Merge main and resolve upstream integration conflicts

tests/android/test_artifact_dumpsys_accessibility.py

@@ -23,7 +23,7 @@ class TestDumpsysAccessibilityArtifact:
         assert len(da.results) == 4
         assert da.results[0]["package_name"] == "com.android.settings"
         assert (
-            da.results[0]["service"]
+            da.results[0]["component"]
             == "com.android.settings/com.samsung.android.settings.development.gpuwatch.GPUWatchInterceptor"
         )
 
@@ -35,9 +35,16 @@ class TestDumpsysAccessibilityArtifact:
 
         assert len(da.results) == 0
         da.parse(data)
-        assert len(da.results) == 1
+        # One named service, plus one count-only record: the dump states
+        # `installedServiceCount=2` and names only one component.
+        assert len(da.results) == 2
         assert da.results[0]["package_name"] == "com.malware.accessibility"
-        assert da.results[0]["service"] == "com.malware.service.malwareservice"
+        assert da.results[0]["service_name"] == "com.malware.service.malwareservice"
+        assert da.results[0]["enabled"] is True
+        # This fixture never prints an `installed services:` section, so the
+        # dump does not state the installed status. Reporting False would turn
+        # "not stated" into "not installed", so it reads None here.
+        assert da.results[0]["installed"] is None
 
     def test_accessibility_service_alert(self):
         da = DumpsysAccessibilityArtifact()
@@ -48,9 +55,27 @@ class TestDumpsysAccessibilityArtifact:
 
         da.check_indicators()
 
-        assert len(da.alertstore.alerts) == 1
+        assert len(da.alertstore.alerts) == 2
         assert da.alertstore.alerts[0].level == AlertLevel.MEDIUM
         assert da.alertstore.alerts[0].event == da.results[0]
+        assert da.alertstore.alerts[1].level == AlertLevel.LOW
+        assert da.alertstore.alerts[1].event == da.results[1]
+
+    def test_same_component_is_kept_for_each_user(self):
+        da = DumpsysAccessibilityArtifact()
+        da.parse(
+            """User state[attributes:{id=0
+  installed services: {
+    0 : com.example/.Service
+  }
+User state[attributes:{id=10
+  installed services: {
+    0 : com.example/.Service
+  }
+"""
+        )
+
+        assert [result["user_id"] for result in da.results] == [0, 10]
 
     def test_ioc_check(self, indicator_file):
         da = DumpsysAccessibilityArtifact()
@@ -66,7 +91,11 @@ class TestDumpsysAccessibilityArtifact:
         assert len(da.alertstore.alerts) == 0
         da.check_indicators()
         assert len(da.alertstore.alerts) == len(da.results)
-        assert da.alertstore.count(AlertLevel.MEDIUM) == 3
+        # Every service in this fixture is installed and switched off
+        # (`enabled services:{}` is printed and empty), so the three non-IOC
+        # findings are LOW, not MEDIUM. The IOC match is unaffected by the
+        # state.
+        assert da.alertstore.count(AlertLevel.LOW) == 3
         assert da.alertstore.count(AlertLevel.CRITICAL) == 1
         critical_alert = next(
             alert

tests/android/test_artifact_dumpsys_accessibility_count.py

@@ -0,0 +1,149 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""The dump's own installed-service count must survive into the artifact.
+
+Most builds never print the `installed services: {…}` block; they state `installedServiceCount=N` in the user's `attributes:{…}` line and
+list nothing. Dropping that number makes an artifact that says "no
+accessibility services" about a dump that said there are five.
+"""
+
+from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+from mvt.common.alerts import AlertLevel
+
+from ..utils import get_artifact
+
+AOSP_NO_LIST = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[
+     attributes:{id=0, touchExplorationEnabled=false, installedServiceCount=5}
+     Bound services:{}
+     Enabled services:{}
+     Binding services:{}
+     Crashed services:{}
+"""
+
+ONE_UI_WITH_LIST = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=2}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+    1 : com.other.app/.Helper
+  }
+  enabled services: {
+  }
+"""
+
+TWO_USERS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=1}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+  }
+User state[attributes:{id=95, installedServiceCount=3}
+     Enabled services:{}
+"""
+
+PARTIAL_TWO_USERS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=3}
+     Enabled services:{{com.example.app/com.example.app.Service}}
+User state[attributes:{id=10, installedServiceCount=1}
+     Enabled services:{{com.other.app/.Helper}}
+"""
+
+ZERO_COUNT = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=0}
+     Enabled services:{}
+"""
+
+
+def _parse(content):
+    artifact = DumpsysAccessibilityArtifact()
+    artifact.results = []
+    artifact.parse(content)
+    return artifact
+
+
+class TestAccessibilityInstalledServiceCount:
+    def test_stated_count_without_a_list_is_kept(self):
+        artifact = _parse(AOSP_NO_LIST)
+        assert len(artifact.results) == 1
+        record = artifact.results[0]
+        assert record["installed_service_count"] == 5
+        assert record["component"] is None
+        # Every state flag stays unknown: the dump named no service to which a
+        # state could belong.
+        assert record["installed"] is None
+        assert record["enabled"] is None
+
+    def test_a_stated_count_is_reported_as_low(self):
+        artifact = _parse(AOSP_NO_LIST)
+        artifact.check_indicators()
+        alerts = artifact.alertstore.alerts
+        assert len(alerts) == 1
+        # A count is a coverage statement, not a running service: it must not
+        # compete with a service the dump says is enabled.
+        assert alerts[0].level == AlertLevel.LOW
+        assert "does not list their component names" in alerts[0].message
+        assert "5 installed" in alerts[0].message
+
+    def test_a_listed_user_carries_the_count_on_each_service(self):
+        artifact = _parse(ONE_UI_WITH_LIST)
+        assert len(artifact.results) == 2
+        assert {record["installed_service_count"] for record in artifact.results} == {2}
+        assert all(record["component"] for record in artifact.results)
+
+    def test_only_the_unlisted_user_gets_a_count_record(self):
+        artifact = _parse(TWO_USERS)
+        listed = [record for record in artifact.results if record["component"]]
+        unlisted = [record for record in artifact.results if not record["component"]]
+        assert [record["user_id"] for record in listed] == [0]
+        assert [record["user_id"] for record in unlisted] == [95]
+        assert unlisted[0]["installed_service_count"] == 3
+
+    def test_a_zero_count_adds_nothing(self):
+        # "Zero installed" is a negative result the empty section already
+        # states; a record for it would be noise.
+        assert _parse(ZERO_COUNT).results == []
+
+    def test_a_partly_named_count_reports_the_unnamed_rest(self):
+        # The Android 14 fixture states `installedServiceCount=2` and names one
+        # enabled component. The listing is incomplete, and must not read as
+        # complete.
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        with open(
+            get_artifact("android_data/dumpsys_accessibility_v14_or_later.txt")
+        ) as handle:
+            artifact.parse(handle.read())
+        unlisted = [record for record in artifact.results if not record["component"]]
+        assert len(unlisted) == 1
+        assert unlisted[0]["installed_service_count"] == 2
+        assert unlisted[0]["unnamed_service_count"] == 1
+
+        artifact.check_indicators()
+        low = [
+            alert
+            for alert in artifact.alertstore.alerts
+            if alert.level == AlertLevel.LOW
+        ]
+        assert len(low) == 1
+        assert "only 1 of them (1 unnamed)" in low[0].message
+
+    def test_the_unnamed_rest_is_counted_per_user(self):
+        # User 0 names one of three, user 10 names its only one: the gap
+        # belongs to user 0 alone.
+        artifact = _parse(PARTIAL_TWO_USERS)
+        unlisted = [record for record in artifact.results if not record["component"]]
+        assert [
+            (record["user_id"], record["unnamed_service_count"]) for record in unlisted
+        ] == [(0, 2)]
+
+    def test_a_fully_named_count_adds_nothing(self):
+        artifact = _parse(ONE_UI_WITH_LIST)
+        assert all(
+            record["unnamed_service_count"] is None for record in artifact.results
+        )

tests/android/test_artifact_dumpsys_accessibility_state.py

@@ -0,0 +1,155 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""Installed is not the same as enabled, and the dump says which.
+
+Two things this guards:
+
+  * a section the dump never printed must read as None ("not stated"), not as
+    False ("not enabled");
+  * the alert must name the state, instead of firing identically on a device
+    where nothing is switched on and one where something is bound.
+"""
+
+from types import SimpleNamespace
+
+from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+from mvt.common.alerts import AlertLevel
+
+from ..utils import get_artifact
+
+NO_STATE_SECTIONS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, currentUser=true}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+  }
+"""
+
+ENABLED_BLOCK = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, currentUser=true}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+    1 : com.other.app/.Helper
+  }
+  enabled services: {
+    0 : com.other.app/.Helper
+  }
+  bound services:{
+    0 : com.other.app/.Helper
+  }
+"""
+
+# User 0 prints only `installed services`, user 10 only `Enabled services`.
+# Neither section speaks for the other user.
+TWO_USERS_DIFFERENT_SECTIONS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, currentUser=true}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+  }
+User state[attributes:{id=10, currentUser=false}
+     Enabled services:{{com.other.app/.Helper}}
+"""
+
+
+class _IndicatorsMatching:
+    """Minimal stand-in: matches one package id, like the STIX2 loader would."""
+
+    def __init__(self, package_name: str) -> None:
+        self.package_name = package_name
+
+    def check_app_id(self, app_id):
+        if app_id != self.package_name:
+            return None
+        return SimpleNamespace(
+            message=f"Found a known suspicious app: {app_id}", ioc={"value": app_id}
+        )
+
+
+class TestAccessibilityServiceState:
+    def _parse(self, content):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(content)
+        return {r["component"]: r for r in artifact.results}
+
+    def test_absent_sections_leave_the_state_unknown(self):
+        # None, not False: a build that does not print the sections says
+        # nothing about what is enabled, and that must not read as "nothing".
+        state = self._parse(NO_STATE_SECTIONS)[
+            "com.example.app/com.example.app.Service"
+        ]
+        assert state["installed"] is True
+        assert state["enabled"] is None
+        assert state["bound"] is None
+
+    def test_enabled_and_bound_are_attributed_per_service(self):
+        results = self._parse(ENABLED_BLOCK)
+        installed_only = results["com.example.app/com.example.app.Service"]
+        active = results["com.other.app/.Helper"]
+        assert (installed_only["enabled"], installed_only["bound"]) == (False, False)
+        assert (active["enabled"], active["bound"]) == (True, True)
+
+    def test_alert_message_carries_the_state(self):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        with open(get_artifact("android_data/dumpsys_accessibility.txt")) as handle:
+            artifact.parse(handle.read())
+        artifact.check_indicators()
+        assert artifact.alertstore.alerts
+        assert all("installed" in alert.message for alert in artifact.alertstore.alerts)
+
+    def test_a_switched_off_service_is_low_and_a_running_one_medium(self):
+        # A service the dump says is OFF still reaches the analyst, but must not
+        # compete with one that is actually bound. "Not stated" is not "off".
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(ENABLED_BLOCK)
+        artifact.check_indicators()
+        by_level = {}
+        for alert in artifact.alertstore.alerts:
+            by_level.setdefault(alert.level, []).append(alert.message)
+        assert artifact.alertstore.count(AlertLevel.LOW) == 1
+        assert artifact.alertstore.count(AlertLevel.MEDIUM) == 1
+        assert "com.example.app" in by_level[AlertLevel.LOW][0]
+        assert "com.other.app" in by_level[AlertLevel.MEDIUM][0]
+
+    def test_an_unstated_enabled_state_stays_medium(self):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(NO_STATE_SECTIONS)
+        artifact.check_indicators()
+        assert artifact.alertstore.count(AlertLevel.MEDIUM) == 1
+        assert artifact.alertstore.count(AlertLevel.LOW) == 0
+
+    def test_a_disabled_service_is_still_matched_against_indicators(self):
+        # The state decides the severity of an ordinary finding, never whether
+        # the package is compared with the IOC feeds.
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(ENABLED_BLOCK)
+        artifact.indicators = _IndicatorsMatching("com.example.app")
+        artifact.check_indicators()
+        assert artifact.alertstore.count(AlertLevel.CRITICAL) == 1
+        assert artifact.alertstore.count(AlertLevel.LOW) == 0
+
+    def test_printed_sections_are_tracked_per_user(self):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(TWO_USERS_DIFFERENT_SECTIONS)
+        by_user = {r["user_id"]: r for r in artifact.results}
+        # User 0's enabled state is not stated, so it is unknown, not off.
+        assert (by_user[0]["installed"], by_user[0]["enabled"]) == (True, None)
+        # User 10's installed state is not stated either.
+        assert (by_user[10]["installed"], by_user[10]["enabled"]) == (None, True)
+
+        artifact.check_indicators()
+        assert artifact.alertstore.count(AlertLevel.LOW) == 0
+        assert artifact.alertstore.count(AlertLevel.MEDIUM) == 2
+        assert not any(
+            "installed, not enabled" in alert.message
+            for alert in artifact.alertstore.alerts
+        )

tests/android/test_artifact_dumpsys_adb.py

@@ -3,6 +3,8 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+import base64
+
 from mvt.android.artifacts.dumpsys_adb import DumpsysADBArtifact
 from mvt.android.modules.bugreport.dumpsys_adb_state import DumpsysADBState
 from mvt.common.alerts import AlertLevel
@@ -11,6 +13,17 @@ from ..utils import get_artifact
 
 
 class TestDumpsysADBArtifact:
+    def test_parsing_binary_xml_recovers_key(self):
+        public_key = base64.b64encode(bytes(range(256)))
+        keystore = DumpsysADBArtifact().parse_binary_xml(
+            b"ABX\x00binary-key=" + public_key + b" user@host\x00lastConnection"
+        )
+
+        assert len(keystore) == 1
+        assert keystore[0]["key"] == public_key.decode()
+        assert keystore[0]["user"] == "user@host"
+        assert keystore[0]["last_connected"] is None
+
     def test_parsing(self):
         da_adb = DumpsysADBArtifact()
         file = get_artifact("android_data/dumpsys_adb.txt")
@@ -117,6 +130,180 @@ class TestDumpsysADBArtifact:
         assert key_store_entry["fingerprint"] == expected_fingerprint
         assert key_store_entry["last_connected"] == "1628501829898"
 
