Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time
#
# finspy config parse (c) 2019-2020
# by Thorsten (THS) Schroeder <ths [at] ccc [dot] de>
#
# Parse configuration data from Finspy-APKs for Android. Based on
# https://github.com/SpiderLabs/malware-analysis/tree/master/Ruby/FinSpy
# and
# https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/finspy-mobile-configuration-and-insight/
# by
# Josh Grunzweig
#
# Thank you!
#
# ---------------------------------------------------------------------------------------------------------
#
# BSD 3-Clause License (modified)
#
# Copyright (c) 2019, Chaos Computer Club
# Author: Thorsten (THS) Schroeder <ths [at] ccc [dot] de>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
# * Redistributions of source code must retain the above copyright notice, this
# list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
# * Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived from
#
# this software without specific prior written permission.
# * NON-MILITARY-USAGE CLAUSE
# Redistribution and use in source and binary form for military use and
# military research is not permitted. Infringement of these clauses may
# result in publishing the source code of the utilizing applications and
# libraries to the public. As this software is developed, tested and
# reviewed by *international* volunteers, this clause shall not be refused
# due to the matter of *national* security concerns.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
import sys
import time
import binascii
# change this to False to output whole configuration strings/arrays
pretty_print = True
def parse(cfgdata, level=0):
tlv_size = int.from_bytes(cfgdata[0:3], byteorder='little')
tlv_type = int.from_bytes(cfgdata[4:7], byteorder='little')
# tlv_data = cfgdata[8:tlv_size - 1]
tlv_data = cfgdata[8:tlv_size]
if tlv_type in tlv_types:
t = tlv_types[tlv_type]
else:
t = "TlvUnknown"
data = None
tabs = "\t" * level
if t == "TlvTypeMobileTargetUID":
data = int.from_bytes(tlv_data, byteorder='little') # reverse?
elif t in ["TlvTypeMobileTrackingSendOnAnyChannel", "TlvTypeMobileTrackingTimeInterval",
"TlvTypeMobileTrackingDistance", "TlvTypeMobileTargetHeartbeatEvents",
"TlvTypeMobileTargetLocationChangedRange", "TlvTypeTrojanMaxInfections", "TlvTypeUserID",
"TlvTypeConfigTargetPort", "TlvTypeMobileTargetHeartbeatInterval",
"TlvTypeConfigAutoRemovalIfNoProxy"]:
data = int.from_bytes(tlv_data, byteorder='little') # reverse?
elif t == "TlvTypeMobileTrojanUID":
data = tlv_data # tlvData.force_encoding("BINARY").scan(/./).reverse.join.hexify.upcase.rjust(8, '0')
# data = binascii.hexlify(tlv_data)
elif t in ["TlvTypeVersion", "TlvTypeRequestID"]:
data = int.from_bytes(tlv_data, byteorder='little') # revEndian(tlvData).to_s.rjust(8, '0')
elif t == "TlvTypeMobileTargetHeartBeatV10":
data = int.from_bytes(tlv_data, byteorder='little') # parseHB(tlvData, t)
elif t == "TlvTypeConfigMobileAutoRemovalDateTime":
data = time.ctime(int.from_bytes(tlv_data, byteorder='little'))
elif t == "TlvTypeInstalledModules":
data = ""
data = data + "{} {} |".format("Logging:", "On" if tlv_data[68] == 1 else "Off")
data = data + " {} {} |".format("Spy Call:", "On" if tlv_data[64] == 1 else "Off")
data = data + " {} {} |".format("Call Interception:", "On" if tlv_data[65] == 1 else "Off")
data = data + " {} {} |".format("SMS:", "On" if tlv_data[66] == 1 else "Off")
data = data + " {} {} |".format("Address Book:", "On" if tlv_data[67] == 1 else "Off")
data = data + " {} {} |".format("Tracking:", "On" if tlv_data[69] == 1 else "Off")
data = data + " {} {} |".format("Phone Logs:", "On" if tlv_data[70] == 1 else "Off")
else:
data = tlv_data
if data:
s = ""
try:
s = '"' + data.decode() + '"'
except Exception:
s = data
pass
if pretty_print == True:
if (pretty_print == True) and (tlv_size > 50) and (t != "TlvTypeInstalledModules"):
print("{0} {1:<46} = {2}[...] ({3})".format(tabs, t, s[:16], tlv_size))
else:
print("{0} {1:<46} = {2} ({3})".format(tabs, t, s, tlv_size))
else:
print("{0} {1:<46} = {2} ({3})".format(tabs, t, s, tlv_size))
if tlv_data[4:7]:
new_type = int.from_bytes(tlv_data[4:7], byteorder='little')
if new_type in tlv_types:
parse(tlv_data, level + 1)
if len(cfgdata) > tlv_size:
new_data = cfgdata[tlv_size:len(cfgdata) - 1]
parse(new_data, level)
def main(ac, av):
if ac < 2:
print("[!] usage: {} <cfg file>".format(av[0]))
