":
+                results.extend(daily_updates)
+                daily = None
+                daily_updates = []
+                continue
+
+            if not line.strip().startswith("Update "):
+                continue
+
+            line = line.strip().replace("Update ", "")
+            package_name, vers = line.split(" ", 1)
+            vers_nr = vers.split("=", 1)[1]
+
+            already_seen = False
+            for update in daily_updates:
+                if package_name == update["package_name"] and vers_nr == update["vers"]:
+                    already_seen = True
+                    break
+
+            if not already_seen:
+                daily_updates.append({
+                    "action": "update",
+                    "from": daily["from"],
+                    "to": daily["to"],
+                    "package_name": package_name,
+                    "vers": vers_nr,
+                })
+
+        return results
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys batterystats --daily")
+        self.results = self.parse_battery_history(output)
+
+        self.log.info("Extracted %d records from battery daily stats", len(self.results))
+
+        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_battery_history.py

@@ -0,0 +1,91 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysBatteryHistory(AndroidExtraction):
+    """This module extracts records from battery history events."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    @staticmethod
+    def parse_battery_history(output):
+        results = []
+
+        for line in output.split("\n")[1:]:
+            if line.strip() == "":
+                break
+
+            time_elapsed, rest = line.strip().split(" ", 1)
+
+            start = line.find(" 100 ")
+            if start == -1:
+                continue
+
+            line = line[start+5:]
+
+            event = ""
+            if line.startswith("+job"):
+                event = "start_job"
+            elif line.startswith("-job"):
+                event = "end_job"
+            elif line.startswith("+running +wake_lock="):
+                event = "wake"
+            else:
+                continue
+
+            if event in ["start_job", "end_job"]:
+                uid = line[line.find("=")+1:line.find(":")]
+                service = line[line.find(":")+1:].strip('"')
+                package_name = service.split("/")[0]
+            elif event == "wake":
+                uid = line[line.find("=")+1:line.find(":")]
+                service = line[line.find("*walarm*:")+9:].split(" ")[0].strip('"').strip()
+                if service == "" or "/" not in service:
+                    continue
+
+                package_name = service.split("/")[0]
+            else:
+                continue
+
+            results.append({
+                "time_elapsed": time_elapsed,
+                "event": event,
+                "uid": uid,
+                "package_name": package_name,
+                "service": service,
+            })
+
+        return results
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys batterystats --history")
+        self.results = self.parse_battery_history(output)
+
+        self.log.info("Extracted %d records from battery history", len(self.results))
+
+        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_batterystats.py

@@ -1,45 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-class DumpsysBatterystats(AndroidExtraction):
-    """This module extracts stats on battery consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        stats = self._adb_command("dumpsys batterystats")
-        if self.output_folder:
-            stats_path = os.path.join(self.output_folder,
-                                      "dumpsys_batterystats.txt")
-            with open(stats_path, "w") as handle:
-                handle.write(stats)
-
-            log.info("Records from dumpsys batterystats stored at %s",
-                      stats_path)
-
-        history = self._adb_command("dumpsys batterystats --history")
-        if self.output_folder:
-            history_path = os.path.join(self.output_folder,
-                                        "dumpsys_batterystats_history.txt")
-            with open(history_path, "w") as handle:
-                handle.write(history)
-
-            log.info("History records from dumpsys batterystats stored at %s",
-                     history_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_dbinfo.py

@@ -0,0 +1,81 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import re
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysDBInfo(AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    slug = "dumpsys_dbinfo"
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            path = result.get("path", "")
+            for part in path.split("/"):
+                ioc = self.indicators.check_app_id(part)
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+    @staticmethod
+    def parse_dbinfo(output):
+        results = []
+
+        rxp = re.compile(r'.*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\".*path\=(.*?$)')
+
+        in_operations = False
+        for line in output.split("\n"):
+            if line.strip() == "Most recently executed operations:":
+                in_operations = True
+                continue
+
+            if not in_operations:
+                continue
+
+            if not line.startswith("        "):
+                in_operations = False
+                continue
+
+            matches = rxp.findall(line)
+            if not matches:
+                continue
+
+            match = matches[0]
+            results.append({
+                "isodate": match[0],
+                "pid": match[1],
+                "action": match[2],
+                "sql": match[3],
+                "path": match[4],
+            })
+
+        return results
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys dbinfo")
+        self.results = self.parse_dbinfo(output)
+
+        self.log.info("Extracted a total of %d records from database information",
+                      len(self.results))
+
+        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_full.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -10,6 +10,7 @@ from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
+
 class DumpsysFull(AndroidExtraction):
     """This module extracts stats on battery consumption by processes."""
 
@@ -22,14 +23,12 @@ class DumpsysFull(AndroidExtraction):
     def run(self):
         self._adb_connect()
 
-        stats = self._adb_command("dumpsys")
+        output = self._adb_command("dumpsys")
         if self.output_folder:
-            stats_path = os.path.join(self.output_folder,
-                                      "dumpsys.txt")
-            with open(stats_path, "w") as handle:
-                handle.write(stats)
+            output_path = os.path.join(self.output_folder, "dumpsys.txt")
+            with open(output_path, "w", encoding="utf-8") as handle:
+                handle.write(output)
 
-            log.info("Full dumpsys output stored at %s",
-                      stats_path)
+            log.info("Full dumpsys output stored at %s", output_path)
 
         self._adb_disconnect()

mvt/android/modules/adb/dumpsys_packages.py

@@ -1,37 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysPackages(AndroidExtraction):
-    """This module extracts details on installed packages."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys package")
-
-        if self.output_folder:
-            packages_path = os.path.join(self.output_folder,
-                                         "dumpsys_packages.txt")
-            with open(packages_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Records from dumpsys package stored at %s",
-                     packages_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_procstats.py

@@ -1,35 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-class DumpsysProcstats(AndroidExtraction):
-    """This module extracts stats on memory consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys procstats")
-        if self.output_folder:
-            procstats_path = os.path.join(self.output_folder,
-                                          "dumpsys_procstats.txt")
-            with open(procstats_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Records from dumpsys procstats stored at %s",
-                     procstats_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_receivers.py

@@ -1,19 +1,20 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import logging
-import os
 
 from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
-ACTION_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
-ACTION_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
-ACTION_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
-ACTION_PHONE_STATE = "android.intent.action.PHONE_STATE"
+INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
+INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
+INTENT_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
+INTENT_PHONE_STATE = "android.intent.action.PHONE_STATE"
+INTENT_NEW_OUTGOING_CALL = "android.intent.action.NEW_OUTGOING_CALL"
+
 
 class DumpsysReceivers(AndroidExtraction):
     """This module extracts details on receivers for risky activities."""
@@ -24,64 +25,96 @@ class DumpsysReceivers(AndroidExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
-    def run(self):
-        self._adb_connect()
+        self.results = results if results else {}
 
-        output = self._adb_command("dumpsys package")
-        if not output:
+    def check_indicators(self):
+        if not self.indicators:
             return
 
-        activity = None
-        for line in output.split("\n"):
-            # Find activity block markers.
-            if line.strip().startswith(ACTION_NEW_OUTGOING_SMS):
-                activity = ACTION_NEW_OUTGOING_SMS
-                continue
-            elif line.strip().startswith(ACTION_SMS_RECEIVED):
-                activity = ACTION_SMS_RECEIVED
-                continue
-            elif line.strip().startswith(ACTION_PHONE_STATE):
-                activity = ACTION_PHONE_STATE
-                continue
-            elif line.strip().startswith(ACTION_DATA_SMS_RECEIVED):
-                activity = ACTION_DATA_SMS_RECEIVED
+        for intent, receivers in self.results.items():
+            for receiver in receivers:
+                if intent == INTENT_NEW_OUTGOING_SMS:
+                    self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_SMS_RECEIVED:
+                    self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_DATA_SMS_RECEIVED:
+                    self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_PHONE_STATE:
+                    self.log.info("Found a receiver monitoring telephony state/incoming calls: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_NEW_OUTGOING_CALL:
+                    self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
+                                  receiver["receiver"])
+
+            ioc = self.indicators.check_app_id(receiver["package_name"])
+            if ioc:
+                receiver["matched_indicator"] = ioc
+                self.detected.append({intent: receiver})
                 continue
 
-            # If we are not in an activity block yet, skip.
-            if not activity:
+    @staticmethod
+    def parse_receiver_resolver_table(output):
+        results = {}
+
+        in_receiver_resolver_table = False
+        in_non_data_actions = False
+        intent = None
+        for line in output.split("\n"):
+            if line.startswith("Receiver Resolver Table:"):
+                in_receiver_resolver_table = True
+                continue
+
+            if not in_receiver_resolver_table:
+                continue
+
+            if line.startswith("  Non-Data Actions:"):
+                in_non_data_actions = True
+                continue
+
+            if not in_non_data_actions:
+                continue
+
+            # If we hit an empty line, the Non-Data Actions section should be
+            # finished.
+            if line.strip() == "":
+                break
+
+            # We detect the action name.
+            if line.startswith(" " * 6) and not line.startswith(" " * 8) and ":" in line:
+                intent = line.strip().replace(":", "")
+                results[intent] = []
+                continue
+
+            # If we are not in an intent block yet, skip.
+            if not intent:
                 continue
 
             # If we are in a block but the line does not start with 8 spaces
             # it means the block ended a new one started, so we reset and
             # continue.
             if not line.startswith(" " * 8):
-                activity = None
+                intent = None
                 continue
 
             # If we got this far, we are processing receivers for the
             # activities we are interested in.
             receiver = line.strip().split(" ")[1]
             package_name = receiver.split("/")[0]
-            if package_name == "com.google.android.gms":
-                continue
 
-            if activity == ACTION_NEW_OUTGOING_SMS:
-                self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
-                    receiver)
-            elif activity == ACTION_SMS_RECEIVED:
-                self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
-                    receiver)
-            elif activity == ACTION_DATA_SMS_RECEIVED:
-                self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
-                    receiver)
-            elif activity == ACTION_PHONE_STATE:
-                self.log.info("Found a receiver monitoring telephony state: \"%s\"",
-                    receiver)
-
-            self.results.append({
-                "activity": activity,
+            results[intent].append({
                 "package_name": package_name,
                 "receiver": receiver,
             })
 
+        return results
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys package")
+        self.results = self.parse_receiver_resolver_table(output)
+
         self._adb_disconnect()

mvt/android/modules/adb/files.py

@@ -1,33 +1,97 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+import datetime
 import logging
-import os
+import stat
+
+from mvt.common.utils import convert_timestamp_to_iso
 
 from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
+
 class Files(AndroidExtraction):
-    """This module extracts the list of installed packages."""
+    """This module extracts the list of files on the device."""
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  serial=None, fast_mode=False, log=None, results=[]):
         super().__init__(file_path=file_path, base_folder=base_folder,
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
+        self.full_find = False
+
+    def find_files(self, folder):
+        if self.full_find:
+            output = self._adb_command(f"find '{folder}' -printf '%T@ %m %s %u %g %p\n' 2> /dev/null")
+
+            for file_line in output.splitlines():
+                [unix_timestamp, mode, size, owner, group, full_path] = file_line.rstrip().split(" ", 5)
+                mod_time = convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(int(float(unix_timestamp))))
+                self.results.append({
+                    "path": full_path,
+                    "modified_time": mod_time,
+                    "mode": mode,
+                    "is_suid": (int(mode, 8) & stat.S_ISUID) == 2048,
+                    "is_sgid": (int(mode, 8) & stat.S_ISGID) == 1024,
+                    "size": size,
+                    "owner": owner,
+                    "group": group,
+                })
+        else:
+            output = self._adb_command(f"find '{folder}' 2> /dev/null")
+            for file_line in output.splitlines():
+                self.results.append({"path": file_line.rstrip()})
+
+    def serialize(self, record):
+        if "modified_time" in record:
+            return {
+                "timestamp": record["modified_time"],
+                "module": self.__class__.__name__,
+                "event": "file_modified",
+                "data": record["path"],
+            }
+
+    def check_suspicious(self):
+        """Check for files with suspicious permissions"""
+        for result in sorted(self.results, key=lambda item: item["path"]):
+            if result.get("is_suid"):
+                self.log.warning("Found an SUID file in a non-standard directory \"%s\".",
+                                 result["path"])
+                self.detected.append(result)
+
+    def check_indicators(self):
+        """Check file list for known suspicious files or suspicious properties"""
+        self.check_suspicious()
+
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            if self.indicators.check_file_path(result["path"]):
+                self.log.warning("Found a known suspicous file at path: \"%s\"", result["path"])
+                self.detected.append(result)
 
     def run(self):
         self._adb_connect()
 
-        output = self._adb_command("find / -type f 2> /dev/null")
-        if output and self.output_folder:
-            files_txt_path = os.path.join(self.output_folder, "files.txt")
-            with open(files_txt_path, "w") as handle:
-                handle.write(output)
+        output = self._adb_command("find '/' -maxdepth 1 -printf '%T@ %m %s %u %g %p\n' 2> /dev/null")
+        if output or output.strip().splitlines():
+            self.full_find = True
 
-            log.info("List of visible files stored at %s", files_txt_path)
+        for data_path in ["/data/local/tmp/", "/sdcard/", "/tmp/"]:
+            self.find_files(data_path)
+
+        self.log.info("Found %s files in primary Android data directories", len(self.results))
+
+        if self.fast_mode:
+            self.log.info("Flag --fast was enabled: skipping full file listing")
+        else:
+            self.log.info("Processing full file listing. This may take a while...")
+            self.find_files("/")
+            self.log.info("Found %s total files", len(self.results))
 
         self._adb_disconnect()

mvt/android/modules/adb/getprop.py

@@ -0,0 +1,45 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import re
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class Getprop(AndroidExtraction):
+    """This module extracts device properties from getprop command."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = {} if not results else results
+
+    def run(self):
+        self._adb_connect()
+
+        rxp = re.compile(r"\[(.+?)\]: \[(.+?)\]")
+        out = self._adb_command("getprop")
+        for line in out.splitlines():
+            line = line.strip()
+            if line == "":
+                continue
+
+            matches = re.findall(rxp, line)
+            if not matches or len(matches[0]) != 2:
+                continue
+
+            key = matches[0][0]
+            value = matches[0][1]
+            self.results[key] = value
+
+        self._adb_disconnect()
+
+        self.log.info("Extracted %d Android system properties", len(self.results))

mvt/android/modules/adb/logcat.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -31,7 +31,7 @@ class Logcat(AndroidExtraction):
         if self.output_folder:
             logcat_path = os.path.join(self.output_folder,
                                        "logcat.txt")
-            with open(logcat_path, "w") as handle:
+            with open(logcat_path, "w", encoding="utf-8") as handle:
                 handle.write(output)
 
             log.info("Current logcat logs stored at %s",
@@ -39,7 +39,7 @@ class Logcat(AndroidExtraction):
 
             logcat_last_path = os.path.join(self.output_folder,
                                             "logcat_last.txt")
-            with open(logcat_last_path, "w") as handle:
+            with open(logcat_last_path, "w", encoding="utf-8") as handle:
                 handle.write(last_output)
 
             log.info("Logcat logs prior to last reboot stored at %s",

mvt/android/modules/adb/packages.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -8,10 +8,37 @@ import os
 
 import pkg_resources
 
+from mvt.android.lookups.koodous import koodous_lookup
+from mvt.android.lookups.virustotal import virustotal_lookup
+
 from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
+DANGEROUS_PERMISSIONS_THRESHOLD = 10
+DANGEROUS_PERMISSIONS = [
+    "android.permission.ACCESS_COARSE_LOCATION",
+    "android.permission.ACCESS_FINE_LOCATION",
+    "android.permission.AUTHENTICATE_ACCOUNTS",
+    "android.permission.CAMERA",
+    "android.permission.DISABLE_KEYGUARD",
+    "android.permission.PROCESS_OUTGOING_CALLS",
+    "android.permission.READ_CALENDAR",
+    "android.permission.READ_CALL_LOG",
+    "android.permission.READ_CONTACTS",
+    "android.permission.READ_PHONE_STATE",
+    "android.permission.READ_SMS",
+    "android.permission.RECEIVE_MMS",
+    "android.permission.RECEIVE_SMS",
+    "android.permission.RECEIVE_WAP_PUSH",
+    "android.permission.RECORD_AUDIO",
+    "android.permission.SEND_SMS",
+    "android.permission.SYSTEM_ALERT_WINDOW",
+    "android.permission.USE_CREDENTIALS",
+    "android.permission.USE_SIP",
+    "com.android.browser.permission.READ_HISTORY_BOOKMARKS",
+]
+
 class Packages(AndroidExtraction):
     """This module extracts the list of installed packages."""
 
