dissect.target 3.22.dev26__tar.gz → 3.22.dev28__tar.gz

{dissect_target-3.22.dev26/dissect.target.egg-info → dissect_target-3.22.dev28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev26
+Version: 3.22.dev28
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/helpers/localeutil.py

@@ -21,10 +21,16 @@ def normalize_timezone(input: str) -> str:
 def normalize_language(input: str) -> str:
     """Returns normalized locales per ISO-3166. Takes Unix LANG locales and Windows registry languages as input.
 
-    Output will be in the format ``ISO-3166-1_ISO-3166-2``, e.g.: ``en_US``, ``nl_NL`` or ``en_GB``.
+    Output will be in the format ``ISO-3166-1-alpha-2-code_ISO-3166-2``, e.g.: ``en_US``, ``nl_NL`` or ``en_GB``.
+
+    Resources:
+        - https://en.wikipedia.org/wiki/ISO_3166
+        - https://en.wikipedia.org/wiki/ISO_3166-1
+        - https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
+        - https://en.wikipedia.org/wiki/ISO_3166-2
     """
 
-    return normalize(input).split(".")[0]
+    return normalize(input.replace("-", "_", 1)).split(".")[0]
 
 
 def get_resource_string(path: str) -> str:

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/helpers/record.py

@@ -124,18 +124,30 @@ WindowsUserRecord = TargetRecordDescriptor(
     ],
 )
 
+COMMON_UNIX_FIELDS = [
+    ("string", "name"),
+    ("string", "passwd"),
+    ("varint", "uid"),
+    ("varint", "gid"),
+    ("string", "gecos"),
+    ("path", "home"),
+    ("string", "shell"),
+    ("string", "source"),
+]
+
 UnixUserRecord = TargetRecordDescriptor(
     "unix/user",
-    [
-        ("string", "name"),
-        ("string", "passwd"),
-        ("varint", "uid"),
-        ("varint", "gid"),
-        ("string", "gecos"),
-        ("path", "home"),
-        ("string", "shell"),
-        ("string", "source"),
-    ],
+    COMMON_UNIX_FIELDS,
+)
+
+MacOSUserRecord = TargetRecordDescriptor(
+    "macos/user",
+    COMMON_UNIX_FIELDS,
+)
+
+IOSUserRecord = TargetRecordDescriptor(
+    "ios/user",
+    COMMON_UNIX_FIELDS,
 )
 
 EmptyRecord = RecordDescriptor(
@@ -180,7 +192,7 @@ WindowsInterfaceRecord = TargetRecordDescriptor(
     ],
 )
 
-MacInterfaceRecord = TargetRecordDescriptor(
+MacOSInterfaceRecord = TargetRecordDescriptor(
     "macos/network/interface",
     [
         *COMMON_INTERFACE_ELEMENTS,
@@ -200,13 +212,3 @@ COMMON_APPLICATION_FIELDS = [
     ("string", "type"),
     ("path", "path"),
 ]
-
-UnixApplicationRecord = TargetRecordDescriptor(
-    "unix/application",
-    COMMON_APPLICATION_FIELDS,
-)
-
-WindowsApplicationRecord = TargetRecordDescriptor(
-    "windows/application",
-    COMMON_APPLICATION_FIELDS,
-)

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/loaders/local.py

@@ -60,7 +60,7 @@ class LocalLoader(Loader):
                 map_solaris_drives(target)
             elif os_name == "vmkernel":
                 map_esxi_drives(target)
-            elif os_name in ["darwin", "osx"]:
+            elif os_name in ["darwin", "osx", "macos"]:
                 # There is currently no way to access raw disk devices in OS-X,
                 # so we always do a simple DirectoryFilesystem fallback.
                 target.filesystems.add(DirectoryFilesystem(Path("/")))

