From ff5ebf73cccf86e2cc1a391443f863e6c6f00593 Mon Sep 17 00:00:00 2001
From: StarRailHub <3151336214@qq.com>
Date: Wed, 23 Sep 2026 12:11:58 +0800
Subject: [PATCH 1/6] fix: parse dumpsys ADB output with CRLF line endings

---
 src/mvt/android/artifacts/dumpsys_adb.py   | 12 ++++++++++--
 tests/android/test_artifact_dumpsys_adb.py | 12 ++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/mvt/android/artifacts/dumpsys_adb.py b/src/mvt/android/artifacts/dumpsys_adb.py
index cbd80e21..f2b68bcc 100644
--- a/src/mvt/android/artifacts/dumpsys_adb.py
+++ b/src/mvt/android/artifacts/dumpsys_adb.py
@@ -29,7 +29,8 @@ class DumpsysADBArtifact(AndroidArtifact):
         stack = [res]
         cur_indent = 0
         in_multiline = False
-        for line in dump_data.strip(b"\n").split(b"\n"):
+        for line in dump_data.strip(b"\r\n").split(b"\n"):
+            line = line.removesuffix(b"\r")
             # Track the level of indentation
             indent = len(line) - len(line.lstrip())
             if indent < cur_indent:
@@ -180,12 +181,19 @@ class DumpsysADBArtifact(AndroidArtifact):
             self.log.error("Unable to find ADB manager state in dumpsys output")
             return
 
+        line_ending_length = 1
         end_of_json = content.rfind(b"}\n")
+        crlf_end_of_json = content.rfind(b"}\r\n")
+        if crlf_end_of_json > end_of_json:
+            line_ending_length = 2
+            end_of_json = crlf_end_of_json
         if end_of_json == -1 or end_of_json <= start_of_json:
             self.log.error("Unable to find complete ADB manager state in dumpsys output")
             return
 
-        json_content = content[start_of_json + 2 : end_of_json - 2].rstrip()
+        json_content = content[
+            start_of_json + 2 : end_of_json - line_ending_length - 1
+        ].rstrip()
 
         parsed = self.indented_dump_parser(json_content)
         if parsed.get("debugging_manager") is None:
diff --git a/tests/android/test_artifact_dumpsys_adb.py b/tests/android/test_artifact_dumpsys_adb.py
index 8d501b7d..beeaba3a 100644
--- a/tests/android/test_artifact_dumpsys_adb.py
+++ b/tests/android/test_artifact_dumpsys_adb.py
@@ -130,6 +130,18 @@ class TestDumpsysADBArtifact:
         assert key_store_entry["fingerprint"] == expected_fingerprint
         assert key_store_entry["last_connected"] == "1628501829898"
 
+    def test_parsing_adb_xml_with_crlf_line_endings(self):
+        da_adb = DumpsysADBArtifact()
+        file = get_artifact("android_data/dumpsys_adb_xml.txt")
+        with open(file, "rb") as f:
+            data = f.read().replace(b"\r\n", b"\n").replace(b"\n", b"\r\n")
+
+        da_adb.parse(data)
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "user@laptop"
+        assert da_adb.results[0]["keystore"][0]["last_connected"] == "1628501829898"
+
 
 class TestDumpsysADBStateAlerts:
     def test_no_androidqf_context_preserves_existing_behavior(self):

From 8c5278f5405ceb26889428166b3c1fe43fa32879 Mon Sep 17 00:00:00 2001
From: besendorf <janik@besendorf.org>
Date: Thu, 24 Sep 2026 04:37:25 -0700
Subject: [PATCH 2/6] Refactor JSON extraction logic in dumpsys_adb.py

---
 src/mvt/android/artifacts/dumpsys_adb.py | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/mvt/android/artifacts/dumpsys_adb.py b/src/mvt/android/artifacts/dumpsys_adb.py
index f2b68bcc..ac397cfb 100644
--- a/src/mvt/android/artifacts/dumpsys_adb.py
+++ b/src/mvt/android/artifacts/dumpsys_adb.py
@@ -181,19 +181,18 @@ class DumpsysADBArtifact(AndroidArtifact):
             self.log.error("Unable to find ADB manager state in dumpsys output")
             return
 
-        line_ending_length = 1
-        end_of_json = content.rfind(b"}\n")
-        crlf_end_of_json = content.rfind(b"}\r\n")
-        if crlf_end_of_json > end_of_json:
-            line_ending_length = 2
-            end_of_json = crlf_end_of_json
+        end_of_json = max(content.rfind(b"}\n"), content.rfind(b"}\r\n"))
         if end_of_json == -1 or end_of_json <= start_of_json:
             self.log.error("Unable to find complete ADB manager state in dumpsys output")
             return
 
