crt0mega
/
mvt
mirror of https://github.com/mvt-project/mvt.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Sorted imports

This commit is contained in:
Nex 2021-07-30 11:40:09 +02:00
parent abcbefe359
commit c966eea7e6
45 changed files with 133 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
dev/mvt-android
View File

@ -10,4 +10,5 @@ import sys
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
from mvt import android
android.cli()

1
dev/mvt-ios
View File

@ -10,4 +10,5 @@ import sys
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
from mvt import ios
ios.cli()

10
mvt/android/cli.py
View File

@ -3,15 +3,17 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import sys
import click
import argparse
import logging
import os
import sys
import click
from rich.logging import RichHandler
from mvt.common.module import run_module, save_timeline
from mvt.common.indicators import Indicators
from mvt.common.module import run_module, save_timeline
from .download_apks import DownloadAPKs
from .lookups.koodous import koodous_lookup
from .lookups.virustotal import virustotal_lookup

4
mvt/android/download_apks.py
View File

@ -3,13 +3,15 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import json
import logging
import os
import pkg_resources
from tqdm import tqdm
from mvt.common.utils import get_sha256_from_file_path
from .modules.adb.base import AndroidExtraction
log = logging.getLogger(__name__)

8
mvt/android/lookups/koodous.py
View File

@ -3,13 +3,13 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import requests
import logging
from rich.text import Text
from rich.table import Table
from rich.progress import track
import requests
from rich.console import Console
from rich.progress import track
from rich.table import Table
from rich.text import Text
log = logging.getLogger(__name__)

9
mvt/android/lookups/virustotal.py
View File

@ -3,12 +3,13 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import requests
import logging
from rich.text import Text
from rich.table import Table
from rich.progress import track
import requests
from rich.console import Console
from rich.progress import track
from rich.table import Table
from rich.text import Text
log = logging.getLogger(__name__)

4
mvt/android/modules/adb/__init__.py
View File

@ -7,11 +7,11 @@ from .chrome_history import ChromeHistory
from .dumpsys_batterystats import DumpsysBatterystats
from .dumpsys_packages import DumpsysPackages
from .dumpsys_procstats import DumpsysProcstats
from .packages import Packages
from .processes import Processes
from .rootbinaries import RootBinaries
from .sms import SMS
from .whatsapp import Whatsapp
from .packages import Packages
from .rootbinaries import RootBinaries
ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes,
DumpsysBatterystats, DumpsysProcstats,

9
mvt/android/modules/adb/base.py
View File

@ -3,18 +3,19 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import logging
import os
import random
import string
import sys
import time
import logging
import tempfile
import time
from adb_shell.adb_device import AdbDeviceUsb
from adb_shell.auth.keygen import keygen, write_public_keyfile
from adb_shell.auth.sign_pythonrsa import PythonRSASigner
from adb_shell.exceptions import DeviceAuthError, AdbCommandFailureException
from usb1 import USBErrorBusy, USBErrorAccess
from adb_shell.exceptions import AdbCommandFailureException, DeviceAuthError
from usb1 import USBErrorAccess, USBErrorBusy
from mvt.common.module import MVTModule

5
mvt/android/modules/adb/chrome_history.py
View File

@ -3,11 +3,12 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import logging
import os
import sqlite3
import logging
from mvt.common.utils import convert_chrometime_to_unix, convert_timestamp_to_iso
from mvt.common.utils import (convert_chrometime_to_unix,
convert_timestamp_to_iso)
from .base import AndroidExtraction

2
mvt/android/modules/adb/dumpsys_batterystats.py
View File

@ -3,8 +3,8 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import logging
import os
from .base import AndroidExtraction

2
mvt/android/modules/adb/dumpsys_packages.py
View File

@ -3,8 +3,8 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import logging
import os
from .base import AndroidExtraction

2
mvt/android/modules/adb/dumpsys_procstats.py
View File

@ -3,8 +3,8 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import logging
import os
from .base import AndroidExtraction

3
mvt/android/modules/adb/packages.py
View File

@ -3,8 +3,9 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import logging
import os
import pkg_resources
from .base import AndroidExtraction

3
mvt/android/modules/adb/rootbinaries.py
View File

@ -3,8 +3,9 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import logging
import os
import pkg_resources
from .base import AndroidExtraction

5
mvt/android/modules/adb/sms.py
View File

@ -3,12 +3,13 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import logging
import os
import sqlite3
import logging
from mvt.common.utils import check_for_links, convert_timestamp_to_iso
from .base import AndroidExtraction
from mvt.common.utils import convert_timestamp_to_iso, check_for_links
log = logging.getLogger(__name__)

7
mvt/android/modules/adb/whatsapp.py
View File

@ -3,13 +3,14 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import base64
import logging
import os
import sqlite3
import logging
import base64
from mvt.common.utils import check_for_links, convert_timestamp_to_iso
from .base import AndroidExtraction
from mvt.common.utils import convert_timestamp_to_iso, check_for_links
log = logging.getLogger(__name__)

6
mvt/android/modules/backup/sms.py
View File

@ -3,13 +3,13 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import json
import os
import zlib
from mvt.common.module import MVTModule
from mvt.common.utils import check_for_links
from mvt.common.utils import convert_timestamp_to_iso
from mvt.common.utils import check_for_links, convert_timestamp_to_iso
class SMS(MVTModule):

3
mvt/common/indicators.py
View File

@ -3,11 +3,12 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import json
import os
from .url import URL
class Indicators:
"""This class is used to parse indicators from a STIX2 file and provide
functions to compare extracted artifacts to the indicators.