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugin.py

@@ -62,7 +62,8 @@ class OperatingSystem(StrEnum):
     FORTIOS = "fortios"
     IOS = "ios"
     LINUX = "linux"
-    OSX = "osx"
+    MACOS = "macos"
+    OSX = "osx"  # legacy
     PROXMOX = "proxmox"
     UNIX = "unix"
     VYOS = "vyos"

dissect_target-3.22.dev28/dissect/target/plugins/apps/remoteaccess/anydesk.py

@@ -0,0 +1,171 @@
+import re
+from datetime import datetime, timezone
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.apps.remoteaccess.remoteaccess import (
+    GENERIC_FILE_TRANSFER_RECORD_FIELDS,
+    GENERIC_LOG_RECORD_FIELDS,
+    RemoteAccessPlugin,
+)
+from dissect.target.plugins.general.users import UserDetails
+
+
+class AnydeskPlugin(RemoteAccessPlugin):
+    """Anydesk plugin."""
+
+    __namespace__ = "anydesk"
+
+    # Anydesk logs when installed as a service
+    SERVICE_GLOBS = [
+        # Standard client >= Windows 7
+        "sysvol/ProgramData/AnyDesk/*.trace",
+        # Custom client >= Windows 7
+        "sysvol/ProgramData/AnyDesk/ad_*/*.trace",
+        # Windows XP / 2003
+        "sysvol/Documents and Settings/Public/AnyDesk/*.trace",
+        "sysvol/Documents and Settings/Public/AnyDesk/ad_*/*.trace",
+        # Standard/Custom client Linux/MacOS
+        "var/log/anydesk*/*.trace",
+    ]
+
+    # Anydesk Filetransfer logs when installed as a service
+    FILETRANSFER_SERVICE_LOGS = [
+        # File transfer service log
+        "sysvol/ProgramData/AnyDesk/file_transfer_trace.txt",
+    ]
+
+    # User specific Anydesk filetransfer log
+    FILETRANSFER_USER_LOGS = [
+        # File transfer log
+        "AppData/Roaming/AnyDesk/file_transfer_trace.txt",
+    ]
+
+    # User specific Anydesk logs
+    USER_GLOBS = [
+        # Standard client Windows
+        "AppData/Roaming/AnyDesk/*.trace",
+        # Custom client Windows
+        "AppData/Roaming/AnyDesk/ad_*/*.trace",
+        # Windows XP / 2003
+        "AppData/AnyDesk/*.trace",
+        # Standard client Linux/MacOS
+        ".anydesk/*.trace",
+        # Custom client Linux/MacOS
+        ".anydesk_ad_*/*.trace",
+    ]
+
+    RemoteAccessLogRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "remoteaccess/anydesk/log", GENERIC_LOG_RECORD_FIELDS
+    )
+
+    RemoteAccessFileTransferRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "remoteaccess/anydesk/filetransfer", GENERIC_FILE_TRANSFER_RECORD_FIELDS
+    )
+
+    def __init__(self, target):
+        super().__init__(target)
+
+        self.trace_files: set[tuple[TargetPath, UserDetails | None]] = set()
+        self.filetransfer_files: set[tuple[TargetPath, UserDetails | None]] = set()
+
+        # Anydesk trace file service globs
+        for trace_glob in self.SERVICE_GLOBS:
+            for path in self.target.fs.path().glob(trace_glob):
+                self.trace_files.add((path, None))
+
+        # Anydesk filetransfer service globs
+        for trace_glob in self.FILETRANSFER_SERVICE_LOGS:
+            for path in self.target.fs.path().glob(trace_glob):
+                self.filetransfer_files.add((path, None))
+
+        for user_details in self.target.user_details.all_with_home():
+            # Anydesk trace file user globs
+            for trace_glob in self.USER_GLOBS:
+                for path in user_details.home_path.glob(trace_glob):
+                    self.trace_files.add((path, user_details.user))
+
+            # Anydesk filetransfer User globs
+            for trace_glob in self.FILETRANSFER_USER_LOGS:
+                for path in user_details.home_path.glob(trace_glob):
+                    self.filetransfer_files.add((path, user_details.user))
+
+    def check_compatible(self) -> None:
+        if not self.trace_files and not self.filetransfer_files:
+            raise UnsupportedPluginError("No Anydesk files found on target")
+
+    @export(record=RemoteAccessLogRecord)
+    def logs(self) -> Iterator[RemoteAccessLogRecord]:
+        """Parse AnyDesk trace files.
+
+        AnyDesk is a remote desktop application and can be used by adversaries to get (persistent) access to a machine.
+        Log files (.trace files) can be stored on various locations, based on target OS and client type.
+        Timestamps in trace files do not carry a time zone designator (TZD) but are in fact UTC.
+
+        References:
+            - https://www.inversecos.com/2021/02/forensic-analysis-of-anydesk-logs.html
+            - https://support.anydesk.com/knowledge/trace-files#trace-file-locations
+        """
+        for path, user in self.trace_files:
+            for line in path.open("rt", errors="backslashreplace"):
+                if not (line := line.strip()) or "* * * * * * * * * * * * * *" in line:
+                    continue
+
+                try:
+                    level, ts_date, ts_time, message = line.split(" ", 3)
+
+                    timestamp = datetime.strptime(f"{ts_date} {ts_time}", "%Y-%m-%d %H:%M:%S.%f").replace(
+                        tzinfo=timezone.utc
+                    )
+                    message = re.sub(r"\s\s+", " ", f"{level} {message}")
+
+                    yield self.RemoteAccessLogRecord(
+                        ts=timestamp,
+                        message=message,
+                        source=path,
+                        _target=self.target,
+                        _user=user,
+                    )
+                except ValueError as e:
+                    self.target.log.warning("Could not parse log line in file %s: '%s'", path, line)
+                    self.target.log.debug("", exc_info=e)
+
+    @export(record=RemoteAccessFileTransferRecord)
+    def filetransfer(self) -> Iterator[RemoteAccessFileTransferRecord]:
+        """Parse AnyDesk filetransfer files.
+
+        AnyDesk is a remote desktop application and can be used by adversaries to get (persistent) access to a machine.
+        File transfer (``file_transfer_trace.txt``) files show what files are downloaded to a system.
+        Timestamps in trace files do not carry a time zone designator (TZD) but are in fact UTC.
+        """
+        for path, user in self.filetransfer_files:
+            for line in path.open("rt", encoding="utf-16-le", errors="backslashreplace"):
+                if not (line := line.strip()):
+                    continue
+
+                try:
+                    # Example log entry:
+                    # Clipboard\t\t2025-01-01, 13:37\tstart \tdownload\t'malware.exe' (~0 B out of 4.20 MiB)
+                    timestamp = line.split("\t")[2]
+                    timestamp = datetime.strptime(timestamp, "%Y-%m-%d, %H:%M").replace(tzinfo=timezone.utc)
+                    # Replace log lines tabs with spaces for readability
+                    message = line.replace("\t", " ")
+
+                    # Attempt to extract 'filename' from message.
+                    filename = match.group(1) if (match := re.search(r"\'([^\']*)\'", message)) else None
+
+                    yield self.RemoteAccessFileTransferRecord(
+                        ts=timestamp,
+                        message=message,
+                        filename=filename,
+                        source=path,
+                        _target=self.target,
+                        _user=user,
+                    )
+                except ValueError as e:
+                    self.target.log.warning("Could not parse log line in file %s: '%s'", path, line)
+                    self.target.log.debug("", exc_info=e)

