diff --git a/src/mvt/android/artifacts/dumpsys_battery_daily.py b/src/mvt/android/artifacts/dumpsys_battery_daily.py index 06b980b..c7bcc6a 100644 --- a/src/mvt/android/artifacts/dumpsys_battery_daily.py +++ b/src/mvt/android/artifacts/dumpsys_battery_daily.py @@ -14,12 +14,23 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact): """ def serialize(self, record: dict) -> Union[dict, list]: + action = record.get("action", "update") + package_name = record["package_name"] + vers = record["vers"] + + if vers == "0": + data = f"Recorded uninstall of package {package_name} (vers 0)" + elif action == "downgrade": + prev_vers = record.get("previous_vers", "unknown") + data = f"Recorded downgrade of package {package_name} from vers {prev_vers} to vers {vers}" + else: + data = f"Recorded update of package {package_name} with vers {vers}" + return { "timestamp": record["from"], "module": self.__class__.__name__, "event": "battery_daily", - "data": f"Recorded update of package {record['package_name']} " - f"with vers {record['vers']}", + "data": data, } def check_indicators(self) -> None: @@ -36,6 +47,7 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact): def parse(self, output: str) -> None: daily = None daily_updates = [] + package_versions = {} # Track package versions to detect downgrades for line in output.splitlines(): if line.startswith(" Daily from "): if len(daily_updates) > 0: @@ -64,15 +76,44 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact): break if not already_seen: - daily_updates.append( - { - "action": "update", - "from": daily["from"], - "to": daily["to"], - "package_name": package_name, - "vers": vers_nr, - } - ) + update_record = { + "action": "update", + "from": daily["from"], + "to": daily["to"], + "package_name": package_name, + "vers": vers_nr, + } + + # Check for uninstall (version 0) + if vers_nr == "0": + self.log.warning( + "Detected uninstall of package %s (vers 0) on %s", + package_name, + daily["from"], + ) + # Check for downgrade + elif package_name in package_versions: + try: + current_vers = int(vers_nr) + previous_vers = int(package_versions[package_name]) + if current_vers < previous_vers: + update_record["action"] = "downgrade" + update_record["previous_vers"] = str(previous_vers) + self.log.warning( + "Detected downgrade of package %s from vers %d to vers %d on %s", + package_name, + previous_vers, + current_vers, + daily["from"], + ) + except ValueError: + # If version numbers aren't integers, skip comparison + pass + + # Update tracking dictionary + package_versions[package_name] = vers_nr + + daily_updates.append(update_record) if len(daily_updates) > 0: self.results.extend(daily_updates)