@@ -44,21 +71,99 @@ class Packages(AndroidExtraction):
         root_packages_path = os.path.join("..", "..", "data", "root_packages.txt")
         root_packages_string = pkg_resources.resource_string(__name__, root_packages_path)
         root_packages = root_packages_string.decode("utf-8").split("\n")
+        root_packages = [rp.strip() for rp in root_packages]
 
-        for root_package in root_packages:
-            root_package = root_package.strip()
-            if not root_package:
+        for result in self.results:
+            if result["package_name"] in root_packages:
+                self.log.warning("Found an installed package related to rooting/jailbreaking: \"%s\"",
+                                 result["package_name"])
+                self.detected.append(result)
                 continue
 
-            if root_package in self.results:
-                self.log.warning("Found an installed package related to rooting/jailbreaking: \"%s\"",
-                                 root_package)
-                self.detected.append(root_package)
+            if not self.indicators:
+                continue
+
+            ioc = self.indicators.check_app_id(result.get("package_name"))
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+            for package_file in result["files"]:
+                ioc = self.indicators.check_file_hash(package_file["sha256"])
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+
+    def _get_package_details(self, package_name):
+        details = {
+            "uid": "",
+            "version_name": "",
+            "version_code": "",
+            "timestamp": "",
+            "first_install_time": "",
+            "last_update_time": "",
+            "requested_permissions": [],
+        }
+
+        in_permissions = False
+        for line in self._adb_command(f"dumpsys package {package_name}").split("\n"):
+            if in_permissions:
+                if line.startswith(" " * 4) and not line.startswith(" " * 6):
+                    in_permissions = False
+                    continue
+
+                permission = line.strip().split(":")[0]
+                details["requested_permissions"].append(permission)
+
+            if line.strip().startswith("userId="):
+                details["uid"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionName="):
+                details["version_name"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionCode="):
+                details["version_code"] = line.split("=", 1)[1].strip()
+            elif line.strip().startswith("timeStamp="):
+                details["timestamp"] = line.split("=")[1].strip()
+            elif line.strip().startswith("firstInstallTime="):
+                details["first_install_time"] = line.split("=")[1].strip()
+            elif line.strip().startswith("lastUpdateTime="):
+                details["last_update_time"] = line.split("=")[1].strip()
+            elif line.strip() == "requested permissions:":
+                in_permissions = True
+                continue
+
+        return details
+
+    def _get_files_for_package(self, package_name):
+        output = self._adb_command(f"pm path {package_name}")
+        output = output.strip().replace("package:", "")
+        if not output:
+            return []
+
+        package_files = []
+        for file_path in output.split("\n"):
+            file_path = file_path.strip()
+
+            md5 = self._adb_command(f"md5sum {file_path}").split(" ")[0]
+            sha1 = self._adb_command(f"sha1sum {file_path}").split(" ")[0]
+            sha256 = self._adb_command(f"sha256sum {file_path}").split(" ")[0]
+            sha512 = self._adb_command(f"sha512sum {file_path}").split(" ")[0]
+
+            package_files.append({
+                "path": file_path,
+                "md5": md5,
+                "sha1": sha1,
+                "sha256": sha256,
+                "sha512": sha512,
+            })
+
+        return package_files
 
     def run(self):
         self._adb_connect()
 
-        packages = self._adb_command("pm list packages -U -u -i -f")
+        packages = self._adb_command("pm list packages -u -i -f")
+
         for line in packages.split("\n"):
             line = line.strip()
             if not line.startswith("package:"):
@@ -75,28 +180,21 @@ class Packages(AndroidExtraction):
                 if installer == "null":
                     installer = None
 
-            try:
-                uid = fields[2].split(":")[1].strip()
-            except IndexError:
-                uid = None
-
-            dumpsys = self._adb_command(f"dumpsys package {package_name} | grep -A2 timeStamp").split("\n")
-            timestamp = dumpsys[0].split("=")[1].strip()
-            first_install = dumpsys[1].split("=")[1].strip()
-            last_update = dumpsys[2].split("=")[1].strip()
-
-            self.results.append({
+            package_files = self._get_files_for_package(package_name)
+            new_package = {
                 "package_name": package_name,
                 "file_name": file_name,
                 "installer": installer,
-                "timestamp": timestamp,
-                "first_install_time": first_install,
-                "last_update_time": last_update,
-                "uid": uid,
                 "disabled": False,
                 "system": False,
                 "third_party": False,
-            })
+                "files": package_files,
+            }
+
+            package_details = self._get_package_details(package_name)
+            new_package.update(package_details)
+
+            self.results.append(new_package)
 
         cmds = [
             {"field": "disabled", "arg": "-d"},
@@ -115,13 +213,32 @@ class Packages(AndroidExtraction):
                     if result["package_name"] == package_name:
                         self.results[i][cmd["field"]] = True
 
+        for result in self.results:
+            if not result["third_party"]:
+                continue
+
+            dangerous_permissions_count = 0
+            for perm in result["requested_permissions"]:
+                if perm in DANGEROUS_PERMISSIONS:
+                    dangerous_permissions_count += 1
+
+            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
+                self.log.info("Third-party package \"%s\" requested %d potentially dangerous permissions",
+                              result["package_name"], dangerous_permissions_count)
+
+        packages_to_lookup = []
         for result in self.results:
             if result["system"]:
                 continue
 
+            packages_to_lookup.append(result)
             self.log.info("Found non-system package with name \"%s\" installed by \"%s\" on %s",
                           result["package_name"], result["installer"], result["timestamp"])
 
+        if not self.fast_mode:
+            virustotal_lookup(packages_to_lookup)
+            koodous_lookup(packages_to_lookup)
+
         self.log.info("Extracted at total of %d installed package names",
                       len(self.results))
 

mvt/android/modules/adb/processes.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -9,6 +9,7 @@ from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
+
 class Processes(AndroidExtraction):
     """This module extracts details on running processes."""
 

mvt/android/modules/adb/root_binaries.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -12,6 +12,7 @@ from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
+
 class RootBinaries(AndroidExtraction):
     """This module extracts the list of installed packages."""
 

mvt/android/modules/adb/settings.py

@@ -0,0 +1,105 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+ANDROID_DANGEROUS_SETTINGS = [
+    {
+        "description": "disabled Google Play Services apps verification",
+        "key": "verifier_verify_adb_installs",
+        "safe_value": "1",
+    },
+    {
+        "description": "disabled Google Play Protect",
+        "key": "package_verifier_enable",
+        "safe_value": "1",
+    },
+    {
+        "description": "disabled Google Play Protect",
+        "key": "package_verifier_user_consent",
+        "safe_value": "1",
+    },
+    {
+        "description": "disabled Google Play Protect",
+        "key": "upload_apk_enable",
+        "safe_value": "1",
+    },
+    {
+        "description": "enabled installation of non-market apps",
+        "key": "install_non_market_apps",
+        "safe_value": "0",
+    },
+    {
+        "description": "disabled confirmation of adb apps installation",
+        "key": "adb_install_need_confirm",
+        "safe_value": "1",
+    },
+    {
+        "description": "disabled sharing of security reports",
+        "key": "send_security_reports",
+        "safe_value": "1",
+    },
+    {
+        "description": "disabled sharing of crash logs with manufacturer",
+        "key": "samsung_errorlog_agree",
+        "safe_value": "1",
+    },
+    {
+        "description": "disabled applications errors reports",
+        "key": "send_action_app_error",
+        "safe_value": "1",
+    },
+]
+
+
+class Settings(AndroidExtraction):
+    """This module extracts Android system settings."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = {} if not results else results
+
+    def check_indicators(self):
+        for namespace, settings in self.results.items():
+            for key, value in settings.items():
+                for danger in ANDROID_DANGEROUS_SETTINGS:
+                    # Check if one of the dangerous settings is using an unsafe
+                    # value (different than the one specified).
+                    if danger["key"] == key and danger["safe_value"] != value:
+                        self.log.warning("Found suspicious setting \"%s = %s\" (%s)",
+                                         key, value, danger["description"])
+                        break
+
+    def run(self):
+        self._adb_connect()
+
+        for namespace in ["system", "secure", "global"]:
+            out = self._adb_command(f"cmd settings list {namespace}")
+            if not out:
+                continue
+
+            self.results[namespace] = {}
+
+            for line in out.splitlines():
+                line = line.strip()
+                if line == "":
+                    continue
+
+                fields = line.split("=", 1)
+                try:
+                    self.results[namespace][fields[0]] = fields[1]
+                except IndexError:
+                    continue
+
+        self._adb_disconnect()

mvt/android/modules/adb/sms.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -15,12 +15,12 @@ log = logging.getLogger(__name__)
 
 SMS_BUGLE_PATH = "data/data/com.google.android.apps.messaging/databases/bugle_db"
 SMS_BUGLE_QUERY = """
-SELECT 
+SELECT
     ppl.normalized_destination AS number,
     p.timestamp AS timestamp,
-CASE WHEN m.sender_id IN 
+CASE WHEN m.sender_id IN
 (SELECT _id FROM participants WHERE contact_id=-1)
-THEN 2 ELSE 1 END incoming, p.text AS text 
+THEN 2 ELSE 1 END incoming, p.text AS text
 FROM messages m, conversations c, parts p,
         participants ppl, conversation_participants cp
 WHERE (m.conversation_id = c._id)
@@ -31,14 +31,15 @@ WHERE (m.conversation_id = c._id)
 
 SMS_MMSSMS_PATH = "data/data/com.android.providers.telephony/databases/mmssms.db"
 SMS_MMSMS_QUERY = """
-SELECT 
+SELECT
     address AS number,
     date_sent AS timestamp,
     type as incoming,
-    body AS text 
+    body AS text
 FROM sms;
 """
 
+
 class SMS(AndroidExtraction):
     """This module extracts all SMS messages containing links."""
 
@@ -62,7 +63,7 @@ class SMS(AndroidExtraction):
             return
 
         for message in self.results:
-            if not "text" in message:
+            if "text" not in message:
                 continue
 
             message_links = check_for_links(message["text"])
@@ -71,11 +72,13 @@ class SMS(AndroidExtraction):
 
     def _parse_db(self, db_path):
         """Parse an Android bugle_db SMS database file.
+
         :param db_path: Path to the Android SMS database file to process
+
         """
         conn = sqlite3.connect(db_path)
         cur = conn.cursor()
-        
+
         if (self.SMS_DB_TYPE == 1):
             cur.execute(SMS_BUGLE_QUERY)
         elif (self.SMS_DB_TYPE == 2):

mvt/android/modules/adb/whatsapp.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -16,6 +16,7 @@ log = logging.getLogger(__name__)
 
 WHATSAPP_PATH = "data/data/com.whatsapp/databases/msgstore.db"
 
+
 class Whatsapp(AndroidExtraction):
     """This module extracts all WhatsApp messages containing links."""
 
@@ -39,7 +40,7 @@ class Whatsapp(AndroidExtraction):
             return
 
         for message in self.results:
-            if not "data" in message:
+            if "data" not in message:
                 continue
 
             message_links = check_for_links(message["data"])
@@ -48,7 +49,9 @@ class Whatsapp(AndroidExtraction):
 
     def _parse_db(self, db_path):
         """Parse an Android msgstore.db WhatsApp database file.
+
         :param db_path: Path to the Android WhatsApp database file to process
+
         """
         conn = sqlite3.connect(db_path)
         cur = conn.cursor()

mvt/android/modules/backup/__init__.py

@@ -1,8 +1,8 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 from .sms import SMS
 
-BACKUP_MODULES = [SMS,]
+BACKUP_MODULES = [SMS]

mvt/android/modules/backup/sms.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -24,7 +24,7 @@ class SMS(MVTModule):
             return
 
         for message in self.results:
-            if not "body" in message:
+            if "body" not in message:
                 continue
 
             message_links = check_for_links(message["body"])

mvt/common/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/common/help.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/common/indicators.py

@@ -1,49 +1,101 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import json
 import os
 
+import requests
+from appdirs import user_data_dir
+
 from .url import URL
 
 
-class IndicatorsFileBadFormat(Exception):
-    pass
-
 class Indicators:
     """This class is used to parse indicators from a STIX2 file and provide
     functions to compare extracted artifacts to the indicators.
     """
 
     def __init__(self, log=None):
+        self.data_dir = user_data_dir("mvt")
         self.log = log
-        self.ioc_domains = []
-        self.ioc_processes = []
-        self.ioc_emails = []
         self.ioc_files = []
-        self.ioc_count = 0
+        self.total_ioc_count = 0
 
-    def _add_indicator(self, ioc, iocs_list):
+    def _load_downloaded_indicators(self):
+        if not os.path.isdir(self.data_dir):
+            return
+
+        for f in os.listdir(self.data_dir):
+            if f.lower().endswith(".stix2"):
+                self.parse_stix2(os.path.join(self.data_dir, f))
+
+    def _check_stix2_env_variable(self):
+        """
+        Checks if a variable MVT_STIX2 contains path to STIX Files.
+        """
+        if "MVT_STIX2" not in os.environ:
+            return
+
+        paths = os.environ["MVT_STIX2"].split(":")
+        for path in paths:
+            if os.path.isfile(path):
+                self.parse_stix2(path)
+            else:
+                self.log.info("Invalid STIX2 path %s in MVT_STIX2 environment variable", path)
+
+    def _generate_indicators_file(self):
+        return {
+            "name": "",
+            "description": "",
+            "file_name": "",
+            "file_path": "",
+            "domains": [],
+            "processes": [],
+            "emails": [],
+            "file_names": [],
+            "file_paths": [],
+            "files_sha256": [],
+            "app_ids": [],
+            "ios_profile_ids": [],
+            "count": 0,
+        }
+
+    def _add_indicator(self, ioc, ioc_file, iocs_list):
         if ioc not in iocs_list:
             iocs_list.append(ioc)
-            self.ioc_count += 1
+            ioc_file["count"] += 1
+            self.total_ioc_count += 1
 
     def parse_stix2(self, file_path):
         """Extract indicators from a STIX2 file.
-        """
-        self.log.info("Parsing STIX2 indicators file at path %s",
-                      file_path)
 
-        with open(file_path, "r") as handle:
+        :param file_path: Path to the STIX2 file to parse
+        :type file_path: str
+
+        """
+        self.log.info("Parsing STIX2 indicators file at path %s", file_path)
+
+        ioc_file = self._generate_indicators_file()
+        ioc_file["file_path"] = file_path
+        ioc_file["file_name"] = os.path.basename(file_path)
+
+        with open(file_path, "r", encoding="utf-8") as handle:
             try:
                 data = json.load(handle)
             except json.decoder.JSONDecodeError:
-                raise IndicatorsFileBadFormat("Unable to parse STIX2 indicators file, the file seems malformed or in the wrong format")
+                self.log.critical("Unable to parse STIX2 indicator file. The file is malformed or in the wrong format.")
+                return
 
         for entry in data.get("objects", []):
-            if entry.get("type", "") != "indicator":
+            entry_type = entry.get("type", "")
+            if entry_type == "malware":
+                ioc_file["name"] = entry.get("name", "") or ioc_file["file_name"]
+                ioc_file["description"] = entry.get("description", "") or ioc_file["file_name"]
+                continue
+
+            if entry_type != "indicator":
                 continue
 
             key, value = entry.get("pattern", "").strip("[]").split("=")
@@ -52,21 +104,81 @@ class Indicators:
             if key == "domain-name:value":
                 # We force domain names to lower case.
                 self._add_indicator(ioc=value.lower(),
-                                    iocs_list=self.ioc_domains)
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["domains"])
             elif key == "process:name":
                 self._add_indicator(ioc=value,
-                                    iocs_list=self.ioc_processes)
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["processes"])
             elif key == "email-addr:value":
                 # We force email addresses to lower case.
                 self._add_indicator(ioc=value.lower(),
-                                    iocs_list=self.ioc_emails)
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["emails"])
             elif key == "file:name":
                 self._add_indicator(ioc=value,
-                                    iocs_list=self.ioc_files)
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["file_names"])
+            elif key == "file:path":
+                self._add_indicator(ioc=value,
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["file_paths"])
+            elif key == "file:hashes.sha256":
+                self._add_indicator(ioc=value,
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["files_sha256"])
+            elif key == "app:id":
+                self._add_indicator(ioc=value,
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["app_ids"])
+            elif key == "configuration-profile:id":
+                self._add_indicator(ioc=value,
+                                    ioc_file=ioc_file,
+                                    iocs_list=ioc_file["ios_profile_ids"])
+
+        self.log.info("Loaded %d indicators from \"%s\" indicators file",
+                      ioc_file["count"], ioc_file["name"])
+
+        self.ioc_files.append(ioc_file)
+
+    def load_indicators_files(self, files, load_default=True):
+        """
+        Load a list of indicators files.
+        """
+        for file_path in files:
+            if os.path.isfile(file_path):
+                self.parse_stix2(file_path)
+            else:
+                self.log.warning("This indicators file %s does not exist", file_path)
+
+        # Load downloaded indicators and any indicators from env variable.
+        if load_default:
+            self._load_downloaded_indicators()
+
+        self._check_stix2_env_variable()
+        self.log.info("Loaded a total of %d unique indicators", self.total_ioc_count)
+
+    def get_iocs(self, ioc_type):
+        for ioc_file in self.ioc_files:
+            for ioc in ioc_file.get(ioc_type, []):
+                yield {
+                    "value": ioc,
+                    "type": ioc_type,
+                    "name": ioc_file["name"]
+                }
 
     def check_domain(self, url):
+        """Check if a given URL matches any of the provided domain indicators.
+
+        :param url: URL to match against domain indicators
+        :type url: str
+        :returns: Indicator details if matched, otherwise None
+
+        """
         # TODO: If the IOC domain contains a subdomain, it is not currently
-        # being matched.
+        #       being matched.
+        if not url:
+            return None
 
         try:
             # First we use the provided URL.
@@ -91,94 +203,239 @@ class Indicators:
             else:
                 # If it's not shortened, we just use the original URL object.
                 final_url = orig_url
-        except Exception as e:
+        except Exception:
             # If URL parsing failed, we just try to do a simple substring
             # match.
-            for ioc in self.ioc_domains:
-                if ioc.lower() in url:
-                    self.log.warning("Maybe found a known suspicious domain: %s", url)
-                    return True
+            for ioc in self.get_iocs("domains"):
+                if ioc["value"].lower() in url:
+                    self.log.warning("Maybe found a known suspicious domain %s matching indicators from \"%s\"",
+                                     url, ioc["name"])
+                    return ioc
 