-        json_content = content[
-            start_of_json + 2 : end_of_json - line_ending_length - 1
-        ].rstrip()
+        # Exclude the final nested closing brace regardless of its line ending.
+        # The indented parser finishes the open debugging_manager at EOF.
+        inner_end = content.rfind(b"}", start_of_json + 2, end_of_json)
+        if inner_end == -1:
+            self.log.error("Unable to find complete ADB manager state in dumpsys output")
+            return
+        json_content = content[start_of_json + 2 : inner_end].rstrip()
 
         parsed = self.indented_dump_parser(json_content)
         if parsed.get("debugging_manager") is None:

From f1e52b297a0d97ebbf6af037c136b1080f7ab2e8 Mon Sep 17 00:00:00 2001
From: besendorf <janik@besendorf.org>
Date: Thu, 24 Sep 2026 04:40:48 -0700
Subject: [PATCH 3/6] test: cover mixed ADB state line endings

Regression for CRLF after the manager brace and LF after the outer brace.
---
 tests/android/test_artifact_dumpsys_adb.py | 23 ++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tests/android/test_artifact_dumpsys_adb.py b/tests/android/test_artifact_dumpsys_adb.py
index beeaba3a..3f6f892d 100644
--- a/tests/android/test_artifact_dumpsys_adb.py
+++ b/tests/android/test_artifact_dumpsys_adb.py
@@ -143,6 +143,29 @@ class TestDumpsysADBArtifact:
         assert da_adb.results[0]["keystore"][0]["last_connected"] == "1628501829898"
 
 
+    def test_parsing_adb_wifi_with_mixed_line_endings(self):
+        da_adb = DumpsysADBArtifact()
+        data = (
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"    user_keys=QUJDRA== host@example\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"    }\n"
+            b"  }\r\n"
+            b"}\n"
+            b"--------- duration\n"
+        )
+
+        da_adb.parse(data)
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "host@example"
+        assert da_adb.results[0]["adb_wifi"]["enabled"] == b"false"
+
+
 class TestDumpsysADBStateAlerts:
     def test_no_androidqf_context_preserves_existing_behavior(self):
         module = DumpsysADBState(

From 9ca4254649a104fcd14420f1bb5a832c47702bfc Mon Sep 17 00:00:00 2001
From: besendorf <janik@besendorf.org>
Date: Thu, 24 Sep 2026 09:38:18 -0700
Subject: [PATCH 4/6] Fix formatting in test_artifact_dumpsys_adb.py

---
 tests/android/test_artifact_dumpsys_adb.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/android/test_artifact_dumpsys_adb.py b/tests/android/test_artifact_dumpsys_adb.py
index 3f6f892d..2fcd0bba 100644
--- a/tests/android/test_artifact_dumpsys_adb.py
+++ b/tests/android/test_artifact_dumpsys_adb.py
@@ -142,7 +142,6 @@ class TestDumpsysADBArtifact:
         assert da_adb.results[0]["user_keys"][0]["user"] == "user@laptop"
         assert da_adb.results[0]["keystore"][0]["last_connected"] == "1628501829898"
 
-
     def test_parsing_adb_wifi_with_mixed_line_endings(self):
         da_adb = DumpsysADBArtifact()
         data = (

From 99b3b5f0140fe2ca59e8581c5ae1f4b579d9eb5b Mon Sep 17 00:00:00 2001
From: SomeoneUnlicensed <kompotomanya@gmail.com>
Date: Thu, 24 Sep 2026 21:29:45 +0300
Subject: [PATCH 5/6] Make the test suite pass on Windows

The Filesystem module stored the paths of an iOS dump with the separator
of the system checking it, so on Windows the process and file path
indicators, which split paths on "/", never matched. It now stores them
as POSIX paths.