+    def test_parsing_adb_xml_with_crlf_line_endings(self):
+        da_adb = DumpsysADBArtifact()
+        file = get_artifact("android_data/dumpsys_adb_xml.txt")
+        with open(file, "rb") as f:
+            data = f.read().replace(b"\r\n", b"\n").replace(b"\n", b"\r\n")
+
+        da_adb.parse(data)
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "user@laptop"
+        assert da_adb.results[0]["keystore"][0]["last_connected"] == "1628501829898"
+
+    def test_parsing_adb_wifi_with_mixed_line_endings(self):
+        da_adb = DumpsysADBArtifact()
+        data = (
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"    user_keys=QUJDRA== host@example\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"    }\n"
+            b"  }\r\n"
+            b"}\n"
+            b"--------- duration\n"
+        )
+
+        da_adb.parse(data)
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "host@example"
+        assert da_adb.results[0]["adb_wifi"]["enabled"] == b"false"
+
+    ADB_STATE = (
+        b"ADB MANAGER STATE (dumpsys adb):\n"
+        b"{\n"
+        b"  debugging_manager={\n"
+        b"    connected_to_adb=true\n"
+        b"    user_keys=QUJDRA== host@example\n"
+        b"  }\n"
+        b"}\n"
+        b"--------- 0.5s was the duration of 'dumpsys adb'\n"
+    )
+
+    def test_a_later_dumpsys_section_does_not_extend_the_adb_state(self):
+        # A bug report holds many sections. Looking for the last closing brace
+        # in the whole output pulled a later section into this one, which threw
+        # IndexError out of parse() and lost the ADB records entirely.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            self.ADB_STATE + b"DUMP OF SERVICE other:\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=false\n"
+            b"    user_keys=RVZJTA== attacker@host\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert [key["user"] for key in da_adb.results[0]["user_keys"]] == [
+            "host@example"
+        ]
+        assert da_adb.results[0]["connected_to_adb"] is True
+
+    def test_braces_in_key_comment_are_not_state_delimiters(self):
+        for user in (b"host{example", b"host}}example"):
+            da_adb = DumpsysADBArtifact()
+            da_adb.parse(
+                b"ADB MANAGER STATE (dumpsys adb):\n"
+                b"{\n"
+                b"  debugging_manager={\n"
+                b"    connected_to_adb=true\n"
+                b"    user_keys=QUJDRA== " + user + b"\n  }\n}\n"
+            )
+
+            assert len(da_adb.results) == 1
+            assert da_adb.results[0]["user_keys"][0]["user"] == user.decode()
+
+    def test_state_without_keys_is_parsed_without_error(self, caplog):
+        # Shape printed by every device with no stored ADB keys (Samsung
+        # SM-A525F, Android 12). The block's closing brace is dedented from
+        # the last entry and must close exactly one level.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=false\n"
+            b"  }\n"
+            b"}\n"
+            b"--------- 0.015s was the duration of dumpsys adb\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is False
+        assert not [r for r in caplog.records if r.levelname == "ERROR"]
+
+    def test_nested_block_as_last_entry_is_parsed_without_error(self, caplog):
+        # Shape printed by Pixel devices with no stored ADB keys.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=false\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"      tls_port=0\n"
+            b"    }\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is False
+        assert da_adb.results[0]["adb_wifi"]["tls_port"] == b"0"
+        assert not [r for r in caplog.records if r.levelname == "ERROR"]
+
+    def test_entry_after_nested_block_stays_in_debugging_manager(self):
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"    }\n"
+            b"    connected_to_adb=true\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is True
+
+    def test_blank_line_after_single_line_value_does_not_raise(self):
+        # `system_keys` is the content of /adb_keys and ends with a newline,
+        # so a blank line follows it. It is not a multiline field, so the
+        # blank line is not a multiline terminator either.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"    user_keys=QUJDRA== host@example\n"
+            b"\n"
+            b"    system_keys=RUZHSA== system@example\n"
+            b"\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "host@example"
+        assert da_adb.results[0]["system_keys"] == "RUZHSA== system@example"
+
+    def test_unbalanced_state_is_reported_rather_than_raising(self):
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"  }\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        # No exception, and whatever was read before the bad line is kept.
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is True
+
 
 class TestDumpsysADBStateAlerts:
     def test_no_androidqf_context_preserves_existing_behavior(self):

tests/android/test_artifact_dumpsys_appops.py

@@ -25,10 +25,37 @@ class TestDumpsysAppopsArtifact:
         assert da.results[0]["uid"] == "0"
         assert len(da.results[0]["permissions"]) == 1
         assert da.results[0]["permissions"][0]["name"] == "MANAGE_IPSEC_TUNNELS"
-        assert da.results[0]["permissions"][0]["access"] == "allow"
+        assert da.results[0]["permissions"][0]["mode"] == "allow"
         assert da.results[6]["package_name"] == "com.sec.factory.camera"
         assert len(da.results[6]["permissions"][1]["entries"]) == 1
         assert len(da.results[11]["permissions"]) == 4
+        wake_lock = next(
+            permission
+            for permission in da.results[11]["permissions"]
+            if permission["name"] == "WAKE_LOCK"
+        )
+        assert wake_lock["entries"][0]["duration"] == "+126ms"
+
+    def test_running_and_attribution_are_retained(self):
+        da = DumpsysAppopsArtifact()
+        da.parse(
+            """  Uid 0:
+    state=cch
+    Package com.example:
+      CAMERA (allow):
+        camera=[
+          Access: [fg-s] 2025-01-01 00:00:00.000 (-1s) duration=+2ms
+        ]
+      RECORD_AUDIO (allow):
+          Running start at: +3s
+"""
+        )
+
+        camera = da.results[0]["permissions"][0]["entries"][0]
+        running = da.results[0]["permissions"][1]["entries"][0]
+        assert camera["attribution"] == "camera"
+        assert running["event"] == "running"
+        assert running["relative_time"] == "+3s"
 
     def test_ioc_check(self, indicator_file):
         da = DumpsysAppopsArtifact()

tests/android/test_artifact_dumpsys_battery_daily.py

@@ -57,18 +57,19 @@ class TestDumpsysBatteryDailyArtifact:
         assert uninstall_alert.message == (
             "Detected uninstall of package com.example.removed (vers 0)"
         )
-        assert uninstall_alert.event_time == "2022-08-16"
+        assert uninstall_alert.event_time == "2022-08-16 15:56:39"
         assert uninstall_alert.event["package_name"] == "com.example.removed"
-        assert uninstall_alert.event["vers"] == "0"
+        assert uninstall_alert.event["version_code"] == 0
+        assert uninstall_alert.event["action"] == "uninstall"
 
         assert downgrade_alert.level == AlertLevel.MEDIUM
         assert downgrade_alert.message == (
             "Detected downgrade of package com.example.app from vers 10 to vers 9"
         )
-        assert downgrade_alert.event_time == "2022-08-17"
+        assert downgrade_alert.event_time == "2022-08-17 15:56:39"
         assert downgrade_alert.event["package_name"] == "com.example.app"
         assert downgrade_alert.event["action"] == "downgrade"
-        assert downgrade_alert.event["previous_vers"] == "10"
+        assert downgrade_alert.event["previous_version_code"] == 10
 
     def test_newest_first_update_is_not_reported_as_downgrade(self):
         dba = DumpsysBatteryDailyArtifact()
@@ -107,7 +108,19 @@ class TestDumpsysBatteryDailyArtifact:
         assert downgrade_alert.event_time == "2026-01-10"
         assert downgrade_alert.event["package_name"] == "com.example.app"
         assert downgrade_alert.event["action"] == "downgrade"
-        assert downgrade_alert.event["previous_vers"] == "102"
+        assert downgrade_alert.event["previous_version_code"] == 102
+
+    def test_duplicate_updates_retain_occurrence_count(self):
+        dba = DumpsysBatteryDailyArtifact()
+        dba.parse(
+            """  Daily from 2026-01-10-01-02-03 to 2026-01-11-04-05-06:
+      Update com.example.app vers=12
+      Update com.example.app vers=12
+"""
+        )
+
+        assert dba.results[0]["occurrences"] == 2
+        assert dba.results[0]["period_start"] == "2026-01-10 01:02:03"
 
     def test_reinstall_after_uninstall_is_not_reported_as_downgrade(self):
         dba = DumpsysBatteryDailyArtifact()
@@ -131,3 +144,18 @@ class TestDumpsysBatteryDailyArtifact:
             "Detected uninstall of package com.example.app (vers 0)"
         )
         assert uninstall_alert.event_time == "2026-01-10"
+
+    def test_malformed_update_line_does_not_lose_later_records(self):
+        # A truncated "Update" line, or one from a vendor that omits "vers=",
+        # used to raise out of parse() and lose every record after it.
+        dba = DumpsysBatteryDailyArtifact()
+        dba.parse(
+            "  Daily from 2021-05-10-08-00-00 to 2021-05-11-08-00-00:\n"
+            "    Update com.first vers=1\n"
+            "    Update com.truncated\n"
+            "    Update com.no.equals vers 2\n"
+            "    Update com.last vers=3\n"
+        )
+
+        assert [r["package_name"] for r in dba.results] == ["com.first", "com.last"]
+        assert [r["version_code"] for r in dba.results] == [1, 3]

tests/android/test_artifact_dumpsys_battery_history.py

@@ -54,6 +54,7 @@ class TestDumpsysBatteryHistoryArtifact:
         assert len(dba.results) == 2
         assert dba.results[0] == {
             "time_elapsed": "07-15 20:27:39.431",
+            "timestamp": "1900-07-15 20:27:39.431000",
             "event": "start_job",
             "uid": "u0a123",
             "package_name": "com.example",
@@ -61,3 +62,23 @@ class TestDumpsysBatteryHistoryArtifact:
         }
         assert dba.results[1]["event"] == "end_job"
         assert dba.results[1]["uid"] == "u0a123"
+
+    def test_wake_lock_without_component_is_retained(self):
+        dba = DumpsysBatteryHistoryArtifact()
+        dba.parse(
+            "Battery History:\n"
+            "  0 (2) 100 RESET:TIME: 2025-09-05-01-04-52-139\n"
+            '  +1s (2) 100 +running +wake_lock=1000:"*alarm*:TIME_TICK"\n'
+            '  +2s (2) 100 +running +wake_lock=u0a1:"*walarm*:com.whatsapp.MessageHandler.LOGOUT_ACTION"\n'
+            "\n"
+        )
+
+        assert [record["event"] for record in dba.results] == ["wake", "wake"]
+        assert dba.results[0]["package_name"] is None
+        assert dba.results[1]["package_name"] == "com.whatsapp"
+
+    def test_decorated_sync_job_uses_component_package(self):
+        dba = DumpsysBatteryHistoryArtifact()
+        dba.parse('+1s (2) 100 +job=u0a1:"@SyncManager@gmail-ls/com.google:android"\n')
+
+        assert dba.results[0]["package_name"] == "com.google"

tests/android/test_artifact_dumpsys_dbinfo.py

@@ -53,9 +53,32 @@ Connection pool for /data/user/0/com.example/databases/current.db:
 