8
mvt/common/module.py
View File

@ -3,16 +3,18 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import io
import os
import re
import csv
import glob
import io
import logging
import os
import re
import simplejson as json
from .indicators import Indicators
class DatabaseNotFoundError(Exception):
pass

3
mvt/common/options.py
View File

@ -5,7 +5,8 @@
# From: https://gist.github.com/stanchan/bce1c2d030c76fe9223b5ff6ad0f03db
from click import command, option, Option, UsageError
from click import Option, UsageError, command, option
class MutuallyExclusiveOption(Option):
"""This class extends click to support mutually exclusive options.

5
mvt/common/utils.py
View File

@ -3,10 +3,11 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import re
import datetime
import hashlib
import os
import re
def convert_mactime_to_unix(timestamp, from_2001=True):
"""Converts Mac Standard Time to a Unix timestamp.

7
mvt/ios/cli.py
View File

@ -4,16 +4,17 @@
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import errno
import logging
import os
import sys
import click
import tarfile
import logging
import click
from rich.logging import RichHandler
from mvt.common.indicators import Indicators
from mvt.common.module import run_module, save_timeline
from mvt.common.options import MutuallyExclusiveOption
from mvt.common.indicators import Indicators
from .decrypt import DecryptBackup
from .modules.fs import BACKUP_MODULES, FS_MODULES

5
mvt/ios/decrypt.py
View File

@ -3,11 +3,12 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import binascii
import logging
import os
import shutil
import sqlite3
import logging
import binascii
from iOSbackup import iOSbackup
log = logging.getLogger(__name__)

38
mvt/ios/modules/fs/__init__.py
View File

@ -3,32 +3,32 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
from .manifest import Manifest
from .contacts import Contacts
from .net_netusage import Netusage
from .net_datausage import Datausage
from .safari_history import SafariHistory
from .safari_favicon import SafariFavicon
from .safari_browserstate import SafariBrowserState
from .webkit_indexeddb import WebkitIndexedDB
from .webkit_localstorage import WebkitLocalStorage
from .webkit_safariviewservice import WebkitSafariViewService
from .webkit_session_resource_log import WebkitSessionResourceLog
from .webkit_resource_load_statistics import WebkitResourceLoadStatistics
from .chrome_history import ChromeHistory
from .cache_files import CacheFiles
from .calls import Calls
from .chrome_favicon import ChromeFavicon
from .firefox_history import FirefoxHistory
from .chrome_history import ChromeHistory
from .contacts import Contacts
from .filesystem import Filesystem
from .firefox_favicon import FirefoxFavicon
from .version_history import IOSVersionHistory
from .firefox_history import FirefoxHistory
from .idstatuscache import IDStatusCache
from .locationd import LocationdClients
from .interactionc import InteractionC
from .locationd import LocationdClients
from .manifest import Manifest
from .net_datausage import Datausage
from .net_netusage import Netusage
from .safari_browserstate import SafariBrowserState
from .safari_favicon import SafariFavicon
from .safari_history import SafariHistory
from .sms import SMS
from .sms_attachments import SMSAttachments
from .calls import Calls
from .version_history import IOSVersionHistory
from .webkit_indexeddb import WebkitIndexedDB
from .webkit_localstorage import WebkitLocalStorage
from .webkit_resource_load_statistics import WebkitResourceLoadStatistics
from .webkit_safariviewservice import WebkitSafariViewService
from .webkit_session_resource_log import WebkitSessionResourceLog
from .whatsapp import Whatsapp
from .cache_files import CacheFiles
from .filesystem import Filesystem
BACKUP_MODULES = [SafariBrowserState, SafariHistory, Datausage, SMS, SMSAttachments,
ChromeHistory, ChromeFavicon, WebkitSessionResourceLog,

7
mvt/ios/modules/fs/base.py
View File

@ -3,15 +3,16 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import glob
import io
import os
import glob
import shutil
import sqlite3
import subprocess
from mvt.common.module import MVTModule
from mvt.common.module import DatabaseNotFoundError, DatabaseCorruptedError
from mvt.common.module import (DatabaseCorruptedError, DatabaseNotFoundError,
MVTModule)
class IOSExtraction(MVTModule):
"""This class provides a base for all iOS filesystem/backup extraction modules."""

