Refactor code of DumpsysDBInfo

tests/android/test_artifact_dumpsys_dbinfo.py

@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+import logging
+
+from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfo
+from mvt.common.indicators import Indicators
+
+from ..utils import get_artifact
+
+
+class TestDumpsysDBinfoArtifact:
+    def test_parsing(self):
+        dbi = DumpsysDBInfo()
+        file = get_artifact("android_data/dumpsys_dbinfo.txt")
+        with open(file) as f:
+            data = f.read()
+
+        assert len(dbi.results) == 0
+        dbi.parse(data)
+        assert len(dbi.results) == 5
+        assert dbi.results[0]["action"] == "executeForCursorWindow"
+        assert dbi.results[0]["sql"] == "PRAGMA database_list;"
+        assert (
+            dbi.results[0]["path"] == "/data/user/0/com.wssyncmldm/databases/idmsdk.db"
+        )
+
+    def test_ioc_check(self, indicator_file):
+        dbi = DumpsysDBInfo()
+        file = get_artifact("android_data/dumpsys_dbinfo.txt")
+        with open(file) as f:
+            data = f.read()
+        dbi.parse(data)
+
+        ind = Indicators(log=logging.getLogger())
+        ind.parse_stix2(indicator_file)
+        ind.ioc_collections[0]["app_ids"].append("com.wssyncmldm")
+        dbi.indicators = ind
+        assert len(dbi.detected) == 0
+        dbi.check_indicators()
+        assert len(dbi.detected) == 5

tests/android_androidqf/test_dumpsys_dbinfo.py

@@ -0,0 +1,24 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 Claudio Guarnieri.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from pathlib import Path
+
+from mvt.android.modules.androidqf.dumpsys_dbinfo import DumpsysDBInfo
+from mvt.common.module import run_module
+
+from ..utils import get_android_androidqf, list_files
+
+
+class TestDumpsysDBInfoModule:
+    def test_parsing(self):
+        data_path = get_android_androidqf()
+        m = DumpsysDBInfo(target_path=data_path)
+        files = list_files(data_path)
+        parent_path = Path(data_path).absolute().parent.as_posix()
+        m.from_folder(parent_path, files)
+        run_module(m)
+        assert len(m.results) == 6
+        assert len(m.timeline) == 0
+        assert len(m.detected) == 0

tests/artifacts/android_data/dumpsys_dbinfo.txt

@@ -0,0 +1,23 @@
+DUMP OF SERVICE dbinfo:
+Applications Database Info:
+
+** Database info for pid 8817 [com.wssyncmldm] **
+
+  Attached db: false
+Connection pool for /data/user/0/com.wssyncmldm/databases/idmsdk.db:
+  Open: true
+  Max connections: 1
+  Total execution time: 46
+  Configuration: openFlags=268435456, isLegacyCompatibilityWalEnabled=false, journalMode=, syncMode=
+  Secure db: false
+  Available primary connection:
+    Connection #0:
+      isPrimaryConnection: true
+      onlyAllowReadOnlyOperations: true
+      Most recently executed operations:
+        0: [2023-07-27 12:21:44.097] [Pid:(0)]executeForCursorWindow took 2ms - succeeded, sql="PRAGMA database_list;", path=/data/user/0/com.wssyncmldm/databases/idmsdk.db
+        1: [2023-07-27 12:21:44.096] [Pid:(0)]executeForLong took 0ms - succeeded, sql="PRAGMA page_size;", path=/data/user/0/com.wssyncmldm/databases/idmsdk.db
+        2: [2023-07-27 12:21:44.092] [Pid:(0)]executeForLong took 4ms - succeeded, sql="PRAGMA page_count;", path=/data/user/0/com.wssyncmldm/databases/idmsdk.db
+        3: [2023-07-26 19:27:41.386] [Pid:(8817)]executeForCursorWindow took 2ms - succeeded, sql="SELECT path, name, acl, scope, format, type, depth, value FROM x6g1q14r75 WHERE (path = './DMAcc/x6g1q14r75/AppAuth/client/AAuthName') ORDER BY depth ASC", path=/data/user/0/com.wssyncmldm/databases/idmsdk.db
+        4: [2023-07-26 19:27:41.385] [Pid:(8817)]prepare took 0ms - succeeded, sql="SELECT path, name, acl, scope, format, type, depth, value FROM x6g1q14r75 WHERE (path = './DMAcc/x6g1q14r75/AppAuth/client/AAuthName') ORDER BY depth ASC", path=/data/user/0/com.wssyncmldm/databases/idmsdk.db
+

tests/artifacts/androidqf/dumpsys.txt

@@ -250,5 +250,30 @@ Current AppOps Service state:
       WRITE_EXTERNAL_STORAGE (allow):
 
 
+-------------------------------------------------------------------------------
+DUMP OF SERVICE dbinfo:
+Applications Database Info:
+
+** Database info for pid 5748 [com.sec.android.inputmethod] **
+
+  Attached db: false
+Connection pool for /data/user/0/com.sec.android.inputmethod/databases/StickerRecentList:
+  Open: true
+  Max connections: 4
+  Total execution time: 61
+  Configuration: openFlags=805306368, isLegacyCompatibilityWalEnabled=false, journalMode=, syncMode=
+  Secure db: false
+  Use WAL mode.
+  Available primary connection:
+    Connection #0:
+      isPrimaryConnection: true
+      onlyAllowReadOnlyOperations: false
+      Most recently executed operations:
+        0: [2023-07-27 12:21:44.458] [Pid:(0)]executeForCursorWindow took 1ms - succeeded, sql="PRAGMA database_list;", path=/data/user/0/com.sec.android.inputmethod/databases/StickerRecentList
+        1: [2023-07-27 12:21:44.456] [Pid:(0)]executeForLong took 0ms - succeeded, sql="PRAGMA page_size;", path=/data/user/0/com.sec.android.inputmethod/databases/StickerRecentList
+        2: [2023-07-27 12:21:44.455] [Pid:(0)]executeForLong took 2ms - succeeded, sql="PRAGMA page_count;", path=/data/user/0/com.sec.android.inputmethod/databases/StickerRecentList
+        3: [2023-07-26 16:50:25.321] [Pid:(0)]executeForCursorWindow took 0ms - succeeded, sql="PRAGMA database_list;", path=/data/user/0/com.sec.android.inputmethod/databases/StickerRecentList
+        4: [2023-07-26 16:50:25.320] [Pid:(0)]executeForLong took 0ms - succeeded, sql="PRAGMA page_size;", path=/data/user/0/com.sec.android.inputmethod/databases/StickerRecentList
+        5: [2023-07-26 16:50:25.318] [Pid:(0)]executeForLong took 2ms - succeeded, sql="PRAGMA page_count;", path=/data/user/0/com.sec.android.inputmethod/databases/StickerRecentList
 
 

tests/common/test_utils.py

@@ -62,5 +62,5 @@ class TestHashes:
         assert hashes[1]["file_path"] == os.path.join(path, "dumpsys.txt")
         assert (
             hashes[1]["sha256"]
-            == "bac858001784657a43c7cfa771fd1fc4a49428eb6b7c458a1ebf2fdeef78dd86"
+            == "c6be3ada77674f5bb9750d24e84b9b7ccf8db0cd4a896d9c17f9456eeab4bd0b"
         )