             # If nothing matched, we can quit here.
-            return False
+            return None
 
         # If all parsing worked, we start walking through available domain indicators.
-        for ioc in self.ioc_domains:
+        for ioc in self.get_iocs("domains"):
             # First we check the full domain.
-            if final_url.domain.lower() == ioc:
+            if final_url.domain.lower() == ioc["value"]:
                 if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning("Found a known suspicious domain %s shortened as %s",
-                                     final_url.url, orig_url.url)
+                    self.log.warning("Found a known suspicious domain %s shortened as %s matching indicators from \"%s\"",
+                                     final_url.url, orig_url.url, ioc["name"])
                 else:
-                    self.log.warning("Found a known suspicious domain: %s", final_url.url)
+                    self.log.warning("Found a known suspicious domain %s matching indicators from \"%s\"",
+                                     final_url.url, ioc["name"])
 
-                return True
+                return ioc
 
             # Then we just check the top level domain.
-            if final_url.top_level.lower() == ioc:
+            if final_url.top_level.lower() == ioc["value"]:
                 if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning("Found a sub-domain matching a known suspicious top level %s shortened as %s",
-                                     final_url.url, orig_url.url)
+                    self.log.warning("Found a sub-domain with suspicious top level %s shortened as %s matching indicators from \"%s\"",
+                                     final_url.url, orig_url.url, ioc["name"])
                 else:
-                    self.log.warning("Found a sub-domain matching a known suspicious top level: %s", final_url.url)
+                    self.log.warning("Found a sub-domain with a suspicious top level %s matching indicators from \"%s\"",
+                                     final_url.url, ioc["name"])
 
-                return True
+                return ioc
 
     def check_domains(self, urls):
-        """Check the provided list of (suspicious) domains against a list of URLs.
-        :param urls: List of URLs to check
+        """Check a list of URLs against the provided list of domain indicators.
+
+        :param urls: List of URLs to check against domain indicators
+        :type urls: list
+        :returns: Indicator details if matched, otherwise None
+
         """
+        if not urls:
+            return None
+
         for url in urls:
-            if self.check_domain(url):
-                return True
+            check = self.check_domain(url)
+            if check:
+                return check
 
     def check_process(self, process):
         """Check the provided process name against the list of process
         indicators.
-        :param process: Process name to check
+
+        :param process: Process name to check against process indicators
+        :type process: str
+        :returns: Indicator details if matched, otherwise None
+
         """
         if not process:
-            return False
+            return None
 
         proc_name = os.path.basename(process)
-        if proc_name in self.ioc_processes:
-            self.log.warning("Found a known suspicious process name \"%s\"", process)
-            return True
+        for ioc in self.get_iocs("processes"):
+            if proc_name == ioc["value"]:
+                self.log.warning("Found a known suspicious process name \"%s\" matching indicators from \"%s\"",
+                                 process, ioc["name"])
+                return ioc
 
-        if len(proc_name) == 16:
-            for bad_proc in self.ioc_processes:
-                if bad_proc.startswith(proc_name):
-                    self.log.warning("Found a truncated known suspicious process name \"%s\"", process)
-                    return True
+            if len(proc_name) == 16:
+                if ioc["value"].startswith(proc_name):
+                    self.log.warning("Found a truncated known suspicious process name \"%s\" matching indicators from \"%s\"",
+                                     process, ioc["name"])
+                    return ioc
 
     def check_processes(self, processes):
         """Check the provided list of processes against the list of
         process indicators.
-        :param processes: List of processes to check
+
+        :param processes: List of processes to check against process indicators
+        :type processes: list
+        :returns: Indicator details if matched, otherwise None
+
         """
+        if not processes:
+            return None
+
         for process in processes:
-            if self.check_process(process):
-                return True
+            check = self.check_process(process)
+            if check:
+                return check
 
     def check_email(self, email):
         """Check the provided email against the list of email indicators.
-        :param email: Suspicious email to check
+
+        :param email: Email address to check against email indicators
+        :type email: str
+        :returns: Indicator details if matched, otherwise None
+
         """
         if not email:
-            return False
+            return None
 
-        if email.lower() in self.ioc_emails:
-            self.log.warning("Found a known suspicious email address: \"%s\"", email)
-            return True
+        for ioc in self.get_iocs("emails"):
+            if email.lower() == ioc["value"].lower():
+                self.log.warning("Found a known suspicious email address \"%s\" matching indicators from \"%s\"",
+                                 email, ioc["name"])
+                return ioc
+
+    def check_file_name(self, file_name):
+        """Check the provided file name against the list of file indicators.
+
+        :param file_name: File name to check against file
+        indicators
+        :type file_name: str
+        :returns: Indicator details if matched, otherwise None
+
+        """
+        if not file_name:
+            return None
+
+        for ioc in self.get_iocs("file_names"):
+            if ioc["value"] == file_name:
+                self.log.warning("Found a known suspicious file name \"%s\" matching indicators from \"%s\"",
+                                 file_name, ioc["name"])
+                return ioc
+
+    def check_file_path(self, file_path):
+        """Check the provided file path against the list of file indicators (both path and name).
+
+        :param file_path: File path or file name to check against file
+        indicators
+        :type file_path: str
+        :returns: Indicator details if matched, otherwise None
 
-    def check_file(self, file_path):
-        """Check the provided file path against the list of file indicators.
-        :param file_path: Path or name of the file to check
         """
         if not file_path:
-            return False
+            return None
 
-        file_name = os.path.basename(file_path)
-        if file_name in self.ioc_files:
-            self.log.warning("Found a known suspicious file: \"%s\"", file_path)
-            return True
+        ioc = self.check_file_name(os.path.basename(file_path))
+        if ioc:
+            return ioc
+
+        for ioc in self.get_iocs("file_paths"):
+            # Strip any trailing slash from indicator paths to match directories.
+            if file_path.startswith(ioc["value"].rstrip("/")):
+                self.log.warning("Found a known suspicious file path \"%s\" matching indicators form \"%s\"",
+                                 file_path, ioc["name"])
+                return ioc
+
+    def check_profile(self, profile_uuid):
+        """Check the provided configuration profile UUID against the list of indicators.
+
+        :param profile_uuid: Profile UUID to check against configuration profile indicators
+        :type profile_uuid: str
+        :returns: Indicator details if matched, otherwise None
+
+        """
+        if not profile_uuid:
+            return None
+
+        for ioc in self.get_iocs("ios_profile_ids"):
+            if profile_uuid in ioc["value"]:
+                self.log.warning("Found a known suspicious profile ID \"%s\" matching indicators from \"%s\"",
+                                 profile_uuid, ioc["name"])
+                return ioc
+
+    def check_file_hash(self, file_hash):
+        """Check the provided SHA256 file hash against the list of indicators.
+
+        :param file_hash: SHA256 hash to check
+        :type file_hash: str
+        :returns: Indicator details if matched, otherwise None
+
+        """
+        if not file_hash:
+            return None
+
+        for ioc in self.get_iocs("files_sha256"):
+            if file_hash.lower() == ioc["value"].lower():
+                self.log.warning("Found a known suspicious file with hash \"%s\" matching indicators from \"%s\"",
+                                 file_hash, ioc["name"])
+                return ioc
+
+    def check_app_id(self, app_id):
+        """Check the provided app identifier (typically an Android package name)
+        against the list of indicators.
+
+        :param app_id: App ID to check against the list of indicators
+        :type app_id: str
+        :returns: Indicator details if matched, otherwise None
+
+        """
+        if not app_id:
+            return None
+
+        for ioc in self.get_iocs("app_ids"):
+            if app_id.lower() == ioc["value"].lower():
+                self.log.warning("Found a known suspicious app with ID \"%s\" matching indicators from \"%s\"",
+                                 app_id, ioc["name"])
+                return ioc
+
+
+def download_indicators_files(log):
+    """
+    Download indicators from repo into MVT app data directory.
+    """
+    data_dir = user_data_dir("mvt")
+    if not os.path.isdir(data_dir):
+        os.makedirs(data_dir, exist_ok=True)
+
+    # Download latest list of indicators from the MVT repo.
+    res = requests.get("https://github.com/mvt-project/mvt/raw/main/public_indicators.json")
+    if res.status_code != 200:
+        log.warning("Unable to find retrieve list of indicators from the MVT repository.")
+        return
+
+    for ioc_entry in res.json():
+        ioc_url = ioc_entry["stix2_url"]
+        log.info("Downloading indicator file '%s' from '%s'", ioc_entry["name"], ioc_url)
+
+        res = requests.get(ioc_url)
+        if res.status_code != 200:
+            log.warning("Could not find indicator file '%s'", ioc_url)
+            continue
+
+        clean_file_name = ioc_url.lstrip("https://").replace("/", "_")
+        ioc_path = os.path.join(data_dir, clean_file_name)
+
+        # Write file to disk. This will overwrite any older version of the STIX2 file.
+        with open(ioc_path, "w", encoding="utf-8") as f:
+            f.write(res.text)
+
+        log.info("Saved indicator file to '%s'", os.path.basename(ioc_path))

mvt/common/logo.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -16,7 +16,7 @@ def logo():
 
     try:
         latest_version = check_for_updates()
-    except:
+    except Exception:
         pass
     else:
         if latest_version:

mvt/common/module.py

@@ -1,27 +1,27 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import csv
-import io
 import os
 import re
 
 import simplejson as json
 
-from .indicators import Indicators
-
 
 class DatabaseNotFoundError(Exception):
     pass
 
+
 class DatabaseCorruptedError(Exception):
     pass
 
+
 class InsufficientPrivileges(Exception):
     pass
 
+
 class MVTModule(object):
     """This class provides a base for all extraction modules."""
 
@@ -29,14 +29,20 @@ class MVTModule(object):
     slug = None
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 fast_mode=False, log=None, results=[]):
+                 fast_mode=False, log=None, results=None):
         """Initialize module.
-        :param file_path: Path to the module's database file, if there is any.
+
+        :param file_path: Path to the module's database file, if there is any
+        :type file_path: str
         :param base_folder: Path to the base folder (backup or filesystem dump)
+        :type file_path: str
         :param output_folder: Folder where results will be stored
+        :type output_folder: str
         :param fast_mode: Flag to enable or disable slow modules
+        :type fast_mode: bool
         :param log: Handle to logger
         :param results: Provided list of results entries
+        :type results: list
         """
         self.file_path = file_path
         self.base_folder = base_folder
@@ -44,14 +50,14 @@ class MVTModule(object):
         self.fast_mode = fast_mode
         self.log = log
         self.indicators = None
-        self.results = results
+        self.results = results if results else []
         self.detected = []
         self.timeline = []
         self.timeline_detected = []
 
     @classmethod
     def from_json(cls, json_path, log=None):
-        with open(json_path, "r") as handle:
+        with open(json_path, "r", encoding="utf-8") as handle:
             results = json.load(handle)
             if log:
                 log.info("Loaded %d results from \"%s\"",
@@ -59,23 +65,23 @@ class MVTModule(object):
             return cls(results=results, log=log)
 
     def get_slug(self):
+        """Use the module's class name to retrieve a slug"""
         if self.slug:
             return self.slug
 
         sub = re.sub("(.)([A-Z][a-z]+)", r"\1_\2", self.__class__.__name__)
         return re.sub("([a-z0-9])([A-Z])", r"\1_\2", sub).lower()
 
-    def load_indicators(self, file_path):
-        self.indicators = Indicators(file_path, self.log)
-
     def check_indicators(self):
         """Check the results of this module against a provided list of
-        indicators."""
+        indicators.
+
+
+        """
         raise NotImplementedError
 
     def save_to_json(self):
-        """Save the collected results to a json file.
-        """
+        """Save the collected results to a json file."""
         if not self.output_folder:
             return
 
@@ -84,7 +90,7 @@ class MVTModule(object):
         if self.results:
             results_file_name = f"{name}.json"
             results_json_path = os.path.join(self.output_folder, results_file_name)
-            with io.open(results_json_path, "w", encoding="utf-8") as handle:
+            with open(results_json_path, "w", encoding="utf-8") as handle:
                 try:
                     json.dump(self.results, handle, indent=4, default=str)
                 except Exception as e:
@@ -94,7 +100,7 @@ class MVTModule(object):
         if self.detected:
             detected_file_name = f"{name}_detected.json"
             detected_json_path = os.path.join(self.output_folder, detected_file_name)
-            with io.open(detected_json_path, "w", encoding="utf-8") as handle:
+            with open(detected_json_path, "w", encoding="utf-8") as handle:
                 json.dump(self.detected, handle, indent=4, default=str)
 
     def serialize(self, record):
@@ -102,15 +108,18 @@ class MVTModule(object):
 
     @staticmethod
     def _deduplicate_timeline(timeline):
-        """Serialize entry as JSON to deduplicate repeated entries"""
+        """Serialize entry as JSON to deduplicate repeated entries
+
+        :param timeline: List of entries from timeline to deduplicate
+
+        """
         timeline_set = set()
         for record in timeline:
             timeline_set.add(json.dumps(record, sort_keys=True))
         return [json.loads(record) for record in timeline_set]
 
     def to_timeline(self):
-        """Convert results into a timeline.
-        """
+        """Convert results into a timeline."""
         for result in self.results:
             record = self.serialize(result)
             if record:
@@ -132,8 +141,7 @@ class MVTModule(object):
         self.timeline_detected = self._deduplicate_timeline(self.timeline_detected)
 
     def run(self):
-        """Run the main module procedure.
-        """
+        """Run the main module procedure."""
         raise NotImplementedError
 
 
@@ -178,10 +186,12 @@ def run_module(module):
 
 def save_timeline(timeline, timeline_path):
     """Save the timeline in a csv file.
-    :param timeline: List of records to order and store.
-    :param timeline_path: Path to the csv file to store the timeline to.
+
+    :param timeline: List of records to order and store
+    :param timeline_path: Path to the csv file to store the timeline to
+
     """
-    with io.open(timeline_path, "a+", encoding="utf-8") as handle:
+    with open(timeline_path, "a+", encoding="utf-8") as handle:
         csvoutput = csv.writer(handle, delimiter=",", quotechar="\"")
         csvoutput.writerow(["UTC Timestamp", "Plugin", "Event", "Description"])
         for event in sorted(timeline, key=lambda x: x["timestamp"] if x["timestamp"] is not None else ""):

mvt/common/options.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -9,8 +9,7 @@ from click import Option, UsageError
 
 
 class MutuallyExclusiveOption(Option):
-    """This class extends click to support mutually exclusive options.
-    """
+    """This class extends click to support mutually exclusive options."""
 
     def __init__(self, *args, **kwargs):
         self.mutually_exclusive = set(kwargs.pop("mutually_exclusive", []))

mvt/common/url.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -7,6 +7,7 @@ import requests
 from tld import get_tld
 
 SHORTENER_DOMAINS = [
+    "1drv.ms",
     "1link.in",
     "1url.com",
     "2big.at",
@@ -15,29 +16,29 @@ SHORTENER_DOMAINS = [
     "2ya.com",
     "4url.cc",
     "6url.com",
+    "a.gg",
+    "a.nf",
     "a2a.me",
     "abbrr.com",
     "adf.ly",
     "adjix.com",
-    "a.gg",
     "alturl.com",
-    "a.nf",
     "atu.ca",
     "b23.ru",
     "bacn.me",
-    "bit.ly",
     "bit.do",
+    "bit.ly",
     "bkite.com",
     "bloat.me",
     "budurl.com",
     "buff.ly",
     "buk.me",
     "burnurl.com",
+    "c-o.in",
     "chilp.it",
     "clck.ru",
-    "clickmeter.com",
     "cli.gs",
-    "c-o.in",
+    "clickmeter.com",
     "cort.as",
     "cut.ly",
     "cuturl.com",
@@ -55,19 +56,20 @@ SHORTENER_DOMAINS = [
     "esyurl.com",
     "ewerl.com",
     "fa.b",
-    "fff.to",
     "ff.im",
+    "fff.to",
     "fhurl.com",
     "fire.to",
     "firsturl.de",
     "flic.kr",
     "fly2.ws",
     "fon.gs",
+    "forms.gle",
     "fwd4.me",
     "gl.am",
-    "go2cut.com",
-    "go2.me",
     "go.9nl.com",
+    "go2.me",
+    "go2cut.com",
     "goo.gl",
     "goshrink.com",
     "gowat.ch",
@@ -77,6 +79,7 @@ SHORTENER_DOMAINS = [
     "hex.io",
     "hover.com",
     "href.in",
+    "ht.ly",
     "htxt.it",
     "hugeurl.com",
     "hurl.it",
@@ -85,8 +88,8 @@ SHORTENER_DOMAINS = [
     "icanhaz.com",
     "idek.net",
     "inreply.to",
-    "iscool.net",
     "is.gd",
+    "iscool.net",
     "iterasi.net",
     "jijr.com",
     "jmp2.net",
@@ -102,10 +105,11 @@ SHORTENER_DOMAINS = [
     "linkbee.com",
     "linkbun.ch",
     "liurl.cn",
-    "lnk.gd",
-    "lnk.in",
     "ln-s.net",
     "ln-s.ru",
+    "lnk.gd",
+    "lnk.in",
+    "lnkd.in",
     "loopt.us",
     "lru.jp",
     "lt.tl",
@@ -122,44 +126,44 @@ SHORTENER_DOMAINS = [
     "nn.nf",
     "notlong.com",
     "nsfw.in",
+    "o-x.fr",
     "om.ly",
     "ow.ly",
-    "o-x.fr",
     "pd.am",
     "pic.gd",
     "ping.fm",
     "piurl.com",
     "pnt.me",
     "poprl.com",
-    "posted.at",
     "post.ly",
+    "posted.at",
     "profile.to",
     "qicute.com",
     "qlnk.net",
     "quip-art.com",
     "rb6.me",
     "redirx.com",
-    "rickroll.it",
     "ri.ms",
+    "rickroll.it",
     "riz.gd",
     "rsmonkey.com",
-    "rubyurl.com",
     "ru.ly",
+    "rubyurl.com",
     "s7y.us",
     "safe.mn",
     "sharein.com",
     "sharetabs.com",
     "shorl.com",
     "short.ie",
+    "short.to",
     "shortlinks.co.uk",
     "shortna.me",
-    "short.to",
     "shorturl.com",
     "shoturl.us",
     "shrinkify.com",
     "shrinkster.com",
-    "shrten.com",
     "shrt.st",
+    "shrten.com",
     "shrunkin.com",
     "shw.me",
     "simurl.com",
@@ -177,20 +181,20 @@ SHORTENER_DOMAINS = [
     "tcrn.ch",
     "thrdl.es",
     "tighturl.com",
-    "tiny123.com",
-    "tinyarro.ws",
     "tiny.cc",
     "tiny.pl",
+    "tiny123.com",
+    "tinyarro.ws",
     "tinytw.it",
     "tinyuri.ca",
     "tinyurl.com",
     "tinyvid.io",
     "tnij.org",
-    "togoto.us",
     "to.ly",
-    "traceurl.com",
+    "togoto.us",
     "tr.im",
     "tr.my",
+    "traceurl.com",
     "turo.us",
     "tweetburner.com",
     "twirl.at",
@@ -200,21 +204,21 @@ SHORTENER_DOMAINS = [
     "twiturl.de",
     "twurl.cc",
     "twurl.nl",
-    "u6e.de",
-    "ub0.cc",
     "u.mavrev.com",
     "u.nu",
+    "u6e.de",
+    "ub0.cc",
     "updating.me",
     "ur1.ca",
+    "url.co.uk",
+    "url.ie",
     "url4.eu",
     "urlao.com",
     "urlbrief.com",
-    "url.co.uk",
     "urlcover.com",
     "urlcut.com",
     "urlenco.de",
     "urlhawk.com",
-    "url.ie",
     "urlkiss.com",
     "urlot.com",
     "urlpire.com",
@@ -227,29 +231,26 @@ SHORTENER_DOMAINS = [
     "wapurl.co.uk",
     "wipi.es",
     "wp.me",
-    "xaddr.com",
     "x.co",
+    "x.se",
+    "xaddr.com",
     "xeeurl.com",
     "xr.com",
     "xrl.in",
     "xrl.us",
-    "x.se",
     "xurl.jp",
     "xzb.cc",
     "yep.it",
     "yfrog.com",
+    "ymlp.com",
     "yweb.com",
     "zi.ma",
     "zi.pe",
     "zipmyurl.com",
     "zz.gd",
-    "ymlp.com",
-    "forms.gle",
-    "ht.ly",
-    "lnkd.in",
-    "1drv.ms",
 ]
 