print(" <cfg-file> - finspyCfgExtract.py output file")
return
print("# parsing FF config {})".format(av[1]))
# tlv_types_dump()
with open(av[1], "rb") as cfgfile:
cfgdata = cfgfile.read()
parse(cfgdata, 0)
return
# list taken from https://github.com/SpiderLabs/malware-analysis/blob/master/Ruby/FinSpy/parseConfig.rb
# thanks again, jgrunzweig @ github
tlv_types = {
4522400: "TlvTypeMobileTrackingStartRequest",
4522656: "TlvTypeMobileTrackingStopRequest",
4523376: "TlvTypeMobileTrackingDataV10",
4535200: "TlvTypeMobileTrackingConfig",
4535440: "TlvTypeMobileTrackingConfigRaw",
4538432: "TlvTypeMobileTrackingTimeInterval",
4538688: "TlvTypeMobileTrackingDistance",
4538928: "TlvTypeMobileTrackingSendOnAnyChannel",
6291872: "TlvTypeMobileLoggingMetaInfo",
6292096: "TlvTypeMobileLoggingData",
4456864: "TlvTypeMobileBlackberryMessengerMetaInfo",
4457088: "TlvTypeMobileBlackberryMessengerData",
4457328: "TlvTypeMobileBlackberryMsChatID",
4457600: "TlvTypeMobileBlackberryMsConversationPartners",
4587936: "TlvTypeMobilePhoneCallLogsMetaInfo",
4588192: "TlvTypeMobilePhoneCallLogsData",
4588400: "TlvTypeMobilePhoneCallLogsType",
4588672: "TlvTypeMobilePhoneCallAdditionalInformation",
4588912: "TlvTypeMobilePhoneCallLogsCallerNumber",
4589168: "TlvTypeMobilePhoneCallLogsCalleeNumber",
4589440: "TlvTypeMobilePhoneCallLogsCallerName",
4589696: "TlvTypeMobilePhoneCallLogsCalleeName",
4591680: "TlvTypeMobilePhoneCallLogLastEntryEndtime",
4325792: "TlvTypeMobileSMSMetaInfo",
4326016: "TlvTypeMobileSMSData",
4326256: "TlvTypeSMSSenderNumber",
4326512: "TlvTypeSMSRecipientNumber",
4326768: "TlvTypeSMSDirection",
4326528: "TlvTypeSMSInformation",
4391328: "TlvTypeMobileAddressBookMetaInfo",
4391552: "TlvTypeMobileAddressBookData",
4407360: "TlvTypeMobileAddressBookChecksum",
8978752: "TlvTypeMobileProxyMasterCommSig",
8979104: "TlvTypeMobileProxyMasterComm",
8979360: "TlvTypeMobileMasterProxyComm",
8979616: "TlvTypeProxyMasterMobileHeartBeatAnswer",
8979872: "TlvTypeMobileMasterProxyCommNotification",
8782176: "TlvTypeProxyMobileTargetCommSig",
8782496: "TlvTypeProxyMobileTargetComm",
8782752: "TlvTypeProxyMasterMobileTargetComm",
1507744: "TlvTypeAccessedFileMetaInfo",
1507968: "TlvTypeAccessedFileAccessTime",
1508224: "TlvTypeAccessedFileAccessEvent",
1508496: "TlvTypeAccessedFileRecording",
1508736: "TlvTypeAccessedApplicationName",
1508912: "TlvTypeConfigRecordImagesFromExplorer",
1519776: "TlvTypeGetAccessedConfigRequest",
1520032: "TlvTypeAccessedConfigReply",
1520288: "TlvTypeSetAccessedConfigRequest",
1520448: "TlvTypeConfigAccessedEvents",
2240672: "TlvTypeGetMouseClicksConfigRequest",
2240928: "TlvTypeMouseClicksConfigReply",
2241184: "TlvTypeSetMouseClicksConfigRequest",
2228640: "TlvTypeMouseClicksMetaInfo",
2228896: "TlvTypeMouseClicksFrame",
2232448: "TlvTypeMouseClicksEncodingType",
2232896: "TlvTypeConfigMouseClicksRectangle",
2233152: "TlvTypeConfigMouseClicksSensitivity",
2233408: "TlvTypeConfigMouseClicksType",
2175136: "TlvTypeGetVoIPConfigRequest",
2175392: "TlvTypeVoIPConfigReply",
2175648: "TlvTypeSetVoIPConfigRequest",
2163104: "TlvTypeVoIPMetaInfo",
2166912: "TlvTypeVoIPEncodingType",
2167168: "TlvTypeVoIPSessionType",
2167424: "TlvTypeVoIPApplicationName",
2167696: "TlvTypeVoIPAppScreenshot",
2167952: "TlvTypeVoIPAudioRecording",
2168112: "TlvTypeConfigVoIPScreenshotEnabled",
2109600: "TlvTypeGetForensicsConfigRequest",
2109856: "TlvTypeForensicsConfigReply",
2110112: "TlvTypeSetForensicsConfigRequest",
2097568: "TlvTypeUploadForensicsApplicationRequest",
2097824: "TlvTypeUploadForensicsApplicationReply",
2098080: "TlvTypeUploadForensicsApplicationChunk",
2098336: "TlvTypeUploadForensicsApplicationDoneRequest",
2098592: "TlvTypeUploadForensicsApplicationDoneReply",
2101664: "TlvTypeRemoveForensicsApplicationRequest",
2101920: "TlvTypeRemoveForensicsApplicationReply",
2105760: "TlvTypeForensicsAppExecuteRequest",
2106016: "TlvTypeForensicsAppExecuteReply",
2106272: "TlvTypeForensicsAppExecuteResult",
2106528: "TlvTypeForensicsAppExecuteResultChunk",
2106784: "TlvTypeForensicsAppExecuteResultDone",
2107040: "TlvTypeForensicsCancelAppExecuteRequest",
2107296: "TlvTypeForensicsCancelAppExecuteReply",
2113680: "TlvTypeConfigForensicsApplicationInfoGeneric",
2113952: "TlvTypeConfigForensicsApplicationInfo",
2117760: "TlvTypeConfigForensicsApplicationName",
2117952: "TlvTypeConfigForensicsApplicationSize",
