Donncha Ó Cearbhaill
0b5b3f2d7c
* Add the mvt.plugin import surface mvt.plugin re-exports the names a plugin needs from MVT under one import path. It holds the module base classes and Command, the alert and result types, the database errors a module raises, the timestamp converters, the plugin settings API, MVT's settings, get_plugin_logger() and MVT_VERSION. The names it exports are kept working on a best-effort basis. Changes to them are announced in the release notes. Anything else in mvt can still be imported, and may change between releases without notice. get_plugin_logger(__name__) returns a logger under mvt.ext for plugin code outside a module class. Its records then reach the console and the command.log file of a run. A file loaded with --load-module or --load-command is named after the file. * Document how to write MVT plugins The custom modules page now leads with plugin packages. Loading module files with --load-module and MVT_CUSTOM_MODULES moves to a section on developing a module locally. A new "Writing a module" section shows a module which subclasses IOSExtraction. It lists each base class, the command pair it serves and the helpers it provides. "Depending on a built-in module" says to import a built-in class from its family package. "Importing from MVT" says what mvt.plugin exports and what importing from it means. The custom commands page shows a Command subclass which lists its own modules. The sysdiagnose and plugin configuration pages import from mvt.plugin.
2.0 KiB
Check an iOS Sysdiagnose
mvt-ios check-sysdiagnose prepares an iOS sysdiagnose archive for analysis by
custom MVT modules. MVT does not include built-in sysdiagnose modules. The
command runs the modules of the installed
plugin packages which
declare support for it. Install at least one such package first.
The command accepts either an extracted sysdiagnose directory or the original gzip-compressed tar archive.
mvt-ios check-sysdiagnose --output ./results \
./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz
Use --hashes to include hashes for analyzed files in info.json, and
--list-modules to display the eligible modules without running them.
Writing a custom module
Extend SysdiagnoseExtraction from mvt.plugin, see
Writing a module. The module reads
the archive the same way whether MVT was given a folder or a tar archive. It
declares the command in supported_commands. While writing one,
load it from its file.
from mvt.plugin import SysdiagnoseExtraction
class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
supported_commands = (("ios", "check-sysdiagnose"),)
slug = "example_sysdiagnose"
def run(self):
paths = self._get_files_by_pattern("*/example.log")
if paths:
content = self._get_file_content(paths[0]).decode("utf-8", "replace")
self.results = [{"content": content}]
def check_indicators(self):
pass
def serialize(self, result):
return None
MVT extracts a tar archive first. It calls from_sysdiagnose_folder() on each
module before run(). ips_files lists the IPS crash reports.
_get_files_by_pattern() and _get_file_content() are internal helpers of the
base class. Use them to read the archive. Their names and signatures can change
between releases. See src/mvt/ios/modules/sysdiagnose/base.py.