+
 class URL:
 
     def __init__(self, url):
@@ -263,33 +264,50 @@ class URL:
 
     def get_domain(self):
         """Get the domain from a URL.
+
         :param url: URL to parse
-        :returns: Just the domain name extracted from the URL
+        :type url: str
+        :returns: Domain name extracted from URL
+        :rtype: str
+
         """
         # TODO: Properly handle exception.
         try:
             return get_tld(self.url, as_object=True, fix_protocol=True).parsed_url.netloc.lower().lstrip("www.")
-        except:
+        except Exception:
             return None
 
     def get_top_level(self):
-        """Get only the top level domain from a URL.
+        """Get only the top-level domain from a URL.
+
         :param url: URL to parse
-        :returns: The top level domain extracted from the URL
+        :type url: str
+        :returns: Top-level domain name extracted from URL
+        :rtype: str
+
         """
         # TODO: Properly handle exception.
         try:
             return get_tld(self.url, as_object=True, fix_protocol=True).fld.lower()
-        except:
+        except Exception:
             return None
 
-    def check_if_shortened(self):
+    def check_if_shortened(self) -> bool:
+        """Check if the URL is among list of shortener services.
+
+
+        :returns: True if the URL is shortened, otherwise False
+
+        :rtype: bool
+
+        """
         if self.domain.lower() in SHORTENER_DOMAINS:
             self.is_shortened = True
 
         return self.is_shortened
 
     def unshorten(self):
+        """Unshorten the URL by requesting an HTTP HEAD response."""
         res = requests.head(self.url)
         if str(res.status_code).startswith("30"):
             return res.headers["Location"]

mvt/common/utils.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -10,8 +10,13 @@ import re
 
 def convert_mactime_to_unix(timestamp, from_2001=True):
     """Converts Mac Standard Time to a Unix timestamp.
-    :param timestamp: MacTime timestamp (either int or float)
-    :returns: Unix epoch timestamp
+
+    :param timestamp: MacTime timestamp (either int or float).
+    :type timestamp: int
+    :param from_2001: bool: Whether to (Default value = True)
+    :param from_2001: Default value = True)
+    :returns: Unix epoch timestamp.
+
     """
     if not timestamp:
         return None
@@ -34,35 +39,49 @@ def convert_mactime_to_unix(timestamp, from_2001=True):
 
 def convert_chrometime_to_unix(timestamp):
     """Converts Chrome timestamp to a Unix timestamp.
-    :param timestamp: Chrome timestamp as int
-    :returns: Unix epoch timestamp
+
+    :param timestamp: Chrome timestamp as int.
+    :type timestamp: int
+    :returns: Unix epoch timestamp.
+
     """
-    epoch_start = datetime.datetime(1601, 1 , 1)
+    epoch_start = datetime.datetime(1601, 1, 1)
     delta = datetime.timedelta(microseconds=timestamp)
     return epoch_start + delta
 
 
 def convert_timestamp_to_iso(timestamp):
     """Converts Unix timestamp to ISO string.
-    :param timestamp: Unix timestamp
-    :returns: ISO timestamp string in YYYY-mm-dd HH:MM:SS.ms format
+
+    :param timestamp: Unix timestamp.
+    :type timestamp: int
+    :returns: ISO timestamp string in YYYY-mm-dd HH:MM:SS.ms format.
+    :rtype: str
+
     """
     try:
         return timestamp.strftime("%Y-%m-%d %H:%M:%S.%f")
     except Exception:
         return None
 
+
 def check_for_links(text):
     """Checks if a given text contains HTTP links.
-    :param text: Any provided text
-    :returns: Search results
+
+    :param text: Any provided text.
+    :type text: str
+    :returns: Search results.
+
     """
     return re.findall("(?P<url>https?://[^\s]+)", text, re.IGNORECASE)
 
+
 def get_sha256_from_file_path(file_path):
     """Calculate the SHA256 hash of a file from a file path.
+
     :param file_path: Path to the file to hash
     :returns: The SHA256 hash string
+
     """
     sha256_hash = hashlib.sha256()
     with open(file_path, "rb") as handle:
@@ -71,12 +90,16 @@ def get_sha256_from_file_path(file_path):
 
     return sha256_hash.hexdigest()
 
+
 # Note: taken from here:
 # https://stackoverflow.com/questions/57014259/json-dumps-on-dictionary-with-bytes-for-keys
 def keys_bytes_to_string(obj):
     """Convert object keys from bytes to string.
+
     :param obj: Object to convert from bytes to string.
-    :returns: Converted object.
+    :returns: Object converted to string.
+    :rtype: str
+
     """
     new_obj = {}
     if not isinstance(obj, dict):

mvt/common/version.py

@@ -1,12 +1,13 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import requests
 from packaging import version
 
-MVT_VERSION = "1.3"
+MVT_VERSION = "1.4.11"
+
 
 def check_for_updates():
     res = requests.get("https://pypi.org/pypi/mvt/json")

mvt/ios/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/cli.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -10,8 +10,10 @@ import click
 from rich.logging import RichHandler
 from rich.prompt import Prompt
 
-from mvt.common.help import *
-from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.common.help import (HELP_MSG_FAST, HELP_MSG_IOC,
+                             HELP_MSG_LIST_MODULES, HELP_MSG_MODULE,
+                             HELP_MSG_OUTPUT)
+from mvt.common.indicators import Indicators, download_indicators_files
 from mvt.common.logo import logo
 from mvt.common.module import run_module, save_timeline
 from mvt.common.options import MutuallyExclusiveOption
@@ -30,6 +32,7 @@ log = logging.getLogger(__name__)
 # Set this environment variable to a password if needed.
 PASSWD_ENV = "MVT_IOS_BACKUP_PASSWORD"
 
+
 #==============================================================================
 # Main
 #==============================================================================
@@ -38,6 +41,14 @@ def cli():
     logo()
 
 
+#==============================================================================
+# Command: version
+#==============================================================================
+@cli.command("version", help="Show the currently installed version of MVT")
+def version():
+    return
+
+
 #==============================================================================
 # Command: decrypt-backup
 #==============================================================================
@@ -146,13 +157,7 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
             ctx.exit(1)
 
     indicators = Indicators(log=log)
-    for ioc_path in iocs:
-        try:
-            indicators.parse_stix2(ioc_path)
-        except IndicatorsFileBadFormat as e:
-            log.critical(e)
-            ctx.exit(1)
-    log.info("Loaded a total of %d indicators", indicators.ioc_count)
+    indicators.load_indicators_files(iocs)
 
     timeline = []
     timeline_detected = []
@@ -163,8 +168,7 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
         m = backup_module(base_folder=backup_path, output_folder=output, fast_mode=fast,
                           log=logging.getLogger(backup_module.__module__))
         m.is_backup = True
-
-        if iocs:
+        if indicators.total_ioc_count > 0:
             m.indicators = indicators
             m.indicators.log = m.log
 
@@ -178,6 +182,10 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
         if len(timeline_detected) > 0:
             save_timeline(timeline_detected, os.path.join(output, "timeline_detected.csv"))
 
+    if len(timeline_detected) > 0:
+        log.warning("The analysis of the backup produced %d detections!",
+                    len(timeline_detected))
+
 
 #==============================================================================
 # Command: check-fs
@@ -209,13 +217,7 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
             ctx.exit(1)
 
     indicators = Indicators(log=log)
-    for ioc_path in iocs:
-        try:
-            indicators.parse_stix2(ioc_path)
-        except IndicatorsFileBadFormat as e:
-            log.critical(e)
-            ctx.exit(1)
-    log.info("Loaded a total of %d indicators", indicators.ioc_count)
+    indicators.load_indicators_files(iocs)
 
     timeline = []
     timeline_detected = []
@@ -227,8 +229,7 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
                       log=logging.getLogger(fs_module.__module__))
 
         m.is_fs_dump = True
-
-        if iocs:
+        if indicators.total_ioc_count > 0:
             m.indicators = indicators
             m.indicators.log = m.log
 
@@ -242,20 +243,24 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
         if len(timeline_detected) > 0:
             save_timeline(timeline_detected, os.path.join(output, "timeline_detected.csv"))
 
+    if len(timeline_detected) > 0:
+        log.warning("The analysis of the filesystem produced %d detections!",
+                    len(timeline_detected))
+
 
 #==============================================================================
 # Command: check-iocs
 #==============================================================================
 @cli.command("check-iocs", help="Compare stored JSON results to provided indicators")
 @click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], required=True, help=HELP_MSG_IOC)
+              default=[], help=HELP_MSG_IOC)
 @click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
 @click.option("--module", "-m", help=HELP_MSG_MODULE)
 @click.argument("FOLDER", type=click.Path(exists=True))
 @click.pass_context
 def check_iocs(ctx, iocs, list_modules, module, folder):
     all_modules = []
-    for entry in BACKUP_MODULES + FS_MODULES:
+    for entry in BACKUP_MODULES + FS_MODULES + MIXED_MODULES:
         if entry not in all_modules:
             all_modules.append(entry)
 
@@ -269,14 +274,9 @@ def check_iocs(ctx, iocs, list_modules, module, folder):
     log.info("Checking stored results against provided indicators...")
 
     indicators = Indicators(log=log)
-    for ioc_path in iocs:
-        try:
-            indicators.parse_stix2(ioc_path)
-        except IndicatorsFileBadFormat as e:
-            log.critical(e)
-            ctx.exit(1)
-    log.info("Loaded a total of %d indicators", indicators.ioc_count)
+    indicators.load_indicators_files(iocs)
 
+    total_detections = 0
     for file_name in os.listdir(folder):
         name_only, ext = os.path.splitext(file_name)
         file_path = os.path.join(folder, file_name)
@@ -293,11 +293,25 @@ def check_iocs(ctx, iocs, list_modules, module, folder):
 
             m = iocs_module.from_json(file_path,
                                       log=logging.getLogger(iocs_module.__module__))
-
-            m.indicators = indicators
-            m.indicators.log = m.log
+            if indicators.total_ioc_count > 0:
+                m.indicators = indicators
+                m.indicators.log = m.log
 
             try:
                 m.check_indicators()
             except NotImplementedError:
                 continue
+            else:
+                total_detections += len(m.detected)
+
+    if total_detections > 0:
+        log.warning("The check of the results produced %d detections!",
+                    total_detections)
+
+
+#==============================================================================
+# Command: download-iocs
+#==============================================================================
+@cli.command("download-iocs", help="Download public STIX2 indicators")
+def download_iocs():
+    download_indicators_files(log)

mvt/ios/decrypt.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -14,9 +14,12 @@ from iOSbackup import iOSbackup
 
 log = logging.getLogger(__name__)
 
+
 class DecryptBackup:
     """This class provides functions to decrypt an encrypted iTunes backup
     using either a password or a key file.
+
+
     """
 
     def __init__(self, backup_path, dest_path=None):
@@ -35,7 +38,9 @@ class DecryptBackup:
     @staticmethod
     def is_encrypted(backup_path) -> bool:
         """Query Manifest.db file to see if it's encrypted or not.
+
         :param backup_path: Path to the backup to decrypt
+
         """
         conn = sqlite3.connect(os.path.join(backup_path, "Manifest.db"))
         cur = conn.cursor()
@@ -95,7 +100,9 @@ class DecryptBackup:
 
     def decrypt_with_password(self, password):
         """Decrypts an encrypted iOS backup.
+
         :param password: Password to use to decrypt the original backup
+
         """
         log.info("Decrypting iOS backup at path %s with password", self.backup_path)
 
@@ -131,7 +138,9 @@ class DecryptBackup:
 
     def decrypt_with_key_file(self, key_file):
         """Decrypts an encrypted iOS backup using a key file.
+
         :param key_file: File to read the key bytes to decrypt the backup
+
         """
         log.info("Decrypting iOS backup at path %s with key file %s",
                  self.backup_path, key_file)
@@ -158,8 +167,7 @@ class DecryptBackup:
             log.critical("Failed to decrypt backup. Did you provide the correct key file?")
 
     def get_key(self):
-        """Retrieve and prints the encryption key.
-        """
+        """Retrieve and prints the encryption key."""
         if not self._backup:
             return
 
@@ -169,13 +177,15 @@ class DecryptBackup:
 
     def write_key(self, key_path):
         """Save extracted key to file.
+
         :param key_path: Path to the file where to write the derived decryption key.
+
         """
         if not self._decryption_key:
             return
 
         try:
-            with open(key_path, 'w') as handle:
+            with open(key_path, 'w', encoding="utf-8") as handle:
                 handle.write(self._decryption_key)
         except Exception as e:
             log.exception(e)

mvt/ios/modules/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/ios/modules/backup/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/backup/backup_info.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/backup/configuration_profiles.py

@@ -1,18 +1,21 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+import os
 import plistlib
 from base64 import b64encode
 
+from mvt.common.utils import convert_timestamp_to_iso
+
 from ..base import IOSExtraction
 
 CONF_PROFILES_DOMAIN = "SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles"
 
