mirror of
https://github.com/mvt-project/mvt.git
synced 2026-02-12 16:42:45 +00:00
Fixed variable names mismatch and styling
This commit is contained in:
@@ -36,7 +36,7 @@ class DumpsysAppOps(AndroidExtraction):
|
||||
"timestamp": entry["timestamp"],
|
||||
"module": self.__class__.__name__,
|
||||
"event": entry["access"],
|
||||
"data": f"{record['package_id']} access to {perm['name']} : {entry['access']}",
|
||||
"data": f"{record['package_name']} access to {perm['name']} : {entry['access']}",
|
||||
})
|
||||
|
||||
return records
|
||||
@@ -49,11 +49,11 @@ class DumpsysAppOps(AndroidExtraction):
|
||||
result["matched_indicator"] = ioc
|
||||
self.detected.append(result)
|
||||
continue
|
||||
|
||||
for perm in result["permissions"]:
|
||||
if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow":
|
||||
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_id"])
|
||||
|
||||
|
||||
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission",
|
||||
result["package_name"])
|
||||
|
||||
def run(self):
|
||||
self._adb_connect()
|
||||
|
||||
@@ -33,7 +33,7 @@ class Appops(BugReportModule):
|
||||
"timestamp": entry["timestamp"],
|
||||
"module": self.__class__.__name__,
|
||||
"event": entry["access"],
|
||||
"data": f"{record['package_id']} access to {perm['name']} : {entry['access']}",
|
||||
"data": f"{record['package_name']} access to {perm['name']} : {entry['access']}",
|
||||
})
|
||||
|
||||
return records
|
||||
@@ -46,9 +46,10 @@ class Appops(BugReportModule):
|
||||
result["matched_indicator"] = ioc
|
||||
self.detected.append(result)
|
||||
continue
|
||||
|
||||
for perm in result["permissions"]:
|
||||
if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow":
|
||||
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_id"])
|
||||
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_name"])
|
||||
|
||||
def run(self):
|
||||
content = self._get_dumpstate_file()
|
||||
@@ -73,4 +74,5 @@ class Appops(BugReportModule):
|
||||
|
||||
self.results = parse_dumpsys_appops("\n".join(lines))
|
||||
|
||||
self.log.info("Identified a total of %d packages in App-Ops Manager", len(self.results))
|
||||
self.log.info("Identified a total of %d packages in App-Ops Manager",
|
||||
len(self.results))
|
||||
|
||||
@@ -4,9 +4,8 @@
|
||||
# https://license.mvt.re/1.1/
|
||||
|
||||
from .dumpsys import (parse_dumpsys_accessibility,
|
||||
parse_dumpsys_appops,
|
||||
parse_dumpsys_activity_resolver_table,
|
||||
parse_dumpsys_battery_daily,
|
||||
parse_dumpsys_appops, parse_dumpsys_battery_daily,
|
||||
parse_dumpsys_battery_history, parse_dumpsys_dbinfo,
|
||||
parse_dumpsys_receiver_resolver_table)
|
||||
from .getprop import parse_getprop
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
|
||||
import re
|
||||
from datetime import datetime
|
||||
|
||||
from mvt.common.utils import convert_timestamp_to_iso
|
||||
|
||||
|
||||
@@ -304,53 +305,59 @@ def parse_dumpsys_appops(output):
|
||||
if not in_packages:
|
||||
continue
|
||||
|
||||
# In packages
|
||||
if line.startswith(" Uid "):
|
||||
uid = line[6:-1]
|
||||
continue
|
||||
|
||||
if line.startswith(" Package "):
|
||||
if entry != {}:
|
||||
if entry:
|
||||
perm["entries"].append(entry)
|
||||
entry = {}
|
||||
if package != {}:
|
||||
if perm != {}:
|
||||
|
||||
if package:
|
||||
if perm:
|
||||
package["permissions"].append(perm)
|
||||
|
||||
perm = {}
|
||||
results.append(package)
|
||||
|
||||
package = {
|
||||
"package_id": line[12:-1],