2118208: "TlvTypeConfigForensicsApplicationID",
2118528: "TlvTypeConfigForensicsApplicationCmdline",
2118784: "TlvTypeConfigForensicsApplicationOutput",
2118976: "TlvTypeConfigForensicsApplicationTimeout",
2119232: "TlvTypeConfigForensicsApplicationVersion",
2119552: "TlvTypeForensicsFriendlyName",
2119808: "TlvTypeConfigForensicsApplicationOutputPrepend",
2120064: "TlvTypeConfigForensicsApplicationOutputContentType",
1638816: "TlvTypeDeletedFileMetaInfo",
1639296: "TlvTypeDeletedFileDeletionTime",
1639552: "TlvTypeDeletedFileRecycleBin",
1639808: "TlvTypeDeletedMethod",
1640064: "TlvTypeDeletedApplicationName",
1640336: "TlvTypeDeletedFileRecording",
1650848: "TlvTypeGetDeletedConfigRequest",
1651104: "TlvTypeDeletedConfigReply",
1651360: "TlvTypeSetDeletedConfigRequest",
1573280: "TlvTypePrintFileMetaInfo",
1573520: "TlvTypePrintFrame",
1581184: "TlvTypePrintApplicationName",
1581440: "TlvTypePrintFilename",
1581696: "TlvTypePrintEncodingType",
1585312: "TlvTypeGetPrintConfigRequest",
1585568: "TlvTypePrintConfigReply",
1585824: "TlvTypeSetPrintConfigRequest",
1442208: "TlvTypeChangedFileMetaInfo",
1442432: "TlvTypeChangedFileChangeTime",
1442688: "TlvTypeChangedFileChangeEvent",
1442960: "TlvTypeChangedFileRecording",
1454240: "TlvTypeGetChangedConfigRequest",
1454496: "TlvTypeChangedConfigReply",
1454752: "TlvTypeSetChangedConfigRequest",
1454912: "TlvTypeConfigChangedEvents",
1311136: "TlvTypeSkypeAudioMetaInfo",
1311376: "TlvTypeSkypeAudioRecording",
1311648: "TlvTypeSkypeTextRecording",
1311904: "TlvTypeSkypeFileMetaInfo",
1312144: "TlvTypeSkypeFileRecording",
1312416: "TlvTypeSkypeContactsRecording",
1312640: "TlvTypeSkypeContactsUserData",
1323168: "TlvTypeGetSkypeConfigRequest",
1323424: "TlvTypeSkypeConfigReply",
1323680: "TlvTypeSetSkypeConfigRequest",
1324336: "TlvTypeConfigSkypeAudioEnable",
1324592: "TlvTypeConfigSkypeTextEnable",
1324848: "TlvTypeConfigSkypeFileEnable",
1325104: "TlvTypeConfigSkypeContactsListEnable",
1327232: "TlvTypeSkypeAudioEncodingType",
1327488: "TlvTypeSkypeLoggedInUserAccountName",
1327744: "TlvTypeSkypeConversationPartnerAccountName",
1328000: "TlvTypeSkypeConversationPartnerDisplayName",
1328256: "TlvTypeSkypeChatMembers",
1328512: "TlvTypeSkypeTextMessage",
1328768: "TlvTypeSkypeChatID",
1329024: "TlvTypeSkypeSenderAccountName",
1329280: "TlvTypeSkypeSenderDisplayName",
1329536: "TlvTypeSkypeIncoming",
1329792: "TlvTypeSkypeSessionType",
1192096: "TlvTypeGetKeyloggerConfigRequest",
1192352: "TlvTypeKeyloggerConfigReply",
1192608: "TlvTypeSetKeyloggerConfigRequest",
1180064: "TlvTypeStartKeyLoggingRequest",
1180320: "TlvTypeStartKeyLoggingReply",
1180576: "TlvTypeKeyLoggingFrame",
1180832: "TlvTypeStopKeyLoggingRequest",
1181088: "TlvTypeKeyLoggingStoppedReply",
1196416: "TlvTypeKLFrameData",
1126560: "TlvTypeGetVideoConfigRequest",
1126816: "TlvTypeVideoConfigReply",
1127072: "TlvTypeSetVideoConfigRequest",
1114528: "TlvTypeStartScreenRequest",
1114784: "TlvTypeStartScreenReply",
1115040: "TlvTypeScreenFrame",
1115296: "TlvTypeStopScreenRequest",
1115552: "TlvTypeScreenStoppedReply",
1115808: "TlvTypeStartScreenRecording",
1122720: "TlvTypeStartWebCamRequest",
1122976: "TlvTypeStartWebCamReply",
1123232: "TlvTypeWebCamFrame",
1123488: "TlvTypeStopWebCamRequest",
1123744: "TlvTypeWebCamStoppedReply",
1124000: "TlvTypeStartWebCamRecording",
1130560: "TlvTypeVDFrameID",
1130896: "TlvTypeVDFrameData",
1131136: "TlvTypeOriginalVideoResolution",
1131392: "TlvTypeVideoResolution",
1066112: "TlvTypeVideoSessionType",
1066368: "TlvTypeVideoEncodingType",
1132160: "TlvTypeAutomaticRecordingUID",
1061024: "TlvTypeGetAudioConfigRequest",
1061280: "TlvTypeAudioConfigReply",
1061536: "TlvTypeSetAudioConfigRequest",
1048992: "TlvTypeStartMicrophoneRequest",
1049248: "TlvTypeStartMicrophoneReply",
1049504: "TlvTypeMicrophoneFrame",
1049760: "TlvTypeStopMicrophoneRequest",
1050016: "TlvTypeMicrophoneStoppedReply",
1050272: "TlvTypeStartMicrophoneRecording",
1052736: "TlvTypeMICFrameID",
1053072: "TlvTypeMICFrameData",
1053312: "TlvTypeAudioSessionType",
1053568: "TlvTypeAudioEncodingType",
328096: "TlvTypeGetSchedulerConfigRequest",
328352: "TlvTypeSchedulerConfigReply",
328608: "TlvTypeSetSchedulerConfigRequest",
331920: "TlvTypeSchedulerTask",
332192: "TlvTypeSchedulerTaskRecordByTime",
332448: "TlvTypeSchedulerTaskRecordScreenWhenAppRuns",