         assert dbi.results == [
             {
-                "isodate": "07-15 20:27:39.431",
+                "timestamp": "07-15 20:27:39.431",
+                "pid": None,
                 "action": "executeForCursorWindow",
+                "duration_ms": 1,
+                "status": "succeeded",
                 "sql": "SELECT 1",
                 "path": "/data/user/0/com.example/databases/current.db",
+                "pool_path": "/data/user/0/com.example/databases/current.db",
+                "connection_number": None,
+                "is_primary": None,
             }
         ]
+
+    def test_parses_operations_from_multiple_connections(self):
+        dbi = DumpsysDBInfoArtifact()
+        dbi.parse(
+            """Connection pool for /data/example.db:
+    Connection #0:
+      isPrimaryConnection: true
+      Most recently executed operations:
+        0: [2025-01-01 00:00:00.000] execute took 1ms - succeeded, sql="SELECT 1", path=/data/example.db
+    Connection #1:
+      isPrimaryConnection: false
+      Most recently executed operations:
+        0: [2025-01-01 00:00:01.000] execute took 2ms - succeeded, sql="SELECT 2", path=/data/example.db
+"""
+        )
+
+        assert [record["connection_number"] for record in dbi.results] == [0, 1]

tests/android/test_artifact_dumpsys_package_activities.py

@@ -21,12 +21,16 @@ class TestDumpsysPackageActivitiesArtifact:
 
         assert len(dpa.results) == 0
         dpa.parse(data)
-        assert len(dpa.results) == 4
-        assert dpa.results[0]["package_name"] == "com.samsung.android.app.social"
+        assert len(dpa.results) == 10
+        assert dpa.results[0]["package_name"] == "com.samsung.android.messaging"
         assert (
-            dpa.results[0]["activity"]
-            == "com.samsung.android.app.social/.feed.FeedsActivity"
+            dpa.results[0]["component"]
+            == "com.samsung.android.messaging/.ui.RcsTransferContent"
         )
+        assert {result["resolver_type"] for result in dpa.results} == {
+            "full_mime_type",
+            "non_data_action",
+        }
 
     def test_ioc_check(self, indicator_file):
         dpa = DumpsysPackageActivitiesArtifact()
@@ -41,4 +45,4 @@ class TestDumpsysPackageActivitiesArtifact:
         dpa.indicators = ind
         assert len(dpa.alertstore.alerts) == 0
         dpa.check_indicators()
-        assert len(dpa.alertstore.alerts) == 1
+        assert len(dpa.alertstore.alerts) == 2

tests/android/test_artifact_dumpsys_packages.py

@@ -25,7 +25,11 @@ class TestDumpsysPackagesArtifact:
             == "com.samsung.android.provider.filterprovider"
         )
         assert dpa.results[0]["version_name"] == "5.0.07"
-        assert dpa.results[0]["first_install_time"] == "2008-12-31 16:00:00"
+        assert dpa.results[0]["version_code"] == 500700000
+        assert dpa.results[0]["min_sdk"] == 28
+        assert dpa.results[0]["target_sdk"] == 28
+        assert dpa.results[0]["package_type"] == "active"
+        assert dpa.results[0]["users"][0]["user_id"] == 0
         assert dpa.results[0]["system"] is True
 
     def test_parsing_system_flag(self):
@@ -60,42 +64,27 @@ class TestDumpsysPackagesArtifact:
         dpa.check_indicators()
         assert len(dpa.alertstore.alerts) == 1
 
-    def test_per_user_fields_use_primary_user(self):
-        details = DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
-            """    User 0: installed=true
-      firstInstallTime=2024-01-10 09:19:39
-      runtime permissions:
-        android.permission.CAMERA: granted=true
-    User 95: installed=false
-      firstInstallTime=1970-01-01 01:00:00
-      runtime permissions:
-        android.permission.CAMERA: granted=false
-        android.permission.RECORD_AUDIO: granted=false
+    def test_hidden_packages_and_per_user_state(self):
+        dpa = DumpsysPackagesArtifact()
+        dpa.parse(
+            """Packages:
+  Package [com.example.active]:
+    appId=10001
+    versionCode=12 minSdk=29 targetSdk=35
+    User 0: installed=true hidden=false
+      firstInstallTime=2025-01-01 01:02:03
+    User 10: installed=false hidden=true
+      firstInstallTime=2025-01-02 01:02:03
+Hidden system packages:
+  Package [com.example.hidden]:
+    appId=10002
+    installerPackageName=null
 """
         )
 
-        assert details["first_install_time"] == "2024-01-10 09:19:39"
-        runtime_permissions = [
-            permission
-            for permission in details["permissions"]
-            if permission["type"] == "runtime"
+        assert [record["package_type"] for record in dpa.results] == [
+            "active",
+            "hidden_system",
         ]
-        assert runtime_permissions == [
-            {
-                "name": "android.permission.CAMERA",
-                "granted": True,
-                "type": "runtime",
-            }
-        ]
-
-    def test_per_user_fields_fall_back_when_user_zero_is_missing(self):
-        details = DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
-            """    User 10: installed=true
-      firstInstallTime=2024-02-10 09:19:39
-      runtime permissions:
-        android.permission.CAMERA: granted=true
-"""
-        )
-
-        assert details["first_install_time"] == "2024-02-10 09:19:39"
-        assert details["permissions"][-1]["name"] == "android.permission.CAMERA"
+        assert len(dpa.results[0]["users"]) == 2
+        assert dpa.results[1]["installer"] is None

tests/android/test_artifact_dumpsys_platform_compat.py

@@ -22,6 +22,9 @@ class TestDumpsysPlatformCompatArtifact:
         assert len(dbi.results) == 2
         assert dbi.results[0]["package_name"] == "org.torproject.torbrowser"
         assert dbi.results[1]["package_name"] == "org.article19.circulo.next"
+        assert dbi.results[0]["change_id"] == 168419799
+        assert dbi.results[0]["change_name"] == "DOWNSCALED"
+        assert dbi.results[0]["override_value"] is False
 
     def test_ioc_check(self, indicator_file):
         dbi = DumpsysPlatformCompatArtifact()

tests/android/test_artifact_dumpsys_receivers.py

@@ -19,17 +19,14 @@ class TestDumpsysReceiversArtifact:
 
         assert len(dr.results) == 0
         dr.parse(data)
-        assert len(dr.results) == 4
-        assert (
-            list(dr.results.keys())[0]
-            == "com.android.storagemanager.automatic.SHOW_NOTIFICATION"
-        )
-        assert (
-            dr.results["com.android.storagemanager.automatic.SHOW_NOTIFICATION"][0][
-                "package_name"
-            ]
-            == "com.android.storagemanager"
+        assert len(dr.results) == 9
+        assert dr.results[0]["resolver_type"] == "full_mime_type"
+        storage_manager = next(
+            result
+            for result in dr.results
+            if result["key"] == "com.android.storagemanager.automatic.SHOW_NOTIFICATION"
         )
+        assert storage_manager["package_name"] == "com.android.storagemanager"
 
     def test_parsing_misindented_action(self):
         dr = DumpsysReceiversArtifact()
@@ -44,12 +41,8 @@ Receiver Resolver Table:
 
         dr.parse(data)
 
-        assert (
-            dr.results["android.intent.action.MY_PACKAGE_REPLACED"][0][
-                "package_name"
-            ]
-            == "com.psycatgames.nhiegame"
-        )
+        assert dr.results[1]["key"] == "android.intent.action.MY_PACKAGE_REPLACED"
+        assert dr.results[1]["package_name"] == "com.psycatgames.nhiegame"
 
     def test_parsing_misindented_first_action(self):
         dr = DumpsysReceiversArtifact()
@@ -62,12 +55,8 @@ Receiver Resolver Table:
 
         dr.parse(data)
 
-        assert (
-            dr.results["android.intent.action.MY_PACKAGE_REPLACED"][0][
-                "package_name"
-            ]
-            == "com.psycatgames.nhiegame"
-        )
+        assert dr.results[0]["key"] == "android.intent.action.MY_PACKAGE_REPLACED"
+        assert dr.results[0]["package_name"] == "com.psycatgames.nhiegame"
 
     def test_ioc_check(self, indicator_file):
         dr = DumpsysReceiversArtifact()

tests/android/test_artifact_getprop.py

@@ -39,3 +39,29 @@ class TestGetPropArtifact:
         assert len(gp.alertstore.alerts) == 0
         gp.check_indicators()
         assert len(gp.alertstore.alerts) == 1
+
+    def test_empty_values_and_invalid_lines(self):
+        gp = GetProp()
+        gp.parse("[empty]: []\n[valid]: [value]\n0\n[broken]: [value")
+
+        assert gp.results == [
+            {"name": "empty", "value": ""},
+            {"name": "valid", "value": "value"},
+        ]
+
+    def test_multiline_value(self):
+        gp = GetProp()
+        gp.parse(
+            "[persist.sys.boot.reason.history]: ["
+            "reboot,ota,1697044974\n"
+            "reboot,watchdog,1696958574]\n"
+            "[ro.build.version.sdk]: [35]\n"
+        )
+
+        assert gp.results == [
+            {
+                "name": "persist.sys.boot.reason.history",
+                "value": "reboot,ota,1697044974\nreboot,watchdog,1696958574",
+            },
+            {"name": "ro.build.version.sdk", "value": "35"},
+        ]

tests/android/test_artifact_mounts.py

@@ -0,0 +1,43 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""A mount is writable only if both mountinfo option layers allow it."""
+
+from mvt.android.artifacts.mounts import Mounts
+from mvt.common.alerts import AlertLevel
+
+# fields[5] is the per-mount (VFS) layer, the field after "-" the superblock.
+RO_OVERLAY = (
+    "304 166 0:130 / /product/usr rw,relatime shared:63 - overlay overlay "
+    "ro,seclabel,lowerdir=/mnt/vendor/ext/product/usr:/product/usr"
+)
+RW_SYSTEM = (
+    "305 166 0:131 / /system rw,relatime shared:64 - ext4 /dev/block/dm-1 "
+    "rw,seclabel,errors=panic"
+)
+
+
+def _run(line):
+    mounts = Mounts()
+    mounts.results = Mounts.parse_mountinfo(line, 1)
+    mounts.check_indicators()
+    return mounts
+
+
+class TestMountsReadWriteLayers:
+    def test_rw_vfs_over_ro_superblock_is_not_writable(self):
+        mounts = _run(RO_OVERLAY)
+        assert mounts.results[0]["is_read_write"] is False
+        assert mounts.alertstore.count(AlertLevel.HIGH) == 0
+        assert mounts.alertstore.count(AlertLevel.MEDIUM) == 0
+
+    def test_rw_in_both_layers_still_alerts(self):
+        mounts = _run(RW_SYSTEM)
+        assert mounts.results[0]["is_read_write"] is True
+        assert mounts.alertstore.count(AlertLevel.HIGH) == 1
+
+    def test_both_option_layers_are_still_reported(self):
+        mounts = _run(RO_OVERLAY)
+        options = mounts.results[0]["options_list"]
+        assert "rw" in options and "ro" in options

tests/android/test_artifact_processes.py

@@ -20,7 +20,7 @@ class TestProcessesArtifact:
         assert len(p.results) == 0
         p.parse(data)
         assert len(p.results) == 17
-        assert p.results[0]["proc_name"] == "init"
+        assert p.results[0]["command"] == "init"
 
     def test_ioc_check(self, indicator_file):
         p = Processes()
@@ -36,3 +36,14 @@ class TestProcessesArtifact:
         assert len(p.alertstore.alerts) == 0
         p.check_indicators()
         assert len(p.alertstore.alerts) == 1
+
+    def test_bugreport_thread_columns(self):
+        p = Processes()
+        p.parse(
+            "LABEL USER PID TID PPID VSZ RSS WCHAN ADDR S PRI NI RTPRIO SCH PCY TIME CMD\n"
+            "u:r:init:s0 root 1 2 0 100 20 0 0 S 19 0 - 0 fg 00:00:01 init\n"
+        )
+
+        assert p.results[0]["label"] == "u:r:init:s0"
+        assert p.results[0]["tid"] == 2
+        assert p.results[0]["command"] == "init"