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugins/apps/remoteaccess/remoteaccess.py

@@ -8,10 +8,21 @@ GENERIC_LOG_RECORD_FIELDS = [
     ("path", "source"),
 ]
 
+GENERIC_FILE_TRANSFER_RECORD_FIELDS = [
+    ("datetime", "ts"),
+    ("path", "filename"),
+    ("string", "message"),
+    ("path", "source"),
+]
+
 RemoteAccessLogRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
     "remoteaccess/log", GENERIC_LOG_RECORD_FIELDS
 )
 
+RemoteAccessFileTransferRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "remoteaccess/filetransfer", GENERIC_FILE_TRANSFER_RECORD_FIELDS
+)
+
 
 class RemoteAccessPlugin(NamespacePlugin):
     """General Remote Access plugin.

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugins/general/users.py

@@ -6,10 +6,15 @@ from typing import Iterator, NamedTuple, Union
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.fsutil import TargetPath
-from dissect.target.helpers.record import UnixUserRecord, WindowsUserRecord
+from dissect.target.helpers.record import (
+    IOSUserRecord,
+    MacOSUserRecord,
+    UnixUserRecord,
+    WindowsUserRecord,
+)
 from dissect.target.plugin import InternalPlugin
 
-UserRecord = Union[UnixUserRecord, WindowsUserRecord]
+UserRecord = Union[UnixUserRecord, WindowsUserRecord, MacOSUserRecord, IOSUserRecord]
 
 
 class UserDetails(NamedTuple):

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugins/os/default/network.py

@@ -6,7 +6,7 @@ from typing import TYPE_CHECKING, Any, Callable, Union, get_args
 from flow.record.fieldtypes.net import IPAddress, IPNetwork
 
 from dissect.target.helpers.record import (
-    MacInterfaceRecord,
+    MacOSInterfaceRecord,
     UnixInterfaceRecord,
     WindowsInterfaceRecord,
 )
@@ -16,7 +16,7 @@ if TYPE_CHECKING:
     from collections.abc import Iterator
 
     from dissect.target.target import Target
-InterfaceRecord = Union[UnixInterfaceRecord, WindowsInterfaceRecord, MacInterfaceRecord]
+InterfaceRecord = Union[UnixInterfaceRecord, WindowsInterfaceRecord, MacOSInterfaceRecord]
 
 
 class NetworkPlugin(Plugin):

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugins/os/unix/_os.py

@@ -45,6 +45,11 @@ ARCH_MAP = {
 
 
 class UnixPlugin(OSPlugin):
+    """UNIX plugin."""
+
+    # Files to parse for user details
+    PASSWD_FILES = ["/etc/passwd", "/etc/passwd-", "/etc/master.passwd"]
+
     def __init__(self, target: Target):
         super().__init__(target)
         self._add_mounts()
@@ -76,12 +81,10 @@ class UnixPlugin(OSPlugin):
             - https://manpages.ubuntu.com/manpages/oracular/en/man5/passwd.5.html
         """
 
-        PASSWD_FILES = ["/etc/passwd", "/etc/passwd-", "/etc/master.passwd"]
-
         seen_users = set()
 
         # Yield users found in passwd files.
-        for passwd_file in PASSWD_FILES:
+        for passwd_file in self.PASSWD_FILES:
             if (path := self.target.fs.path(passwd_file)).exists():
                 for line in path.open("rt", errors="surrogateescape"):
                     line = line.strip()

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugins/os/unix/applications.py

@@ -3,10 +3,18 @@ from typing import Iterator
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers import configutil
 from dissect.target.helpers.fsutil import TargetPath
-from dissect.target.helpers.record import UnixApplicationRecord
+from dissect.target.helpers.record import (
+    COMMON_APPLICATION_FIELDS,
+    TargetRecordDescriptor,
+)
 from dissect.target.plugin import Plugin, export
 from dissect.target.target import Target
 
+UnixApplicationRecord = TargetRecordDescriptor(
+    "unix/application",
+    COMMON_APPLICATION_FIELDS,
+)
+
 
 class UnixApplicationsPlugin(Plugin):
     """Unix Applications plugin."""

{dissect_target-3.22.dev26 → dissect_target-3.22.dev28}/dissect/target/plugins/os/unix/bsd/_os.py

@@ -1,7 +1,5 @@
 from __future__ import annotations
 
-from typing import List, Optional
-
 from dissect.target.filesystem import Filesystem
 from dissect.target.plugin import OperatingSystem, export
 from dissect.target.plugins.os.unix._os import UnixPlugin
@@ -13,7 +11,7 @@ class BsdPlugin(UnixPlugin):
         super().__init__(target)
 
     @classmethod
-    def detect(cls, target: Target) -> Optional[Filesystem]:
+    def detect(cls, target: Target) -> Filesystem | None:
         for fs in target.filesystems:
             # checking the existence of /var/authpf for free- and openbsd
             # checking the existence of /var/at for net- and freebsd
@@ -27,7 +25,7 @@ class BsdPlugin(UnixPlugin):
         return OperatingSystem.BSD.value
 
     @export(property=True)
-    def hostname(self) -> Optional[str]:
+    def hostname(self) -> str | None:
         fh = self.target.fs.path("/etc/rc.conf")
 
         for line in fh.open("rt").readlines():
@@ -36,6 +34,6 @@ class BsdPlugin(UnixPlugin):
                 return hostname
 
