crt0mega/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2024-06-26 14:28:54 +00:00
Code Issues Projects Releases Wiki Activity

Add SMS read time in the MVT logs

Browse Source
This commit is contained in:
Donncha Ó Cearbhaill 2023-06-29 18:55:39 +02:00
parent e2516f284b
commit 7046ff80d1
2 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
mvt/ios/modules/mixed/sms.py
View File

@ -43,13 +43,21 @@ class SMS(IOSExtraction):
def serialize(self, record: dict) -> Union[dict, list]:
text = record["text"].replace("\n", "\\n")
return {
"timestamp": record["isodate"],
"module": self.__class__.__name__,
"event": "sms_received",
"data": f"{record['service']}: {record['guid']} \"{text}\" "
f"from {record['phone_number']} ({record['account']})",
}
sms_data = f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})"
return [
{
"timestamp": record["isodate"],
"module": self.__class__.__name__,
"event": "sms_received",
"data": sms_data,
},
{
"timestamp": record["isodate_read"],
"module": self.__class__.__name__,
"event": "sms_read",
"data": sms_data,
},
]
def check_indicators(self) -> None:
if not self.indicators:
@ -120,6 +128,7 @@ class SMS(IOSExtraction):
# We convert Mac's ridiculous timestamp format.
message["isodate"] = convert_mactime_to_iso(message["date"])
message["isodate_read"] = convert_mactime_to_iso(message["date_read"])
message["direction"] = (
"sent" if message.get("is_from_me", 0) == 1 else "received"
)

2
tests/ios_backup/test_sms.py
View File

@ -17,7 +17,7 @@ class TestSMSModule:
m = SMS(target_path=get_ios_backup_folder())
run_module(m)
assert len(m.results) == 1
assert len(m.timeline) == 1
assert len(m.timeline) == 2 # SMS received and read events.
assert len(m.detected) == 0
def test_detection(self, indicator_file):