tests/android/test_artifact_settings.py

@@ -0,0 +1,213 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from typing import Optional
+
+from mvt.android.artifacts.settings import Settings
+
+from ..utils import get_artifact
+
+
+def parse_bugreport_settings() -> Settings:
+    settings = Settings()
+    with open(get_artifact("android_data/bugreport/dumpstate.txt")) as handle:
+        data = handle.read()
+
+    settings.parse(settings.extract_dumpsys_section(data, "DUMP OF SERVICE settings:"))
+    return settings
+
+
+def find(settings: Settings, name: str) -> list:
+    return [result for result in settings.results if result["name"] == name]
+
+
+def resolve_history_time(time: str, section_end: str) -> Optional[str]:
+    settings = Settings()
+    settings.parse(
+        "SECURE SETTINGS (user 0)\n"
+        "_id:240 name:accessibility_enabled pkg:android value:1\n"
+        "\tHistory (accessibility_enabled)\n"
+        f"\t\ttime:{time} mode:update oldValue:0 newValue:1 "
+        "package:com.example.helper\n"
+        "\n"
+        "--------- 0.019s was the duration of dumpsys settings, "
+        f"ending at: {section_end}\n"
+    )
+    return settings.results[0]["history"][0]["timestamp"]
+
+
+class TestSettingsArtifact:
+    def test_parsing(self):
+        settings = parse_bugreport_settings()
+
+        assert len(settings.results) == 12
+        assert {result["namespace"] for result in settings.results} == {
+            "config",
+            "global",
+            "secure",
+        }
+        assert settings.results[0] == {
+            "namespace": "config",
+            "user": "0",
+            "_id": "682",
+            "name": "namespace_one/blocked_components",
+            "pkg": "com.example.services",
+            "value": (
+                "com.android.settings,com.android.vending,\n"
+                "com.example.dialer,\n"
+                "com.example.camera"
+            ),
+            "default": (
+                "com.android.settings,\n"
+                "        com.android.vending,\n"
+                "        com.example.dialer"
+            ),
+            "defaultSystemSet": "false",
+            "history": [],
+        }
+
+    def test_multiline_values_are_kept_whole(self):
+        settings = parse_bugreport_settings()
+
+        assert find(settings, "namespace_one/allowed_packages")[0]["value"] == (
+            "com.example.messaging,\ncom.example.chat"
+        )
+        assert find(settings, "widget_instance_data")[0]["value"] == (
+            '{\n  "version": 1,\n  "data": [\n    {\n      "number": 10000,\n'
+            '      "package_name": "com.example.widget"\n    }\n  ]\n}'
+        )
+
+    def test_trailing_default_is_not_part_of_the_value(self):
+        settings = parse_bugreport_settings()
+
+        record = find(settings, "namespace_one/streaming_blocked_components")[0]
+        assert record["value"] == "com.example.dialer,com.example.camera"
+        assert record["default"] == "com.android.settings,\n        com.android.vending"
+
+    def test_trailing_metadata_is_not_part_of_the_value(self):
+        settings = parse_bugreport_settings()
+
+        record = find(settings, "lock_screen_show_notifications")[0]
+        assert record["value"] == "1"
+        assert record["defaultSystemSet"] == "true"
+        assert record["isValuePreservedInRestore"] == "true"
+
+        # Without a default, the tag or the restore token follows the value.
+        record = find(settings, "accessibility_enabled")[1]
+        assert record["value"] == "0"
+        assert record["tag"] == "null"
+        assert "default" not in record
+
+        record = find(settings, "send_action_app_error")[0]
+        assert record["value"] == "1"
+        assert record["isValuePreservedInRestore"] == "false"
+
+    def test_dumps_after_the_last_block_are_not_part_of_the_last_row(self):
+        settings = parse_bugreport_settings()
+
+        assert settings.results[-1] == {
+            "namespace": "secure",
+            "user": "10",
+            "_id": "311",
+            "name": "accessibility_enabled",
+            "pkg": "android",
+            "value": "0",
+            "tag": "null",
+            "history": [],
+        }
+
+    def test_repeated_names_are_kept_as_separate_records(self):
+        settings = parse_bugreport_settings()
+
+        widgets = find(settings, "widget_instance_data")
+        assert [record["_id"] for record in widgets] == ["771", "41654"]
+
+        accessibility = find(settings, "accessibility_enabled")
+        assert [(record["user"], record["value"]) for record in accessibility] == [
+            ("0", "1"),
+            ("10", "0"),
+        ]
+
+    def test_setting_without_recording_package(self):
+        settings = parse_bugreport_settings()
+
+        record = find(settings, "hidden_api_blacklist_exemptions")[0]
+        assert "pkg" not in record
+        assert record["value"] == "{null}"
+
+    def test_history_timestamps_resolved_against_section_end(self):
+        settings = parse_bugreport_settings()
+
+        # The section was dumped on 2022-03-29, so an 11-02 entry belongs to
+        # the previous year and an 03-14 entry to the same year.
+        assert find(settings, "development_settings_enabled")[0]["history"] == [
+            {
+                "timestamp": "2021-11-02 11:21:22.212000",
+                "oldValue": "null",
+                "newValue": "1",
+                "pkg": "com.android.settings",
+            },
+            {
+                "timestamp": "2022-03-14 09:02:11.100000",
+                "oldValue": "1",
+                "newValue": "0",
+                "pkg": "com.example.updater",
+            },
+        ]
+
+    def test_history_without_a_section_end_has_no_timestamp(self):
+        settings = Settings()
+        settings.parse(
+            "SECURE SETTINGS (user 0)\n"
+            "_id:240 name:accessibility_enabled pkg:android value:1\n"
+            "\tHistory (accessibility_enabled)\n"
+            "\t\ttime:03-28 22:41:07.980 mode:update oldValue:0 newValue:1 "
+            "package:com.example.helper\n"
+        )
+
+        assert settings.results[0]["history"] == [
+            {
+                "timestamp": None,
+                "oldValue": "0",
+                "newValue": "1",
+                "pkg": "com.example.helper",
+            }
+        ]
+
+    def test_leap_day_history_keeps_its_timestamp(self):
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2024-03-05 23:14:28")
+            == "2024-02-29 22:41:07.980000"
+        )
+
+    def test_leap_day_history_resolved_to_the_last_leap_year(self):
+        # The most recent 29 February at or before the dump can be several
+        # years back when the dump was taken in a year without one.
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2025-03-01 10:00:00")
+            == "2024-02-29 22:41:07.980000"
+        )
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2024-01-10 10:00:00")
+            == "2020-02-29 22:41:07.980000"
+        )
+
+    def test_leap_day_history_before_a_leap_day_after_a_skipped_century(self):
+        # 2100 is not a leap year, so before 29 February 2104 the most
+        # recent matching date is eight years earlier, in 2096.
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2104-01-10 10:00:00")
+            == "2096-02-29 22:41:07.980000"
+        )
+
+    def test_dangerous_setting_is_detected_with_the_changing_package(self):
+        settings = parse_bugreport_settings()
+        settings.check_indicators()
+
+        assert len(settings.alertstore.alerts) == 1
+        alert = settings.alertstore.alerts[0]
+        assert "accessibility_enabled = 1" in alert.message
+        assert alert.event_time == "2022-03-28 22:41:07.980000"
+        assert alert.event["history"][0]["pkg"] == "com.example.helper"

tests/android/test_artifact_tombstone_caused_by.py

@@ -0,0 +1,54 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""A `Caused by:` line must not discard the whole text tombstone.
+
+Keys are matched as bare prefixes, so `Caused by: …` — an ordinary line inside
+an abort message — reached the `Cause` key, failed the key comparison and
+raised, which `Tombstones.run()` logged while dropping the entire crash record.
+Seen on a 1.6 MB tombstone whose protobuf twin was zero bytes: the crash then
+had no representation at all.
+"""
+
+import datetime
+
+from mvt.android.artifacts.tombstone_crashes import TombstoneCrashArtifact
+
+TOMBSTONE = b"""\
+*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
+Build fingerprint: 'Xiaomi/vili_eea/vili:13/TKQ1.220829.002/V14.0.10.0:user/release-keys'
+Revision: '0'
+ABI: 'arm64'
+Timestamp: 2023-08-24 14:54:47.999124034+0300
+Process uptime: 12199s
+Cmdline: com.example.game
+pid: 8044, tid: 26222, name: UnityMain  >>> com.example.game <<<
+uid: 10235
+signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
+Abort message: 'No pending exception expected: java.lang.SecurityException: listen
+  at void android.os.Parcel.readException() (Parcel.java:2920)
+Caused by: android.os.RemoteException: Remote stack trace:
+\tat com.android.server.TelephonyRegistry.listen(TelephonyRegistry.java:1096)
+"""
+
+WITH_CAUSE = TOMBSTONE + b"Cause: null pointer dereference\n"
+
+
+class TestTombstoneCausedBy:
+    def _parse(self, content):
+        artifact = TombstoneCrashArtifact()
+        artifact.results = []
+        artifact.parse("tombstone_23", datetime.datetime(2023, 8, 24), content)
+        return artifact.results
+
+    def test_caused_by_line_does_not_discard_the_tombstone(self):
+        results = self._parse(TOMBSTONE)
+        assert len(results) == 1
+        assert results[0]["pid"] == 8044
+        assert results[0]["process_name"] == "UnityMain"
+        assert results[0]["uid"] == 10235
+
+    def test_the_real_cause_key_is_still_parsed(self):
+        results = self._parse(WITH_CAUSE)
+        assert results[0]["cause"] == "null pointer dereference"

tests/android/test_artifact_tombstones.py

@@ -128,8 +128,5 @@ class TestTombstoneCrashArtifact:
         assert tombstone_result.get("pid") == 25541
         assert tombstone_result.get("process_name") == "mtk.ape.decoder"
 
-        # With Android logs we want to keep timestamps as device local time for consistency.
-        # We often don't know the time offset for a log entry and so can't convert everything to UTC.
-        # MVT should output the local time only:
-        # So original 2023-04-12 12:32:40.518290770+0200 -> 2023-04-12 12:32:40.000000
-        assert tombstone_result.get("timestamp") == "2023-04-12 12:32:40.518290"
+        # Tombstones include an explicit offset, so normalize them to UTC.
+        assert tombstone_result.get("timestamp") == "2023-04-12 10:32:40.518290"

tests/android/test_bugreport_section_extraction.py

@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""A section ends at the next section, not at a timing line printed inside it."""
+
+from mvt.android.modules.bugreport.base import BugReportModule
+
+# dumpstate prints a section's duration when that section finishes, which can
+# land in the middle of the section currently being written.
+DUMPSTATE = """\
+------ SYSTEM PROPERTIES (getprop) ------
+[nfc.initialized]: [true]
+------ 0.101s was the duration of 'DROPBOX SYSTEM SERVER CRASHES' ------
+[ro.build.version.sdk]: [30]
+[ro.product.model]: [SM-A305F]
+------ 0.064s was the duration of 'SYSTEM PROPERTIES' ------
+------ STORAGE INFO (df) ------
+/dev/root  2.9G
+"""
+
+
+class TestExtractCommandSection:
+    def test_a_foreign_timing_line_does_not_end_the_section(self):
+        section = BugReportModule.extract_command_section(
+            DUMPSTATE, "------ SYSTEM PROPERTIES"
+        )
+        assert "[ro.product.model]: [SM-A305F]" in section
+        assert section.count("\n") == 2
+
+    def test_the_next_section_is_still_the_boundary(self):
+        section = BugReportModule.extract_command_section(
+            DUMPSTATE, "------ SYSTEM PROPERTIES"
+        )
+        assert "STORAGE INFO" not in section
+        assert "/dev/root" not in section
+
+    def test_timing_lines_are_not_returned_as_content(self):
+        section = BugReportModule.extract_command_section(
+            DUMPSTATE, "------ SYSTEM PROPERTIES"
+        )
+        assert "was the duration of" not in section

tests/android/test_check_backup_optional_failure.py

@@ -0,0 +1,39 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""An encrypted backup.ab must not take the whole check-androidqf run with it.
+
+`CmdAndroidCheckBackup.from_ab()` already raises `InvalidAndroidBackup` instead
+of exiting when it runs as a sub-command (`check-androidqf` catches that and
+skips the backup modules), for a wrong file format and for a parse error. The
+password branches used to call `sys.exit(1)` unconditionally, which ends the
+parent run inside `finish()` — before the intrusion-logs command and before the
+timeline, alerts, urls, info and run-manifest are written.
+"""
+
+import pytest
+
+from mvt.android.cmd_check_backup import CmdAndroidCheckBackup, InvalidAndroidBackup
+
+ENCRYPTED_AB_HEADER = b"ANDROID BACKUP\n5\n0\nAES-256\n" + b"\x00" * 64
+
+
+class TestCheckBackupOptionalFailure:
+    def _cmd(self, tmp_path, sub_command):
+        return CmdAndroidCheckBackup(
+            target_path=None,
+            results_path=str(tmp_path),
+            module_options={"interactive": False},
+            sub_command=sub_command,
+        )
+
+    def test_missing_password_raises_when_nested(self, tmp_path):
+        cmd = self._cmd(tmp_path, sub_command=True)
+        with pytest.raises(InvalidAndroidBackup):
+            cmd.from_ab(ENCRYPTED_AB_HEADER)
+
+    def test_missing_password_still_exits_on_its_own_command(self, tmp_path):
+        cmd = self._cmd(tmp_path, sub_command=False)
+        with pytest.raises(SystemExit):
+            cmd.from_ab(ENCRYPTED_AB_HEADER)