+
 class ConfigurationProfiles(IOSExtraction):
-    """This module extracts the full plist data from configuration profiles.
-    """
+    """This module extracts the full plist data from configuration profiles."""
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):
@@ -20,23 +23,78 @@ class ConfigurationProfiles(IOSExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
+    def serialize(self, record):
+        if not record["install_date"]:
+            return
+
+        payload_name = record['plist'].get('PayloadDisplayName')
+        payload_description = record['plist'].get('PayloadDescription')
+        return {
+            "timestamp": record["install_date"],
+            "module": self.__class__.__name__,
+            "event": "configuration_profile_install",
+            "data": f"{record['plist']['PayloadType']} installed: {record['plist']['PayloadUUID']} - {payload_name}: {payload_description}"
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            if result["plist"].get("PayloadUUID"):
+                payload_content = result["plist"]["PayloadContent"][0]
+
+                # Alert on any known malicious configuration profiles in the indicator list.
+                ioc = self.indicators.check_profile(result["plist"]["PayloadUUID"])
+                if ioc:
+                    self.log.warning(f"Found a known malicious configuration profile \"{result['plist']['PayloadDisplayName']}\" with UUID '{result['plist']['PayloadUUID']}'.")
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+                # Highlight suspicious configuration profiles which may be used to hide notifications.
+                if payload_content["PayloadType"] in ["com.apple.notificationsettings"]:
+                    self.log.warning(f"Found a potentially suspicious configuration profile \"{result['plist']['PayloadDisplayName']}\" with payload type '{payload_content['PayloadType']}'.")
+                    self.detected.append(result)
+                    continue
+
     def run(self):
         for conf_file in self._get_backup_files_from_manifest(domain=CONF_PROFILES_DOMAIN):
+            conf_rel_path = conf_file["relative_path"]
+            # Filter out all configuration files that are not configuration profiles.
+            if not conf_rel_path or not os.path.basename(conf_rel_path).startswith("profile-"):
+                continue
+
             conf_file_path = self._get_backup_file_from_id(conf_file["file_id"])
             if not conf_file_path:
                 continue
 
             with open(conf_file_path, "rb") as handle:
-                conf_plist = plistlib.load(handle)
+                try:
+                    conf_plist = plistlib.load(handle)
+                except Exception:
+                    conf_plist = {}
 
             if "SignerCerts" in conf_plist:
                 conf_plist["SignerCerts"] = [b64encode(x) for x in conf_plist["SignerCerts"]]
+            if "OTAProfileStub" in conf_plist:
+                if "SignerCerts" in conf_plist["OTAProfileStub"]:
+                    conf_plist["OTAProfileStub"]["SignerCerts"] = [b64encode(x) for x in conf_plist["OTAProfileStub"]["SignerCerts"]]
+            if "PushTokenDataSentToServerKey" in conf_plist:
+                conf_plist["PushTokenDataSentToServerKey"] = b64encode(conf_plist["PushTokenDataSentToServerKey"])
+            if "LastPushTokenHash" in conf_plist:
+                conf_plist["LastPushTokenHash"] = b64encode(conf_plist["LastPushTokenHash"])
+            if "PayloadContent" in conf_plist:
+                for x in range(len(conf_plist["PayloadContent"])):
+                    if "PERSISTENT_REF" in conf_plist["PayloadContent"][x]:
+                        conf_plist["PayloadContent"][x]["PERSISTENT_REF"] = b64encode(conf_plist["PayloadContent"][x]["PERSISTENT_REF"])
 
             self.results.append({
                 "file_id": conf_file["file_id"],
                 "relative_path": conf_file["relative_path"],
                 "domain": conf_file["domain"],
                 "plist": conf_plist,
+                "install_date": convert_timestamp_to_iso(conf_plist.get("InstallDate")),
             })
 
         self.log.info("Extracted details about %d configuration profiles", len(self.results))

mvt/ios/modules/backup/manifest.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -27,12 +27,19 @@ class Manifest(IOSExtraction):
     def _get_key(self, dictionary, key):
         """Unserialized plist objects can have keys which are str or byte types
         This is a helper to try fetch a key as both a byte or string type.
+
+        :param dictionary:
+        :param key:
+
         """
         return dictionary.get(key.encode("utf-8"), None) or dictionary.get(key, None)
 
     @staticmethod
     def _convert_timestamp(timestamp_or_unix_time_int):
         """Older iOS versions stored the manifest times as unix timestamps.
+
+        :param timestamp_or_unix_time_int:
+
         """
         if isinstance(timestamp_or_unix_time_int, datetime.datetime):
             return convert_timestamp_to_iso(timestamp_or_unix_time_int)
@@ -65,9 +72,7 @@ class Manifest(IOSExtraction):
             return
 
         for result in self.results:
-            if not "relative_path" in result:
-                continue
-            if not result["relative_path"]:
+            if not result.get("relative_path"):
                 continue
 
             if result["domain"]:
@@ -76,16 +81,15 @@ class Manifest(IOSExtraction):
                     self.detected.append(result)
                     continue
 
-            if self.indicators.check_file(result["relative_path"]):
-                self.log.warning("Found a known malicious file at path: %s", result["relative_path"])
+            if self.indicators.check_file_path("/" + result["relative_path"]):
                 self.detected.append(result)
                 continue
 
-            relPath = result["relative_path"].lower()
-            for ioc in self.indicators.ioc_domains:
-                if ioc.lower() in relPath:
+            rel_path = result["relative_path"].lower()
+            for ioc in self.indicators.get_iocs("domains"):
+                if ioc["value"].lower() in rel_path:
                     self.log.warning("Found mention of domain \"%s\" in a backup file with path: %s",
-                                     ioc, relPath)
+                                     ioc["value"], rel_path)
                     self.detected.append(result)
 
     def run(self):
@@ -126,7 +130,7 @@ class Manifest(IOSExtraction):
                         "owner": self._get_key(file_metadata, "UserID"),
                         "size": self._get_key(file_metadata, "Size"),
                     })
-                except:
+                except Exception:
                     self.log.exception("Error reading manifest file metadata for file with ID %s and relative path %s",
                                        file_data["fileID"], file_data["relativePath"])
                     pass

mvt/ios/modules/backup/profile_events.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -11,9 +11,12 @@ from ..base import IOSExtraction
 
 CONF_PROFILES_EVENTS_RELPATH = "Library/ConfigurationProfiles/MCProfileEvents.plist"
 
+
 class ProfileEvents(IOSExtraction):
     """This module extracts events related to the installation of configuration
     profiles.
+
+
     """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,

mvt/ios/modules/base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -26,25 +26,28 @@ class IOSExtraction(MVTModule):
         self.is_fs_dump = False
         self.is_sysdiagnose = False
 
-    def _recover_sqlite_db_if_needed(self, file_path):
+    def _recover_sqlite_db_if_needed(self, file_path, forced=False):
         """Tries to recover a malformed database by running a .clone command.
+
         :param file_path: Path to the malformed database file.
+
         """
         # TODO: Find a better solution.
-        conn = sqlite3.connect(file_path)
-        cur = conn.cursor()
+        if not forced:
+            conn = sqlite3.connect(file_path)
+            cur = conn.cursor()
 
-        try:
-            recover = False
-            cur.execute("SELECT name FROM sqlite_master WHERE type='table';")
-        except sqlite3.DatabaseError as e:
-            if "database disk image is malformed" in str(e):
-                recover = True
-        finally:
-            conn.close()
+            try:
+                recover = False
+                cur.execute("SELECT name FROM sqlite_master WHERE type='table';")
+            except sqlite3.DatabaseError as e:
+                if "database disk image is malformed" in str(e):
+                    recover = True
+            finally:
+                conn.close()
 
-        if not recover:
-            return
+            if not recover:
+                return
 
         self.log.info("Database at path %s is malformed. Trying to recover...", file_path)
 
@@ -65,8 +68,10 @@ class IOSExtraction(MVTModule):
 
     def _get_backup_files_from_manifest(self, relative_path=None, domain=None):
         """Locate files from Manifest.db.
-        :param relative_path: Relative path to use as filter from Manifest.db.
-        :param domain: Domain to use as filter from Manifest.db.
+
+        :param relative_path: Relative path to use as filter from Manifest.db. (Default value = None)
+        :param domain: Domain to use as filter from Manifest.db. (Default value = None)
+
         """
         manifest_db_path = os.path.join(self.base_folder, "Manifest.db")
         if not os.path.exists(manifest_db_path):
@@ -116,8 +121,11 @@ class IOSExtraction(MVTModule):
         modules that expect to work with a single SQLite database.
         If a module requires to process multiple databases or files,
         you should use the helper functions above.
+
         :param backup_id: iTunes backup database file's ID (or hash).
-        :param root_paths: Glob patterns for files to seek in filesystem dump.
+        :param root_paths: Glob patterns for files to seek in filesystem dump. (Default value = [])
+        :param backup_ids: Default value = None)
+
         """
         file_path = None
         # First we check if the was an explicit file path specified.

mvt/ios/modules/fs/__init__.py

@@ -1,16 +1,19 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+from .analytics import Analytics
 from .cache_files import CacheFiles
 from .filesystem import Filesystem
 from .net_netusage import Netusage
 from .safari_favicon import SafariFavicon
+from .shutdownlog import ShutdownLog
 from .version_history import IOSVersionHistory
 from .webkit_indexeddb import WebkitIndexedDB
 from .webkit_localstorage import WebkitLocalStorage
 from .webkit_safariviewservice import WebkitSafariViewService
 
-FS_MODULES = [CacheFiles, Filesystem, Netusage, SafariFavicon, IOSVersionHistory,
-              WebkitIndexedDB, WebkitLocalStorage, WebkitSafariViewService,]
+FS_MODULES = [CacheFiles, Filesystem, Netusage, Analytics, SafariFavicon, ShutdownLog,
+              IOSVersionHistory, WebkitIndexedDB, WebkitLocalStorage,
+              WebkitSafariViewService]

mvt/ios/modules/fs/analytics.py

@@ -0,0 +1,124 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import plistlib
+import sqlite3
+
+from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+ANALYTICS_DB_PATH = [
+    "private/var/Keychains/Analytics/*.db",
+]
+
+
+class Analytics(IOSExtraction):
+    """This module extracts information from the private/var/Keychains/Analytics/*.db files."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["timestamp"],
+            "module": self.__class__.__name__,
+            "event": record["artifact"],
+            "data": f"{record}",
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            for value in result.values():
+                if not isinstance(value, str):
+                    continue
+
+                ioc = self.indicators.check_process(value)
+                if ioc:
+                    self.log.warning("Found mention of a malicious process \"%s\" in %s file at %s",
+                                     value, result["artifact"], result["timestamp"])
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+                ioc = self.indicators.check_domain(value)
+                if ioc:
+                    self.log.warning("Found mention of a malicious domain \"%s\" in %s file at %s",
+                                     value, result["artifact"], result["timestamp"])
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+
+    def _extract_analytics_data(self):
+        artifact = self.file_path.split("/")[-1]
+
+        conn = sqlite3.connect(self.file_path)
+        cur = conn.cursor()
+
+        try:
+            cur.execute("""
+                SELECT
+                    timestamp,
+                    data
+                FROM hard_failures
+                UNION
+                SELECT
+                    timestamp,
+                    data
+                FROM soft_failures
+                UNION
+                SELECT
+                    timestamp,
+                    data
+                FROM all_events;
+            """)
+        except sqlite3.OperationalError:
+            cur.execute("""
+                SELECT
+                    timestamp,
+                    data
+                FROM hard_failures
+                UNION
+                SELECT
+                    timestamp,
+                    data
+                FROM soft_failures;
+            """)
+
+        for row in cur:
+            if row[0] and row[1]:
+                timestamp = convert_timestamp_to_iso(convert_mactime_to_unix(row[0], False))
+                data = plistlib.loads(row[1])
+                data["timestamp"] = timestamp
+            elif row[0]:
+                timestamp = convert_timestamp_to_iso(convert_mactime_to_unix(row[0], False))
+                data = {}
+                data["timestamp"] = timestamp
+            elif row[1]:
+                timestamp = ""
+                data = plistlib.loads(row[1])
+                data["timestamp"] = timestamp
+
+            data["artifact"] = artifact
+
+            self.results.append(data)
+
+        self.results = sorted(self.results, key=lambda entry: entry["timestamp"])
+
+        cur.close()
+        conn.close()
+
+        self.log.info("Extracted information on %d analytics data from %s", len(self.results), artifact)
+
+    def run(self):
+        for file_path in self._get_fs_files_from_patterns(ANALYTICS_DB_PATH):
+            self.file_path = file_path
+            self.log.info("Found Analytics database file at path: %s", file_path)
+            self._extract_analytics_data()

mvt/ios/modules/fs/cache_files.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -34,13 +34,15 @@ class CacheFiles(IOSExtraction):
             return
 
         self.detected = {}
-        for key, items in self.results.items():
-            for item in items:
-                if self.indicators.check_domain(item["url"]):
+        for key, values in self.results.items():
+            for value in values:
+                ioc = self.indicators.check_domain(value["url"])
+                if ioc:
+                    value["matched_indicator"] = ioc
                     if key not in self.detected:
-                        self.detected[key] = [item,]
+                        self.detected[key] = [value, ]
                     else:
-                        self.detected[key].append(item)
+                        self.detected[key].append(value)
 
     def _process_cache_file(self, file_path):
         self.log.info("Processing cache file at path: %s", file_path)
@@ -54,7 +56,7 @@ class CacheFiles(IOSExtraction):
             return
 
         key_name = os.path.relpath(file_path, self.base_folder)
-        if not key_name in self.results:
+        if key_name not in self.results:
             self.results[key_name] = []
 
         for row in cur:

mvt/ios/modules/fs/filesystem.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -13,7 +13,10 @@ from ..base import IOSExtraction
 
 class Filesystem(IOSExtraction):
     """This module extracts creation and modification date of files from a
-    full file-system dump."""
+    full file-system dump.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):
@@ -25,8 +28,8 @@ class Filesystem(IOSExtraction):
         return {
             "timestamp": record["modified"],
             "module": self.__class__.__name__,
-            "event": "file_modified",
-            "data": record["file_path"],
+            "event": "entry_modified",
+            "data": record["path"],
         }
 
     def check_indicators(self):
@@ -34,19 +37,48 @@ class Filesystem(IOSExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_file(result["file_path"]):
+            if "path" not in result:
+                continue
+
+            ioc = self.indicators.check_file_path(result["path"])
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
+            # If we are instructed to run fast, we skip the rest.
+            if self.fast_mode:
+                continue
+
+            for ioc in self.indicators.get_iocs("processes"):
+                parts = result["path"].split("/")
+                if ioc["value"] in parts:
+                    self.log.warning("Found known suspicious process name mentioned in file at path \"%s\" matching indicators from \"%s\"",
+                                     result["path"], ioc["name"])
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+
     def run(self):
         for root, dirs, files in os.walk(self.base_folder):
+            for dir_name in dirs:
+                try:
+                    dir_path = os.path.join(root, dir_name)
+                    result = {
+                        "path": os.path.relpath(dir_path, self.base_folder),
+                        "modified": convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(os.stat(dir_path).st_mtime)),
+                    }
+                except Exception:
+                    continue
+                else:
+                    self.results.append(result)
+
             for file_name in files:
                 try:
                     file_path = os.path.join(root, file_name)
                     result = {
-                        "file_path": os.path.relpath(file_path, self.base_folder),
+                        "path": os.path.relpath(file_path, self.base_folder),
                         "modified": convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(os.stat(file_path).st_mtime)),
                     }
-                except:
+                except Exception:
                     continue
                 else:
                     self.results.append(result)

mvt/ios/modules/fs/net_netusage.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -12,9 +12,13 @@ NETUSAGE_ROOT_PATHS = [
     "private/var/networkd/db/netusage.sqlite"
 ]
 
+
 class Netusage(NetBase):
     """This class extracts data from netusage.sqlite and attempts to identify
-    any suspicious processes if running on a full filesystem dump."""
+    any suspicious processes if running on a full filesystem dump.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):

mvt/ios/modules/fs/safari_favicon.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -14,6 +14,7 @@ SAFARI_FAVICON_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/Library/Image Cache/Favicons/Favicons.db",
 ]
 
+
 class SafariFavicon(IOSExtraction):
     """This module extracts all Safari favicon records."""
 
@@ -36,7 +37,12 @@ class SafariFavicon(IOSExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_domain(result["url"]) or self.indicators.check_domain(result["icon_url"]):
+            ioc = self.indicators.check_domain(result["url"])
+            if not ioc:
+                ioc = self.indicators.check_domain(result["icon_url"])
+
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
     def _process_favicon_db(self, file_path):

mvt/ios/modules/fs/shutdownlog.py

@@ -0,0 +1,90 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+SHUTDOWN_LOG_PATH = [
+    "private/var/db/diagnostics/shutdown.log",
+]
+
+
+class ShutdownLog(IOSExtraction):
+    """This module extracts processes information from the shutdown log file."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["isodate"],
+            "module": self.__class__.__name__,
+            "event": "shutdown",
+            "data": f"Client {record['client']} with PID {record['pid']} was running when the device was shut down",
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_file_path(result["client"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+            for ioc in self.indicators.get_iocs("processes"):
+                parts = result["client"].split("/")
+                if ioc in parts:
+                    self.log.warning("Found mention of a known malicious process \"%s\" in shutdown.log",
+                                     ioc)
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+    def process_shutdownlog(self, content):
+        current_processes = []
+        for line in content.split("\n"):
+            line = line.strip()
+
+            if line.startswith("remaining client pid:"):
+                current_processes.append({
+                    "pid": line[line.find("pid: ")+5:line.find(" (")],
+                    "client": line[line.find("(")+1:line.find(")")],
+                })
+            elif line.startswith("SIGTERM: "):
+                try:
+                    mac_timestamp = int(line[line.find("[")+1:line.find("]")])
+                except ValueError:
+                    try:
+                        start = line.find(" @")+2
+                        mac_timestamp = int(line[start:start+10])
+                    except Exception:
+                        mac_timestamp = 0
+
+                timestamp = convert_mactime_to_unix(mac_timestamp, from_2001=False)
+                isodate = convert_timestamp_to_iso(timestamp)
+
+                for current_process in current_processes:
+                    self.results.append({
+                        "isodate": isodate,
+                        "pid": current_process["pid"],
+                        "client": current_process["client"],
+                    })
+
+                current_processes = []
+
+        self.results = sorted(self.results, key=lambda entry: entry["isodate"])
+
+    def run(self):
+        self._find_ios_database(root_paths=SHUTDOWN_LOG_PATH)
+        self.log.info("Found shutdown log at path: %s", self.file_path)
+        with open(self.file_path, "r", encoding="utf-8") as handle:
+            self.process_shutdownlog(handle.read())

mvt/ios/modules/fs/version_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -14,6 +14,7 @@ IOS_ANALYTICS_JOURNAL_PATHS = [
     "private/var/db/analyticsd/Analytics-Journal-*.ips",
 ]
 
+
 class IOSVersionHistory(IOSExtraction):
     """This module extracts iOS update history from Analytics Journal log files."""
 
