Fixed variable names mismatch and styling

This commit is contained in:
Nex
2022-03-30 08:49:22 +02:00
parent 9950b3d6c2
commit 9d61b9048c
7 changed files with 41 additions and 32 deletions
+4 -4
View File
@@ -36,7 +36,7 @@ class DumpsysAppOps(AndroidExtraction):
"timestamp": entry["timestamp"], "timestamp": entry["timestamp"],
"module": self.__class__.__name__, "module": self.__class__.__name__,
"event": entry["access"], "event": entry["access"],
"data": f"{record['package_id']} access to {perm['name']} : {entry['access']}", "data": f"{record['package_name']} access to {perm['name']} : {entry['access']}",
}) })
return records return records
@@ -49,11 +49,11 @@ class DumpsysAppOps(AndroidExtraction):
result["matched_indicator"] = ioc result["matched_indicator"] = ioc
self.detected.append(result) self.detected.append(result)
continue continue
for perm in result["permissions"]: for perm in result["permissions"]:
if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow": if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow":
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_id"]) self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission",
result["package_name"])
def run(self): def run(self):
self._adb_connect() self._adb_connect()
+5 -3
View File
@@ -33,7 +33,7 @@ class Appops(BugReportModule):
"timestamp": entry["timestamp"], "timestamp": entry["timestamp"],
"module": self.__class__.__name__, "module": self.__class__.__name__,
"event": entry["access"], "event": entry["access"],
"data": f"{record['package_id']} access to {perm['name']} : {entry['access']}", "data": f"{record['package_name']} access to {perm['name']} : {entry['access']}",
}) })
return records return records
@@ -46,9 +46,10 @@ class Appops(BugReportModule):
result["matched_indicator"] = ioc result["matched_indicator"] = ioc
self.detected.append(result) self.detected.append(result)
continue continue
for perm in result["permissions"]: for perm in result["permissions"]:
if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow": if perm["name"] == "REQUEST_INSTALL_PACKAGES" and perm["access"] == "allow":
self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_id"]) self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission", result["package_name"])
def run(self): def run(self):
content = self._get_dumpstate_file() content = self._get_dumpstate_file()
@@ -73,4 +74,5 @@ class Appops(BugReportModule):
self.results = parse_dumpsys_appops("\n".join(lines)) self.results = parse_dumpsys_appops("\n".join(lines))
self.log.info("Identified a total of %d packages in App-Ops Manager", len(self.results)) self.log.info("Identified a total of %d packages in App-Ops Manager",
len(self.results))
+1 -2
View File
@@ -4,9 +4,8 @@
# https://license.mvt.re/1.1/ # https://license.mvt.re/1.1/
from .dumpsys import (parse_dumpsys_accessibility, from .dumpsys import (parse_dumpsys_accessibility,
parse_dumpsys_appops,
parse_dumpsys_activity_resolver_table, parse_dumpsys_activity_resolver_table,
parse_dumpsys_battery_daily, parse_dumpsys_appops, parse_dumpsys_battery_daily,
parse_dumpsys_battery_history, parse_dumpsys_dbinfo, parse_dumpsys_battery_history, parse_dumpsys_dbinfo,
parse_dumpsys_receiver_resolver_table) parse_dumpsys_receiver_resolver_table)
from .getprop import parse_getprop from .getprop import parse_getprop
+26 -18
View File
@@ -5,6 +5,7 @@
import re import re
from datetime import datetime from datetime import datetime
from mvt.common.utils import convert_timestamp_to_iso from mvt.common.utils import convert_timestamp_to_iso
@@ -304,53 +305,59 @@ def parse_dumpsys_appops(output):
if not in_packages: if not in_packages:
continue continue
# In packages
if line.startswith(" Uid "): if line.startswith(" Uid "):
uid = line[6:-1] uid = line[6:-1]
continue continue
if line.startswith(" Package "): if line.startswith(" Package "):
if entry != {}: if entry:
perm["entries"].append(entry) perm["entries"].append(entry)
entry = {} entry = {}
if package != {}:
if perm != {}: if package:
if perm:
package["permissions"].append(perm) package["permissions"].append(perm)
perm = {} perm = {}
results.append(package) results.append(package)
package = { package = {
"package_id": line[12:-1], "package_name": line[12:-1],