tests/android/test_check_bugreport_wrapper.py

@@ -0,0 +1,56 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""An OEM wrapper archive must not read as an empty bug report.
+
+MIUI / HyperOS hands out a zip of app logs with the real
+`bugreport-<device>-<timestamp>.zip` nested inside. The outer archive has
+none of the entry points the modules read, so every module
+reported it found nothing and the command still exited 0 — an empty analysis
+that looks like a finished one.
+"""
+
+import io
+import zipfile
+
+from mvt.android.cmd_check_bugreport import CmdAndroidCheckBugreport
+
+DUMPSTATE = "== dumpstate: 2026-01-01 00:00:00\nDUMP OF SERVICE package:\n"
+
+
+def _inner_zip() -> bytes:
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as inner:
+        inner.writestr("main_entry.txt", "bugreport-test-2026-01-01-00-00-00.txt")
+        inner.writestr("bugreport-test-2026-01-01-00-00-00.txt", DUMPSTATE)
+    return buffer.getvalue()
+
+
+def _wrapper_zip() -> zipfile.ZipFile:
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as outer:
+        outer.writestr("app_logs/hilog.txt", "unrelated OEM log\n")
+        outer.writestr("bugreport-test-2026-01-01-00-00-00.zip", _inner_zip())
+    return zipfile.ZipFile(io.BytesIO(buffer.getvalue()))
+
+
+class TestCheckBugreportWrapper:
+    def test_nested_bugreport_is_used(self, tmp_path):
+        cmd = CmdAndroidCheckBugreport(results_path=str(tmp_path))
+        cmd.from_zip(_wrapper_zip())
+        module = cmd.modules[0](results_path=str(tmp_path))
+        cmd.module_init(module)
+        assert "main_entry.txt" in module.zip_files
+
+    def test_plain_bugreport_is_left_alone(self, tmp_path):
+        buffer = io.BytesIO()
+        with zipfile.ZipFile(buffer, "w") as archive:
+            archive.writestr("main_entry.txt", "bugreport.txt")
+            archive.writestr("bugreport.txt", DUMPSTATE)
+            archive.writestr("attachments/extra.zip", _inner_zip())
+        cmd = CmdAndroidCheckBugreport(results_path=str(tmp_path))
+        cmd.from_zip(zipfile.ZipFile(io.BytesIO(buffer.getvalue())))
+        module = cmd.modules[0](results_path=str(tmp_path))
+        cmd.module_init(module)
+        assert "attachments/extra.zip" in module.zip_files

tests/android_androidqf/test_mounts.py

@@ -13,6 +13,19 @@ from ..utils import get_android_androidqf, list_files
 
 
 class TestAndroidqfMountsArtifact:
+    def test_parse_proc_mountinfo(self):
+        from mvt.android.artifacts.mounts import Mounts as MountsArtifact
+
+        results = MountsArtifact.parse_mountinfo(
+            "41 40 254:13 / / ro,relatime shared:1 - erofs /dev/block/dm-13 ro,seclabel\n",
+            123,
+        )
+
+        assert results[0]["mount_id"] == 41
+        assert results[0]["mount_point"] == "/"
+        assert results[0]["filesystem_type"] == "erofs"
+        assert results[0]["process_ids"] == [123]
+
     def test_parse_mounts_token_checks(self):
         """
         Test the artifact-level `parse` method using tolerant token checks.

tests/android_androidqf/test_settings.py

@@ -19,7 +19,13 @@ class TestSettingsModule:
         parent_path = Path(data_path).absolute().parent.as_posix()
         m.from_dir(parent_path, files)
         run_module(m)
-        assert len(m.results) == 1
-        assert "random" in m.results.keys()
+        assert len(m.results) == 9
+        assert {result["namespace"] for result in m.results} == {"random"}
+        assert m.results[0] == {
+            "namespace": "random",
+            "user": None,
+            "name": "samsung_errorlog_agree",
+            "value": "0",
+        }
         assert len(m.alertstore.alerts) == 1
         assert "samsung_errorlog_agree" in m.alertstore.alerts[0].message

tests/android_bugreport/test_bugreport.py

@@ -10,6 +10,7 @@ from mvt.android.modules.bugreport.dumpsys_appops import DumpsysAppops
 from mvt.android.modules.bugreport.dumpsys_getprop import DumpsysGetProp
 from mvt.android.modules.bugreport.dumpsys_packages import DumpsysPackages
 from mvt.android.modules.bugreport.dumpsys_receivers import DumpsysReceivers
+from mvt.android.modules.bugreport.settings import Settings
 from mvt.android.modules.bugreport.tombstones import Tombstones
 from mvt.common.module import run_module
 
@@ -54,10 +55,11 @@ class TestBugreportAnalysis:
             == "com.samsung.android.provider.filterprovider"
         )
         assert m.results[1]["package_name"] == "com.instagram.android"
-        assert m.results[0]["installer"] == ""
+        assert m.results[0]["installer"] is None
         assert m.results[1]["installer"] == "com.android.vending"
         assert len(m.results[0]["permissions"]) == 4
-        assert len(m.results[1]["permissions"]) == 32
+        assert len(m.results[1]["permissions"]) == 20
+        assert len(m.results[1]["users"][0]["permissions"]) == 19
 
     def test_getprop_module(self):
         m = self.launch_bug_report_module(DumpsysGetProp)
@@ -66,29 +68,53 @@ class TestBugreportAnalysis:
     def test_receivers_match_exact_package_name(self, indicators_factory):
         intent = "android.intent.action.PHONE_STATE"
         false_positive = {
+            "resolver_type": "non_data_action",
+            "key": intent,
             "package_name": "com.android.phone",
-            "receiver": (
+            "component": (
                 "com.android.phone/"
                 "com.android.services.telephony.sip.SipIncomingCallReceiver"
             ),
+            "filter_count": 1,
         }
         malicious_receiver = {
+            "resolver_type": "non_data_action",
+            "key": intent,
             "package_name": "com.android.services",
-            "receiver": "com.android.services/com.example.SomeReceiver",
+            "component": "com.android.services/com.example.SomeReceiver",
+            "filter_count": 1,
         }
-        module = DumpsysReceivers(
-            results={intent: [false_positive, malicious_receiver]}
-        )
+        module = DumpsysReceivers(results=[false_positive, malicious_receiver])
         module.indicators = indicators_factory(app_ids=["com.android.services"])
 
         module.check_indicators()
 
         assert len(module.alertstore.alerts) == 1
         alert = module.alertstore.alerts[0]
-        assert alert.event == {intent: malicious_receiver}
+        assert alert.event == malicious_receiver
         assert alert.matched_indicator.value == "com.android.services"
 
+    def test_settings_module(self):
+        m = self.launch_bug_report_module(Settings)
+        assert len(m.results) == 12
+
+        assert len(m.alertstore.alerts) == 1
+        assert "accessibility_enabled = 1" in m.alertstore.alerts[0].message
+
+        assert len(m.timeline) == 3
+        change = [
+            entry
+            for entry in m.timeline
+            if entry["timestamp"] == "2022-03-28 22:41:07.980000"
+        ][0]
+        assert change["event"] == "settings_change"
+        assert change["data"] == (
+            'secure setting "accessibility_enabled" changed from "0" to "1" '
+            "by com.example.helper"
+        )
+
     def test_tombstones_modules(self):
         m = self.launch_bug_report_module(Tombstones)
         assert len(m.results) == 2
         assert m.results[1]["pid"] == 3559
+        assert m.results[0]["sources"]["text"]["parsed"] is True

tests/artifacts/android_data/bugreport/dumpstate.txt

@@ -264,5 +264,53 @@ ChangeId(143539591; name=SELINUX_LATEST_CHANGES; disabled)
 ChangeId(247079863; name=DISALLOW_INVALID_GROUP_REFERENCE; enableSinceTargetSdk=34)
 ChangeId(174227820; name=FORCE_DISABLE_HEVC_SUPPORT; disabled)
 ChangeId(168419799; name=DOWNSCALED; disabled; packageOverrides={com.google.android.apps.tachyon=false, org.torproject.torbrowser=false}; rawOverrides={org.torproject.torbrowser=false, org.article19.circulo.next=false}; overridable)
+-------------------------------------------------------------------------------
+DUMP OF SERVICE settings:
+CONFIG SETTINGS (user 0)
+_id:682 name:namespace_one/blocked_components pkg:com.example.services value:com.android.settings,com.android.vending,
+com.example.dialer,
+com.example.camera default:com.android.settings,
+        com.android.vending,
+        com.example.dialer defaultSystemSet:false
+_id:684 name:namespace_one/streaming_blocked_components pkg:com.example.services value:com.example.dialer,com.example.camera default:com.android.settings,
+        com.android.vending defaultSystemSet:false
+_id:680 name:namespace_one/allowed_packages pkg:com.example.services value:com.example.messaging,
+com.example.chat
 
+GLOBAL SETTINGS (user 0)
+_id:2070 name:adb_wifi_enabled pkg:android value:0 default:0 defaultSystemSet:true
+_id:778 name:hidden_api_blacklist_exemptions value:{null}
+_id:9640 name:send_action_app_error pkg:android value:1 notPreservedInRestore
+_id:9631 name:development_settings_enabled pkg:com.android.settings value:1 default:1 defaultSystemSet:true
+	History (development_settings_enabled)
+		time:11-02 11:21:22.212 mode:update oldValue:null newValue:1 package:com.android.settings
+		time:03-14 09:02:11.100 mode:update oldValue:1 newValue:0 package:com.example.updater
+_id:771 name:widget_instance_data pkg:com.android.systemui value:{
+  "version": 1,
+  "data": [
+    {
+      "number": 10000,
+      "package_name": "com.example.widget"
+    }
+  ]
+} defaultSystemSet:true
+_id:41654 name:widget_instance_data pkg:com.android.systemui value:{
+  "version": 3,
+  "data": []
+} defaultSystemSet:true
 
+SECURE SETTINGS (user 0)
+_id:907 name:lock_screen_show_notifications pkg:com.android.settings value:1 default:1 defaultSystemSet:true isValuePreservedInRestore:true
+_id:240 name:accessibility_enabled pkg:android value:1 default:0 defaultSystemSet:true
+	History (accessibility_enabled)
+		time:03-28 22:41:07.980 mode:update oldValue:0 newValue:1 package:com.example.helper
+
+SECURE SETTINGS (user 10)
+_id:311 name:accessibility_enabled pkg:android value:0 tag:null
+
+GENERATION REGISTRY
+Maximum number of backing stores:8
+Number of backing stores:1
+_Backing store for type:SETTINGS_SECURE user:10 size:1024 cachedEntries:1
+
+--------- 0.019s was the duration of dumpsys settings, ending at: 2022-03-29 23:14:28

tests/common/test_cli_plugins.py

@@ -1,11 +1,15 @@
+import shlex
 from types import SimpleNamespace
 
 import click
 from click.testing import CliRunner
 
+from mvt.cli import cli as mvt_cli
 from mvt.common.cli_plugins import (
     ANDROID_CLI_PLUGIN_GROUP,
     IOS_CLI_PLUGIN_GROUP,
+    MVT_CUSTOM_COMMANDS_ENV,
+    NEUTRAL_CLI_PLUGIN_GROUP,
     BrokenPluginCommand,
     load_cli_commands_option,
     register_cli_commands_from_path,
@@ -14,6 +18,9 @@ from mvt.common.cli_plugins import (
 )
 
 
+# Keep the banner of the mvt group callback from checking for updates online.
+OFFLINE = ["--disable-update-check", "--disable-indicator-update-check"]
+
 COMMAND_TEMPLATE = """
 import click
 