@@ -33,7 +34,7 @@ class IOSVersionHistory(IOSExtraction):
 
     def run(self):
         for found_path in self._get_fs_files_from_patterns(IOS_ANALYTICS_JOURNAL_PATHS):
-            with open(found_path, "r") as analytics_log:
+            with open(found_path, "r", encoding="utf-8") as analytics_log:
                 log_line = json.loads(analytics_log.readline().strip())
 
                 timestamp = datetime.datetime.strptime(log_line["timestamp"],

mvt/ios/modules/fs/webkit_base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -18,9 +18,11 @@ class WebkitBase(IOSExtraction):
         if not self.indicators:
             return
 
-        for item in self.results:
-            if self.indicators.check_domain(item["url"]):
-                self.detected.append(item)
+        for result in self.results:
+            ioc = self.indicators.check_domain(result["url"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
 
     def _process_webkit_folder(self, root_paths):
         for found_path in self._get_fs_files_from_patterns(root_paths):

mvt/ios/modules/fs/webkit_indexeddb.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -9,9 +9,13 @@ WEBKIT_INDEXEDDB_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/IndexedDB",
 ]
 
+
 class WebkitIndexedDB(WebkitBase):
     """This module looks extracts records from WebKit IndexedDB folders,
-    and checks them against any provided list of suspicious domains."""
+    and checks them against any provided list of suspicious domains.
+
+
+    """
 
     slug = "webkit_indexeddb"
 

mvt/ios/modules/fs/webkit_localstorage.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -9,9 +9,13 @@ WEBKIT_LOCALSTORAGE_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/LocalStorage/",
 ]
 
+
 class WebkitLocalStorage(WebkitBase):
     """This module looks extracts records from WebKit LocalStorage folders,
-    and checks them against any provided list of suspicious domains."""
+    and checks them against any provided list of suspicious domains.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):

mvt/ios/modules/fs/webkit_safariviewservice.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -9,9 +9,13 @@ WEBKIT_SAFARIVIEWSERVICE_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/",
 ]
 
+
 class WebkitSafariViewService(WebkitBase):
     """This module looks extracts records from WebKit LocalStorage folders,
-    and checks them against any provided list of suspicious domains."""
+    and checks them against any provided list of suspicious domains.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):

mvt/ios/modules/mixed/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -13,15 +13,19 @@ from .idstatuscache import IDStatusCache
 from .interactionc import InteractionC
 from .locationd import LocationdClients
 from .net_datausage import Datausage
+from .osanalytics_addaily import OSAnalyticsADDaily
 from .safari_browserstate import SafariBrowserState
 from .safari_history import SafariHistory
+from .shortcuts import Shortcuts
 from .sms import SMS
 from .sms_attachments import SMSAttachments
+from .tcc import TCC
 from .webkit_resource_load_statistics import WebkitResourceLoadStatistics
 from .webkit_session_resource_log import WebkitSessionResourceLog
 from .whatsapp import Whatsapp
 
 MIXED_MODULES = [Calls, ChromeFavicon, ChromeHistory, Contacts, FirefoxFavicon,
                  FirefoxHistory, IDStatusCache, InteractionC, LocationdClients,
-                 Datausage, SafariBrowserState, SafariHistory, SMS, SMSAttachments,
-                 WebkitResourceLoadStatistics, WebkitSessionResourceLog, Whatsapp,]
+                 OSAnalyticsADDaily, Datausage, SafariBrowserState, SafariHistory,
+                 TCC, SMS, SMSAttachments, WebkitResourceLoadStatistics,
+                 WebkitSessionResourceLog, Whatsapp, Shortcuts]

mvt/ios/modules/mixed/calls.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -16,6 +16,7 @@ CALLS_ROOT_PATHS = [
     "private/var/mobile/Library/CallHistoryDB/CallHistory.storedata"
 ]
 
+
 class Calls(IOSExtraction):
     """This module extracts phone calls details"""
 
@@ -45,7 +46,7 @@ class Calls(IOSExtraction):
                 ZDATE, ZDURATION, ZLOCATION, ZADDRESS, ZSERVICE_PROVIDER
             FROM ZCALLRECORD;
         """)
-        names = [description[0] for description in cur.description]
+        # names = [description[0] for description in cur.description]
 
         for row in cur:
             self.results.append({

mvt/ios/modules/mixed/chrome_favicon.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -19,6 +19,7 @@ CHROME_FAVICON_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/Library/Application Support/Google/Chrome/Default/Favicons",
 ]
 
+
 class ChromeFavicon(IOSExtraction):
     """This module extracts all Chrome favicon records."""
 
@@ -41,7 +42,12 @@ class ChromeFavicon(IOSExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_domain(result["url"]) or self.indicators.check_domain(result["icon_url"]):
+            ioc = self.indicators.check_domain(result["url"])
+            if not ioc:
+                ioc = self.indicators.check_domain(result["icon_url"])
+
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
     def run(self):

mvt/ios/modules/mixed/chrome_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -13,12 +13,12 @@ from ..base import IOSExtraction
 CHROME_HISTORY_BACKUP_IDS = [
     "faf971ce92c3ac508c018dce1bef2a8b8e9838f1",
 ]
-
 # TODO: Confirm Chrome database path.
 CHROME_HISTORY_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/Library/Application Support/Google/Chrome/Default/History",
 ]
 
+
 class ChromeHistory(IOSExtraction):
     """This module extracts all Chome visits."""
 
@@ -41,7 +41,9 @@ class ChromeHistory(IOSExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_domain(result["url"]):
+            ioc = self.indicators.check_domain(result["url"])
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
     def run(self):

mvt/ios/modules/mixed/contacts.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -14,6 +14,7 @@ CONTACTS_ROOT_PATHS = [
     "private/var/mobile/Library/AddressBook/AddressBook.sqlitedb",
 ]
 
+
 class Contacts(IOSExtraction):
     """This module extracts all contact details from the phone's address book."""
 

mvt/ios/modules/mixed/firefox_favicon.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -17,6 +17,7 @@ FIREFOX_HISTORY_ROOT_PATHS = [
     "private/var/mobile/profile.profile/browser.db",
 ]
 
+
 class FirefoxFavicon(IOSExtraction):
     """This module extracts all Firefox favicon"""
 
@@ -39,8 +40,12 @@ class FirefoxFavicon(IOSExtraction):
             return
 
         for result in self.results:
-            if (self.indicators.check_domain(result.get("url", "")) or 
-                self.indicators.check_domain(result.get("history_url", ""))):
+            ioc = self.indicators.check_domain(result.get("url", ""))
+            if not ioc:
+                ioc = self.indicators.check_domain(result.get("history_url", ""))
+
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
     def run(self):

mvt/ios/modules/mixed/firefox_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -17,9 +17,13 @@ FIREFOX_HISTORY_ROOT_PATHS = [
     "private/var/mobile/profile.profile/browser.db",
 ]
 
+
 class FirefoxHistory(IOSExtraction):
     """This module extracts all Firefox visits and tries to detect potential
-    network injection attacks."""
+    network injection attacks.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):
@@ -40,7 +44,9 @@ class FirefoxHistory(IOSExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_domain(result["url"]):
+            ioc = self.indicators.check_domain(result["url"])
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
     def run(self):

mvt/ios/modules/mixed/idstatuscache.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -18,6 +18,7 @@ IDSTATUSCACHE_ROOT_PATHS = [
     "private/var/mobile/Library/IdentityServices/idstatuscache.plist",
 ]
 
+
 class IDStatusCache(IOSExtraction):
     """Extracts Apple Authentication information from idstatuscache.plist"""
 
@@ -42,7 +43,9 @@ class IDStatusCache(IOSExtraction):
         for result in self.results:
             if result.get("user", "").startswith("mailto:"):
                 email = result["user"][7:].strip("'")
-                if self.indicators.check_email(email):
+                ioc = self.indicators.check_email(email)
+                if ioc:
+                    result["matched_indicator"] = ioc
                     self.detected.append(result)
                     continue
 
@@ -51,12 +54,8 @@ class IDStatusCache(IOSExtraction):
                                  result.get("user"))
                 self.detected.append(result)
 
-    def run(self):
-        self._find_ios_database(backup_ids=IDSTATUSCACHE_BACKUP_IDS,
-                                root_paths=IDSTATUSCACHE_ROOT_PATHS)
-        self.log.info("Found IDStatusCache plist at path: %s", self.file_path)
-
-        with open(self.file_path, "rb") as handle:
+    def _extract_idstatuscache_entries(self, file_path):
+        with open(file_path, "rb") as handle:
             file_plist = plistlib.load(handle)
 
         id_status_cache_entries = []
@@ -84,4 +83,16 @@ class IDStatusCache(IOSExtraction):
             entry["occurrences"] = entry_counter[entry["user"]]
             self.results.append(entry)
 
+    def run(self):
+
+        if self.is_backup:
+            self._find_ios_database(backup_ids=IDSTATUSCACHE_BACKUP_IDS)
+            self.log.info("Found IDStatusCache plist at path: %s", self.file_path)
+            self._extract_idstatuscache_entries(self.file_path)
+        elif self.is_fs_dump:
+            for idstatuscache_path in self._get_fs_files_from_patterns(IDSTATUSCACHE_ROOT_PATHS):
+                self.file_path = idstatuscache_path
+                self.log.info("Found IDStatusCache plist at path: %s", self.file_path)
+                self._extract_idstatuscache_entries(self.file_path)
+
         self.log.info("Extracted a total of %d ID Status Cache entries", len(self.results))

mvt/ios/modules/mixed/interactionc.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -16,6 +16,7 @@ INTERACTIONC_ROOT_PATHS = [
     "private/var/mobile/Library/CoreDuet/People/interactionC.db",
 ]
 
+
 class InteractionC(IOSExtraction):
     """This module extracts data from InteractionC db."""
 
@@ -54,8 +55,8 @@ class InteractionC(IOSExtraction):
                 "timestamp": record[ts],
                 "module": self.__class__.__name__,
                 "event": ts,
-                "data": f"[{record['bundle_id']}] {record['account']} - from {record['sender_display_name']} " \
-                        f"({record['sender_identifier']}) to {record['recipient_display_name']} " \
+                "data": f"[{record['bundle_id']}] {record['account']} - from {record['sender_display_name']} "
+                        f"({record['sender_identifier']}) to {record['recipient_display_name']} "
                         f"({record['recipient_identifier']}): {record['content']}"
             })
             processed.append(record[ts])
@@ -123,8 +124,7 @@ class InteractionC(IOSExtraction):
                 LEFT JOIN Z_2INTERACTIONRECIPIENT ON ZINTERACTIONS.Z_PK== Z_2INTERACTIONRECIPIENT.Z_3INTERACTIONRECIPIENT
                 LEFT JOIN ZCONTACTS RECEIPIENTCONACT ON Z_2INTERACTIONRECIPIENT.Z_2RECIPIENTS== RECEIPIENTCONACT.Z_PK;
         """)
-
-        names = [description[0] for description in cur.description]
+        # names = [description[0] for description in cur.description]
 
         for row in cur:
             self.results.append({

mvt/ios/modules/mixed/locationd.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -14,10 +14,12 @@ LOCATIOND_BACKUP_IDS = [
 ]
 LOCATIOND_ROOT_PATHS = [
     "private/var/mobile/Library/Caches/locationd/clients.plist",
+    "private/var/root/Library/Caches/locationd/clients.plist"
 ]
 
+
 class LocationdClients(IOSExtraction):
-    """Extract information from apps who used geolocation"""
+    """Extract information from apps who used geolocation."""
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):
@@ -39,33 +41,83 @@ class LocationdClients(IOSExtraction):
 
     def serialize(self, record):
         records = []
-        for ts in self.timestamps:
-            if ts in record.keys():
+        for timestamp in self.timestamps:
+            if timestamp in record.keys():
                 records.append({
-                    "timestamp": record[ts],
+                    "timestamp": record[timestamp],
                     "module": self.__class__.__name__,
-                    "event": ts,
-                    "data": f"{ts} from {record['package']}"
+                    "event": timestamp,
+                    "data": f"{timestamp} from {record['package']}"
                 })
 
         return records
 
-    def run(self):
-        self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS,
-                                root_paths=LOCATIOND_ROOT_PATHS)
-        self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
+    def check_indicators(self):
+        if not self.indicators:
+            return
 
-        with open(self.file_path, "rb") as handle:
+        for result in self.results:
+            parts = result["package"].split("/")
+            proc_name = parts[len(parts)-1]
+
+            ioc = self.indicators.check_process(proc_name)
+            if ioc:
+                self.log.warning("Found a suspicious process name in LocationD entry %s",
+                                 result["package"])
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+            if "BundlePath" in result:
+                ioc = self.indicators.check_file_path(result["BundlePath"])
+                if ioc:
+                    self.log.warning("Found a suspicious file path in Location D: %s",
+                                     result["BundlePath"])
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+            if "Executable" in result:
+                ioc = self.indicators.check_file_path(result["Executable"])
+                if ioc:
+                    self.log.warning("Found a suspicious file path in Location D: %s",
+                                     result["Executable"])
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+            if "Registered" in result:
+                ioc = self.indicators.check_file_path(result["Registered"])
+                if ioc:
+                    self.log.warning("Found a suspicious file path in Location D: %s",
+                                     result["Registered"])
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+    def _extract_locationd_entries(self, file_path):
+        with open(file_path, "rb") as handle:
             file_plist = plistlib.load(handle)
 
-        for app in file_plist:
-            if file_plist[app] is dict:
-                result = file_plist[app]
-                result["package"] = app
-                for ts in self.timestamps:
-                    if ts in result.keys():
-                        result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))
+        for key, values in file_plist.items():
+            result = file_plist[key]
+            result["package"] = key
+            for ts in self.timestamps:
+                if ts in result.keys():
+                    result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))
 
-                self.results.append(result)
+            self.results.append(result)
+
+    def run(self):
+
+        if self.is_backup:
+            self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS)
+            self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
+            self._extract_locationd_entries(self.file_path)
+        elif self.is_fs_dump:
+            for locationd_path in self._get_fs_files_from_patterns(LOCATIOND_ROOT_PATHS):
+                self.file_path = locationd_path
+                self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
+                self._extract_locationd_entries(self.file_path)
 
         self.log.info("Extracted a total of %d Locationd Clients entries", len(self.results))

mvt/ios/modules/mixed/net_datausage.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -12,9 +12,13 @@ DATAUSAGE_ROOT_PATHS = [
     "private/var/wireless/Library/Databases/DataUsage.sqlite",
 ]
 
+
 class Datausage(NetBase):
     """This class extracts data from DataUsage.sqlite and attempts to identify
-    any suspicious processes if running on a full filesystem dump."""
+    any suspicious processes if running on a full filesystem dump.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):

mvt/ios/modules/mixed/osanalytics_addaily.py

@@ -0,0 +1,67 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import plistlib
+
+from mvt.common.utils import convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+OSANALYTICS_ADDAILY_BACKUP_IDS = [
+    "f65b5fafc69bbd3c60be019c6e938e146825fa83",
+]
+OSANALYTICS_ADDAILY_ROOT_PATHS = [
+    "private/var/mobile/Library/Preferences/com.apple.osanalytics.addaily.plist",
+]
+
+
+class OSAnalyticsADDaily(IOSExtraction):
+    """Extract network usage information by process, from com.apple.osanalytics.addaily.plist"""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        record_data = f"{record['package']} WIFI IN: {record['wifi_in']}, WIFI OUT: {record['wifi_out']} - "  \
+                      f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"
+        return {
+            "timestamp": record["ts"],
+            "module": self.__class__.__name__,
+            "event": "osanalytics_addaily",
+            "data": record_data,
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_process(result["package"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+
+    def run(self):
+        self._find_ios_database(backup_ids=OSANALYTICS_ADDAILY_BACKUP_IDS,
+                                root_paths=OSANALYTICS_ADDAILY_ROOT_PATHS)
+        self.log.info("Found com.apple.osanalytics.addaily plist at path: %s", self.file_path)
+
+        with open(self.file_path, "rb") as handle:
+            file_plist = plistlib.load(handle)
+
+        for app, values in file_plist.get("netUsageBaseline", {}).items():
+            self.results.append({
+                "package": app,
+                "ts": convert_timestamp_to_iso(values[0]),
+                "wifi_in": values[1],
+                "wifi_out": values[2],
+                "wwan_in": values[3],
+                "wwan_out": values[4],
+            })
+
+        self.log.info("Extracted a total of %d com.apple.osanalytics.addaily entries", len(self.results))

mvt/ios/modules/mixed/safari_browserstate.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -13,15 +13,13 @@ from mvt.common.utils import (convert_mactime_to_unix,
 
 from ..base import IOSExtraction
 
-SAFARI_BROWSER_STATE_BACKUP_IDS = [
-    "3a47b0981ed7c10f3e2800aa66bac96a3b5db28e",
-]
 SAFARI_BROWSER_STATE_BACKUP_RELPATH = "Library/Safari/BrowserState.db"
 SAFARI_BROWSER_STATE_ROOT_PATHS = [
     "private/var/mobile/Library/Safari/BrowserState.db",
     "private/var/mobile/Containers/Data/Application/*/Library/Safari/BrowserState.db",
 ]
 
+
 class SafariBrowserState(IOSExtraction):
     """This module extracts all Safari browser state records."""
 