The rest are test fixes:
- the completion install tests also redirect USERPROFILE, which
  Path.home() reads on Windows; they wrote to the real home folder;
- the plugin table helpers accept the light header Rich draws on
  consoles that cannot show the heavy one;
- the completion test quotes the command path, whose backslashes were
  dropped when COMP_WORDS was split;
- tests that need symbolic links or the sqlite3 binary are skipped when
  those are not available;
- two assertions no longer depend on the path separator or on the line
  ending text mode writes.
---
 src/mvt/ios/modules/fs/filesystem.py     |  8 ++++++--
 tests/common/test_cli_plugins.py         |  3 ++-
 tests/common/test_cmd_plugins.py         | 20 ++++++++++++--------
 tests/ios_backup/test_decrypt.py         |  6 +++++-
 tests/ios_backup/test_sqlite_handling.py |  5 +++++
 tests/test_check_android_androidqf.py    |  2 +-
 tests/test_cmd_check_sysdiagnose.py      |  2 +-
 tests/test_completion.py                 |  2 ++
 8 files changed, 34 insertions(+), 14 deletions(-)

diff --git a/src/mvt/ios/modules/fs/filesystem.py b/src/mvt/ios/modules/fs/filesystem.py
index 563d0394..b3cc1134 100644
--- a/src/mvt/ios/modules/fs/filesystem.py
+++ b/src/mvt/ios/modules/fs/filesystem.py
@@ -82,7 +82,9 @@ class Filesystem(IOSExtraction):
                 try:
                     dir_path = os.path.join(root, dir_name)
                     result = {
-                        "path": os.path.relpath(dir_path, self.target_path),
+                        "path": os.path.relpath(dir_path, self.target_path).replace(
+                            os.sep, "/"
+                        ),
                         "modified": convert_unix_to_iso(os.stat(dir_path).st_mtime),
                     }
                 except Exception:
@@ -94,7 +96,9 @@ class Filesystem(IOSExtraction):
                 try:
                     file_path = os.path.join(root, file_name)
                     result = {
-                        "path": os.path.relpath(file_path, self.target_path),
+                        "path": os.path.relpath(file_path, self.target_path).replace(
+                            os.sep, "/"
+                        ),
                         "modified": convert_unix_to_iso(os.stat(file_path).st_mtime),
                     }
                 except Exception:
diff --git a/tests/common/test_cli_plugins.py b/tests/common/test_cli_plugins.py
index 5abb2c98..0618b8d6 100644
--- a/tests/common/test_cli_plugins.py
+++ b/tests/common/test_cli_plugins.py
@@ -1,3 +1,4 @@
+import shlex
 from types import SimpleNamespace
 
 import click
@@ -110,7 +111,7 @@ def test_load_command_option_supports_folders_and_repeated_paths(tmp_path):
 def test_loaded_command_participates_in_shell_completion(tmp_path):
     command_path = _write_command(tmp_path / "hello.py", "hello")
     group = _make_group()
-    words = f"group --load-command {command_path} he"
+    words = f"group --load-command {shlex.quote(str(command_path))} he"
 
     result = CliRunner().invoke(
         group,
diff --git a/tests/common/test_cmd_plugins.py b/tests/common/test_cmd_plugins.py
index adf93227..3767491a 100644
--- a/tests/common/test_cmd_plugins.py
+++ b/tests/common/test_cmd_plugins.py
@@ -1,4 +1,5 @@
 import json
+import re
 from types import SimpleNamespace
 
 import pytest
@@ -54,20 +55,23 @@ def _run(command, arguments):
     return CliRunner().invoke(command, arguments, env={"COLUMNS": "200"})
 
 
-def _table_rows(output):
-    """Return the content of the table rows, without the header and the box."""
+def _table_lines(output):
+    """Return the cells of each line of the table, header first."""
     return [
-        [cell.strip() for cell in line.strip().strip("│").split("│")]
+        [cell.strip() for cell in re.split("[│┃]", line.strip().strip("│┃"))]
         for line in output.splitlines()
-        if "│" in line
+        if "│" in line or "┃" in line
     ]
 
 
+def _table_rows(output):
+    """Return the content of the table rows, without the header and the box."""
+    return _table_lines(output)[1:]
+
+
 def _table_header(output):
-    for line in output.splitlines():
-        if "┃" in line:
-            return [cell.strip() for cell in line.strip().strip("┃").split("┃")]
-    return []
+    lines = _table_lines(output)
+    return lines[0] if lines else []
 
 
 def _install(monkeypatch, distributions, entry_points):
diff --git a/tests/ios_backup/test_decrypt.py b/tests/ios_backup/test_decrypt.py
index 25decce5..a03e687f 100644
--- a/tests/ios_backup/test_decrypt.py
+++ b/tests/ios_backup/test_decrypt.py
@@ -7,6 +7,7 @@ import logging
 import threading
 from pathlib import Path
 