@@ -104,7 +111,7 @@ def test_load_command_option_supports_folders_and_repeated_paths(tmp_path):
 def test_loaded_command_participates_in_shell_completion(tmp_path):
     command_path = _write_command(tmp_path / "hello.py", "hello")
     group = _make_group()
-    words = f"group --load-command {command_path} he"
+    words = f"group --load-command {shlex.quote(str(command_path))} he"
 
     result = CliRunner().invoke(
         group,
@@ -345,7 +352,11 @@ def test_platform_entry_point_groups_and_environment_paths_are_separate(
     def entry_points(*, group):
         if group == IOS_CLI_PLUGIN_GROUP:
             return [_entry_point("ios-package", "ios_plugin:cli", ios_package)]
-        return [_entry_point("android-package", "android_plugin:cli", android_package)]
+        if group == ANDROID_CLI_PLUGIN_GROUP:
+            return [
+                _entry_point("android-package", "android_plugin:cli", android_package)
+            ]
+        return []
 
     monkeypatch.setattr(
         "mvt.common.cli_plugins.importlib.metadata.entry_points",
@@ -369,3 +380,187 @@ def test_platform_entry_point_groups_and_environment_paths_are_separate(
 
     assert set(ios_group.commands) == {"ios-file", "ios-package"}
     assert set(android_group.commands) == {"android-file", "android-package"}
+
+
+def test_neutral_entry_point_group_is_not_registered_on_the_platform_clis(
+    monkeypatch,
+):
+    @click.command()
+    def neutral_package():
+        pass
+
+    def entry_points(*, group):
+        if group == NEUTRAL_CLI_PLUGIN_GROUP:
+            return [
+                _entry_point("neutral-package", "neutral_plugin:cli", neutral_package)
+            ]
+        return []
+
+    monkeypatch.setattr(
+        "mvt.common.cli_plugins.importlib.metadata.entry_points",
+        entry_points,
+    )
+    ios_group = click.Group()
+    android_group = click.Group()
+
+    register_cli_plugins(
+        ios_group,
+        entry_point_group=IOS_CLI_PLUGIN_GROUP,
+        environment_variable="TEST_IOS_COMMANDS",
+    )
+    register_cli_plugins(
+        android_group,
+        entry_point_group=ANDROID_CLI_PLUGIN_GROUP,
+        environment_variable="TEST_ANDROID_COMMANDS",
+    )
+
+    assert not ios_group.commands
+    assert not android_group.commands
+
+
+def test_environment_command_wins_collision_with_installed_command(
+    tmp_path, monkeypatch, caplog
+):
+    command_path = _write_command(
+        tmp_path / "duplicate.py",
+        "duplicate",
+        message="environment command ran",
+    )
+
+    @click.command()
+    def installed_command():
+        pass
+
+    def entry_points(*, group):
+        if group == IOS_CLI_PLUGIN_GROUP:
+            return [
+                _entry_point(
+                    "duplicate",
+                    "ios_plugin:cli",
+                    installed_command,
+                    distribution="ios-plugin",
+                )
+            ]
+        return []
+
+    monkeypatch.setattr(
+        "mvt.common.cli_plugins.importlib.metadata.entry_points",
+        entry_points,
+    )
+    monkeypatch.setenv("TEST_IOS_COMMANDS", str(command_path))
+    group = click.Group()
+
+    register_cli_plugins(
+        group,
+        entry_point_group=IOS_CLI_PLUGIN_GROUP,
+        environment_variable="TEST_IOS_COMMANDS",
+    )
+
+    assert group.commands["duplicate"] is not installed_command
+    result = CliRunner().invoke(group, ["duplicate"])
+    assert result.exit_code == 0
+    assert "environment command ran" in result.output
+    assert "the command name is already registered" in caplog.text
+    assert "ios-plugin 1.0 (ios_plugin:cli)" in caplog.text
+
+
+def test_the_mvt_cli_gets_the_neutral_commands_and_no_platform_command(
+    monkeypatch, restore_cli_commands
+):
+    @click.command()
+    def shared_package():
+        click.echo("shared command ran")
+
+    @click.command()
+    def ios_package():
+        pass
+
+    def entry_points(*, group):
+        if group == NEUTRAL_CLI_PLUGIN_GROUP:
+            return [_entry_point("shared-package", "shared_plugin:cli", shared_package)]
+        if group == IOS_CLI_PLUGIN_GROUP:
+            return [_entry_point("ios-package", "ios_plugin:cli", ios_package)]
+        return []
+
+    monkeypatch.setattr(
+        "mvt.common.cli_plugins.importlib.metadata.entry_points",
+        entry_points,
+    )
+
+    register_cli_plugins(
+        mvt_cli,
+        entry_point_group=NEUTRAL_CLI_PLUGIN_GROUP,
+        environment_variable=MVT_CUSTOM_COMMANDS_ENV,
+    )
+
+    assert "ios-package" not in mvt_cli.commands
+    result = CliRunner().invoke(mvt_cli, [*OFFLINE, "shared-package"])
+    assert result.exit_code == 0
+    assert "shared command ran" in result.output
+
+
+def test_builtin_mvt_command_wins_collision_with_neutral_command(
+    monkeypatch, caplog, restore_cli_commands
+):
+    @click.command()
+    def neutral_version():
+        pass
+
+    def entry_points(*, group):
+        if group == NEUTRAL_CLI_PLUGIN_GROUP:
+            return [
+                _entry_point(
+                    "version",
+                    "neutral_plugin:cli",
+                    neutral_version,
+                    distribution="neutral-plugin",
+                )
+            ]
+        return []
+
+    monkeypatch.setattr(
+        "mvt.common.cli_plugins.importlib.metadata.entry_points",
+        entry_points,
+    )
+    builtin_version = mvt_cli.commands["version"]
+
+    register_cli_plugins(
+        mvt_cli,
+        entry_point_group=NEUTRAL_CLI_PLUGIN_GROUP,
+        environment_variable=MVT_CUSTOM_COMMANDS_ENV,
+    )
+
+    assert mvt_cli.commands["version"] is builtin_version
+    assert "the command name is already registered" in caplog.text
+    assert "neutral-plugin 1.0 (neutral_plugin:cli)" in caplog.text
+
+
+def test_broken_neutral_plugin_does_not_break_the_mvt_cli(
+    monkeypatch, restore_cli_commands
+):
+    def entry_points(*, group):
+        if group == NEUTRAL_CLI_PLUGIN_GROUP:
+            return [
+                _entry_point(
+                    "broken",
+                    "broken_plugin:cli",
+                    exception=RuntimeError("missing dependency"),
+                    distribution="broken-plugin",
+                )
+            ]
+        return []
+
+    monkeypatch.setattr(
+        "mvt.common.cli_plugins.importlib.metadata.entry_points",
+        entry_points,
+    )
+
+    register_cli_plugins(
+        mvt_cli,
+        entry_point_group=NEUTRAL_CLI_PLUGIN_GROUP,
+        environment_variable=MVT_CUSTOM_COMMANDS_ENV,
+    )
+
+    assert isinstance(mvt_cli.commands["broken"], BrokenPluginCommand)
+    result = CliRunner().invoke(mvt_cli, [*OFFLINE, "version"])
+    assert result.exit_code == 0

tests/common/test_cmd_check_iocs.py

@@ -0,0 +1,225 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import json
+import logging
+
+import pytest
+from click.testing import CliRunner
+
+from mvt.android.cli import cli as android_cli
+from mvt.android.command_modules import ANDROID_CHECK_IOCS_MODULES
+from mvt.common.cmd_check_iocs import CmdCheckIOCS
+from mvt.common.module import MVTModule
+from mvt.ios.cli import cli as ios_cli
+from mvt.ios.command_modules import IOS_CHECK_IOCS_MODULES
+from mvt.ios.modules.backup.manifest import Manifest
+
+# Keep the banner of the group callback from checking for updates online.
+OFFLINE = ["--disable-update-check", "--disable-indicator-update-check"]
+
+
+class CustomResultsModule(MVTModule):
+    """A custom module which declares the check-iocs pair of both platforms."""
+
+    slug = "custom_results"
+    supported_commands = (
+        ("ios", "check-backup"),
+        ("ios", "check-iocs"),
+        ("android", "check-iocs"),
+    )
+
+    checked: list = []
+
+    def run(self) -> None:
+        pass
+
+    def check_indicators(self) -> None:
+        self.checked.append(list(self.results))
+
+
+class BackupCheckerModule(MVTModule):
+    """An iOS module which implements check_indicators() without declaring check-iocs."""
+
+    slug = "backup_checker"
+    supported_commands = (("ios", "check-backup"),)
+
+    checked: list = []
+
+    def run(self) -> None:
+        pass
+
+    def check_indicators(self) -> None:
+        self.checked.append(list(self.results))
+
+
+class BugReportCheckerModule(MVTModule):
+    """The same for Android."""
+
+    slug = "bugreport_checker"
+    supported_commands = (("android", "check-bugreport"),)
+
+    checked: list = []
+
+    def run(self) -> None:
+        pass
+
+    def check_indicators(self) -> None:
+        self.checked.append(list(self.results))
+
+
+class BackupOnlyModule(MVTModule):
+    """A custom module which does not implement check_indicators()."""
+
+    slug = "backup_only"
+    supported_commands = (("ios", "check-backup"),)
+
+    def run(self) -> None:
+        pass
+
+
+@pytest.mark.parametrize(
+    "platform, builtin_modules, checker_module",
+    [
+        ("ios", IOS_CHECK_IOCS_MODULES, BackupCheckerModule),
+        ("android", ANDROID_CHECK_IOCS_MODULES, BugReportCheckerModule),
+    ],
+)
+def test_check_iocs_rechecks_the_stored_results_of_custom_modules(
+    platform, builtin_modules, checker_module, tmp_path, caplog
+):
+    # check-iocs matches every <slug>.json in the results folder to the module
+    # with that slug, custom modules included, and runs its check_indicators()
+    # again over the stored results.
+    results = [{"domain": "example.org"}]
+    (tmp_path / "custom_results.json").write_text(json.dumps(results))
+    (tmp_path / f"{checker_module.slug}.json").write_text(json.dumps(results))
+    (tmp_path / "backup_only.json").write_text(json.dumps(results))
+    CustomResultsModule.checked.clear()
+    checker_module.checked.clear()
+
+    cmd = CmdCheckIOCS(
+        target_path=str(tmp_path),
+        custom_modules=[CustomResultsModule, checker_module, BackupOnlyModule],
+        platform=platform,
+    )
+    cmd.modules = builtin_modules
+
+    with caplog.at_level(logging.INFO):
+        cmd.run()
+
+    # A module which declares the check-iocs pair is re-checked.
+    assert CustomResultsModule.checked == [results]
+    assert (
+        'Loading results from "custom_results.json" with module CustomResultsModule'
+        in caplog.text
+    )
+    # So is a module which only implements check_indicators().
+    assert checker_module.checked == [results]
+    # A module which does neither is not part of check-iocs.
+    assert "backup_only.json" not in caplog.text
+
+
+@pytest.mark.parametrize(
+    "platform, builtin_modules, listed, not_listed",
+    [
+        (
+            "ios",
+            IOS_CHECK_IOCS_MODULES,
+            "BackupCheckerModule",
+            "BugReportCheckerModule",
+        ),
+        (
+            "android",
+            ANDROID_CHECK_IOCS_MODULES,
+            "BugReportCheckerModule",
+            "BackupCheckerModule",
+        ),
+    ],
+)
+def test_check_iocs_lists_the_custom_modules_it_runs(
+    platform, builtin_modules, listed, not_listed, caplog
+):
+    cmd = CmdCheckIOCS(
+        custom_modules=[
+            CustomResultsModule,
+            BackupCheckerModule,
+            BugReportCheckerModule,
+            BackupOnlyModule,
+        ],
+        platform=platform,
+    )
+    cmd.modules = builtin_modules
+
+    with caplog.at_level(logging.INFO):
+        cmd.list_modules()
+
+    assert "CustomResultsModule" in caplog.text
+    # The module which implements check_indicators() for this platform is listed.
+    assert listed in caplog.text
+    # The one for the other platform is not, and neither is BackupOnlyModule.
+    assert not_listed not in caplog.text
+    assert "BackupOnlyModule" not in caplog.text
+
+
+class ReplacementManifest(Manifest):
+    """A replacement for a built-in module which does not declare check-iocs."""
+
+    supported_commands = (("ios", "check-backup"),)
+    replaces = Manifest
+
+
+def test_check_iocs_uses_a_replacement_of_a_built_in_module():
+    # A replacement which subclasses a built-in module inherits its
+    # check_indicators(). check-iocs then runs it in place of that module.
+    cmd = CmdCheckIOCS(custom_modules=[ReplacementManifest], platform="ios")
+    cmd.modules = IOS_CHECK_IOCS_MODULES
+
+    available = cmd._available_modules()
+
+    assert ReplacementManifest in available
+    assert Manifest not in available
+
+
+LOADED_MODULE = '''
+from mvt.common.module import MVTModule
+
+
+class LoadedResultsModule(MVTModule):
+    """A module loaded from a file with --load-module."""
+
+    slug = "loaded_results"
+    supported_commands = (("ios", "check-iocs"), ("android", "check-iocs"))
+
+    def run(self) -> None:
+        pass
+
+    def check_indicators(self) -> None:
+        self.log.warning("loaded module checked %d results", len(self.results))
+'''
+
+
+@pytest.mark.parametrize("cli", [ios_cli, android_cli], ids=["mvt-ios", "mvt-android"])
+def test_check_iocs_loads_custom_modules_from_a_file_on_each_cli(cli, tmp_path, caplog):
+    module_path = tmp_path / "loaded_module.py"
+    module_path.write_text(LOADED_MODULE)
+    results_folder = tmp_path / "results"
+    results_folder.mkdir()
+    (results_folder / "loaded_results.json").write_text(json.dumps([{"a": 1}]))
+
+    with caplog.at_level(logging.INFO):
+        result = CliRunner().invoke(
+            cli,
+            [
+                *OFFLINE,
+                "check-iocs",
+                "--load-module",
+                str(module_path),
+                str(results_folder),
+            ],
+        )
+
+    assert result.exit_code == 0, result.output
+    assert "loaded module checked 1 results" in caplog.text