|
||||
"permissions": [],
|
||||
"uid": uid,
|
||||
"package_name": line[12:-1],
|
||||
"permissions": [],
|
||||
"uid": uid,
|
||||
}
|
||||
continue
|
||||
|
||||
if line.startswith(" ") and line[6] != " ":
|
||||
# Permission name READ_EXTERNAL_STORAGE (allow):
|
||||
if entry != {}:
|
||||
if entry:
|
||||
perm["entries"].append(entry)
|
||||
entry = {}
|
||||
if perm != {}:
|
||||
if perm:
|
||||
package["permissions"].append(perm)
|
||||
perm = {}
|
||||
|
||||
perm["name"] = line.split()[0]
|
||||
perm["entries"] = []
|
||||
if len(line.split()) > 1:
|
||||
perm["access"] = line.split()[1][1:-2]
|
||||
|
||||
continue
|
||||
|
||||
if line.startswith(" "):
|
||||
# Permission entry like Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
|
||||
if entry != {}:
|
||||
# Permission entry like:
|
||||
# Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
|
||||
if entry:
|
||||
perm["entries"].append(entry)
|
||||
entry = {}
|
||||
|
||||
entry["access"] = line.split(":")[0].strip()
|
||||
entry["type"] = line[line.find("[")+1:line.find("]")]
|
||||
|
||||
try:
|
||||
entry["timestamp"] = convert_timestamp_to_iso(
|
||||
datetime.strptime(
|
||||
line[line.find("]")+1:line.find("(")].strip(),
|
||||
"%Y-%m-%d %H:%M:%S.%f"))
|
||||
datetime.strptime(
|
||||
line[line.find("]")+1:line.find("(")].strip(),
|
||||
"%Y-%m-%d %H:%M:%S.%f"))
|
||||
except ValueError:
|
||||
# Invalid date format
|
||||
pass
|
||||
@@ -358,10 +365,11 @@ def parse_dumpsys_appops(output):
|
||||
if line.strip() == "":
|
||||
break
|
||||
|
||||
if entry != {}:
|
||||
if entry:
|
||||
perm["entries"].append(entry)
|
||||
if perm != {}:
|
||||
if perm:
|
||||
package["permissions"].append(perm)
|
||||
if package != {}:
|
||||
if package:
|
||||
results.append(package)
|
||||
|
||||
return results
|
||||
|
||||
@@ -7,9 +7,9 @@ import logging
|
||||
import os
|
||||
from pathlib import Path
|
||||
|
||||
from mvt.android.modules.bugreport.appops import Appops
|
||||
from mvt.common.indicators import Indicators
|
||||
from mvt.common.module import run_module
|
||||
from mvt.android.modules.bugreport.appops import Appops
|
||||
|
||||
from ..utils import get_artifact_folder
|
||||
|
||||
|
||||
@@ -19,11 +19,11 @@ class TestDumpsysParsing:
|
||||
res = parse_dumpsys_appops(data)
|
||||
|
||||
assert len(res) == 12
|
||||
assert res[0]["package_id"] == "com.android.phone"
|
||||
assert res[0]["package_name"] == "com.android.phone"
|
||||
assert res[0]["uid"] == "0"
|
||||
assert len(res[0]["permissions"]) == 1
|
||||
assert res[0]["permissions"][0]["name"] == "MANAGE_IPSEC_TUNNELS"
|
||||
assert res[0]["permissions"][0]["access"] == "allow"
|
||||
assert res[6]["package_id"] == "com.sec.factory.camera"
|
||||
assert res[6]["package_name"] == "com.sec.factory.camera"
|
||||
assert len(res[6]["permissions"][1]["entries"]) == 1
|
||||
assert len(res[11]["permissions"]) == 4
|
||||
|
||||
@@ -4,17 +4,17 @@
|
||||
# https://license.mvt.re/1.1/
|
||||
|
||||
import os
|
||||
|
||||
from click.testing import CliRunner
|
||||
|
||||
from mvt.android.cli import check_bugreport
|
||||
|
||||
from .utils import get_artifact_folder
|
||||
|
||||
|
||||
class TestCheckBugreportCommand:
|
||||
def test_check(self):
|
||||
runner = CliRunner()
|
||||
path = os.path.join(get_artifact_folder(), "android_data/bugreport/")
|
||||
result = runner.invoke(check_bugreport, [path])
|
||||
assert result.exit_code == 0
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user