     @export(property=True)
-    def ips(self) -> Optional[List[str]]:
+    def ips(self) -> list[str] | None:
         self.target.log.error(f"ips plugin not implemented for {self.__class__}")
         return None

dissect_target-3.22.dev28/dissect/target/plugins/os/unix/bsd/darwin/_os.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from dissect.target.filesystem import Filesystem
+from dissect.target.plugins.os.unix.bsd._os import BsdPlugin
+from dissect.target.target import Target
+
+# https://en.wikipedia.org/wiki/Mach-O
+ARCH_MAP = {
+    b"\x0c\x00\x00\x01": "arm64",  # big endian, x64
+    b"\x01\x00\x00\x0c": "arm64",  # little endian, x64
+    b"\x0c\x00\x00\x00": "arm32",  # big endian, x32
+    b"\x00\x00\x00\x0c": "arm32",  # little endian, x32
+}
+
+
+class DarwinPlugin(BsdPlugin):
+    """Darwin plugin."""
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+
+    @classmethod
+    def detect(cls, target: Target) -> Filesystem | None:
+        for fs in target.filesystems:
+            if (fs.exists("/Library") and fs.exists("/Applications")) or fs.exists("/private/var/mobile"):
+                return fs
+
+
+def detect_macho_arch(paths: list[str | Path], fs: Filesystem | None = None) -> str | None:
+    """Detect the architecture of the system by reading the Mach-O headers of the provided binaries.
+
+    We could use the mach-o magic headers (feedface, feedfacf, cafebabe), but the mach-o cpu type
+    also contains bitness.
+
+    Args:
+        paths: List of strings or ``Path`` objects.
+        fs: Optional filesystem to search the provided paths in. Required if ``paths`` is a list of strings.
+
+    Returns:
+        Detected architecture (e.g. ``arm64``) or ``None``.
+
+    Resources:
+        - https://github.com/opensource-apple/cctools/blob/master/include/mach/machine.h
+    """
+    for path in paths:
+        if isinstance(path, str):
+            if not fs:
+                raise ValueError("Provided string paths but no filesystem!")
+            path = fs.path(path)
+
+        if not path.is_file():
+            continue
+
+        try:
+            with path.open("rb") as fh:
+                fh.seek(4)
+                return ARCH_MAP.get(fh.read(4))  # mach-o cpu type
+        except Exception:
+            pass

dissect_target-3.22.dev28/dissect/target/plugins/os/unix/bsd/darwin/ios/_os.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+import plistlib
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterator
+
+from dissect.target.filesystem import Filesystem, VirtualFilesystem
+from dissect.target.helpers.record import IOSUserRecord
+from dissect.target.plugin import OperatingSystem, export
+from dissect.target.plugins.os.unix.bsd.darwin._os import (
+    DarwinPlugin,
+    detect_macho_arch,
+)
+from dissect.target.target import Target
+
+
+class IOSPlugin(DarwinPlugin):
+    """Apple iOS plugin.
+
+    Resources:
+        - https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemOverview/FileSystemOverview.html
+        - https://corp.digitalcorpora.org/corpora/mobile/iOS17/
+    """  # noqa: E501
+
+    SYSTEM = "/private/var/preferences/SystemConfiguration/preferences.plist"
+    GLOBAL = "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist"
+    VERSION = "/System/Library/CoreServices/SystemVersion.plist"
+
+    # /private/etc/master.passwd is a copy of /private/etc/passwd
+    PASSWD_FILES = ["/private/etc/passwd"]
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+
+        self._config = Config.load(
+            target.fs.path(self.SYSTEM),
+            target.fs.path(self.GLOBAL),
+            target.fs.path(self.VERSION),
+        )
+
+    @classmethod
+    def detect(cls, target: Target) -> Filesystem | None:
+        for fs in target.filesystems:
+            if fs.exists("/private/var/preferences") and fs.exists("/private/var/mobile"):
+                return fs
+
+    @classmethod
+    def create(cls, target: Target, sysvol: VirtualFilesystem) -> None:
+        target.fs.mount("/", sysvol)
+        return cls(target)
+
+    @export(property=True)
+    def hostname(self) -> str | None:
+        try:
+            # ComputerName can contain invalid utf characters, so we use HostName instead.
+            return self._config.SYSTEM["System"]["System"]["HostName"]
+        except KeyError:
+            pass
+
+    @export(property=True)
+    def ips(self) -> list:
+        return []
+
+    @export(property=True)
+    def version(self) -> str:
+        return f'{self._config.VERSION["ProductName"]} {self._config.VERSION["ProductVersion"]} ({self._config.VERSION["ProductBuildVersion"]})'  # noqa: E501
+
+    @export(record=IOSUserRecord)
+    def users(self) -> Iterator[IOSUserRecord]:
+        for user in super().users():
+            yield IOSUserRecord(**user._asdict())
+
+    @export(property=True)
+    def os(self) -> str:
+        return OperatingSystem.IOS.value
+
+    @export(property=True)
+    def architecture(self) -> str | None:
+        if arch := detect_macho_arch(["/bin/df", "/bin/ps", "/sbin/fsck", "/sbin/mount"], fs=self.target.fs):
+            return f"{arch}-ios"
+
+
+@dataclass
+class Config:
+    SYSTEM: dict[str, Any]
+    GLOBAL: dict[str, Any]
+    VERSION: dict[str, Any]
+
+    @classmethod
+    def load(cls, *args: list[Path]) -> Config:
+        plists = []
+        for path in args:
+            if path.is_file():
+                plists.append(plistlib.load(path.open("rb")))
+            else:
+                plists.append({})
+        return cls(*plists)