+import pytest
 from Crypto.Cipher import AES
 
 from mvt.ios.decrypt import DecryptBackup, MVTEncryptedBackup
@@ -96,7 +97,10 @@ def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_pat
         source_path = backup_path / file_id[:2] / file_id
         source_path.parent.mkdir(parents=True, exist_ok=True)
         source_path.write_bytes(b"encrypted")
-    (destination / "ab").symlink_to(outside, target_is_directory=True)
+    try:
+        (destination / "ab").symlink_to(outside, target_is_directory=True)
+    except OSError:
+        pytest.skip("creating symbolic links is not permitted on this system")
 
     cursor = mocker.MagicMock()
     cursor.__iter__.return_value = iter(
diff --git a/tests/ios_backup/test_sqlite_handling.py b/tests/ios_backup/test_sqlite_handling.py
index f7806401..2774098e 100644
--- a/tests/ios_backup/test_sqlite_handling.py
+++ b/tests/ios_backup/test_sqlite_handling.py
@@ -9,6 +9,8 @@ import plistlib
 import shutil
 import sqlite3
 
+import pytest
+
 from mvt.ios.modules.base import IOSExtraction
 from mvt.ios.modules.fs.analytics import Analytics
 
@@ -45,6 +47,9 @@ def test_open_sqlite_reads_wal_without_modifying_evidence(tmp_path):
     assert not os.path.exists(str(evidence_path) + "-shm")
 
 
+@pytest.mark.skipif(
+    shutil.which("sqlite3") is None, reason="the recovery needs the sqlite3 binary"
+)
 def test_recovery_preserves_source_database(tmp_path):
     database_path = tmp_path / "source.db"
     conn = sqlite3.connect(database_path)
diff --git a/tests/test_check_android_androidqf.py b/tests/test_check_android_androidqf.py
index 4e6ef984..65973109 100644
--- a/tests/test_check_android_androidqf.py
+++ b/tests/test_check_android_androidqf.py
@@ -85,7 +85,7 @@ class TestCheckAndroidqfCommand:
     def test_acquisition_context_falls_back_to_public_key_file(self, tmp_path):
         data_path = tmp_path / "androidqf"
         data_path.mkdir()
-        (data_path / "adb_host_key.pub").write_text("QUJDRA== acquisition@host\n")
+        (data_path / "adb_host_key.pub").write_bytes(b"QUJDRA== acquisition@host\n")
         command = CmdAndroidCheckAndroidQF(target_path=str(data_path))
 
         command.init()
diff --git a/tests/test_cmd_check_sysdiagnose.py b/tests/test_cmd_check_sysdiagnose.py
index b00b648b..702e985f 100644
--- a/tests/test_cmd_check_sysdiagnose.py
+++ b/tests/test_cmd_check_sysdiagnose.py
@@ -116,7 +116,7 @@ def test_archive_is_extracted_once_and_unsafe_members_are_skipped(tmp_path):
         module = SysdiagnoseExtraction()
         command.module_init(module)
         assert module.tar is None
-        assert module.parent_path == str(extracted_path.parent)
+        assert Path(module.parent_path) == extracted_path.parent
     finally:
         command.finish()
 
diff --git a/tests/test_completion.py b/tests/test_completion.py
index 08ad3ce3..d240e492 100644
--- a/tests/test_completion.py
+++ b/tests/test_completion.py
@@ -43,6 +43,7 @@ class TestCompletionCommand:
 
     def test_completion_install_updates_bashrc_once(self, tmp_path, monkeypatch):
         monkeypatch.setenv("HOME", str(tmp_path))
+        monkeypatch.setenv("USERPROFILE", str(tmp_path))
         runner = CliRunner()
 
         result = runner.invoke(mvt_cli, ["completion", "bash", "--install"])
@@ -67,6 +68,7 @@ class TestCompletionCommand:
         self, tmp_path, monkeypatch
     ):
         monkeypatch.setenv("HOME", str(tmp_path))
+        monkeypatch.setenv("USERPROFILE", str(tmp_path))
         runner = CliRunner()
 
         result = runner.invoke(mvt_cli, ["completion", "fish", "--install"])

From 658c7aa327cc0ecfed18be143640ce04674d6ffb Mon Sep 17 00:00:00 2001
From: Janik Besendorf <janik@besendorf.org>
Date: Mon, 28 Sep 2026 15:47:15 +0200
Subject: [PATCH 6/6] Test Windows path normalization and preserve backup
 safety coverage