tests/common/test_cmd_plugins.py

@@ -0,0 +1,240 @@
+import json
+import re
+from types import SimpleNamespace
+
+import pytest
+from click.testing import CliRunner
+
+from mvt.android.cli import cli as android_cli
+from mvt.cli import cli as mvt_cli
+from mvt.common.cli_plugins import (
+    ANDROID_CLI_PLUGIN_GROUP,
+    IOS_CLI_PLUGIN_GROUP,
+    NEUTRAL_CLI_PLUGIN_GROUP,
+)
+from mvt.common.cmd_plugins import plugins
+from mvt.common.module import MVTModule
+from mvt.common.module_loader import MODULES_ENTRY_POINT_GROUP
+from mvt.common.updates import PluginUpdates
+from mvt.ios.cli import cli as ios_cli
+
+
+class ExampleModule(MVTModule):
+    pass
+
+
+class AnotherModule(MVTModule):
+    pass
+
+
+class FakeDistribution:
+    def __init__(self, name, version="1.0.0", direct_url=None):
+        self.name = name
+        self.version = version
+        self.direct_url = direct_url
+
+    def read_text(self, file_name):
+        if file_name == "direct_url.json" and self.direct_url is not None:
+            return json.dumps(self.direct_url)
+        return None
+
+
+def _entry_point(name, distribution, modules=None, exception=None):
+    def load():
+        if exception is not None:
+            raise exception
+        return modules
+
+    return SimpleNamespace(
+        name=name, value="example_plugin:modules", dist=distribution, load=load
+    )
+
+
+def _run(command, arguments):
+    # Keep rich from wrapping the table while its content is being asserted.
+    return CliRunner().invoke(command, arguments, env={"COLUMNS": "200"})
+
+
+def _table_lines(output):
+    """Return the cells of each line of the table, header first."""
+    return [
+        [cell.strip() for cell in re.split("[│┃]", line.strip().strip("│┃"))]
+        for line in output.splitlines()
+        if "│" in line or "┃" in line
+    ]
+
+
+def _table_rows(output):
+    """Return the content of the table rows, without the header and the box."""
+    return _table_lines(output)[1:]
+
+
+def _table_header(output):
+    lines = _table_lines(output)
+    return lines[0] if lines else []
+
+
+def _install(monkeypatch, distributions, entry_points):
+    monkeypatch.setattr(
+        "mvt.common.cmd_plugins.installed_plugin_distributions",
+        lambda: distributions,
+    )
+    monkeypatch.setattr(
+        "mvt.common.cmd_plugins.importlib.metadata.entry_points",
+        lambda *, group: entry_points.get(group, []),
+    )
+
+
+def test_plugins_is_a_builtin_command_of_the_mvt_cli_only():
+    assert mvt_cli.commands["plugins"] is plugins
+    assert "plugins" not in ios_cli.commands
+    assert "plugins" not in android_cli.commands
+
+
+def test_list_shows_what_every_plugin_contributes(monkeypatch):
+    index_plugin = FakeDistribution("example-plugin", version="1.2.0")
+    repository_plugin = FakeDistribution(
+        "repository-plugin",
+        version="0.1.0",
+        direct_url={
+            "url": "https://example.org/plugin.git",
+            "vcs_info": {"vcs": "git", "commit_id": "b" * 40},
+        },
+    )
+    local_plugin = FakeDistribution(
+        "local-plugin",
+        direct_url={"url": "file:///plugins", "dir_info": {"editable": True}},
+    )
+    _install(
+        monkeypatch,
+        [index_plugin, local_plugin, repository_plugin],
+        {
+            MODULES_ENTRY_POINT_GROUP: [
+                _entry_point(
+                    "example", index_plugin, modules=[ExampleModule, AnotherModule]
+                ),
+                _entry_point("local", local_plugin, modules=lambda: [ExampleModule]),
+            ],
+            IOS_CLI_PLUGIN_GROUP: [_entry_point("summarize", repository_plugin)],
+            ANDROID_CLI_PLUGIN_GROUP: [_entry_point("triage", local_plugin)],
+            NEUTRAL_CLI_PLUGIN_GROUP: [_entry_point("report", repository_plugin)],
+        },
+    )
+
+    result = _run(plugins, ["list"])
+
+    assert result.exit_code == 0
+    # Plugins are listed by name, with the modules and the commands each of
+    # them contributes.
+    assert _table_header(result.output) == [
+        "Name",
+        "Version",
+        "Origin",
+        "Modules",
+        "Commands",
+    ]
+    assert _table_rows(result.output) == [
+        ["example-plugin", "1.2.0", "pypi", "2", "-"],
+        ["local-plugin", "1.0.0", "local", "1", "triage"],
+        ["repository-plugin", "0.1.0", "git+bbbbbbbb", "0", "report, summarize"],
+    ]
+
+
+def test_list_reports_a_broken_module_entry_point(monkeypatch):
+    plugin = FakeDistribution("broken-plugin")
+    _install(
+        monkeypatch,
+        [plugin],
+        {
+            MODULES_ENTRY_POINT_GROUP: [
+                _entry_point(
+                    "broken", plugin, exception=ImportError("missing dependency")
+                )
+            ]
+        },
+    )
+
+    result = _run(plugins, ["list"])
+
+    assert result.exit_code == 0
+    assert _table_rows(result.output) == [
+        ["broken-plugin", "1.0.0", "pypi", "error", "-"]
+    ]
+
+
+def test_list_without_plugins(monkeypatch):
+    _install(monkeypatch, [], {})
+
+    result = _run(plugins, ["list"])
+
+    assert result.exit_code == 0
+    assert result.output == "No MVT plugins are installed.\n"
+
+
+def test_check_updates_prints_the_findings_and_ignores_the_throttle(monkeypatch):
+    findings = [
+        {
+            "name": "example-plugin",
+            "installed": "1.0.0",
+            "latest": "1.2.0",
+            "origin": "pypi",
+            "upgrade_command": "pip install -U example-plugin",
+        }
+    ]
+    _install(monkeypatch, [FakeDistribution("example-plugin")], {})
+    monkeypatch.setattr(PluginUpdates, "check", lambda self: findings)
+    monkeypatch.setattr(
+        PluginUpdates,
+        "should_check",
+        lambda self: pytest.fail("an explicit check must not be throttled"),
+    )
+
+    result = _run(plugins, ["check-updates"])
+
+    assert result.exit_code == 0
+    assert "Plugin updates available:" in result.output
+    assert "example-plugin  1.0.0 → 1.2.0" in result.output
+    assert "Upgrade with: pip install -U example-plugin" in result.output
+    assert "MVT does not install plugin updates." in result.output
+
+
+def test_check_updates_without_available_updates(monkeypatch):
+    _install(monkeypatch, [FakeDistribution("example-plugin")], {})
+    monkeypatch.setattr(PluginUpdates, "check", lambda self: [])
+
+    result = _run(plugins, ["check-updates"])
+
+    assert result.exit_code == 0
+    assert "All plugins are up to date." in result.output
+
+
+def test_check_updates_without_plugins(monkeypatch):
+    _install(monkeypatch, [], {})
+    monkeypatch.setattr(
+        PluginUpdates,
+        "check",
+        lambda self: pytest.fail("nothing must be checked without plugins"),
+    )
+
+    result = _run(plugins, ["check-updates"])
+
+    assert result.exit_code == 0
+    assert "No MVT plugins are installed." in result.output
+
+
+def test_check_updates_without_network_access(monkeypatch):
+    monkeypatch.setattr("mvt.common.cmd_plugins.settings.NETWORK_ACCESS_ALLOWED", False)
+    monkeypatch.setattr(
+        "mvt.common.cmd_plugins.installed_plugin_distributions",
+        lambda: pytest.fail("plugins must not be listed without network access"),
+    )
+    monkeypatch.setattr(
+        PluginUpdates,
+        "check",
+        lambda self: pytest.fail("nothing must be checked without network access"),
+    )
+
+    result = _run(plugins, ["check-updates"])
+
+    assert result.exit_code == 0
+    assert "Network access is disabled" in result.output

tests/common/test_command.py

@@ -5,8 +5,13 @@
 
 import json
 import logging
+from unittest.mock import patch
+
+import pytest
+from click.testing import CliRunner
 
 from mvt.common.command import Command
+from mvt.common.indicators import Indicators
 from mvt.common.module import MVTModule
 
 
@@ -68,6 +73,123 @@ class CustomDependsOnBuiltin(RecordingModule):
     dependencies = (FirstModule,)
 
 
+class ReplacementModule(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+
+    def run(self):
+        super().run()
+        self.results = ["replacement"]
+
+
+class OtherReplacementModule(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+
+
+class UnrelatedReplacementModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = IndependentModule
+
+
+class ReplacementOfReplacementModule(ReplacementModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = ReplacementModule
+
+    def run(self):
+        super().run()
+        self.results = ["replacement of replacement"]
+
+
+class ReplacesOwnDependencyModule(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+    dependencies = (FirstModule,)
+
+
+class DisabledReplacementModule(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+    enabled = False
+
+
+class MutualReplacementOne(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+
+
+class MutualReplacementTwo(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = MutualReplacementOne
+
+
+MutualReplacementOne.replaces = MutualReplacementTwo
+
+
+class CycleOneModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+
+
+class CycleTwoModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = CycleOneModule
+
+
+class CycleThreeModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = CycleTwoModule
+
+
+CycleOneModule.replaces = CycleThreeModule
+
+
+class UnavailableDependencyModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+
+
+class ReplacementMissingDependency(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+    dependencies = (UnavailableDependencyModule,)
+
+
+class SharedSlugModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+    slug = "shared_slug"
+
+
+class OtherSharedSlugModule(RecordingModule):
+    supported_commands = (("ios", "check-backup"),)
+    slug = "shared_slug"
+
+
+class ReplacementKeepingTheSlug(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+    slug = "first_module"
+
+
+class SameNameReplacementModule(FirstModule):
+    supported_commands = (("ios", "check-backup"),)
+    replaces = FirstModule
+
+    def run(self):
+        super().run()
+        self.results = ["replacement"]
+
+
+# Modules replacing a built-in one usually keep its class name, which is the
+# name `--module` matches on.
+SameNameReplacementModule.__name__ = "FirstModule"
+
+
+def logged_substitutions(caplog) -> list[str]:
+    return [
+        record.getMessage()
+        for record in caplog.records
+        if record.levelno == logging.INFO and "replaces module" in record.getMessage()
+    ]
+
+
 class RecordingCommand(Command):
     def init(self):
         self.initialized = True
@@ -80,6 +202,86 @@ class RecordingCommand(Command):
 