1
mvt/ios/modules/fs/cache_files.py
View File

@ -8,6 +8,7 @@ import sqlite3
from .base import IOSExtraction
class CacheFiles(IOSExtraction):
def __init__(self, file_path=None, base_folder=None, output_folder=None,

1
mvt/ios/modules/fs/calls.py
View File

@ -6,6 +6,7 @@
import sqlite3
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
from .base import IOSExtraction
CALLS_BACKUP_IDS = [

3
mvt/ios/modules/fs/chrome_favicon.py
View File

@ -5,7 +5,8 @@
import sqlite3
from mvt.common.utils import convert_chrometime_to_unix, convert_timestamp_to_iso
from mvt.common.utils import (convert_chrometime_to_unix,
convert_timestamp_to_iso)
from .base import IOSExtraction

3
mvt/ios/modules/fs/chrome_history.py
View File

@ -5,7 +5,8 @@
import sqlite3
from mvt.common.utils import convert_chrometime_to_unix, convert_timestamp_to_iso
from mvt.common.utils import (convert_chrometime_to_unix,
convert_timestamp_to_iso)
from .base import IOSExtraction

3
mvt/ios/modules/fs/filesystem.py
View File

@ -3,13 +3,14 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import datetime
import os
from mvt.common.utils import convert_timestamp_to_iso
from .base import IOSExtraction
class Filesystem(IOSExtraction):
"""This module extracts creation and modification date of files from a
full file-system dump."""

2
mvt/ios/modules/fs/firefox_favicon.py
View File

@ -4,8 +4,8 @@
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import sqlite3
from datetime import datetime
from mvt.common.url import URL
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

2
mvt/ios/modules/fs/firefox_history.py
View File

@ -4,8 +4,8 @@
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import sqlite3
from datetime import datetime
from mvt.common.url import URL
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

7
mvt/ios/modules/fs/idstatuscache.py
View File

@ -3,10 +3,11 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import glob
import biplist
import collections
import glob
import os
import biplist
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

3
mvt/ios/modules/fs/locationd.py
View File

@ -3,8 +3,9 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import glob
import os
import biplist
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

6
mvt/ios/modules/fs/manifest.py
View File

@ -3,16 +3,18 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import datetime
import io
import os
import biplist
import sqlite3
import datetime
import biplist
from mvt.common.utils import convert_timestamp_to_iso
from .base import IOSExtraction
class Manifest(IOSExtraction):
"""This module extracts information from a backup Manifest.db file."""

3
mvt/ios/modules/fs/net_base.py
View File

@ -3,14 +3,15 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import sqlite3
import operator
import sqlite3
from pathlib import Path
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
from .base import IOSExtraction
class NetBase(IOSExtraction):
"""This class provides a base for DataUsage and NetUsage extraction modules."""

7
mvt/ios/modules/fs/safari_browserstate.py
View File

@ -4,11 +4,12 @@
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import io
import biplist
import sqlite3
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
from mvt.common.utils import keys_bytes_to_string
import biplist
from mvt.common.utils import (convert_mactime_to_unix,
convert_timestamp_to_iso, keys_bytes_to_string)
from .base import IOSExtraction

4
mvt/ios/modules/fs/sms.py
View File

@ -6,8 +6,8 @@
import sqlite3
from base64 import b64encode
from mvt.common.utils import check_for_links
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
from mvt.common.utils import (check_for_links, convert_mactime_to_unix,
convert_timestamp_to_iso)
from .base import IOSExtraction

4
mvt/ios/modules/fs/sms_attachments.py
View File

@ -6,8 +6,8 @@
import sqlite3
from base64 import b64encode
from mvt.common.utils import check_for_links
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
from mvt.common.utils import (check_for_links, convert_mactime_to_unix,
convert_timestamp_to_iso)
from .base import IOSExtraction

2
mvt/ios/modules/fs/version_history.py
View File

@ -3,8 +3,8 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import json
import datetime
import json
from mvt.common.utils import convert_timestamp_to_iso

5
mvt/ios/modules/fs/webkit_base.py
View File

@ -3,12 +3,13 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import datetime
import os
from mvt.common.utils import convert_timestamp_to_iso
from .base import IOSExtraction
from mvt.common.utils import convert_timestamp_to_iso
class WebkitBase(IOSExtraction):
"""This class is a base for other WebKit-related modules."""

6
mvt/ios/modules/fs/webkit_resource_load_statistics.py
View File

@ -3,14 +3,14 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import datetime
import os
import sqlite3
import datetime
from .base import IOSExtraction
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
from .base import IOSExtraction
WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/observations.db"
WEBKIT_RESOURCELOADSTATICS_ROOT_PATHS = [
"private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/ResourceLoadStatistics/observations.db",

3
mvt/ios/modules/fs/webkit_session_resource_log.py
View File

@ -3,8 +3,9 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
import glob
import os
import biplist
from mvt.common.utils import convert_timestamp_to_iso

5
mvt/ios/modules/fs/whatsapp.py
View File

@ -3,10 +3,11 @@
# See the file 'LICENSE' for usage and copying permissions, or find a copy at
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import sqlite3
import logging
import sqlite3
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso, check_for_links
from mvt.common.utils import (check_for_links, convert_mactime_to_unix,
convert_timestamp_to_iso)
from .base import IOSExtraction

3
setup.py
View File

@ -4,7 +4,8 @@
# https://github.com/mvt-project/mvt/blob/main/LICENSE
import os
from setuptools import setup, find_packages
from setuptools import find_packages, setup
__package_name__ = "mvt"
__version__ = "1.0.13"