Getting python's error when trying to check with stix2

[digits16]

Getting python's error when trying to check with stix2

[Te-k]

Hi,

Thanks for reporting this. It looks like a change in the locationd file format with iOS 17. I just pushed a fix for that 4bdb97e
Could you download the latest version from this repo and test it on your phone? Could you share the iOS version of your phone?

Thanks

[digits16]

Hey,

I have tried with the latest repo and now I have another error. Im having IOS 17.0.1 (21A340) Also, get a warning that the latest is 17.0.2, but my model is iPhone 13.

ERROR    [mvt.ios.modules.mixed.locationd] Error in running extraction from module LocationdClients: 'p/System/Library/LocationBundles/TimeZone.bundle'
Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/common/module.py", line 167, in run_module
exec_or_profile("module.run()", globals(), locals())
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/common/utils.py", line 236, in exec_or_profile
exec(module, globals, locals)
File "<string>", line 1, in <module>
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/ios/modules/mixed/locationd.py", line 163, in run
self._extract_locationd_entries(self.file_path)
File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/mvt/ios/modules/mixed/locationd.py", line 146, in_extract_locationd_entries
result = file_plist[key]
 ~~~~~~~~~~^^^^^
KeyError: 'p/System/Library/LocationBundles/TimeZone.bundle'

Also, get a warning that the latest is 17.0.2, but my model is iPhone 13.

WARNING [mvt.ios.modules.backup.backup_info] This phone is running an outdated iOS version: 17.0.1 (latest is 17.0.2)

[Te-k]

Ah right, my bad. Can you try now with the latest commit?

Yeah for iOS 17.0.2, it is the first time we have an update that is not available for all models afaik but we aren't filtering on such level of details. We'll probably let it as it is as it's not a very common case

[digits16]

@Te-k ,

Thanks, it works now with no errors.

[Te-k]

Great, thanks