mirror of
https://github.com/mvt-project/mvt.git
synced 2026-09-11 04:08:55 +02:00
Donncha Ó Cearbhaill
2eb40b85cf
* Add a SysdiagnoseInfo module to check-sysdiagnose check-sysdiagnose had no module of its own: it prepared the archive for plugin modules and refused to run without one. SysdiagnoseInfo is the first built-in module. It writes sysdiagnose_info.json with details about the device and the archive: product type and model, iOS version and build, serial number, IMEI, MEID and UDID from remotectl_dumpstate.txt and the mobile activation request, the Apple account name and email from the App Store daemon database, and the archive's original file name and creation time from sysdiagnose.log. The build is checked against the known iOS versions the way BackupInfo does. The App Store database is copied out of the archive together with its -wal and -shm sidecars before it is opened, so rows still in the write-ahead log are read. With a built-in module the command's list is never empty, so the "no custom modules" error and its test go. The module joins IOS_CHECK_IOCS_MODULES like every other module that writes a results file. * Note that newer sysdiagnoses lack the App Store daemon database * Keep refusing check-sysdiagnose runs without a custom module * Warn instead of refusing when no forensic sysdiagnose module is loaded
31 lines
1.3 KiB
Python
31 lines
1.3 KiB
Python
# Mobile Verification Toolkit (MVT)
|
|
# Copyright (c) 2021-2026 The MVT Authors.
|
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
|
# https://license.mvt.re/1.1/
|
|
|
|
from mvt.android.command_modules import ANDROID_CHECK_IOCS_MODULES
|
|
from mvt.android.modules.androidqf import ANDROIDQF_MODULES
|
|
from mvt.android.modules.backup import BACKUP_MODULES as ANDROID_BACKUP_MODULES
|
|
from mvt.android.modules.bugreport import BUGREPORT_MODULES
|
|
from mvt.android.modules.intrusion_logs import INTRUSION_LOGS_MODULES
|
|
from mvt.ios.command_modules import IOS_CHECK_IOCS_MODULES
|
|
from mvt.ios.modules.backup import BACKUP_MODULES as IOS_BACKUP_MODULES
|
|
from mvt.ios.modules.fs import FS_MODULES
|
|
from mvt.ios.modules.mixed import MIXED_MODULES
|
|
from mvt.ios.modules.sysdiagnose import SYSDIAGNOSE_MODULES
|
|
|
|
|
|
def test_the_check_iocs_lists_are_the_families_of_their_platform():
|
|
# The CLI reads these same lists, so nothing composing one elsewhere can
|
|
# drift from what the command runs. This pins what the lists are composed
|
|
# of.
|
|
assert IOS_CHECK_IOCS_MODULES == (
|
|
IOS_BACKUP_MODULES + FS_MODULES + MIXED_MODULES + SYSDIAGNOSE_MODULES
|
|
)
|
|
assert ANDROID_CHECK_IOCS_MODULES == (
|
|
ANDROID_BACKUP_MODULES
|
|
+ BUGREPORT_MODULES
|
|
+ ANDROIDQF_MODULES
|
|
+ INTRUSION_LOGS_MODULES
|
|
)
|