@@ -46,32 +44,48 @@ class SafariBrowserState(IOSExtraction):
             return
 
         for result in self.results:
-            if "tab_url" in result and self.indicators.check_domain(result["tab_url"]):
-                self.detected.append(result)
-                continue
+            if "tab_url" in result:
+                ioc = self.indicators.check_domain(result["tab_url"])
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
 
-            if not "session_data" in result:
+            if "session_data" not in result:
                 continue
 
             for session_entry in result["session_data"]:
-                if "entry_url" in session_entry and self.indicators.check_domain(session_entry["entry_url"]):
-                    self.detected.append(result)
+                if "entry_url" in session_entry:
+                    ioc = self.indicators.check_domain(session_entry["entry_url"])
+                    if ioc:
+                        result["matched_indicator"] = ioc
+                        self.detected.append(result)
 
     def _process_browser_state_db(self, db_path):
+        self._recover_sqlite_db_if_needed(db_path)
         conn = sqlite3.connect(db_path)
 
         cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                tabs.title,
-                tabs.url,
-                tabs.user_visible_url,
-                tabs.last_viewed_time,
-                tab_sessions.session_data
-            FROM tabs
-            JOIN tab_sessions ON tabs.uuid = tab_sessions.tab_uuid
-            ORDER BY tabs.last_viewed_time;
-        """)
+        try:
+            cur.execute("""
+                SELECT
+                    tabs.title,
+                    tabs.url,
+                    tabs.user_visible_url,
+                    tabs.last_viewed_time,
+                    tab_sessions.session_data
+                FROM tabs
+                JOIN tab_sessions ON tabs.uuid = tab_sessions.tab_uuid
+                ORDER BY tabs.last_viewed_time;
+            """)
+        except sqlite3.OperationalError:
+            # Old version iOS <12 likely
+            cur.execute("""
+                SELECT
+                    title, url, user_visible_url, last_viewed_time, session_data
+                FROM tabs
+                ORDER BY last_viewed_time;
+            """)
 
         for row in cur:
             session_entries = []
@@ -79,8 +93,12 @@ class SafariBrowserState(IOSExtraction):
             if row[4]:
                 # Skip a 4 byte header before the plist content.
                 session_plist = row[4][4:]
-                session_data = plistlib.load(io.BytesIO(session_plist))
-                session_data = keys_bytes_to_string(session_data)
+                session_data = {}
+                try:
+                    session_data = plistlib.load(io.BytesIO(session_plist))
+                    session_data = keys_bytes_to_string(session_data)
+                except plistlib.InvalidFileException:
+                    pass
 
                 if "SessionHistoryEntries" in session_data.get("SessionHistory", {}):
                     for session_entry in session_data["SessionHistory"].get("SessionHistoryEntries"):
@@ -101,12 +119,16 @@ class SafariBrowserState(IOSExtraction):
             })
 
     def run(self):
-        # TODO: Is there really only one BrowserState.db in a device?
-        self._find_ios_database(backup_ids=SAFARI_BROWSER_STATE_BACKUP_IDS,
-                                root_paths=SAFARI_BROWSER_STATE_ROOT_PATHS)
-        self.log.info("Found Safari browser state database at path: %s", self.file_path)
-
-        self._process_browser_state_db(self.file_path)
+        if self.is_backup:
+            for backup_file in self._get_backup_files_from_manifest(relative_path=SAFARI_BROWSER_STATE_BACKUP_RELPATH):
+                self.file_path = self._get_backup_file_from_id(backup_file["file_id"])
+                self.log.info("Found Safari browser state database at path: %s", self.file_path)
+                self._process_browser_state_db(self.file_path)
+        elif self.is_fs_dump:
+            for safari_browserstate_path in self._get_fs_files_from_patterns(SAFARI_BROWSER_STATE_ROOT_PATHS):
+                self.file_path = safari_browserstate_path
+                self.log.info("Found Safari browser state database at path: %s", self.file_path)
+                self._process_browser_state_db(self.file_path)
 
         self.log.info("Extracted a total of %d tab records and %d session history entries",
                       len(self.results), self._session_history_count)

mvt/ios/modules/mixed/safari_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -17,9 +17,13 @@ SAFARI_HISTORY_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/Library/Safari/History.db",
 ]
 
+
 class SafariHistory(IOSExtraction):
     """This module extracts all Safari visits and tries to detect potential
-    network injection attacks."""
+    network injection attacks.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):
@@ -59,7 +63,7 @@ class SafariHistory(IOSExtraction):
                     continue
 
                 self.log.info("Found HTTP redirect to different domain: \"%s\" -> \"%s\"",
-                         origin_domain, redirect_domain)
+                              origin_domain, redirect_domain)
 
                 redirect_time = convert_mactime_to_unix(redirect["timestamp"])
                 origin_time = convert_mactime_to_unix(result["timestamp"])
@@ -76,7 +80,9 @@ class SafariHistory(IOSExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_domain(result["url"]):
+            ioc = self.indicators.check_domain(result["url"])
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
 
     def _process_history_db(self, history_path):

mvt/ios/modules/mixed/shortcuts.py

@@ -0,0 +1,121 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import io
+import itertools
+import plistlib
+import sqlite3
+
+from mvt.common.utils import (check_for_links, convert_mactime_to_unix,
+                              convert_timestamp_to_iso)
+
+from ..base import IOSExtraction
+
+SHORTCUT_BACKUP_IDS = [
+    "5b4d0b44b5990f62b9f4d34ad8dc382bf0b01094",
+]
+SHORTCUT_ROOT_PATHS = [
+    "private/var/mobile/Library/Shortcuts/Shortcuts.sqlite",
+]
+
+
+class Shortcuts(IOSExtraction):
+    """This module extracts all info about SMS/iMessage attachments."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        found_urls = ""
+        if record["action_urls"]:
+            found_urls = "- URLs in actions: {}".format(", ".join(record["action_urls"]))
+        desc = ""
+        if record["description"]:
+            desc = record["description"].decode('utf-8', errors='ignore')
+
+        return [{
+            "timestamp": record["isodate"],
+            "module": self.__class__.__name__,
+            "event": "shortcut_created",
+            "data": f"iOS Shortcut '{record['shortcut_name'].decode('utf-8')}': {desc} {found_urls}"
+        }, {
+            "timestamp": record["modified_date"],
+            "module": self.__class__.__name__,
+            "event": "shortcut_modified",
+            "data": f"iOS Shortcut '{record['shortcut_name'].decode('utf-8')}': {desc} {found_urls}"
+        }]
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_domains(result["action_urls"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+
+    def run(self):
+        self._find_ios_database(backup_ids=SHORTCUT_BACKUP_IDS,
+                                root_paths=SHORTCUT_ROOT_PATHS)
+        self.log.info("Found Shortcuts database at path: %s", self.file_path)
+
+        conn = sqlite3.connect(self.file_path)
+        conn.text_factory = bytes
+        cur = conn.cursor()
+        try:
+            cur.execute("""
+                SELECT
+                    ZSHORTCUT.Z_PK as "shortcut_id",
+                    ZSHORTCUT.ZNAME as "shortcut_name",
+                    ZSHORTCUT.ZCREATIONDATE as "created_date",
+                    ZSHORTCUT.ZMODIFICATIONDATE as "modified_date",
+                    ZSHORTCUT.ZACTIONSDESCRIPTION as "description",
+                    ZSHORTCUTACTIONS.ZDATA as "action_data"
+                FROM ZSHORTCUT
+                LEFT JOIN ZSHORTCUTACTIONS ON ZSHORTCUTACTIONS.ZSHORTCUT == ZSHORTCUT.Z_PK;
+            """)
+        except sqlite3.OperationalError:
+            # Table ZSHORTCUT does not exist
+            self.log.info("Invalid shortcut database format, skipping...")
+            cur.close()
+            conn.close()
+            return
+
+        names = [description[0] for description in cur.description]
+
+        for item in cur:
+            shortcut = {}
+            # We store the value of each column under the proper key.
+            for index, value in enumerate(item):
+                shortcut[names[index]] = value
+
+            action_data = plistlib.load(io.BytesIO(shortcut.pop("action_data", [])))
+            actions = []
+            for action_entry in action_data:
+                action = {}
+                action["identifier"] = action_entry["WFWorkflowActionIdentifier"]
+                action["parameters"] = action_entry["WFWorkflowActionParameters"]
+
+                # URLs might be in multiple fields, do a simple regex search across the parameters.
+                extracted_urls = check_for_links(str(action["parameters"]))
+
+                # Remove quoting characters that may have been captured by the regex.
+                action["urls"] = [url.rstrip("',") for url in extracted_urls]
+                actions.append(action)
+
+            shortcut["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut.pop("created_date")))
+            shortcut["modified_date"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut["modified_date"]))
+            shortcut["parsed_actions"] = len(actions)
+            shortcut["action_urls"] = list(itertools.chain(*[action["urls"] for action in actions]))
+            self.results.append(shortcut)
+
+        cur.close()
+        conn.close()
+
+        self.log.info("Extracted a total of %d Shortcuts", len(self.results))

mvt/ios/modules/mixed/sms.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -18,6 +18,7 @@ SMS_ROOT_PATHS = [
     "private/var/mobile/Library/SMS/sms.db",
 ]
 
+
 class SMS(IOSExtraction):
     """This module extracts all SMS messages containing links."""
 
@@ -40,35 +41,56 @@ class SMS(IOSExtraction):
         if not self.indicators:
             return
 
-        for message in self.results:
-            message_links = check_for_links(message.get("text", ""))
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
+        for result in self.results:
+            message_links = check_for_links(result.get("text", ""))
+            ioc = self.indicators.check_domains(message_links)
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
 
     def run(self):
         self._find_ios_database(backup_ids=SMS_BACKUP_IDS,
                                 root_paths=SMS_ROOT_PATHS)
         self.log.info("Found SMS database at path: %s", self.file_path)
 
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                message.*,
-                handle.id as "phone_number"
-            FROM message, handle
-            WHERE handle.rowid = message.handle_id;
-        """)
+        try:
+            conn = sqlite3.connect(self.file_path)
+            cur = conn.cursor()
+            cur.execute("""
+                SELECT
+                    message.*,
+                    handle.id as "phone_number"
+                FROM message, handle
+                WHERE handle.rowid = message.handle_id;
+            """)
+            # Force the query early to catch database issues
+            items = list(cur)
+        except sqlite3.DatabaseError as e:
+            conn.close()
+            if "database disk image is malformed" in str(e):
+                self._recover_sqlite_db_if_needed(self.file_path, forced=True)
+                conn = sqlite3.connect(self.file_path)
+                cur = conn.cursor()
+                cur.execute("""
+                    SELECT
+                        message.*,
+                        handle.id as "phone_number"
+                    FROM message, handle
+                    WHERE handle.rowid = message.handle_id;
+                """)
+                items = list(cur)
+            else:
+                raise e
         names = [description[0] for description in cur.description]
 
-        for item in cur:
+        for item in items:
             message = {}
             for index, value in enumerate(item):
                 # We base64 escape some of the attributes that could contain
                 # binary data.
                 if (names[index] == "attributedBody" or
-                    names[index] == "payload_data" or
-                    names[index] == "message_summary_info") and value:
+                        names[index] == "payload_data" or
+                        names[index] == "message_summary_info") and value:
                     value = b64encode(value).decode()
 
                 # We store the value of each column under the proper key.
@@ -82,12 +104,16 @@ class SMS(IOSExtraction):
             if not message.get("text", None):
                 message["text"] = ""
 
-            # Extract links from the SMS message.
-            message_links = check_for_links(message.get("text", ""))
-
-            # If we find links in the messages or if they are empty we add them to the list.
-            if message_links or message.get("text", "").strip() == "":
+            if message.get("text", "").startswith("ALERT: State-sponsored attackers may be targeting your iPhone"):
+                self.log.warn("Apple warning about state-sponsored attack received on the %s", message["isodate"])
                 self.results.append(message)
+            else:
+                # Extract links from the SMS message.
+                message_links = check_for_links(message.get("text", ""))
+
+                # If we find links in the messages or if they are empty we add them to the list.
+                if message_links or message.get("text", "").strip() == "":
+                    self.results.append(message)
 
         cur.close()
         conn.close()

mvt/ios/modules/mixed/sms_attachments.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -17,6 +17,7 @@ SMS_ROOT_PATHS = [
     "private/var/mobile/Library/SMS/sms.db",
 ]
 
+
 class SMSAttachments(IOSExtraction):
     """This module extracts all info about SMS/iMessage attachments."""
 
@@ -45,7 +46,7 @@ class SMSAttachments(IOSExtraction):
         cur.execute("""
             SELECT
                 attachment.ROWID as "attachment_id",
-				attachment.*,
+                attachment.*,
                 message.service as "service",
                 handle.id as "phone_number"
             FROM attachment
@@ -73,7 +74,7 @@ class SMSAttachments(IOSExtraction):
             attachment["filename"] = attachment["filename"] or "NULL"
 
             if (attachment["filename"].startswith("/var/tmp/") and attachment["filename"].endswith("-1") and
-                attachment["direction"] == "received"):
+                    attachment["direction"] == "received"):
                 self.log.warn(f"Suspicious iMessage attachment '{attachment['filename']}' on {attachment['isodate']}")
                 self.detected.append(attachment)
 

mvt/ios/modules/mixed/tcc.py

@@ -0,0 +1,164 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import sqlite3
+from datetime import datetime
+
+from mvt.common.utils import convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+TCC_BACKUP_IDS = [
+    "64d0019cb3d46bfc8cce545a8ba54b93e7ea9347",
+]
+TCC_ROOT_PATHS = [
+    "private/var/mobile/Library/TCC/TCC.db",
+]
+
+AUTH_VALUE_OLD = {
+    0: "denied",
+    1: "allowed"
+}
+
+AUTH_VALUES = {
+    0: "denied",
+    1: "unknown",
+    2: "allowed",
+    3: "limited",
+}
+AUTH_REASONS = {
+    1: "error",
+    2: "user_consent",
+    3: "user_set",
+    4: "system_set",
+    5: "service_policy",
+    6: "mdm_policy",
+    7: "override_policy",
+    8: "missing_usage_string",
+    9: "prompt_timeout",
+    10: "preflight_unknown",
+    11: "entitled",
+    12: "app_type_policy",
+}
+
+
+class TCC(IOSExtraction):
+    """This module extracts records from the TCC.db SQLite database."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        if "last_modified" in record:
+            if "allowed_value" in record:
+                msg = f"Access to {record['service']} by {record['client']} {record['allowed_value']}"
+            else:
+                msg = f"Access to {record['service']} by {record['client']} {record['auth_value']}"
+            return {
+                "timestamp": record["last_modified"],
+                "module": self.__class__.__name__,
+                "event": "AccessRequest",
+                "data": msg
+            }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_process(result["client"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+
+    def process_db(self, file_path):
+        conn = sqlite3.connect(file_path)
+        cur = conn.cursor()
+        db_version = "v3"
+        try:
+            cur.execute("""SELECT
+                service, client, client_type, auth_value, auth_reason, last_modified
+            FROM access;""")
+        except sqlite3.OperationalError:
+            # v2 version
+            try:
+                cur.execute("""SELECT
+                    service, client, client_type, allowed, prompt_count, last_modified
+                    FROM access;""")
+                db_version = "v2"
+            except sqlite3.OperationalError:
+                cur.execute("""SELECT
+                    service, client, client_type, allowed, prompt_count
+                    FROM access;""")
+                db_version = "v1"
+
+        for row in cur:
+            service = row[0]
+            client = row[1]
+            client_type = row[2]
+            client_type_desc = "bundle_id" if client_type == 0 else "absolute_path"
+            if db_version == "v3":
+                auth_value = row[3]
+                auth_value_desc = AUTH_VALUES.get(auth_value, "")
+                auth_reason = row[4]
+                auth_reason_desc = AUTH_REASONS.get(auth_reason, "unknown")
+                last_modified = convert_timestamp_to_iso(datetime.utcfromtimestamp((row[5])))
+
+                if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
+                    device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
+                    self.log.info("Found client \"%s\" with access %s to %s on %s by %s",
+                                  client, auth_value_desc, device, last_modified, auth_reason_desc)
+
+                self.results.append({
+                    "service": service,
+                    "client": client,
+                    "client_type": client_type_desc,
+                    "auth_value": auth_value_desc,
+                    "auth_reason_desc": auth_reason_desc,
+                    "last_modified": last_modified,
+                })
+            else:
+                allowed_value = row[3]
+                allowed_desc = AUTH_VALUE_OLD.get(allowed_value, "")
+                prompt_count = row[4]
+                if db_version == "v2":
+                    last_modified = convert_timestamp_to_iso(datetime.utcfromtimestamp((row[5])))
+                    if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
+                        device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
+                        self.log.info("Found client \"%s\" with access %s to %s at %s",
+                                      client, allowed_desc, device, last_modified)
+                    self.results.append({
+                        "service": service,
+                        "client": client,
+                        "client_type": client_type_desc,
+                        "allowed_value": allowed_desc,
+                        "prompt_count": prompt_count,
+                        "last_modified": last_modified
+                    })
+                else:
+                    if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
+                        device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
+                        self.log.info("Found client \"%s\" with access %s to %s",
+                                      client, allowed_desc, device)
+                    self.results.append({
+                        "service": service,
+                        "client": client,
+                        "client_type": client_type_desc,
+                        "allowed_value": allowed_desc,
+                        "prompt_count": prompt_count
+                    })
+
+        cur.close()
+        conn.close()
+
+    def run(self):
+        self._find_ios_database(backup_ids=TCC_BACKUP_IDS, root_paths=TCC_ROOT_PATHS)
+        self.log.info("Found TCC database at path: %s", self.file_path)
+        self.process_db(self.file_path)
+
+        self.log.info("Extracted a total of %d TCC items", len(self.results))

mvt/ios/modules/mixed/webkit_resource_load_statistics.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -17,9 +17,9 @@ WEBKIT_RESOURCELOADSTATICS_ROOT_PATHS = [
     "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/observations.db",
 ]
 
