Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added service requested to tcc module #6

Merged
merged 3 commits into from
Dec 2, 2021
Merged

added service requested to tcc module #6

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
16254ef
added service requested to tcc module
stuartjash Dec 2, 2021
5b38db6
rename
stuartjash Dec 2, 2021
5b55a1d
rename
stuartjash Dec 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 65 additions & 2 deletions artifacts/ArtifactsModule.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,13 @@ class ArtifactsModule {

if sqlite3_open(fileURL.path, &db) == SQLITE_OK {
var queryStatement: OpaquePointer? = nil
let queryString = "select client, auth_value, auth_reason from access"
let queryString = "select client, auth_value, auth_reason, service from access"

if sqlite3_prepare_v2(db, queryString, -1, &queryStatement, nil) == SQLITE_OK {
var client: String = ""
var authValue: String = ""
var authReason: String = ""
var service: String = ""

while sqlite3_step(queryStatement) == SQLITE_ROW {
let col1 = sqlite3_column_text(queryStatement, 0)
Expand Down Expand Up @@ -71,7 +72,17 @@ class ArtifactsModule {
}
}

self.caseHandler.addTextToFile(atUrl: capturedTCC, text: "Name: \(client)\nAuth Value: \(authValue)\nAuth Reason: \(authReason)\n")
let col4 = sqlite3_column_text(queryStatement, 3)
if col4 != nil {
service = String(cString: col4!)
for item in TCCService.allCases {
if service == String(item.rawValue) {
service = String(describing: item)
}
}
}

self.caseHandler.addTextToFile(atUrl: capturedTCC, text: "Name: \(client)\nRequested Service: \(service)\nAuth Value: \(authValue)\nAuth Reason: \(authReason)\n")
}
}
self.caseHandler.log("Finished capturing TCC data")
Expand Down Expand Up @@ -105,4 +116,56 @@ class ArtifactsModule {
case entitled = "11"
case appTypePolicy = "12"
}

/*
Compiled from /System/Library/PrivateFrameworks/TCC.framework/Resources/en.lproj/Localizable.strings and https://rainforest.engineering/2021-02-09-macos-tcc/
*/
enum TCCService: String, CaseIterable {
// critical
case location = "kTCCServiceLiverpool"
case icloud = "kTCCServiceUbiquity"
case sharing = "kTCCServiceShareKit"
case fda = "kTCCServiceSystemPolicyAllFiles"

// common
case accessibility = "kTCCServiceAccessibility"
case keystrokes = "kTCCServicePostEvent"
case inputMonitoring = "kTCCServiceListenEvent"
case developerTools = "kTCCServiceDeveloperTool"
case screenCapture = "kTCCServiceScreenCapture"

// file access
case adminFiles = "kTCCServiceSystemPolicySysAdminFiles"
case desktopFolder = "kTCCServiceSystemPolicyDesktopFolder"
case developerFiles = "kTCCServiceSystemPolicyDeveloperFiles"
case documentsFolder = "kTCCServiceSystemPolicyDocumentsFolder"
case downloadsFolder = "kTCCServiceSystemPolicyDownloadsFolder"
case networkVolumes = "kTCCServiceSystemPolicyNetworkVolumes"

// service access
case addressBook = "kTCCServiceAddressBook"
case appleEvents = "kTCCServiceAppleEvents"
case availability = "kTCCServiceUserAvailability"
case bluetooth_always = "kTCCServiceBluetoothAlways"
case calendar = "kTCCServiceCalendar"
case camera = "kTCCServiceCamera"
case contacts_full = "kTCCServiceContactsFull"
case contacts_limited = "kTCCServiceContactsLimited"
case currentLocation = "kTCCServiceLocation"
case fileAccess = "kTCCServiceFileProviderDomain"
case fileAccess_request = "kTCCServiceFileProviderPresence"
case fitness = "kTCCServiceMotion"
case focus_notifications = "kTCCServiceFocusStatus"
case gamecenter = "kTCCServiceGameCenterFriends"
case homeData = "kTCCServiceWillow"
case mediaLibrary = "kTCCServiceMediaLibrary"
case microphone = "kTCCServiceMicrophone"
case photos = "kTCCServicePhotos"
case photos_add = "kTCCServicePhotosAdd"
case proto3Right = "kTCCServicePrototype3Rights"
case reminders = "kTCCServiceReminders"
case removableVolumes = "kTCCServiceSystemPolicyRemovableVolumes"
case siri = "kTCCServiceSiri"
case speechRecognition = "kTCCServiceSpeechRecognition"
}
}