"""Plist parser plugin for Apple iOS SIM information plist files."""
from dfdatetime import posix_time as dfdatetime_posix_time
from plaso.containers import events
from plaso.parsers.plist_plugins import interface
from plaso.parsers.plist import PlistParser
[docs]
class IOSSIMInfoEventData(events.EventData):
"""Apple iOS SIM information event data.
Attributes:
cell_broadcast_version (str): Cell broadcast version.
eap_aka_enabled (bool): value to indicate EAP-AKA is enabled.
label_identifier (str): label identifier.
last_used_time (dfdatetime.DateTimeValues): date and time the SIM was last
used.
phone_number (str): phone number.
sim_type (str): type of SIM
"""
DATA_TYPE = "ios:sim:info"
[docs]
def __init__(self):
"""Initializes event data."""
super().__init__(data_type=self.DATA_TYPE)
self.cell_broadcast_version = None
self.eap_aka_enabled = None
self.label_identifier = None
self.last_used_time = None
self.phone_number = None
self.sim_type = None
[docs]
class IOSSIMInfoPlugin(interface.PlistPlugin):
"""Plist parser plugin for Apple iOS SIM information plist files."""
NAME = "ios_siminfo"
DATA_FORMAT = "iOS SIM Info plist file"
PLIST_PATH_FILTERS = frozenset(
[interface.PlistPathFilter("com.apple.commcenter.data.plist")]
)
# Note that there a com.apple.commcenter.data.plist does not have to contain
# a PersonalWallet key.
PLIST_KEYS = frozenset(["PersonalWallet", "PersonalitySlots", "pw_ver"])
# pylint: disable=arguments-differ
def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs):
"""Extract SIM information entries.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS.
"""
personal_wallet = match.get("PersonalWallet", {})
for _, wallet_item in personal_wallet.items():
info = wallet_item.get("info", {})
timestamp = timestamp = info.get("ts")
event_data = IOSSIMInfoEventData()
event_data.cell_broadcast_version = info.get("cb_ver")
event_data.eap_aka_enabled = info.get("eap_aka")
event_data.label_identifier = info.get("label-id")
# Mobile Directory Number.
event_data.phone_number = info.get("mdn")
event_data.sim_type = info.get("type")
if timestamp is not None:
event_data.last_used_time = dfdatetime_posix_time.PosixTime(
timestamp=timestamp
)
parser_mediator.ProduceEventData(event_data)
PlistParser.RegisterPlugin(IOSSIMInfoPlugin)