Check an iOS Sysdiagnose

mvt-ios check-sysdiagnose analyzes an iOS sysdiagnose archive. MVT's own SysdiagnoseInfo module extracts details about the device and the archive (see sysdiagnose_info.json); the checks come from the modules of the installed plugin packages which declare support for the command. Without any such module the command still records the device details, and warns that no forensic sysdiagnose modules have been loaded so that the run cannot pass for a clean analysis.

The command accepts either an extracted sysdiagnose directory or the original gzip-compressed tar archive.

mvt-ios check-sysdiagnose --output ./results \
    ./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz

Use --hashes to include hashes for analyzed files in info.json, and --list-modules to display the eligible modules without running them.

Writing a custom module

Extend SysdiagnoseExtraction from mvt.plugin, see Writing a module. The module reads the archive the same way whether MVT was given a folder or a tar archive. It declares the command in supported_commands. While writing one, load it from its file.

from mvt.plugin import SysdiagnoseExtraction


class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
    supported_commands = (("ios", "check-sysdiagnose"),)
    slug = "example_sysdiagnose"

    def run(self):
        paths = self._get_files_by_pattern("*/example.log")
        if paths:
            content = self._get_file_content(paths[0]).decode("utf-8", "replace")
            self.results = [{"content": content}]

    def check_indicators(self):
        pass

    def serialize(self, result):
        return None

MVT extracts a tar archive first. It calls from_sysdiagnose_folder() on each module before run(). ips_files lists the IPS crash reports.

_get_files_by_pattern() and _get_file_content() are internal helpers of the base class. Use them to read the archive. Their names and signatures can change between releases. See src/mvt/ios/modules/sysdiagnose/base.py.