dissect_target-3.22.dev28/dissect/target/plugins/os/unix/bsd/darwin/ios/applications.py

@@ -0,0 +1,66 @@
+import plistlib
+from pathlib import Path
+from typing import Iterator
+
+from dissect.util.plist import NSKeyedArchiver
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import (
+    COMMON_APPLICATION_FIELDS,
+    TargetRecordDescriptor,
+)
+from dissect.target.plugin import OperatingSystem, Plugin, export
+
+IOSApplicationRecord = TargetRecordDescriptor(
+    "ios/application",
+    COMMON_APPLICATION_FIELDS,
+)
+
+
+class IOSApplicationsPlugin(Plugin):
+    """iOS applications plugin."""
+
+    PATH = "/private/var/containers/Bundle/Application"
+
+    def check_compatible(self) -> None:
+        if self.target.os != OperatingSystem.IOS or not self.target.fs.path(self.PATH).exists():
+            raise UnsupportedPluginError("Target is not iOS or no Bundle Application folder found")
+
+    @export(record=IOSApplicationRecord)
+    def applications(self) -> Iterator[IOSApplicationRecord]:
+        """Yield installed iOS apps."""
+
+        for app_dir in self.target.fs.path(self.PATH).glob("*"):
+            if not app_dir.is_dir():
+                continue
+
+            metadata = {}
+            if (metadata_file := app_dir.joinpath("iTunesMetadata.plist")).exists():
+                metadata = plistlib.load(metadata_file.open("rb"))
+
+            bundle = {}
+            if (bundle_file := app_dir.joinpath("BundleMetadata.plist")).exists():
+                bundle = NSKeyedArchiver(bundle_file.open("rb"))["root"]
+
+            # System apps do not have a iTunesMetadata.plist file.
+            info = {}
+            if not metadata:
+                if info_file := next(app_dir.glob("*.app/Info.plist"), None):
+                    info = plistlib.load(info_file.open("rb"))
+                    if info.get("CFBundleIdentifier", "").startswith("com.apple."):
+                        info["author"] = "Apple"
+                        info["type"] = "system"
+
+            # Ultimate fallback to application name
+            if not info.get("CFBundleDisplayName") and not metadata.get("itemName"):
+                metadata["itemName"] = next(app_dir.glob("*.app"), Path("")).name.removesuffix(".app")
+
+            yield IOSApplicationRecord(
+                ts_installed=bundle.get("installDate"),
+                name=metadata.get("itemName") or info.get("CFBundleDisplayName"),
+                version=metadata.get("bundleShortVersionString") or info.get("CFBundleShortVersionString"),
+                author=metadata.get("artistName") or info.get("author"),
+                type=metadata.get("kind") or info.get("type"),
+                path=app_dir,
+                _target=self.target,
+            )