mvt-project / mvt

Mobile Verification Toolkit

Important: We recently merged the “v3” branch. This introduced breaking changes. If you relied on mvt output in other scripts, they might have broken. More details: #757

重要提示：我们最近合并了“v3”分支，这引入了一些破坏性变更。如果您在其他脚本中依赖了 mvt 的输出，它们可能会失效。更多详情请见：#757

Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices. It has been developed and released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus Project along with a technical forensic methodology. It continues to be maintained by Amnesty International and other contributors.

移动取证工具包 (MVT) 是一套旨在简化和自动化收集取证痕迹过程的实用程序，有助于识别 Android 和 iOS 设备是否遭到入侵。该工具由国际特赦组织安全实验室于 2021 年 7 月在“飞马项目”(Pegasus Project) 的背景下开发并发布，同时提供了一套技术取证方法。目前，该工具继续由国际特赦组织及其他贡献者共同维护。

Note: MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device, please seek reputable expert assistance.

注意：MVT 是一款面向技术人员和调查人员的取证研究工具。它要求使用者具备数字取证知识并能够使用命令行工具。本工具不适用于终端用户的自我评估。如果您担心设备的安全性，请寻求可靠的专家协助。

Indicators of Compromise

入侵指标 (IOCs)

MVT supports using public indicators of compromise (IOCs) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by Amnesty International and other research groups.

MVT 支持使用公开的入侵指标 (IOCs) 来扫描移动设备，以查找已知间谍软件活动可能留下的定位或感染痕迹。这包括由国际特赦组织及其他研究机构发布的 IOCs。

Warning: Public indicators of compromise are insufficient to determine that a device is “clean”, and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security. Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence. Such support is available to civil society through Amnesty International’s Security Lab or through our forensic partnership with Access Now’s Digital Security Helpline. More information about using indicators of compromise with MVT is available in the documentation.

警告：公开的入侵指标不足以断定设备是“干净”的，或未受到特定间谍软件的攻击。仅依赖公开指标可能会遗漏最新的取证痕迹，并产生虚假的安全感。可靠且全面的数字取证支持和分类需要访问非公开指标、研究成果和威胁情报。公民社会可以通过国际特赦组织安全实验室，或通过我们与 Access Now 数字安全热线的取证合作伙伴关系获得此类支持。有关在 MVT 中使用入侵指标的更多信息，请参阅文档。

Installation

安装

MVT can be installed from sources or from PyPI (you will need some dependencies, check the documentation): pip3 install mvt

MVT 可以从源码或 PyPI 安装（您需要安装一些依赖项，请查看文档）： pip3 install mvt

You can also install MVT from PyPI with uv. First, install uv: curl -LsSf https://astral.sh/uv/install.sh | sh Then install MVT as a command-line tool: uv tool install mvt

您也可以使用 uv 从 PyPI 安装 MVT。首先，安装 uv： curl -LsSf https://astral.sh/uv/install.sh | sh 然后将 MVT 安装为命令行工具： uv tool install mvt

For alternative installation options and known issues, please refer to the documentation as well as GitHub Issues.

有关其他安装选项和已知问题，请参阅文档以及 GitHub Issues。

Usage

使用方法

MVT provides three commands: mvt-ios and mvt-android analyse acquisitions from devices of that platform, and mvt hosts what belongs to neither: version, completion, plugins and download-iocs (version and download-iocs remain available on the platform commands for now).

MVT 提供三个命令：mvt-ios 和 mvt-android 用于分析相应平台的设备采集数据，而 mvt 则包含不属于上述两者的功能：版本信息、自动补全、插件和下载 IOCs（目前版本信息和下载 IOCs 在平台命令中仍然可用）。

Running mvt on its own shows the installed version, update notices and the available commands. Check out the documentation to learn how to use them!

直接运行 mvt 将显示已安装的版本、更新通知和可用命令。请查看文档以了解如何使用它们！

Pass --verbose to any of the three commands, before the command name (mvt-ios --verbose check-backup ...), for debug output. The --verbose option the check-* commands accept after their name still works but is kept for compatibility only and will be removed in a future release.

在三个命令的名称之前添加 --verbose 参数（例如 mvt-ios --verbose check-backup ...）即可获取调试输出。check-* 命令在名称之后接受 --verbose 选项的方式仍然有效，但仅为了兼容性保留，并将在未来的版本中移除。

Shell completion

Shell 自动补全

MVT can generate a shell completion script for Bash, Zsh, and Fish which covers mvt, mvt-ios and mvt-android: mvt completion

MVT 可以为 Bash、Zsh 和 Fish 生成涵盖 mvt、mvt-ios 和 mvt-android 的 Shell 自动补全脚本： mvt completion

The command prints setup instructions by default. To generate the completion script directly, pass the shell name: mvt completion bash

该命令默认会打印设置说明。若要直接生成自动补全脚本，请传入 Shell 名称： mvt completion bash

MVT only writes completion files or shell configuration when --install is passed. See the command completion documentation for details.

只有在传入 --install 参数时，MVT 才会写入自动补全文件或 Shell 配置。详情请参阅命令补全文档。

Plugin packages extend MVT with additional forensic modules, which run inside the check-* commands, and with top-level commands on mvt, mvt-ios and mvt-android. See the development documentation for writing and installing them, and the custom CLI command documentation for the entry points a package registers commands in.

插件包通过额外的取证模块扩展了 MVT 的功能，这些模块在 check-* 命令中运行，并为 mvt、mvt-ios 和 mvt-android 提供顶级命令。请参阅开发文档以了解如何编写和安装插件，并参阅自定义 CLI 命令文档以了解包注册命令的入口点。

License

许可证

The purpose of MVT is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals. In order to achieve this, MVT is released under its own license. Read more here.

MVT 的宗旨是促进对可能成为复杂移动间谍软件攻击目标的人员（特别是公民社会成员和边缘化群体）的设备进行基于同意的取证分析。我们不希望 MVT 被用于侵犯非同意者的隐私。为了实现这一目标，MVT 以其特定的许可证发布。点击此处阅读更多信息。