mirror of
https://github.com/mvt-project/mvt.git
synced 2026-09-03 08:30:51 +02:00
Donncha Ó Cearbhaill
d02b9676c8
The two primary InteractionC queries contained a SQL syntax error in
their direction CASE expression (a double column alias), so they always
failed and the module silently fell back to a reduced query without the
recipient join. As a result outgoing messages were serialized with no
counterpart at all ("from None (None)"). Fix the syntax so recipient
names and identifiers are extracted again, and normalize the raw 0/1
direction values from the fallback queries to INCOMING/OUTGOING.
WhatsApp identifies chat peers in interactionC.db by LID and stores the
peer LID in the domain identifier, which InteractionC could not map to a
person. Declare a dependency on the WhatsappContacts module and resolve
sender, recipient and domain identifiers (LID, JID or phone number)
against the WhatsApp contacts database, adding resolved phone number and
name fields to WhatsApp records.
Rewrite the timeline serialization to use the resolved values, fall back
to the chat peer from the domain identifier when no recipient was
recorded, label the local user instead of printing None, and include the
message direction and group name.
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
# Mobile Verification Toolkit (MVT)
|
|
# Copyright (c) 2021-2023 The MVT Authors.
|
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
|
# https://license.mvt.re/1.1/
|
|
import logging
|
|
|
|
from mvt.common.indicators import Indicators
|
|
from mvt.common.module import run_module
|
|
from mvt.ios.modules.fs.filesystem import Filesystem
|
|
|
|
from ..utils import get_ios_backup_folder
|
|
|
|
|
|
class TestFilesystem:
|
|
def test_filesystem(self):
|
|
m = Filesystem(target_path=get_ios_backup_folder())
|
|
run_module(m)
|
|
assert len(m.results) == 19
|
|
assert len(m.timeline) == 19
|
|
assert len(m.alertstore.alerts) == 0
|
|
|
|
def test_detection(self, indicator_file):
|
|
m = Filesystem(target_path=get_ios_backup_folder())
|
|
ind = Indicators(log=logging.getLogger())
|
|
ind.parse_stix2(indicator_file)
|
|
# Adds a filename that exist in the folder
|
|
ind.ioc_collections[0]["processes"].append(
|
|
"64d0019cb3d46bfc8cce545a8ba54b93e7ea9347"
|
|
)
|
|
m.indicators = ind
|
|
run_module(m)
|
|
assert len(m.results) == 19
|
|
assert len(m.timeline) == 19
|
|
assert len(m.alertstore.alerts) == 1
|