---
 tests/ios_backup/test_decrypt.py | 36 +++++++++++++++++++-------------
 tests/ios_fs/test_filesystem.py  | 30 ++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 14 deletions(-)

diff --git a/tests/ios_backup/test_decrypt.py b/tests/ios_backup/test_decrypt.py
index a03e687f..1e2ce148 100644
--- a/tests/ios_backup/test_decrypt.py
+++ b/tests/ios_backup/test_decrypt.py
@@ -82,7 +82,10 @@ def test_extract_file_by_id_copies_unencrypted_files(mocker, tmp_path):
     assert output_path.read_bytes() == b"plain content"
 
 
-def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_path):
+@pytest.mark.parametrize("with_symlink", [False, True], ids=["file-id", "symlink"])
+def test_process_backup_rejects_unsafe_file_ids_and_destinations(
+    mocker, tmp_path, with_symlink
+):
     backup_path = tmp_path / "backup"
     destination = tmp_path / "destination"
     outside = tmp_path / "outside"
@@ -93,23 +96,27 @@ def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_pat
     safe_file_id = "ef" + "3" * 38
     unsafe_file_id = "../../outside-file"
     symlink_file_id = "ab" + "4" * 38
-    for file_id in (safe_file_id, symlink_file_id):
+    file_ids = [safe_file_id]
+    if with_symlink:
+        file_ids.append(symlink_file_id)
+    for file_id in file_ids:
         source_path = backup_path / file_id[:2] / file_id
         source_path.parent.mkdir(parents=True, exist_ok=True)
         source_path.write_bytes(b"encrypted")
-    try:
-        (destination / "ab").symlink_to(outside, target_is_directory=True)
-    except OSError:
-        pytest.skip("creating symbolic links is not permitted on this system")
+    if with_symlink:
+        try:
+            (destination / "ab").symlink_to(outside, target_is_directory=True)
+        except OSError:
+            pytest.skip("creating symbolic links is not permitted on this system")
 
     cursor = mocker.MagicMock()
-    cursor.__iter__.return_value = iter(
-        [
-            (safe_file_id, "Domain", "safe", b"plist"),
-            (unsafe_file_id, "Domain", "unsafe", b"plist"),
-            (symlink_file_id, "Domain", "symlink", b"plist"),
-        ]
-    )
+    records = [
+        (safe_file_id, "Domain", "safe", b"plist"),
+        (unsafe_file_id, "Domain", "unsafe", b"plist"),
+    ]
+    if with_symlink:
+        records.append((symlink_file_id, "Domain", "symlink", b"plist"))
+    cursor.__iter__.return_value = iter(records)
     cursor_context = mocker.MagicMock()
     cursor_context.__enter__.return_value = cursor
 
@@ -128,7 +135,8 @@ def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_pat
     decryptor.process_backup()
 
     assert (destination / safe_file_id[:2] / safe_file_id).read_bytes() == b"decrypted"
-    assert not (outside / symlink_file_id).exists()
+    if with_symlink:
+        assert not (outside / symlink_file_id).exists()
     backup.extract_file_by_id.assert_called_once()
     assert backup.extract_file_by_id.call_args.kwargs["file_id"] == safe_file_id
 
diff --git a/tests/ios_fs/test_filesystem.py b/tests/ios_fs/test_filesystem.py
index 636c004a..fe3ecf68 100644
--- a/tests/ios_fs/test_filesystem.py
+++ b/tests/ios_fs/test_filesystem.py
@@ -3,15 +3,45 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 import logging
+import ntpath
+from types import SimpleNamespace
 
 from mvt.common.indicators import Indicators
 from mvt.common.module import run_module
+from mvt.ios.modules.fs import filesystem
 from mvt.ios.modules.fs.filesystem import Filesystem
 
 from ..utils import get_ios_backup_folder
 
 
 class TestFilesystem:
+    def test_windows_paths_are_normalized_for_indicators(
+        self, monkeypatch, indicators_factory
+    ):
+        m = Filesystem(target_path=r"C:\dump")
+        m.indicators = indicators_factory(
+            file_paths=["matched/directory"], processes=["matched"]
+        )
+        monkeypatch.setattr(
+            filesystem,
+            "os",
+            SimpleNamespace(
+                sep="\\",
+                path=ntpath,
+                walk=lambda _: [(r"C:\dump\matched", ["directory"], ["file.txt"])],
+                stat=lambda _: SimpleNamespace(st_mtime=0),
+            ),
+        )
+
+        m.run()
+        m.check_indicators()
+
+        assert {result["path"] for result in m.results} == {
+            "matched/directory",
+            "matched/file.txt",
+        }
+        assert len(m.alertstore.alerts) == 3
+
     def test_filesystem(self):
         m = Filesystem(target_path=get_ios_backup_folder())
         run_module(m)