Fixed variable names mismatch and styling

This commit is contained in:
Nex
2022-03-30 08:49:22 +02:00
parent 9950b3d6c2
commit 9d61b9048c
7 changed files with 41 additions and 32 deletions

View File

@@ -36,7 +36,7 @@ class DumpsysAppOps(AndroidExtraction):
"timestamp": entry["timestamp"],
"module": self.__class__.__name__,
"event": entry["access"],
"data": f"{record['package_id']} access to {perm['name']} : {entry['access']}",
"data": f"{record['package_name']} access to {perm['name']} : {entry['access']}",
})
return records
@@ -49,11 +49,11 @@ class DumpsysAppOps(AndroidExtraction):
result["matched_indicator"] = ioc
self.detected.append(result)
continue
for perm in result["permissions"]:
if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow":
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_id"])
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission",
result["package_name"])
def run(self):
self._adb_connect()

View File

@@ -33,7 +33,7 @@ class Appops(BugReportModule):
"timestamp": entry["timestamp"],
"module": self.__class__.__name__,
"event": entry["access"],
"data": f"{record['package_id']} access to {perm['name']} : {entry['access']}",
"data": f"{record['package_name']} access to {perm['name']} : {entry['access']}",
})
return records
@@ -46,9 +46,10 @@ class Appops(BugReportModule):
result["matched_indicator"] = ioc
self.detected.append(result)
continue
for perm in result["permissions"]:
if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow":
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_id"])
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_name"])
def run(self):
content = self._get_dumpstate_file()
@@ -73,4 +74,5 @@ class Appops(BugReportModule):
self.results = parse_dumpsys_appops("\n".join(lines))
self.log.info("Identified a total of %d packages in App-Ops Manager", len(self.results))
self.log.info("Identified a total of %d packages in App-Ops Manager",
len(self.results))

View File

@@ -4,9 +4,8 @@
# https://license.mvt.re/1.1/
from .dumpsys import (parse_dumpsys_accessibility,
parse_dumpsys_appops,
parse_dumpsys_activity_resolver_table,
parse_dumpsys_battery_daily,
parse_dumpsys_appops, parse_dumpsys_battery_daily,
parse_dumpsys_battery_history, parse_dumpsys_dbinfo,
parse_dumpsys_receiver_resolver_table)
from .getprop import parse_getprop

View File

@@ -5,6 +5,7 @@
import re
from datetime import datetime
from mvt.common.utils import convert_timestamp_to_iso
@@ -304,53 +305,59 @@ def parse_dumpsys_appops(output):
if not in_packages:
continue
# In packages
if line.startswith(" Uid "):
uid = line[6:-1]
continue
if line.startswith(" Package "):
if entry != {}:
if entry:
perm["entries"].append(entry)
entry = {}
if package != {}:
if perm != {}:
if package:
if perm:
package["permissions"].append(perm)
perm = {}
results.append(package)
package = {
"package_id": line[12:-1],
"permissions": [],
"uid": uid,
"package_name": line[12:-1],
"permissions": [],
"uid": uid,
}
continue
if line.startswith(" ") and line[6] != " ":
# Permission name READ_EXTERNAL_STORAGE (allow):
if entry != {}:
if entry:
perm["entries"].append(entry)
entry = {}
if perm != {}:
if perm:
package["permissions"].append(perm)
perm = {}
perm["name"] = line.split()[0]
perm["entries"] = []
if len(line.split()) > 1:
perm["access"] = line.split()[1][1:-2]
continue
if line.startswith(" "):
# Permission entry like Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
if entry != {}:
# Permission entry like:
# Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
if entry:
perm["entries"].append(entry)
entry = {}
entry["access"] = line.split(":")[0].strip()
entry["type"] = line[line.find("[")+1:line.find("]")]
try:
entry["timestamp"] = convert_timestamp_to_iso(
datetime.strptime(
line[line.find("]")+1:line.find("(")].strip(),
"%Y-%m-%d %H:%M:%S.%f"))
datetime.strptime(
line[line.find("]")+1:line.find("(")].strip(),
"%Y-%m-%d %H:%M:%S.%f"))
except ValueError:
# Invalid date format
pass
@@ -358,10 +365,11 @@ def parse_dumpsys_appops(output):
if line.strip() == "":
break
if entry != {}:
if entry:
perm["entries"].append(entry)
if perm != {}:
if perm:
package["permissions"].append(perm)
if package != {}:
if package:
results.append(package)
return results

View File

@@ -7,9 +7,9 @@ import logging
import os
from pathlib import Path
from mvt.android.modules.bugreport.appops import Appops
from mvt.common.indicators import Indicators
from mvt.common.module import run_module
from mvt.android.modules.bugreport.appops import Appops
from ..utils import get_artifact_folder

View File

@@ -19,11 +19,11 @@ class TestDumpsysParsing:
res = parse_dumpsys_appops(data)
assert len(res) == 12
assert res[0]["package_id"] == "com.android.phone"
assert res[0]["package_name"] == "com.android.phone"
assert res[0]["uid"] == "0"
assert len(res[0]["permissions"]) == 1
assert res[0]["permissions"][0]["name"] == "MANAGE_IPSEC_TUNNELS"
assert res[0]["permissions"][0]["access"] == "allow"
assert res[6]["package_id"] == "com.sec.factory.camera"
assert res[6]["package_name"] == "com.sec.factory.camera"
assert len(res[6]["permissions"][1]["entries"]) == 1
assert len(res[11]["permissions"]) == 4

View File

@@ -4,17 +4,17 @@
# https://license.mvt.re/1.1/
import os
from click.testing import CliRunner
from mvt.android.cli import check_bugreport
from .utils import get_artifact_folder
class TestCheckBugreportCommand:
def test_check(self):
runner = CliRunner()
path = os.path.join(get_artifact_folder(), "android_data/bugreport/")
result = runner.invoke(check_bugreport, [path])
assert result.exit_code == 0