332704: "TlvTypeSchedulerTaskRecordMicWhenAppUsesIt",
332960: "TlvTypeSchedulerTaskRecordWebCamWhenAppUsesIt",
360592: "TlvTypeSCHTaskConfiguration",
360752: "TlvTypeSCHTaskEnabled",
361344: "TlvTypeSCHTaskStartDateTime",
361600: "TlvTypeSCHTaskStopDateTime",
362112: "TlvTypeSCHApplicationName",
362288: "TlvTypeSCHApplicationWindowOnly",
299168: "TlvTypeGetCmdLineConfigRequest",
299424: "TlvTypeCmdLineConfigReply",
299680: "TlvTypeSetCmdLineConfigRequest",
262560: "TlvTypeStartCmdLineSessionRequest",
262816: "TlvTypeStartCmdLineSessionReply",
263072: "TlvTypeStopCmdLineSessionRequest",
263328: "TlvTypeCmdLineSessionStoppedReply",
263584: "TlvTypeCmdLineExecute",
263840: "TlvTypeCmdLineExecutionResult",
266352: "TlvTypeCmdLineExecuteCommand",
266560: "TlvTypeCmdLineExecuteAnswerID",
266864: "TlvTypeCmdLineExecuteAnswerData",
168096: "TlvTypeGetFileSystemConfigRequest",
168352: "TlvTypeFileSystemConfigReply",
168608: "TlvTypeSetFileSystemConfigRequest",
131488: "TlvTypeGetAllDrivesRequest",
131744: "TlvTypeGetAllDrivesReply",
135328: "TlvTypeGetFolderContentsRequest",
135584: "TlvTypeGetFolderContentsReply",
135840: "TlvTypeGetFolderContentsNext",
136096: "TlvTypeGetFolderContentsEnd",
139424: "TlvTypeDownloadFileRequest",
139680: "TlvTypeCancelDownloadFileRequest",
139936: "TlvTypeDownloadFileReply",
140192: "TlvTypeDownloadFileNext",
140448: "TlvTypeDownloadFileEnd",
140704: "TlvTypeCancelDownloadFileReply",
143520: "TlvTypeUploadFileRequest",
143776: "TlvTypeCancelUploadFileRequest",
144032: "TlvTypeUploadFileReply",
144288: "TlvTypeUploadFileNext",
144544: "TlvTypeUploadFileEnd",
144800: "TlvTypeUploadFileCompleted",
145056: "TlvTypeCancelUploadFileReply",
147616: "TlvTypeDeleteFileRequest",
147872: "TlvTypeDeleteFileReply",
151968: "TlvTypeSearchFileRequest",
152224: "TlvTypeSearchFileReply",
152480: "TlvTypeSearchFileNext",
152736: "TlvTypeSearchFileEnd",
152992: "TlvTypeCancelSearchFileRequest",
153248: "TlvTypeCancelSearchFileReply",
159888: "TlvTypeFSFileDataChunk",
160128: "TlvTypeFSDiskDrive",
160384: "TlvTypeFSFullPath",
160640: "TlvTypeFSFilename",
160896: "TlvTypeFSFileExtension",
161088: "TlvTypeFSDiskDriveType",
161408: "TlvTypeFSFileSize",
161584: "TlvTypeFSIsFolder",
161840: "TlvTypeFSReadOnly",
162096: "TlvTypeFSHidden",
162352: "TlvTypeFSSystem",
162688: "TlvTypeFSFileCreationTime",
162944: "TlvTypeFSFileLastAccessTime",
163200: "TlvTypeFSFileLastWriteTime",
163472: "TlvTypeFSFullPathM",
8978848: "TlvTypeMasterMobileTargetConn",
7471520: "TlvTypeMasterTargetConn",
7405984: "TlvTypeMasterAgentLogin",
7406240: "TlvTypeMasterAgentLoginAnswer",
7406752: "TlvTypeMasterAgentTargetList",
7407008: "TlvTypeMasterAgentTargetOnlineList",
7407264: "TlvTypeMasterAgentTargetInfoReply",
7407520: "TlvTypeMasterAgentUserList",
7407776: "TlvTypeMasterAgentUserListReply",
7408032: "TlvTypeMasterAgentTargetArchivedList",
7408288: "TlvTypeMasterAgentTargetListEx",
7408544: "TlvTypeMasterAgentTargetOnlineListEx",
7408800: "TlvTypeMasterAgentMobileTargetArchivedList",
7409056: "TlvTypeMasterAgentMobileTargetList",
7409312: "TlvTypeMasterAgentMobileTargetOnlineList",
7409824: "TlvTypeMasterAgentQueryFirst",
7410080: "TlvTypeMasterAgentQueryNext",
7410336: "TlvTypeMasterAgentQueryLast",
7410592: "TlvTypeMasterAgentQueryAnswer",
7410848: "TlvTypeMasterAgentRemoveRecord",
7411104: "TlvTypeMasterAgentTargetInfoExReply",
7411344: "TlvTypeTargetInfoExProperty",
7411616: "TlvTypeTargetInfoExPropertyValue",
7411840: "TlvTypeTargetInfoExPropertyValueName",
7411968: "TlvTypeTargetInfoExPropertyValueData",
7412384: "TlvTypeMasterAgentAlarm",
7413920: "TlvTypeMasterAgentRetrieveData",
7414176: "TlvTypeMasterAgentRetrieveDataAnswer",
7414432: "TlvTypeMasterAgentRemoveUser",
7414688: "TlvTypeMasterAgentRemoveTarget",
7414944: "TlvTypeMasterAgentRetrieveDataComments",
7415200: "TlvTypeMasterAgentUpdateDataComments",
7415712: "TlvTypeMasterAgentRetrieveActivityLogging",
7415968: "TlvTypeMasterAgentRetrieveMasterLogging",
7416224: "TlvTypeMasterAgentRetrieveAgentActivityLogging",
7417248: "TlvTypeMasterAgentSendUserGUIConfig",
7417504: "TlvTypeMasterAgentGetUserGUIConfigRequest",
7417760: "TlvTypeMasterAgentGetUserGUIConfigReply",
7418016: "TlvTypeMasterAgentProxyList",
7418272: "TlvTypeMasterAgentProxyInfoReply",
7419040: "TlvTypeMasterAgentNameValuePacket",
7419248: "TlvTypeMasterAgentValueName",
7419392: "TlvTypeMasterAgentValueData",
