mvt-project / mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

Home Page:https://mvt.re

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Getting python's error when trying to check with stix2

digits16 opened this issue · comments

Hi there,

ERROR    [mvt.ios.modules.mixed.locationd] Error in running extraction from module LocationdClients: 'int' object does not support item assignment
                  Traceback (most recent call last):
                    File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/common/module.py", line 167, in run_module
                      exec_or_profile("module.run()", globals(), locals())
                    File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/common/utils.py", line 236, in exec_or_profile
                      exec(module, globals, locals)
                    File "<string>", line 1, in <module>
                    File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/ios/modules/mixed/locationd.py", line 139, in run
                      self._extract_locationd_entries(self.file_path)
                    File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/ios/modules/mixed/locationd.py", line 128, in
                  _extract_locationd_entries
                      result["package"] = key
                      ~~~~~~^^^^^^^^^^^
                  TypeError: 'int' object does not support item assignment
commented

Hi,

Thanks for reporting this. It looks like a change in the locationd file format with iOS 17. I just pushed a fix for that 4bdb97e
Could you download the latest version from this repo and test it on your phone? Could you share the iOS version of your phone?

Thanks

Hey,

I have tried with the latest repo and now I have another error. Im having IOS 17.0.1 (21A340) Also, get a warning that the latest is 17.0.2, but my model is iPhone 13.

ERROR    [mvt.ios.modules.mixed.locationd] Error in running extraction from module LocationdClients: 'p/System/Library/LocationBundles/TimeZone.bundle'
Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/common/module.py", line 167, in run_module
exec_or_profile("module.run()", globals(), locals())
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/common/utils.py", line 236, in exec_or_profile
exec(module, globals, locals)
File "<string>", line 1, in <module>
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/ios/modules/mixed/locationd.py", line 163, in run
self._extract_locationd_entries(self.file_path)
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/ios/modules/mixed/locationd.py", line 146, in_extract_locationd_entries
result = file_plist[key]
 ~~~~~~~~~~^^^^^
KeyError: 'p/System/Library/LocationBundles/TimeZone.bundle'

Also, get a warning that the latest is 17.0.2, but my model is iPhone 13.

WARNING [mvt.ios.modules.backup.backup_info] This phone is running an outdated iOS version: 17.0.1 (latest is 17.0.2)

commented

Ah right, my bad. Can you try now with the latest commit?

Yeah for iOS 17.0.2, it is the first time we have an update that is not available for all models afaik but we aren't filtering on such level of details. We'll probably let it as it is as it's not a very common case

@Te-k ,

Thanks, it works now with no errors.

commented

Great, thanks