crt0mega/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2024-06-28 15:18:55 +00:00
Code Issues Projects Releases Wiki Activity

Fixed bug in locationd module

Browse Source
This commit is contained in:
Nex 2021-09-07 15:06:19 +02:00
parent ef8622d4c3
commit 969b5cc506
1 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
mvt/ios/modules/mixed/locationd.py
View File

@ -17,7 +17,7 @@ LOCATIOND_ROOT_PATHS = [
] ]
class LocationdClients(IOSExtraction): class LocationdClients(IOSExtraction):
"""Extract information from apps who used geolocation""" """Extract information from apps who used geolocation."""
def __init__(self, file_path=None, base_folder=None, output_folder=None, def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]): fast_mode=False, log=None, results=[]):
@ -50,6 +50,14 @@ class LocationdClients(IOSExtraction):
return records return records
def check_indicators(self):
for result in self.results:
parts = result["package"].split("/")
proc_name = parts[len(parts)-1]
if self.indicators.check_process(proc_name):
self.detected.append(result)
def run(self): def run(self):
self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS, self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS,
root_paths=LOCATIOND_ROOT_PATHS) root_paths=LOCATIOND_ROOT_PATHS)
@ -58,14 +66,13 @@ class LocationdClients(IOSExtraction):
with open(self.file_path, "rb") as handle: with open(self.file_path, "rb") as handle:
file_plist = plistlib.load(handle) file_plist = plistlib.load(handle)
for app in file_plist: for key, values in file_plist.items():
if file_plist[app] is dict: result = file_plist[key]
result = file_plist[app] result["package"] = key
result["package"] = app for ts in self.timestamps:
for ts in self.timestamps: if ts in result.keys():
if ts in result.keys(): result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))
result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))
self.results.append(result) self.results.append(result)
self.log.info("Extracted a total of %d Locationd Clients entries", len(self.results)) self.log.info("Extracted a total of %d Locationd Clients entries", len(self.results))