"permissions": [], "permissions": [],
"uid": uid, "uid": uid,
} }
continue continue
if line.startswith(" ") and line[6] != " ": if line.startswith(" ") and line[6] != " ":
# Permission name READ_EXTERNAL_STORAGE (allow): if entry:
if entry != {}:
perm["entries"].append(entry) perm["entries"].append(entry)
entry = {} entry = {}
if perm != {}: if perm:
package["permissions"].append(perm) package["permissions"].append(perm)
perm = {} perm = {}
perm["name"] = line.split()[0] perm["name"] = line.split()[0]
perm["entries"] = [] perm["entries"] = []
if len(line.split()) > 1: if len(line.split()) > 1:
perm["access"] = line.split()[1][1:-2] perm["access"] = line.split()[1][1:-2]
continue continue
if line.startswith(" "): if line.startswith(" "):
# Permission entry like Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms) # Permission entry like:
if entry != {}: # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
if entry:
perm["entries"].append(entry) perm["entries"].append(entry)
entry = {} entry = {}
entry["access"] = line.split(":")[0].strip() entry["access"] = line.split(":")[0].strip()
entry["type"] = line[line.find("[")+1:line.find("]")] entry["type"] = line[line.find("[")+1:line.find("]")]
try: try:
entry["timestamp"] = convert_timestamp_to_iso( entry["timestamp"] = convert_timestamp_to_iso(
datetime.strptime( datetime.strptime(
line[line.find("]")+1:line.find("(")].strip(), line[line.find("]")+1:line.find("(")].strip(),
"%Y-%m-%d %H:%M:%S.%f")) "%Y-%m-%d %H:%M:%S.%f"))
except ValueError: except ValueError:
# Invalid date format # Invalid date format
pass pass
@@ -358,10 +365,11 @@ def parse_dumpsys_appops(output):
if line.strip() == "": if line.strip() == "":
break break
if entry != {}: if entry:
perm["entries"].append(entry) perm["entries"].append(entry)
if perm != {}: if perm:
package["permissions"].append(perm) package["permissions"].append(perm)
if package != {}: if package:
results.append(package) results.append(package)
return results return results
+1 -1
View File
@@ -7,9 +7,9 @@ import logging
import os import os
from pathlib import Path from pathlib import Path
from mvt.android.modules.bugreport.appops import Appops
from mvt.common.indicators import Indicators from mvt.common.indicators import Indicators
from mvt.common.module import run_module from mvt.common.module import run_module
from mvt.android.modules.bugreport.appops import Appops
from ..utils import get_artifact_folder from ..utils import get_artifact_folder
+2 -2
View File
@@ -19,11 +19,11 @@ class TestDumpsysParsing:
res = parse_dumpsys_appops(data) res = parse_dumpsys_appops(data)
assert len(res) == 12 assert len(res) == 12
assert res[0]["package_id"] == "com.android.phone" assert res[0]["package_name"] == "com.android.phone"
assert res[0]["uid"] == "0" assert res[0]["uid"] == "0"
assert len(res[0]["permissions"]) == 1 assert len(res[0]["permissions"]) == 1
assert res[0]["permissions"][0]["name"] == "MANAGE_IPSEC_TUNNELS" assert res[0]["permissions"][0]["name"] == "MANAGE_IPSEC_TUNNELS"
assert res[0]["permissions"][0]["access"] == "allow" assert res[0]["permissions"][0]["access"] == "allow"
assert res[6]["package_id"] == "com.sec.factory.camera" assert res[6]["package_name"] == "com.sec.factory.camera"
assert len(res[6]["permissions"][1]["entries"]) == 1 assert len(res[6]["permissions"][1]["entries"]) == 1
assert len(res[11]["permissions"]) == 4 assert len(res[11]["permissions"]) == 4
+2 -2
View File
@@ -4,17 +4,17 @@
# https://license.mvt.re/1.1/ # https://license.mvt.re/1.1/
import os import os
from click.testing import CliRunner from click.testing import CliRunner
from mvt.android.cli import check_bugreport from mvt.android.cli import check_bugreport
from .utils import get_artifact_folder from .utils import get_artifact_folder
class TestCheckBugreportCommand: class TestCheckBugreportCommand:
def test_check(self): def test_check(self):
runner = CliRunner() runner = CliRunner()
path = os.path.join(get_artifact_folder(), "android_data/bugreport/") path = os.path.join(get_artifact_folder(), "android_data/bugreport/")
result = runner.invoke(check_bugreport, [path]) result = runner.invoke(check_bugreport, [path])
assert result.exit_code == 0 assert result.exit_code == 0