7419808: "TlvTypeMasterAgentRetrieveTargetHistory",
7421088: "TlvTypeMasterAgentInstallMasterLicense",
7421344: "TlvTypeMasterAgentInstallSoftwareUpdate",
7421600: "TlvTypeMasterAgentInstallSoftwareUpdateChunk",
7421856: "TlvTypeMasterAgentInstallSoftwareUpdateDone",
7422112: "TlvTypeMasterAgentSoftwareUpdateInfo",
7422368: "TlvTypeMasterAgentSoftwareUpdateInfoReply",
7422624: "TlvTypeMasterAgentSoftwareUpdate",
7422880: "TlvTypeMasterAgentSoftwareUpdateReply",
7423136: "TlvTypeMasterAgentSoftwareUpdateNext",
7423392: "TlvTypeMasterAgentAddTimeSchedule",
7423648: "TlvTypeMasterAgentAddScreenSchedule",
7423904: "TlvTypeMasterAgentAddLockedSchedule",
7424160: "TlvTypeMasterAgentRemoveSchedule",
7424416: "TlvTypeMasterAgentGetSchedulerList",
7424672: "TlvTypeMasterAgentSchedulerTimeAction",
7424928: "TlvTypeMasterAgentSchedulerScreenAction",
7425184: "TlvTypeMasterAgentSchedulerLockedAction",
7425440: "TlvTypeMasterAgentProjectSoftwareUpdateInfo",
7425696: "TlvTypeMasterAgentProjectSoftwareUpdateInfoReply",
7425952: "TlvTypeMasterAgentProjectSoftwareUpdate",
7426112: "TlvTypeMasterAgentSchedulerID",
7426368: "TlvTypeMasterAgentSchedulerStartTime",
7426624: "TlvTypeMasterAgentSchedulerStopTime",
7427488: "TlvTypeMasterAgentAddRecordedDataAvailableSchedule",
7427744: "TlvTypeMasterAgentSchedulerRecordedDataAvailableAction",
7428256: "TlvTypeMasterAgentRetrieveRemoteMasterData",
7428512: "TlvTypeMasterAgentRetrieveRemoteMasterDataReply",
7428768: "TlvTypeMasterAgentDeleteRemoteMasterData",
7429024: "TlvTypeMasterAgentRetrieveOfflineMasterData",
7429280: "TlvTypeMasterAgentRetrieveOfflineMasterDataReply",
7429536: "TlvTypeMasterAgentDeleteOfflineMasterData",
7430304: "TlvTypeMasterAgentQueryFirstEx",
7430560: "TlvTypeMasterAgentQueryNextEx",
7430816: "TlvTypeMasterAgentQueryLastEx",
7431072: "TlvTypeMasterAgentQueryAnswerEx",
7431328: "TlvTypeMasterAgentSendUserPreferences",
7431584: "TlvTypeMasterAgentGetUserPreferencesRequest",
7431840: "TlvTypeMasterAgentGetUserPreferencesReply",
7432096: "TlvTypeMasterAgentListMCFilesRequest",
8415392: "TlvTypeMasterAgentListMCFilesReply",
7432608: "TlvTypeMasterAgentDeleteMCFiles",
7432864: "TlvTypeMasterAgentSendMCFiles",
7433120: "TlvTypeMasterAgentMCStatisticsRequest",
7433376: "TlvTypeMasterAgentMCStatisticsReply",
7433616: "TlvTypeMasterAgentMCStatisticsValues",
7434400: "TlvTypeMasterAgentTrojanKeyRequest",
7434656: "TlvTypeMasterAgentTrojanKeyReply",
7434912: "TlvTypeMasterAgentEvProtectionX509Request",
7435168: "TlvTypeMasterAgentEvProtectionX509Reply",
7435424: "TlvTypeMasterAgentEvProtectionImportCert",
7435680: "TlvTypeMasterAgentEvProtectionImportCertCompleted",
7435936: "TlvTypeMasterAgentConfigurationRequest",
7436192: "TlvTypeMasterAgentConfigurationReply",
7436448: "TlvTypeMasterAgentConfigurationUpdateRequest",
7436704: "TlvTypeMasterAgentConfigurationUpdateRequestCompleted",
7436944: "TlvTypeMasterAgentConfiguration",
7437216: "TlvTypeMasterAgentConfigurationValue",
7437424: "TlvTypeMasterAgentConfigurationValueName",
7437568: "TlvTypeMasterAgentConfigurationValueData",
7437984: "TlvTypeMasterAgentConfigurationTransferDone",
7438496: "TlvTypeMasterAgentRetrieveTargetFile",
7438752: "TlvTypeMasterAgentRetrieveTargetFileAnswer",
7438912: "TlvTypeMasterAgentAlarmEntryID",
7439168: "TlvTypeMasterAgentAlarmEntryVersion",
7439424: "TlvTypeMasterAgentAlarmTriggerFlags",
7439776: "TlvTypeMasterAgentGetAlarmList",
7440032: "TlvTypeMasterAgentAddAlarmEntry",
7440288: "TlvTypeMasterAgentRemoveAlarmEntry",
7440544: "TlvTypeMasterAgentAlarmEntry",
7440800: "TlvTypeMasterAgentSystemStatus",
7441056: "TlvTypeMasterAgentSystemStatusRequest",
7441312: "TlvTypeMasterAgentSystemStatusReply",
7441552: "TlvTypeMasterAgentLicenseValues",
7441824: "TlvTypeMasterAgentLicenseValuesRequest",
7442080: "TlvTypeMasterAgentLicenseValuesReply",
7442592: "TlvTypeMasterAgentGetNetworkConfigurationRequest",
7442848: "TlvTypeMasterAgentSetNetworkConfigurationRequest",
7443104: "TlvTypeMasterAgentSetNetworkConfigurationReply",
7443360: "TlvTypeMasterAgentRetrieveAllowedModulesList",
7443616: "TlvTypeMasterAgentRetrieveAllowedModulesListAnswer",
7446688: "TlvTypeMasterAgentRemoveAllTargetData",
7446944: "TlvTypeMasterAgentForceDownloadRecordedData",
7447200: "TlvTypeMasterAgentTargetCreateNotification",
7447456: "TlvTypeMasterAgentMobileTargetInfoReply",
7447696: "TlvTypeMasterAgentMobileTargetInfoValues",
