mirror of
https://github.com/mvt-project/mvt.git
synced 2026-03-09 04:15:31 +00:00
Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
6333cafd38 | ||
|
|
03c59811a3 | ||
|
|
cfd3b5bbcb | ||
|
|
97ab67240f | ||
|
|
7fc664185c | ||
|
|
93094367c7 | ||
|
|
e8fa9c6eea |
@@ -124,7 +124,7 @@ class SMS(AndroidExtraction):
|
|||||||
try:
|
try:
|
||||||
self.results = parse_tar_for_sms(backup_tar)
|
self.results = parse_tar_for_sms(backup_tar)
|
||||||
except AndroidBackupParsingError:
|
except AndroidBackupParsingError:
|
||||||
self.log.info("Impossible to read SMS from the Android Backup, please extract "\
|
self.log.info("Impossible to read SMS from the Android Backup, please extract "
|
||||||
"the SMS and try extracting it with Android Backup Extractor")
|
"the SMS and try extracting it with Android Backup Extractor")
|
||||||
return
|
return
|
||||||
|
|
||||||
@@ -142,6 +142,6 @@ class SMS(AndroidExtraction):
|
|||||||
except InsufficientPrivileges:
|
except InsufficientPrivileges:
|
||||||
pass
|
pass
|
||||||
|
|
||||||
self.log.warn("No SMS database found. Trying extraction of SMS data using " \
|
self.log.warn("No SMS database found. Trying extraction of SMS data using "
|
||||||
"Android backup feature.")
|
"Android backup feature.")
|
||||||
self._extract_sms_adb()
|
self._extract_sms_adb()
|
||||||
|
|||||||
@@ -43,6 +43,9 @@ class IndicatorsUpdates:
|
|||||||
self.index_branch = "main"
|
self.index_branch = "main"
|
||||||
self.index_path = "indicators.yaml"
|
self.index_path = "indicators.yaml"
|
||||||
|
|
||||||
|
if not os.path.exists(MVT_DATA_FOLDER):
|
||||||
|
os.makedirs(MVT_DATA_FOLDER)
|
||||||
|
|
||||||
self.latest_update_path = os.path.join(MVT_DATA_FOLDER,
|
self.latest_update_path = os.path.join(MVT_DATA_FOLDER,
|
||||||
"latest_indicators_update")
|
"latest_indicators_update")
|
||||||
self.latest_check_path = os.path.join(MVT_DATA_FOLDER,
|
self.latest_check_path = os.path.join(MVT_DATA_FOLDER,
|
||||||
|
|||||||
@@ -3,8 +3,9 @@
|
|||||||
# Use of this software is governed by the MVT License 1.1 that can be found at
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
||||||
# https://license.mvt.re/1.1/
|
# https://license.mvt.re/1.1/
|
||||||
|
|
||||||
import requests
|
|
||||||
from typing import Optional
|
from typing import Optional
|
||||||
|
|
||||||
|
import requests
|
||||||
from tld import get_tld
|
from tld import get_tld
|
||||||
|
|
||||||
SHORTENER_DOMAINS = [
|
SHORTENER_DOMAINS = [
|
||||||
|
|||||||
@@ -3,4 +3,4 @@
|
|||||||
# Use of this software is governed by the MVT License 1.1 that can be found at
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
||||||
# https://license.mvt.re/1.1/
|
# https://license.mvt.re/1.1/
|
||||||
|
|
||||||
MVT_VERSION = "2.1"
|
MVT_VERSION = "2.1.2"
|
||||||
|
|||||||
@@ -31,7 +31,7 @@ class ProfileEvents(IOSExtraction):
|
|||||||
"timestamp": record.get("timestamp"),
|
"timestamp": record.get("timestamp"),
|
||||||
"module": self.__class__.__name__,
|
"module": self.__class__.__name__,
|
||||||
"event": "profile_operation",
|
"event": "profile_operation",
|
||||||
"data": f"Process {record.get('process')} started operation " \
|
"data": f"Process {record.get('process')} started operation "
|
||||||
f"{record.get('operation')} of profile {record.get('profile_id')}"
|
f"{record.get('operation')} of profile {record.get('profile_id')}"
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -52,11 +52,10 @@ class ProfileEvents(IOSExtraction):
|
|||||||
self.detected.append(result)
|
self.detected.append(result)
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def parse_profile_events(events_file_path) -> list:
|
def parse_profile_events(file_data: bytes) -> list:
|
||||||
results = []
|
results = []
|
||||||
|
|
||||||
with open(events_file_path, "rb") as handle:
|
events_plist = plistlib.loads(file_data)
|
||||||
events_plist = plistlib.load(handle)
|
|
||||||
|
|
||||||
if "ProfileEvents" not in events_plist:
|
if "ProfileEvents" not in events_plist:
|
||||||
return results
|
return results
|
||||||
@@ -90,7 +89,8 @@ class ProfileEvents(IOSExtraction):
|
|||||||
|
|
||||||
self.log.info("Found MCProfileEvents.plist file at %s", events_file_path)
|
self.log.info("Found MCProfileEvents.plist file at %s", events_file_path)
|
||||||
|
|
||||||
self.results.extend(self.parse_profile_events(events_file_path))
|
with open(events_file_path, "rb") as handle:
|
||||||
|
self.results.extend(self.parse_profile_events(handle.read()))
|
||||||
|
|
||||||
for result in self.results:
|
for result in self.results:
|
||||||
self.log.info("On %s process \"%s\" started operation \"%s\" of profile \"%s\"",
|
self.log.info("On %s process \"%s\" started operation \"%s\" of profile \"%s\"",
|
||||||
|
|||||||
Reference in New Issue
Block a user