ec-digit-csirc / sysdiagnose Goto Github PK
View Code? Open in Web Editor NEWForensic toolkit for iOS sysdiagnose feature
License: European Union Public License 1.2
Forensic toolkit for iOS sysdiagnose feature
License: European Union Public License 1.2
recent iOS has network activity reports ("App Privacy report" in the Settings). Are those also in sysdiagnose?
If you run the tools from another folder, it wont' work :
$ python ~/tools/forensic/sysdiagnose/initialyze.py file FILE
Could not read version info, bailing out. Something is wrong: [Errno 2] No such file or directory: 'VERSION.txt'
This is because the get_version function checks for VERSION.txt in the local folder instead of the script folder. It would be nice to allow to run it from another folder
print("ProductName = %s" % pl["ProductName"]) # XXX FIXME: should that return the structure instead of print() ing it?
sysdiagnose/parsers/sysdiagnose-sys.py
Line 76 in 022828f
Like how to do a venv / conda env, installation of dependencies, etc. etc.
Be consistent, f-strings are the way to go.
Document a minimum python version of Python >= 3.6
Its buggy like the appinstallation used to
create analzyer for that.
Maybe a GPS file output + timestamp. Load it in google earth.
Use: https://github.com/EC-DIGIT-CSIRC/sysdiagnose/blob/main/analyzers/sysdiagnose-wifi-gelocation.py
In sysdiagnose-uuid2path.py +62 there is a variable which seems that it should be a different one...
def export_to_json(json, filename="./uuid2path.json"):
json_u2p = json.dumps(json, indent=4)
try:
fd = open(filename, "w")
fd.write(json_ps) # XXX FIXME! What is json_ps?? XXX FIXME
fd.close()
except Exception as e:
print(f"Impossible to dump the UUID to Path to {filename}. Reason: {str(e)}\n")
return
@ddurvaux could you take a look pls?
#10 only fixed that print()s have f-strings (where applicable).
However, there are more pure strings which should be converted to f-strings.
Example:
data/4/sysdiagnose_2023.05.19_09-39-55+0200_iPhone-OS_iPhone_20E252/WiFi/com.apple.wifi.known-networks.plist
Go over the file and look at all TODOs
https://github.com/EC-DIGIT-CSIRC/sysdiagnose/blob/main/analyzers/sysdiagnose-timeliner.py#L60
--> Implement it and fix the parser as well (might be wrong) . Take a look at sysdiagnose-powerlogs.py
(probably sqlite2json)
settle on british or US english, not both.
Today its handled with
d[k]=binascii.hexlify(v).decode('utf-8')
But it should handle differently outputs from the plist module
depending on the data it output with b' or b"
Maybe reading the code of the plist module would figure out how they handle different classes.
Retrieve proces and their PID from taskinfo.txt.
sysdiagnose/parsers/sysdiagnose-brctl.py
Line 364 in 6403090
Apply this to all files where the version check is present. It's really a useless if
statement.
Reasoning: Since all files, use python3 syntax only (f-strings, print(), etc.), the file won't run anyway in python2.x . So get rid of the version check all together! If you try to run it in python2, the interpreter will spit out the file anyway.
# XXX FIXME: this is obviously a very generic function and could be generalized and moved to misc/
sysdiagnose/parsers/sysdiagnose-sys.py
Line 26 in 49f1420
"z" -> "s"
analyZer or analyser
I identified 2 types of IPS files located in ./crashes_and_spins/ :
Should be easy as the IPS format is... a json.
So maybe a parser to put together all the IPS files so it is easier to analyse/ingest in a consistent way
Possible scenarios:
Example of a broken timestamp format:
+052643-10-21T13:46:40.000Z
parser.add_option("-i", dest="inputfile", action="store", type="string", # XXX FIXME! Here we should pass on a glob **.plist like in mobileactivation.py's main()
undefined
The option to generate a graphviz graph seems to have dissapear.
Fix the option.
Parser is currently outpouting to stdout
docstrings docstrings docstrings
Timeliner complains about JSON format of powerlog export
ERROR while extracting timestamp from ./parsed_data//4//sysdiagnose-powerlogs.json. Reason: not all arguments converted during string formatting
produces:
"{\n \"application\": [],\n \"asset\": [],\n \"client\": [],\n \"download_policy\": [],\n \"download_state\": [],\n \"download\": [],\n \"finished_download\": [],\n \"job_restore\": [],\n \"job_software\": [],\n \"job\": [],\n \"persistent_job\": [],\n \"persistent_manager\": [],\n \"purchase\": []\n}
aaron@host:~/Desktop/git/work/ec/sysdiagnose$ python initialyze.py file data/sysdiagnose_2023.02.24_15-37-15+0100_iPhone-OS_iPhone_20D67.tar.gz
fff3dcf24bed8acfc7734a22b0b29565e6890a425f90d91ae4789d5b874e9de7
Traceback (most recent call last):
File "/Users/aaron/Desktop/git/work/ec/sysdiagnose/initialyze.py", line 290, in <module>
main()
File "/Users/aaron/Desktop/git/work/ec/sysdiagnose/initialyze.py", line 278, in main
init(arguments['<sysdiagnose_file>'])
File "/Users/aaron/Desktop/git/work/ec/sysdiagnose/initialyze.py", line 225, in init
with open(new_case_json['sysdiagnose.log'], 'r') as f:
FileNotFoundError: [Errno 2] No such file or directory: './data/1/sysdiagnose_2023.02.24_15-37-15+0100_iPhone-OS_iPhone_20D67/sysdiagnose.log'
--> identify why and fix
TBD if we want to use python's logger. That's a clearer way to separate log messages from print messages.. Related to #10 however, since the logger prefers late bindings and not f-strings.
Need to implement the export and parsing via httsp://github.com/ydkhatri/UnifiedLogReader. The UnifiedLogReader has a different format than the OS X /usr/bin/log show
command.
This is a precondition to #40
While the timeline is compatible with TimeSketch, no events are shown there :(.
type hints type hints type hints
Useful for debugging
Building parsers for:
subject says it all
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.