7450784: "TlvTypeMasterAgentAlert",
7454880: "TlvTypeMasterAgentAddUser",
7455392: "TlvTypeMasterAgentAddUserReply",
7455648: "TlvTypeMasterAgentModifyUser",
7455904: "TlvTypeMasterAgentSetUserPermission",
7456160: "TlvTypeMasterAgentSetTargetPermission",
7456400: "TlvTypeMasterAgentUserPermission",
7456656: "TlvTypeMasterAgentTargetPermission",
7456928: "TlvTypeMasterAgentUserPermissionValuePacket",
7457184: "TlvTypeMasterAgentTargetPermissionValuePacket",
7457344: "TlvTypeMasterAgentUserPermissionValueName",
7457600: "TlvTypeMasterAgentTargetPermissionValueName",
7457856: "TlvTypeMasterAgentUserPermissionValueData",
7458112: "TlvTypeMasterAgentTargetPermissionValueData",
7458464: "TlvTypeMasterAgentModifyPassword",
7458656: "TlvTypeMasterAgentMobileTargetPermissionValueName",
7458976: "TlvTypeMasterAgentUploadFile",
7459232: "TlvTypeMasterAgentUploadFileChunk",
7459488: "TlvTypeMasterAgentUploadFileDone",
7459744: "TlvTypeMasterAgentUploadFilesTransferDone",
7460000: "TlvTypeMasterAgentGetTargetModuleConfigRequest",
7460256: "TlvTypeMasterAgentRemoveFile",
7460512: "TlvTypeMasterAgentMobileProxyList",
7460768: "TlvTypeMasterAgentSMSProxyList",
7461024: "TlvTypeMasterAgentSMSProxyInfoReply",
7461280: "TlvTypeMasterAgentCallPhoneNumberList",
7461536: "TlvTypeMasterAgentCallPhoneNumberInfoReply",
7461792: "TlvTypeMasterAgentGetMobileTargetModuleConfigRequest",
7462048: "TlvTypeMasterAgentSendSMS",
7469984: "TlvTypeMasterAgentEncryptionRequired",
7470752: "TlvTypeAgentMasterComm",
7470240: "TlvTypeMasterAgentFileCompleted",
7470496: "TlvTypeMasterAgentRequestCompleted",
7471008: "TlvTypeMasterAgentRequestStatus",
7733664: "TlvTypeRelayProxyComm",
8454800: "TlvTypeRelayData",
7734176: "TlvTypeRelayDummyHeartbeat",
7668128: "TlvTypeMasterTargetComm",
7668384: "TlvTypeTargetCloseAllLiveStreaming",
7471424: "TlvTypeProxyMasterCommSig",
7471776: "TlvTypeProxyMasterComm",
7472032: "TlvTypeMasterProxyComm",
7472288: "TlvTypeProxyMasterHeartBeatAnswer",
7472544: "TlvTypeProxyMasterDisconnect",
7472704: "TlvTypeProxyMasterNotification",
7473056: "TlvTypeProxyMasterRequest",
7473312: "TlvTypeMasterProxyCommNotification",
7473568: "TlvTypeMasterCheckTargetDisconnect",
7536960: "TlvTypeProxyTargetCommSig",
7537312: "TlvTypeProxyTargetComm",
7537568: "TlvTypeProxyMasterTargetComm",
7537728: "TlvTypeProxyTargetRequestCrypto",
7538064: "TlvTypeProxyTargetAnswerCrypto",
8454544: "TlvTypeProxyData",
8458400: "TlvTypeProxyTargetDisconnect",
8458656: "TlvTypeProxyMobileTargetDisconnect",
8458912: "TlvTypeProxyDummyHeartbeat",
8459168: "TlvTypeProxyMobileDummyHeartbeat",
8585616: "TlvTypeAgentData",
8585808: "TlvTypeAgentQueryID",
8586048: "TlvTypeAgentQueryModSubmodID",
8586304: "TlvTypeAgentQueryFromDate",
8586560: "TlvTypeAgentQueryToDate",
8586816: "TlvTypeAgentQuerySortOrder",
8587136: "TlvTypeAgentQueryValueFilter",
8587328: "TlvTypeAgentUID",
8520080: "TlvTypeMasterData",
8520768: "TlvTypeMasterMode",
8521024: "TlvTypeMasterToken",
8521344: "TlvTypeMasterQueryResult",
8522368: "TlvTypeMasterAlarmString",
8651152: "TlvTypeMobileTargetData",
8651376: "TlvTypeMobileTargetHeartBeatV10",
8651632: "TlvTypeMobileTargetExtendedHeartBeatV10",
8651888: "TlvTypeMobileHeartBeatReplyV10",
8653472: "TlvTypeMobileInstalledModulesReply",
8656032: "TlvTypeMobileTargetUploadModuleRequest",
8656288: "TlvTypeMobileTargetUploadModuleReply",
8656544: "TlvTypeMobileTargetUploadModuleChunk",
8656800: "TlvTypeMobileTargetUploadModuleDoneRequest",
8657056: "TlvTypeMobileTargetUploadModuleDoneReply",
8657312: "TlvTypeMobileTargetRemoveModuleRequest",
8657568: "TlvTypeMobileTargetRemoveModuleReply",
8655008: "TlvTypeMobileTargetOfflineUploadModuleRequest",
8657824: "TlvTypeMobileTargetOfflineUploadModuleReply",
8658080: "TlvTypeMobileTargetOfflineUploadModuleChunk",
8658336: "TlvTypeMobileTargetOfflineUploadModuleDoneRequest",
8658592: "TlvTypeMobileTargetOfflineUploadModuleDoneReply",
8658848: "TlvTypeMobileTargetOfflineError",
8659104: "TlvTypeMobileTargetError",
8659360: "TlvTypeMobileTargetGetRecordedFilesRequest",
8659616: "TlvTypeMobileTargetRecordedFilesReply",
8659872: "TlvTypeMobileTargetRecordedFileDownloadRequest",
8660128: "TlvTypeMobileTargetRecordedFileDownloadReply",
8660384: "TlvTypeMobileTargetRecordedFileDownloadChunk",
8660640: "TlvTypeMobileTargetRecordedFileDownloadCompleted",
8660896: "TlvTypeMobileTargetRecordedFileDeleteRequest",
