Donncha Ó Cearbhaill
2eb40b85cf
* Add a SysdiagnoseInfo module to check-sysdiagnose check-sysdiagnose had no module of its own: it prepared the archive for plugin modules and refused to run without one. SysdiagnoseInfo is the first built-in module. It writes sysdiagnose_info.json with details about the device and the archive: product type and model, iOS version and build, serial number, IMEI, MEID and UDID from remotectl_dumpstate.txt and the mobile activation request, the Apple account name and email from the App Store daemon database, and the archive's original file name and creation time from sysdiagnose.log. The build is checked against the known iOS versions the way BackupInfo does. The App Store database is copied out of the archive together with its -wal and -shm sidecars before it is opened, so rows still in the write-ahead log are read. With a built-in module the command's list is never empty, so the "no custom modules" error and its test go. The module joins IOS_CHECK_IOCS_MODULES like every other module that writes a results file. * Note that newer sysdiagnoses lack the App Store daemon database * Keep refusing check-sysdiagnose runs without a custom module * Warn instead of refusing when no forensic sysdiagnose module is loaded
2.2 KiB
Check an iOS Sysdiagnose
mvt-ios check-sysdiagnose analyzes an iOS sysdiagnose archive. MVT's own
SysdiagnoseInfo module extracts details about the device and the archive
(see sysdiagnose_info.json); the checks
come from the modules of the installed
plugin packages which
declare support for the command. Without any such module the command still
records the device details, and warns that no forensic sysdiagnose modules
have been loaded so that the run cannot pass for a clean analysis.
The command accepts either an extracted sysdiagnose directory or the original gzip-compressed tar archive.
mvt-ios check-sysdiagnose --output ./results \
./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz
Use --hashes to include hashes for analyzed files in info.json, and
--list-modules to display the eligible modules without running them.
Writing a custom module
Extend SysdiagnoseExtraction from mvt.plugin, see
Writing a module. The module reads
the archive the same way whether MVT was given a folder or a tar archive. It
declares the command in supported_commands. While writing one,
load it from its file.
from mvt.plugin import SysdiagnoseExtraction
class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
supported_commands = (("ios", "check-sysdiagnose"),)
slug = "example_sysdiagnose"
def run(self):
paths = self._get_files_by_pattern("*/example.log")
if paths:
content = self._get_file_content(paths[0]).decode("utf-8", "replace")
self.results = [{"content": content}]
def check_indicators(self):
pass
def serialize(self, result):
return None
MVT extracts a tar archive first. It calls from_sysdiagnose_folder() on each
module before run(). ips_files lists the IPS crash reports.
_get_files_by_pattern() and _get_file_content() are internal helpers of the
base class. Use them to read the archive. Their names and signatures can change
between releases. See src/mvt/ios/modules/sysdiagnose/base.py.