+
 class WebkitResourceLoadStatistics(IOSExtraction):
-    """This module extracts records from WebKit ResourceLoadStatistics observations.db.
-    """
+    """This module extracts records from WebKit ResourceLoadStatistics observations.db."""
     # TODO: Add serialize().
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
@@ -28,7 +28,7 @@ class WebkitResourceLoadStatistics(IOSExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
-        self.results = {}
+        self.results = {} if not results else results
 
     def check_indicators(self):
         if not self.indicators:
@@ -37,9 +37,11 @@ class WebkitResourceLoadStatistics(IOSExtraction):
         self.detected = {}
         for key, items in self.results.items():
             for item in items:
-                if self.indicators.check_domain(item["registrable_domain"]):
+                ioc = self.indicators.check_domain(item["registrable_domain"])
+                if ioc:
+                    item["matched_indicator"] = ioc
                     if key not in self.detected:
-                        self.detected[key] = [item,]
+                        self.detected[key] = [item, ]
                     else:
                         self.detected[key].append(item)
 
@@ -56,7 +58,7 @@ class WebkitResourceLoadStatistics(IOSExtraction):
         except sqlite3.OperationalError:
             return
 
-        if not key in self.results:
+        if key not in self.results:
             self.results[key] = []
 
         for row in cur:
@@ -77,7 +79,8 @@ class WebkitResourceLoadStatistics(IOSExtraction):
                 for backup_file in self._get_backup_files_from_manifest(relative_path=WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH):
                     db_path = self._get_backup_file_from_id(backup_file["file_id"])
                     key = f"{backup_file['domain']}/{WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH}"
-                    self._process_observations_db(db_path=db_path, key=key)
+                    if db_path:
+                        self._process_observations_db(db_path=db_path, key=key)
             except Exception as e:
                 self.log.info("Unable to search for WebKit observations.db: %s", e)
         elif self.is_fs_dump:

mvt/ios/modules/mixed/webkit_session_resource_log.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -20,10 +20,14 @@ WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS = [
     "private/var/mobile/Library/WebClips/*/Storage/full_browsing_session_resourceLog.plist",
 ]
 
+
 class WebkitSessionResourceLog(IOSExtraction):
     """This module extracts records from WebKit browsing session
     resource logs, and checks them against any provided list of
-    suspicious domains."""
+    suspicious domains.
+
+
+    """
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  fast_mode=False, log=None, results=[]):
@@ -31,7 +35,7 @@ class WebkitSessionResourceLog(IOSExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
-        self.results = {}
+        self.results = {} if not results else results
 
     @staticmethod
     def _extract_domains(entries):
@@ -62,7 +66,9 @@ class WebkitSessionResourceLog(IOSExtraction):
 
                 all_origins = set([entry["origin"]] + source_domains + destination_domains)
 
-                if self.indicators.check_domains(all_origins):
+                ioc = self.indicators.check_domains(all_origins)
+                if ioc:
+                    entry["matched_indicator"] = ioc
                     self.detected.append(entry)
 
                     redirect_path = ""

mvt/ios/modules/mixed/whatsapp.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -20,6 +20,7 @@ WHATSAPP_ROOT_PATHS = [
     "private/var/mobile/Containers/Shared/AppGroup/*/ChatStorage.sqlite",
 ]
 
+
 class Whatsapp(IOSExtraction):
     """This module extracts all WhatsApp messages containing links."""
 
@@ -31,21 +32,26 @@ class Whatsapp(IOSExtraction):
 
     def serialize(self, record):
         text = record.get("ZTEXT", "").replace("\n", "\\n")
+        links_text = ""
+        if record["links"]:
+            links_text = " - Embedded links: " + ", ".join(record["links"])
+
         return {
             "timestamp": record.get("isodate"),
             "module": self.__class__.__name__,
             "event": "message",
-            "data": f"{text} from {record.get('ZFROMJID', 'Unknown')}",
+            "data": f"\'{text}\' from {record.get('ZFROMJID', 'Unknown')}{links_text}",
         }
 
     def check_indicators(self):
         if not self.indicators:
             return
 
-        for message in self.results:
-            message_links = check_for_links(message.get("ZTEXT", ""))
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
+        for result in self.results:
+            ioc = self.indicators.check_domains(result.get("links", []))
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
 
     def run(self):
         self._find_ios_database(backup_ids=WHATSAPP_BACKUP_IDS,
@@ -54,26 +60,50 @@ class Whatsapp(IOSExtraction):
 
         conn = sqlite3.connect(self.file_path)
         cur = conn.cursor()
-        cur.execute("SELECT * FROM ZWAMESSAGE;")
+
+        # Query all messages and join tables which can contain media attachments and links
+        cur.execute("""
+            SELECT
+                ZWAMESSAGE.*,
+                ZWAMEDIAITEM.ZAUTHORNAME,
+                ZWAMEDIAITEM.ZMEDIAURL,
+                ZWAMESSAGEDATAITEM.ZCONTENT1,
+                ZWAMESSAGEDATAITEM.ZCONTENT2,
+                ZWAMESSAGEDATAITEM.ZMATCHEDTEXT,
+                ZWAMESSAGEDATAITEM.ZSUMMARY,
+                ZWAMESSAGEDATAITEM.ZTITLE
+            FROM ZWAMESSAGE
+            LEFT JOIN ZWAMEDIAITEM ON ZWAMEDIAITEM.ZMESSAGE = ZWAMESSAGE.Z_PK
+            LEFT JOIN ZWAMESSAGEDATAITEM ON ZWAMESSAGEDATAITEM.ZMESSAGE = ZWAMESSAGE.Z_PK;
+        """)
         names = [description[0] for description in cur.description]
 
-        for message in cur:
-            new_message = {}
-            for index, value in enumerate(message):
-                new_message[names[index]] = value
+        for message_row in cur:
+            message = {}
+            for index, value in enumerate(message_row):
+                message[names[index]] = value
 
-            if not new_message.get("ZTEXT", None):
-                continue
+            message["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(message.get("ZMESSAGEDATE")))
+            message["ZTEXT"] = message["ZTEXT"] if message["ZTEXT"] else ""
 
-            # We convert Mac's silly timestamp again.
-            new_message["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(new_message.get("ZMESSAGEDATE")))
+            # Extract links from the WhatsApp message. URLs can be stored in multiple fields/columns.
+            # Check each of them!
+            message_links = []
+            fields_with_links = ["ZTEXT", "ZMATCHEDTEXT", "ZMEDIAURL", "ZCONTENT1", "ZCONTENT2"]
+            for field in fields_with_links:
+                if message.get(field):
+                    message_links.extend(check_for_links(message.get(field, "")))
 
-            # Extract links from the WhatsApp message.
-            message_links = check_for_links(new_message["ZTEXT"])
+            # Remove WhatsApp internal media URLs.
+            filtered_links = []
+            for link in message_links:
+                if not (link.startswith("https://mmg-fna.whatsapp.net/") or link.startswith("https://mmg.whatsapp.net/")):
+                    filtered_links.append(link)
 
-            # If we find messages, or if there's an empty message we add it to the list.
-            if new_message["ZTEXT"] and (message_links or new_message["ZTEXT"].strip() == ""):
-                self.results.append(new_message)
+            # If we find messages with links, or if there's an empty message we add it to the results list.
+            if filtered_links or (message.get("ZTEXT") or "").strip() == "":
+                message["links"] = list(set(filtered_links))
+                self.results.append(message)
 
         cur.close()
         conn.close()

mvt/ios/modules/net_base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -39,7 +39,9 @@ class NetBase(IOSExtraction):
                 ZLIVEUSAGE.ZHASPROCESS,
                 ZLIVEUSAGE.ZTIMESTAMP
             FROM ZLIVEUSAGE
-            LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK;
+            LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK
+            UNION
+            SELECT ZFIRSTTIMESTAMP, ZTIMESTAMP, ZPROCNAME, ZBUNDLENAME, Z_PK, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM ZPROCESS WHERE Z_PK NOT IN (SELECT ZHASPROCESS FROM ZLIVEUSAGE);
         """)
 
         for row in cur:
@@ -68,7 +70,7 @@ class NetBase(IOSExtraction):
                 "wwan_out": row[8],
                 "live_id": row[9],
                 "live_proc_id": row[10],
-                "live_isodate": live_timestamp,
+                "live_isodate": live_timestamp if row[10] else first_isodate,
             })
 
         cur.close()
@@ -79,7 +81,7 @@ class NetBase(IOSExtraction):
     def serialize(self, record):
         record_data = f"{record['proc_name']} (Bundle ID: {record['bundle_id']}, ID: {record['proc_id']})"
         record_data_usage = record_data + f" WIFI IN: {record['wifi_in']}, WIFI OUT: {record['wifi_out']} - "  \
-                            f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"
+            f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"
 
         records = [{
             "timestamp": record["live_isodate"],
@@ -89,7 +91,7 @@ class NetBase(IOSExtraction):
         }]
 
         # Only included first_usage and current_usage records when a ZPROCESS entry exists.
-        if "MANIPULATED" not in record["proc_name"] and "MISSING" not in record["proc_name"]:
+        if "MANIPULATED" not in record["proc_name"] and "MISSING" not in record["proc_name"] and record["live_proc_id"] is not None:
             records.extend([
                 {
                     "timestamp": record["first_isodate"],
@@ -145,14 +147,17 @@ class NetBase(IOSExtraction):
                     self.log.debug("Located at %s", binary_path)
                 else:
                     msg = f"Could not find the binary associated with the process with name {proc['proc_name']}"
-                    if len(proc["proc_name"]) == 16:
+                    if (proc["proc_name"] is None):
+                        msg = f"Found process entry with empty 'proc_name' : {proc['live_proc_id']} at {proc['live_isodate']}"
+                    elif len(proc["proc_name"]) == 16:
                         msg = msg + " (However, the process name might have been truncated in the database)"
 
                     self.log.warning(msg)
+            if not proc["live_proc_id"]:
+                self.log.info(f"Found process entry in ZPROCESS but not in ZLIVEUSAGE : {proc['proc_name']} at {proc['live_isodate']}")
 
     def check_manipulated(self):
-        """Check for missing or manipulate DB entries
-        """
+        """Check for missing or manipulate DB entries"""
         # Don't show duplicates for each missing process.
         missing_process_cache = set()
         for result in sorted(self.results, key=operator.itemgetter("live_isodate")):
@@ -232,5 +237,7 @@ class NetBase(IOSExtraction):
             if not result["proc_id"]:
                 continue
 
-            if self.indicators.check_process(proc_name):
+            ioc = self.indicators.check_process(proc_name)
+            if ioc:
+                result["matched_indicator"] = ioc
                 self.detected.append(result)

mvt/ios/versions.py

@@ -1,43 +1,47 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 IPHONE_MODELS = [
-    {"description": "iPhone 4S", "identifier": "iPhone4,1"},
-    {"description": "iPhone 5", "identifier": "iPhone5,1"},
-    {"description": "iPhone 5", "identifier": "iPhone5,2"},
-    {"description": "iPhone 5c", "identifier": "iPhone5,3"},
-    {"description": "iPhone 5c", "identifier": "iPhone5,4"},
-    {"description": "iPhone 5s", "identifier": "iPhone6,1"},
-    {"description": "iPhone 5s", "identifier": "iPhone6,2"},
-    {"description": "iPhone 6 Plus", "identifier": "iPhone7,1"},
-    {"description": "iPhone 6", "identifier": "iPhone7,2"},
-    {"description": "iPhone 6s", "identifier": "iPhone8,1"},
-    {"description": "iPhone 6s Plus", "identifier": "iPhone8,2"},
-    {"description": "iPhone SE (1st generation)", "identifier": "iPhone8,4"},
-    {"description": "iPhone 7", "identifier": "iPhone9,1"},
-    {"description": "iPhone 7 Plus", "identifier": "iPhone9,2"},
-    {"description": "iPhone 7", "identifier": "iPhone9,3"},
-    {"description": "iPhone 7 Plus", "identifier": "iPhone9,4"},
-    {"description": "iPhone 8", "identifier": "iPhone10,1"},
-    {"description": "iPhone 8 Plus", "identifier": "iPhone10,2"},
-    {"description": "iPhone X", "identifier": "iPhone10,3"},
-    {"description": "iPhone 8", "identifier": "iPhone10,4"},
-    {"description": "iPhone 8 Plus", "identifier": "iPhone10,5"},
-    {"description": "iPhone X", "identifier": "iPhone10,6"},
-    {"description": "iPhone XS", "identifier": "iPhone11,2"},
-    {"description": "iPhone XS Max", "identifier": "iPhone11,4"},
-    {"description": "iPhone XS Max", "identifier": "iPhone11,6"},
-    {"description": "iPhone XR", "identifier": "iPhone11,8"},
-    {"description": "iPhone 11", "identifier": "iPhone12,1"},
-    {"description": "iPhone 11 Pro", "identifier": "iPhone12,3"},
-    {"description": "iPhone 11 Pro Max", "identifier": "iPhone12,5"},
-    {"description": "iPhone SE (2nd generation)", "identifier": "iPhone12,8"},
-    {"description": "iPhone 12 mini", "identifier": "iPhone13,1"},
-    {"description": "iPhone 12", "identifier": "iPhone13,2"},
-    {"description": "iPhone 12 Pro", "identifier": "iPhone13,3"},
-    {"description": "iPhone 12 Pro Max", "identifier": "iPhone13,4"},
+    {"identifier": "iPhone4,1", "description": "iPhone 4S"},
+    {"identifier": "iPhone5,1", "description": "iPhone 5"},
+    {"identifier": "iPhone5,2", "description": "iPhone 5"},
+    {"identifier": "iPhone5,3", "description": "iPhone 5c"},
+    {"identifier": "iPhone5,4", "description": "iPhone 5c"},
+    {"identifier": "iPhone6,1", "description": "iPhone 5s"},
+    {"identifier": "iPhone6,2", "description": "iPhone 5s"},
+    {"identifier": "iPhone7,1", "description": "iPhone 6 Plus"},
+    {"identifier": "iPhone7,2", "description": "iPhone 6"},
+    {"identifier": "iPhone8,1", "description": "iPhone 6s"},
+    {"identifier": "iPhone8,2", "description": "iPhone 6s Plus"},
+    {"identifier": "iPhone8,4", "description": "iPhone SE (1st generation)"},
+    {"identifier": "iPhone9,1", "description": "iPhone 7"},
+    {"identifier": "iPhone9,2", "description": "iPhone 7 Plus"},
+    {"identifier": "iPhone9,3", "description": "iPhone 7"},
+    {"identifier": "iPhone9,4", "description": "iPhone 7 Plus"},
+    {"identifier": "iPhone10,1", "description": "iPhone 8"},
+    {"identifier": "iPhone10,2", "description": "iPhone 8 Plus"},
+    {"identifier": "iPhone10,3", "description": "iPhone X"},
+    {"identifier": "iPhone10,4", "description": "iPhone 8"},
+    {"identifier": "iPhone10,5", "description": "iPhone 8 Plus"},
+    {"identifier": "iPhone10,6", "description": "iPhone X"},
+    {"identifier": "iPhone11,2", "description": "iPhone XS"},
+    {"identifier": "iPhone11,4", "description": "iPhone XS Max"},
+    {"identifier": "iPhone11,6", "description": "iPhone XS Max"},
+    {"identifier": "iPhone11,8", "description": "iPhone XR"},
+    {"identifier": "iPhone12,1", "description": "iPhone 11"},
+    {"identifier": "iPhone12,3", "description": "iPhone 11 Pro"},
+    {"identifier": "iPhone12,5", "description": "iPhone 11 Pro Max"},
+    {"identifier": "iPhone12,8", "description": "iPhone SE (2nd generation)"},
+    {"identifier": "iPhone13,1", "description": "iPhone 12 mini"},
+    {"identifier": "iPhone13,2", "description": "iPhone 12"},
+    {"identifier": "iPhone13,3", "description": "iPhone 12 Pro"},
+    {"identifier": "iPhone13,4", "description": "iPhone 12 Pro Max"},
+    {"identifier": "iPhone14,4", "description": "iPhone 13 Mini"},
+    {"identifier": "iPhone14,5", "description": "iPhone 13"},
+    {"identifier": "iPhone14,2", "description": "iPhone 13 Pro"},
+    {"identifier": "iPhone14,3", "description": "iPhone 13 Pro Max"},
 ]
 
 IPHONE_IOS_VERSIONS = [
@@ -222,13 +226,26 @@ IPHONE_IOS_VERSIONS = [
     {"build": "18F72", "version": "14.6"},
     {"build": "18G69", "version": "14.7"},
     {"build": "18G82", "version": "14.7.1"},
+    {"build": "18H17", "version": "14.8"},
+    {"build": "18H107", "version": "14.8.1"},
+    {"build": "19A341", "version": "15.0"},
+    {"build": "19A346", "version": "15.0"},
+    {"build": "19A348", "version": "15.0.1"},
+    {"build": "19A404", "version": "15.0.2"},
+    {"build": "19B74", "version": "15.1"},
+    {"build": "19B81", "version": "15.1.1"},
+    {"build": "19C56", "version": "15.2"},
+    {"build": "19C63", "version": "15.2.1"},
+    {"build": "19D50", "version": "15.3"},
 ]
 
+
 def get_device_desc_from_id(identifier, devices_list=IPHONE_MODELS):
     for model in IPHONE_MODELS:
         if identifier == model["identifier"]:
             return model["description"]
 
+
 def find_version_by_build(build):
     build = build.upper()
     for version in IPHONE_IOS_VERSIONS:

public_indicators.json

@@ -0,0 +1,14 @@
+[
+    {
+        "name": "NSO Group Pegasus Indicators of Compromise",
+        "source": "Amnesty International",
+        "reference": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
+        "stix2_url": "https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/pegasus.stix2"
+    },
+    {
+        "name": "Cytrox Predator Spyware Indicators of Compromise",
+        "source": "Meta, Amnesty International, Citizen Lab",
+        "reference": "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/",
+        "stix2_url": "https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-12-16_cytrox/cytrox.stix2"
+    }
+]