8661152: "TlvTypeMobileTargetRecordedFileDeleteReply",
8663968: "TlvTypeMobileTargetOfflineConfig",
8664224: "TlvTypeMobileTargetEmergencyConfigAsTLV",
8664432: "TlvTypeMobileTargetEmergencyConfig",
8671392: "TlvTypeMobileTargetLoadModuleRequest",
8671648: "TlvTypeMobileTargetLoadModuleReply",
8671904: "TlvTypeMobileTargetUnLoadModuleRequest",
8672160: "TlvTypeMobileTargetUnLoadModuleReply",
8675472: "TlvTypeMobileTargetHeartbeatEvents",
8675648: "TlvTypeMobileTargetHeartbeatInterval",
8675984: "TlvTypeMobileTargetHeartbeatRestrictions",
8676208: "TlvTypeConfigSMSPhoneNumber",
8676496: "TlvTypeMobileTargetPositioning",
8676672: "TlvTypeMobileTrojanUID",
8676976: "TlvTypeMobileTrojanID",
8677296: "TlvTypeMobileTargetLocationChangedRange",
8677440: "TlvTypeConfigMobileAutoRemovalDateTime",
8677808: "TlvTypeConfigOverwriteProxyAndPhones",
8678000: "TlvTypeConfigCallPhoneNumber",
8679488: "TlvTypeLocationAreaCode",
8679744: "TlvTypeCellID",
8680048: "TlvTypeMobileCountryCode",
8680304: "TlvTypeMobileNetworkCode",
8680560: "TlvTypeIMSI",
8680816: "TlvTypeIMEI",
8681072: "TlvTypeGPSLatitude",
8681328: "TlvTypeGPSLongitude",
8681520: "TlvTypeFirstHeartbeat",
8681872: "TlvTypeInstalledModules",
8683568: "TlvTypeValidGPSValues",
8389008: "TlvTypeTargetData",
8389280: "TlvTypeTargetHeartBeat",
8389680: "TlvTypeTargetKeepSessionAlive",
8390000: "TlvTypeTargetLocalIP",
8390256: "TlvTypeTargetGlobalIP",
8390448: "TlvTypeTargetState",
8390784: "TlvTypeTargetID",
8391072: "TlvTypeGetInstalledModulesRequest",
8391328: "TlvTypeInstalledModulesReply",
8391488: "TlvTypeTrojanUID",
8391808: "TlvTypeTrojanID",
8392000: "TlvTypeTrojanMaxInfections",
8392240: "TlvTypeScreenSaverOn",
8392496: "TlvTypeScreenLocked",
8392752: "TlvTypeRecordedDataAvailable",
8393024: "TlvTypeDownloadedRecordedDataTimeStamp",
8393280: "TlvTypeInstallationMode",
8393552: "TlvTypeTargetRemoveNotification",
8393792: "TlvTypeTargetPlatformBits",
8394032: "TlvTypeRemoveItselfMaxInfectionReached",
8394288: "TlvTypeRemoveItselfAtMasterRequest",
8394544: "TlvTypeRemoveItselfAtAgentRequest",
8394912: "TlvTypeRemoveItselfAtAgentReqRequest",
8395072: "TlvTypeRecordedFilesDownloadTotal",
8395328: "TlvTypeRecordedFilesDownloadProgress",
8395632: "TlvTypeTargetLicenseInfo",
8395840: "TlvTypeRemoveTargetLicenseInfo",
8396176: "TlvTypeTargetAllConfigurations",
8396960: "TlvTypeTargetError",
8401056: "TlvTypeGetTargetConfigRequest",
8401312: "TlvTypeTargetConfigReply",
8401568: "TlvTypeSetTargetConfigRequest",
8402304: "TlvTypeConfigTargetID",
8402496: "TlvTypeConfigTargetHeartbeatInterval",
8402800: "TlvTypeConfigTargetProxy",
8403008: "TlvTypeConfigTargetPort",
8403584: "TlvTypeConfigAutoRemovalDateTime",
8403776: "TlvTypeConfigAutoRemovalIfNoProxy",
8404032: "TlvTypeInternalAutoRemovalElapsedTime",
8405040: "TlvTypeConfigActiveHiding",
8409248: "TlvTypeTargetLoadModuleRequest",
8409504: "TlvTypeTargetLoadModuleReply",
8409760: "TlvTypeTargetUnLoadModuleRequest",
8410016: "TlvTypeTargetUnLoadModuleReply",
8410272: "TlvTypeTargetUploadModuleRequest",
8410528: "TlvTypeTargetUploadModuleReply",
8410784: "TlvTypeTargetUploadModuleChunk",
8411040: "TlvTypeTargetUploadModuleDoneRequest",
8411296: "TlvTypeTargetUploadModuleDoneReply",
8411552: "TlvTypeTargetRemoveModuleRequest",
8411808: "TlvTypeTargetRemoveModuleReply",
8412064: "TlvTypeTargetOfflineUploadModuleRequest",
8412320: "TlvTypeTargetOfflineUploadModuleReply",
8412576: "TlvTypeTargetOfflineUploadModuleChunk",
8412832: "TlvTypeTargetOfflineUploadModuleDoneRequest",
8413088: "TlvTypeTargetOfflineUploadModuleDoneReply",
8413344: "TlvTypeTargetOfflineError",
8413600: "TlvTypeTargetUploadError",
8417440: "TlvTypeTargetGetRecordedFilesRequest",
8417696: "TlvTypeTargetRecordedFilesReply",
8417952: "TlvTypeTargetRecordedFileDownloadRequest",
8418208: "TlvTypeTargetRecordedFileDownloadReply",
8418464: "TlvTypeTargetRecordedFileDownloadChunk",
8418720: "TlvTypeTargetRecordedFileDownloadCompleted",
8418976: "TlvTypeTargetRecordedFileDeleteRequest",
8419232: "TlvTypeTargetRecordedFileDeleteReply",
8419488: "TlvTypeTargetGetRecordedFilesRequestEx",
8419744: "TlvTypeTargetRecordedFilesReplyEx",
8420000: "TlvTypeTargetRecordedFileDeleteRequestEx",
8420256: "TlvTypeTargetRecordedFilesDownloadRequestEx",
16744768: "TlvTypeProxyConnectionBroken",
16712000: "TlvTypeTargetConnectionBroken",
