mirror of
https://github.com/mvt-project/mvt.git
synced 2026-09-03 08:30:51 +02:00
Donncha Ó Cearbhaill
5c6bd65495
WhatsApp on iOS stores the disappearing messages timer for 1:1 chats on the contact records in ContactsV2.sqlite, not in ChatStorage.sqlite. Add a new WhatsappContacts module which extracts contact records from this database, including phone numbers, WhatsApp and LID identifiers, and the per-contact disappearing messages duration, and emits a timeline event when a disappearing messages timer was set. The database is often missing from incremental backups, so the module logs a clear warning and returns no results instead of failing. Columns are selected based on the actual table schema to tolerate changes across WhatsApp versions, and if the disappearing messages column is absent the state is reported as unknown rather than off. The test fixture is a synthetic ContactsV2.sqlite with fictional contacts, stored under the backup file ID derived from the WhatsApp shared app group domain.
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
# Mobile Verification Toolkit (MVT)
|
|
# Copyright (c) 2021-2023 The MVT Authors.
|
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
|
# https://license.mvt.re/1.1/
|
|
import logging
|
|
|
|
from mvt.common.indicators import Indicators
|
|
from mvt.common.module import run_module
|
|
from mvt.ios.modules.fs.filesystem import Filesystem
|
|
|
|
from ..utils import get_ios_backup_folder
|
|
|
|
|
|
class TestFilesystem:
|
|
def test_filesystem(self):
|
|
m = Filesystem(target_path=get_ios_backup_folder())
|
|
run_module(m)
|
|
assert len(m.results) == 17
|
|
assert len(m.timeline) == 17
|
|
assert len(m.alertstore.alerts) == 0
|
|
|
|
def test_detection(self, indicator_file):
|
|
m = Filesystem(target_path=get_ios_backup_folder())
|
|
ind = Indicators(log=logging.getLogger())
|
|
ind.parse_stix2(indicator_file)
|
|
# Adds a filename that exist in the folder
|
|
ind.ioc_collections[0]["processes"].append(
|
|
"64d0019cb3d46bfc8cce545a8ba54b93e7ea9347"
|
|
)
|
|
m.indicators = ind
|
|
run_module(m)
|
|
assert len(m.results) == 17
|
|
assert len(m.timeline) == 17
|
|
assert len(m.alertstore.alerts) == 1
|