CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-07-03 03:35:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Adds indicators for android properties

Browse Source
This commit is contained in:
tek
2023-03-29 12:57:41 +02:00
parent 70c6f0c153
commit b5d7e528de
7 changed files with 96 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/android_androidqf/test_getprop.py
+14
View File
@@ -7,6 +7,7 @@ import logging
import os
from mvt.android.modules.androidqf.getprop import Getprop
from mvt.common.indicators import Indicators
from mvt.common.module import run_module
from ..utils import get_artifact_folder
@@ -18,5 +19,18 @@ class TestAndroidqfGetpropAnalysis:
m = Getprop(target_path=os.path.join(get_artifact_folder(), "androidqf"), log=logging)
run_module(m)
assert len(m.results) == 10
assert m.results[0]["name"] == "dalvik.vm.appimageformat"
assert m.results[0]["value"] == "lz4"
assert len(m.timeline) == 0
assert len(m.detected) == 0
def test_androidqf_getprop_detection(self, indicator_file):
m = Getprop(target_path=os.path.join(get_artifact_folder(), "androidqf"), log=logging)
ind = Indicators(log=logging.getLogger())
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["android_property_names"].append("dalvik.vm.heapmaxfree")
m.indicators = ind
run_module(m)
assert len(m.results) == 10
assert len(m.detected) == 1
assert m.detected[0]["name"] == "dalvik.vm.heapmaxfree"