16712256: "TlvTypeAgentConnectionBroken",
16712512: "TlvTypeTargetOffline",
16646544: "TlvTypePlaintext",
16646800: "TlvTypeCompression",
16647056: "TlvTypeEncryption",
16647232: "TlvTypeTargetUID",
16647536: "TlvTypeIPAddress",
16647808: "TlvTypeUserName",
16648064: "TlvTypeComputerName",
16648304: "TlvTypeLoginName",
16648560: "TlvTypePassphrase",
16648832: "TlvTypeRecordID",
16649088: "TlvTypeOwner",
16649344: "TlvTypeMetaData",
16649536: "TlvTypeModuleID",
16649856: "TlvTypeOSName",
16650048: "TlvTypeModuleSubID",
16650320: "TlvTypeErrorCode",
16650560: "TlvTypeOffset",
16650816: "TlvTypeLength",
16651088: "TlvTypeRequestID",
16651328: "TlvTypeRequestType",
16651584: "TlvTypeVersion",
16651840: "TlvTypeMachineID",
16652096: "TlvTypeMajorNumber",
16652352: "TlvTypeMinorNumber",
16652656: "TlvTypeGlobalIPAddress",
16652912: "TlvTypeASCII_Filename",
16653120: "TlvTypeFilesize",
16653392: "TlvTypeFilecount",
16653712: "TlvTypeFiledata",
16653968: "TlvTypeMD5Sum",
16654144: "TlvTypeProxyPort",
16654400: "TlvTypeStatus",
16654656: "TlvTypeUserID",
16654912: "TlvTypeGroupID",
16655168: "TlvTypePermissions",
16655424: "TlvTypeRequestCode",
16655680: "TlvTypeDataSize",
16655936: "TlvTypeKeyType",
16656240: "TlvTypeEmail",
16656432: "TlvTypeEnabled",
16656688: "TlvTypeLicensed",
16656960: "TlvTypeAudioFrequency",
16657216: "TlvTypeAudioBitsPerSample",
16657472: "TlvTypeAudioChannels",
16657728: "TlvTypeStartTime",
16657984: "TlvTypeStopTime",
16658240: "TlvTypeBitMask",
16658560: "TlvTypeTimeZone",
16658816: "TlvTypeDateTime",
16659072: "TlvTypeStartSessionDateTime",
16659328: "TlvTypeStopSessionDateTime",
16659520: "TlvTypeDateTimeRef",
16659776: "TlvTypeScheduleRepeat",
16660032: "TlvTypeUnixMasterDateTime",
16660288: "TlvTypeUnixUTCDateTime",
16660544: "TlvTypeDurationInSeconds",
16660864: "TlvTypeMasterRefTime",
16661120: "TlvTypeMasterRefTimeStart",
16661376: "TlvTypeMasterRefTimeEnd",
16661568: "TlvTypeCounter",
16661888: "TlvTypeWhiteListEntry",
16662144: "TlvTypeBlackListEntry",
16662336: "TlvTypeBlackWhiteListingMode",
16662576: "TlvTypeConfigEnabled",
16662848: "TlvTypeConfigMaxRecordingSize",
16663104: "TlvTypeConfigAudioQuality",
16663344: "TlvTypeConfigVideoBlackAndWhite",
16663616: "TlvTypeConfigVideoResolution",
16663872: "TlvTypeConfigCaptureFrequency",
16664128: "TlvTypeConfigVideoQuality",
16664384: "TlvTypeConfigFilesStandardFilter",
16664704: "TlvTypeConfigFilesCustomFilter",
16664896: "TlvTypeConfigStandardLocation",
16665216: "TlvTypeConfigCustomLocation",
16665408: "TlvTypeConfigFileChunkSize",
16665664: "TlvTypeConfigFileTransferSpeed",
16665904: "TlvTypeConfigUploadFileOverwrite",
16666160: "TlvTypeConfigDeleteOverReboot",
16666496: "TlvTypeConfigCustomLocationException",
16666752: "TlvTypeExtraData",
16667008: "TlvTypeSignature",
16667264: "TlvTypeComments",
16667520: "TlvTypeDescription",
16667776: "TlvTypeFilenameExtension",
16668032: "TlvTypeSessionType",
16668224: "TlvTypePeriod",
16668512: "TlvTypeMobileTargetUID",
16668784: "TlvTypeMobileTargetID",
16669072: "TlvTypeMobilePlaintext",
16669328: "TlvTypeMobileCompression",
16669584: "TlvTypeMobileEncryption",
16669824: "TlvTypeEncodingType",
16670576: "TlvTypePhoneNumber",
16670784: "TlvTypeConfigCustomLocationMode",
16674928: "TlvTypeNetworkInterface",
16675136: "TlvTypeNetworkInterfaceMode",
16675440: "TlvTypeNetworkInterfaceAddress",
16675696: "TlvTypeNetworkInterfaceNetmask",
16675952: "TlvTypeNetworkInterfaceGateway",
16676208: "TlvTypeNetworkInterfaceDNS_1",
16676464: "TlvTypeNetworkInterfaceDNS_2",
16677440: "TlvTypeLoginTime",
16677696: "TlvTypeLogoffTime",
16678720: "TlvTypeGeneric_Type",
16678976: "TlvTypeChecksum",
16679280: "TlvTypeCity",
16679536: "TlvTypeCountry",
16679792: "TlvTypeCountryCode",
16683072: "TlvTypeTargetType",
16683392: "TlvTypeDurationString",
8257792: "TlvTypeTestMetaTypeInvalid",
8258608: "TlvTypeTestMetaTypeBool",
8258880: "TlvTypeTestMetaTypeUInt",
8259152: "TlvTypeTestMetaTypeInt",
8259440: "TlvTypeTestMetaTypeString",
8259712: "TlvTypeTestMetaTypeUnicode",
8259984: "TlvTypeTestMetaTypeRaw",
8260256: "TlvTypeTestMetaTypeGroup",
8260416: "TlvTypeTestMemberIdentifier",
8260736: "TlvTypeTestMemberName"
}
def tlv_types_dump():
for k, v in tlv_types.items():
print("[-] {}\t{}".format(k, v))
print("[-] {} tlv type entries.".format(len(tlv_types)))
if __name__ == '__main__':
main(len(sys.argv), sys.argv)