Donncha Ó Cearbhaill
1cf82f44e9
The custom modules page now leads with plugin packages. Loading module files with --load-module and MVT_CUSTOM_MODULES moves to a section on developing a module locally. A new "Writing a module" section shows a module which subclasses IOSExtraction. It lists each base class, the command pair it serves and the helpers it provides. "Depending on a built-in module" says to import a built-in class from its family package. "Importing from MVT" says what mvt.plugin exports and what importing from it means. The custom commands page shows a Command subclass which lists its own modules. The sysdiagnose and plugin configuration pages import from mvt.plugin.
2.0 KiB
Check an iOS Sysdiagnose
mvt-ios check-sysdiagnose prepares an iOS sysdiagnose archive for analysis by
custom MVT modules. MVT does not include built-in sysdiagnose modules. The
command runs the modules of the installed
plugin packages which
declare support for it. Install at least one such package first.
The command accepts either an extracted sysdiagnose directory or the original gzip-compressed tar archive.
mvt-ios check-sysdiagnose --output ./results \
./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz
Use --hashes to include hashes for analyzed files in info.json, and
--list-modules to display the eligible modules without running them.
Writing a custom module
Extend SysdiagnoseExtraction from mvt.plugin, see
Writing a module. The module reads
the archive the same way whether MVT was given a folder or a tar archive. It
declares the command in supported_commands. While writing one,
load it from its file.
from mvt.plugin import SysdiagnoseExtraction
class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
supported_commands = (("ios", "check-sysdiagnose"),)
slug = "example_sysdiagnose"
def run(self):
paths = self._get_files_by_pattern("*/example.log")
if paths:
content = self._get_file_content(paths[0]).decode("utf-8", "replace")
self.results = [{"content": content}]
def check_indicators(self):
pass
def serialize(self, result):
return None
MVT extracts a tar archive first. It calls from_sysdiagnose_folder() on each
module before run(). ips_files lists the IPS crash reports.
_get_files_by_pattern() and _get_file_content() are internal helpers of the
base class. Use them to read the archive. Their names and signatures can change
between releases. See src/mvt/ios/modules/sysdiagnose/base.py.