 
 class TestCommand:
+    def test_listing_modules_does_not_load_indicators(self):
+        with patch("mvt.common.command.Indicators.load_indicators_files") as load:
+            cmd = RecordingCommand()
+            cmd.list_modules()
+            load.assert_not_called()
+
+    def test_output_folder_is_created_by_a_run_not_by_listing(self, tmp_path):
+        output_path = tmp_path / "out"
+        with patch("mvt.common.command.Indicators.load_indicators_files"):
+            cmd = RecordingCommand(results_path=str(output_path))
+            cmd.list_modules()
+            assert not output_path.exists()
+            cmd.run()
+        assert (output_path / "command.log").is_file()
+
+    def test_indicators_load_once_and_are_shared(self, indicator_file, monkeypatch):
+        from mvt.common.config import settings
+
+        monkeypatch.setattr(settings, "STIX2", "")
+        monkeypatch.setattr(Indicators, "_load_downloaded_indicators", lambda self: None)
+        original = Indicators.load_indicators_files
+        with patch.object(
+            Indicators, "load_indicators_files", autospec=True, side_effect=original
+        ) as load:
+            cmd = RecordingCommand(ioc_files=[indicator_file])
+            load.assert_not_called()
+            indicators = cmd.iocs
+            assert indicators.total_ioc_count == 9
+            assert len(indicators.ioc_collections) == 1
+            assert cmd.iocs is indicators
+            child = RecordingCommand(iocs=indicators)
+            assert child.iocs is indicators
+            load.assert_called_once_with(indicators, [indicator_file])
+
+    @pytest.mark.parametrize("assign", [False, True])
+    def test_supplied_empty_indicators_are_not_loaded(self, assign):
+        indicators = Indicators(logging.getLogger(__name__))
+        with patch.object(Indicators, "load_indicators_files") as load:
+            cmd = RecordingCommand(iocs=None if assign else indicators)
+            if assign:
+                cmd.iocs = indicators
+            assert cmd.iocs is indicators
+            assert cmd.iocs.total_ioc_count == 0
+            load.assert_not_called()
+
+    @pytest.mark.parametrize("list_modules", [False, True])
+    def test_backup_cli_does_not_load_indicators_before_analysis(
+        self, tmp_path, list_modules
+    ):
+        from mvt.ios.cli import check_backup
+
+        args = [str(tmp_path)]
+        if list_modules:
+            args.insert(0, "--list-modules")
+        with patch.object(Indicators, "load_indicators_files") as load:
+            result = CliRunner().invoke(check_backup, args)
+            assert result.exit_code == (0 if list_modules else 1)
+            load.assert_not_called()
+
+    def test_run_checks_synthetic_indicators(self, indicator_file, monkeypatch):
+        from mvt.common.config import settings
+
+        monkeypatch.setattr(settings, "STIX2", "")
+        monkeypatch.setattr(Indicators, "_load_downloaded_indicators", lambda self: None)
+
+        class MatchingModule(RecordingModule):
+            def run(self):
+                self.results = ["https://example.org/test"]
+
+            def check_indicators(self):
+                self.detected = [
+                    url for url in self.results if self.indicators.check_domain(url)
+                ]
+
+        cmd = RecordingCommand(ioc_files=[indicator_file])
+        cmd.modules = [MatchingModule]
+        cmd.run()
+        assert cmd.executed[0].detected == ["https://example.org/test"]
+        assert cmd.executed[0].indicators is cmd.iocs
+
     def setup_method(self):
         RecordingModule.run_order = []
 
@@ -157,7 +359,7 @@ class TestCommand:
         assert not hasattr(cmd, "initialized")
         assert "Circular module dependency detected" in caplog.text
 
-    def test_unavailable_dependency_warns_and_stops(self, caplog):
+    def test_unavailable_dependency_only_skips_the_dependent_module(self, caplog):
         class UnavailableModule(RecordingModule):
             pass
 
@@ -165,14 +367,97 @@ class TestCommand:
             dependencies = (UnavailableModule,)
 
         cmd = RecordingCommand()
-        cmd.modules = [DependentModule]
+        cmd.modules = [DependentModule, IndependentModule, FirstModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["IndependentModule", "FirstModule"]
+        assert cmd.initialized
+        assert "Module DependentModule will be SKIPPED" in caplog.text
+        assert "depends on module UnavailableModule" in caplog.text
+
+    def test_modules_depending_on_a_skipped_module_are_skipped_too(self, caplog):
+        class UnavailableModule(RecordingModule):
+            pass
+
+        class SkippedModule(RecordingModule):
+            dependencies = (UnavailableModule,)
+
+        class DependsOnSkippedModule(RecordingModule):
+            dependencies = (SkippedModule,)
+
+        class DependsOnTheChain(RecordingModule):
+            dependencies = (DependsOnSkippedModule,)
+
+        cmd = RecordingCommand()
+        cmd.modules = [
+            DependsOnTheChain,
+            DependsOnSkippedModule,
+            SkippedModule,
+            IndependentModule,
+        ]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["IndependentModule"]
+        skip_warnings = [
+            record.getMessage()
+            for record in caplog.records
+            if "will be SKIPPED" in record.getMessage()
+        ]
+        assert len(skip_warnings) == 3
+        assert [warning.split()[1] for warning in skip_warnings] == [
+            "SkippedModule",
+            "DependsOnSkippedModule",
+            "DependsOnTheChain",
+        ]
+        # Every warning names the root cause: the module missing a dependency
+        # and the dependency it is missing.
+        assert all("UnavailableModule" in warning for warning in skip_warnings)
+        assert all("module SkippedModule" in warning for warning in skip_warnings[1:])
+
+    def test_explicitly_selected_module_with_missing_dependency_runs_nothing(
+        self, caplog
+    ):
+        class UnavailableModule(RecordingModule):
+            pass
+
+        class DependentModule(RecordingModule):
+            dependencies = (UnavailableModule,)
+
+        cmd = RecordingCommand(module_name="DependentModule")
+        cmd.modules = [DependentModule, IndependentModule]
 
         with caplog.at_level(logging.WARNING):
             cmd.run()
 
         assert RecordingModule.run_order == []
-        assert not hasattr(cmd, "initialized")
-        assert "depends on unavailable module UnavailableModule" in caplog.text
+        assert "Module DependentModule will be SKIPPED" in caplog.text
+        assert "No modules will be run" in caplog.text
+        # Nothing else was selected, so the warning must not promise that the
+        # analysis continues right before saying that it does not.
+        assert "The rest of the analysis will still run" not in caplog.text
+
+    def test_unaffected_dependency_chains_keep_their_order(self, caplog):
+        class UnavailableModule(RecordingModule):
+            pass
+
+        class SkippedModule(RecordingModule):
+            dependencies = (UnavailableModule,)
+
+        cmd = RecordingCommand()
+        cmd.modules = [ThirdModule, SkippedModule, SecondModule, FirstModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == [
+            "FirstModule",
+            "SecondModule",
+            "ThirdModule",
+        ]
 
     def test_custom_modules_are_filtered_before_ordering(self):
         cmd = RecordingCommand()
@@ -220,3 +505,376 @@ class TestCommand:
         cmd.run()
 
         assert RecordingModule.run_order == ["FirstModule", "CustomDependsOnBuiltin"]
+
+    def test_custom_module_replaces_builtin(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule, IndependentModule]
+        cmd.custom_modules = [ReplacementModule]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["IndependentModule", "ReplacementModule"]
+        assert cmd.module_replacements == {FirstModule: ReplacementModule}
+        assert (
+            "Module ReplacementModule from" in caplog.text
+            and "replaces module FirstModule" in caplog.text
+        )
+
+    def test_modules_without_replaces_all_run(self):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [CustomIOSBackupModule]
+
+        cmd.run()
+
+        assert RecordingModule.run_order == ["FirstModule", "CustomIOSBackupModule"]
+        assert cmd.module_replacements == {}
+
+    def test_unavailable_replaced_module_is_ignored(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [IndependentModule]
+        cmd.custom_modules = [ReplacementModule]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["IndependentModule", "ReplacementModule"]
+        assert cmd.module_replacements == {}
+        assert "replaces module FirstModule" not in caplog.text
+
+    def test_dependencies_are_resolved_to_the_replacement(self):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [SecondModule, FirstModule]
+        cmd.custom_modules = [ReplacementModule]
+
+        cmd.run()
+
+        assert RecordingModule.run_order == ["ReplacementModule", "SecondModule"]
+        second = next(
+            module for module in cmd.executed if isinstance(module, SecondModule)
+        )
+        assert isinstance(second.dependency_modules[FirstModule], ReplacementModule)
+        assert second.results == ["replacement", "second"]
+
+    def test_replacement_with_unavailable_dependency_skips_its_dependents(
+        self, caplog
+    ):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule, SecondModule, IndependentModule]
+        cmd.custom_modules = [ReplacementMissingDependency]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        # The replacement cannot run, and the module it replaced was dropped
+        # from the run by the replacement, so neither of them produces
+        # results and the module depending on the replaced one is skipped.
+        assert RecordingModule.run_order == ["IndependentModule"]
+        assert (
+            "Module ReplacementMissingDependency will be SKIPPED: it depends "
+            "on module UnavailableDependencyModule, which is not available in "
+            "this command." in caplog.text
+        )
+        # The skipped dependent is told which module it actually depends on,
+        # and the module class its author declared.
+        assert (
+            "Module SecondModule will be SKIPPED: it depends on module "
+            "ReplacementMissingDependency (replacing module FirstModule), "
+            "itself skipped for depending on unavailable module "
+            "UnavailableDependencyModule." in caplog.text
+        )
+
+    def test_selected_replacement_with_unavailable_dependency_runs_nothing(
+        self, caplog, tmp_path
+    ):
+        cmd = RecordingCommand(module_name="FirstModule", results_path=str(tmp_path))
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule, IndependentModule]
+        cmd.custom_modules = [ReplacementMissingDependency]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == []
+        assert not hasattr(cmd, "initialized")
+        assert (
+            "Module FirstModule was replaced by module "
+            "ReplacementMissingDependency, which is run in its place."
+            in caplog.text
+        )
+        assert "Module ReplacementMissingDependency will be SKIPPED" in caplog.text
+        assert "No modules will be run" in caplog.text
+        # Nothing else was selected, so the warnings must not promise that the
+        # analysis continues right before saying that it does not.
+        assert "The rest of the analysis will still run" not in caplog.text
+        # No module ran, so no results were stored next to the command log.
+        assert [path.name for path in tmp_path.iterdir()] == ["command.log"]
+
+    def test_chained_replacements_are_resolved(self):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [SecondModule, FirstModule]
+        cmd.custom_modules = [ReplacementModule, ReplacementOfReplacementModule]
+
+        cmd.run()
+
+        assert RecordingModule.run_order == [
+            "ReplacementOfReplacementModule",
+            "SecondModule",
+        ]
+        second = next(
+            module for module in cmd.executed if isinstance(module, SecondModule)
+        )
+        assert second.results == ["replacement of replacement", "second"]
+
+    def test_replacement_which_is_not_a_subclass_warns(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [IndependentModule]
+        cmd.custom_modules = [UnrelatedReplacementModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["UnrelatedReplacementModule"]
+        assert "is not a subclass of it" in caplog.text
+
+    def test_multiple_modules_replacing_the_same_module_warn(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [ReplacementModule, OtherReplacementModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == [
+            "ReplacementModule",
+            "OtherReplacementModule",
+        ]
+        assert cmd.module_replacements == {FirstModule: ReplacementModule}
+        assert (
+            "Modules ReplacementModule and OtherReplacementModule both replace "
+            "module FirstModule. Both of them will run, FirstModule will not, "
+            "and modules depending on FirstModule will use the results of "
+            "ReplacementModule." in caplog.text
+        )
+        assert "overwrite each other's results file" in caplog.text
+
+    def test_module_replacing_its_own_dependency_runs(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [ReplacesOwnDependencyModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["ReplacesOwnDependencyModule"]
+        assert (
+            "Module ReplacesOwnDependencyModule depends on module FirstModule, "
+            "which it also replaces" in caplog.text
+        )
+
+    def test_literal_self_dependency_is_still_circular(self, caplog):
+        class SelfDependentModule(RecordingModule):
+            pass
+
+        SelfDependentModule.dependencies = (SelfDependentModule,)
+
+        cmd = RecordingCommand()
+        cmd.modules = [SelfDependentModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == []
+        assert not hasattr(cmd, "initialized")
+        assert "Circular module dependency detected" in caplog.text
+
+    def test_disabled_replacement_keeps_the_replaced_module(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [DisabledReplacementModule]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["FirstModule"]
+        assert cmd.module_replacements == {}
+        assert logged_substitutions(caplog) == []
+
+    def test_modules_replacing_each_other_all_run(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.custom_modules = [MutualReplacementOne, MutualReplacementTwo]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == [
+            "MutualReplacementOne",
+            "MutualReplacementTwo",
+        ]
+        assert cmd.module_replacements == {}
+        assert (
+            "Modules MutualReplacementOne, MutualReplacementTwo replace each "
+            "other in a cycle" in caplog.text
+        )
+        assert logged_substitutions(caplog) == []
+
+    def test_replacement_cycle_of_three_modules_all_run(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.custom_modules = [CycleOneModule, CycleTwoModule, CycleThreeModule]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == [
+            "CycleOneModule",
+            "CycleTwoModule",
+            "CycleThreeModule",
+        ]
+        assert cmd.module_replacements == {}
+        assert (
+            "Modules CycleOneModule, CycleThreeModule, CycleTwoModule replace "
+            "each other in a cycle" in caplog.text
+        )
+        assert logged_substitutions(caplog) == []
+
+    def test_selected_replaced_module_name_runs_the_replacement(self, caplog):
+        cmd = RecordingCommand(module_name="FirstModule")
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [ReplacementModule]
+
+        with caplog.at_level(logging.INFO):
+            cmd.run()
+
+        assert RecordingModule.run_order == ["ReplacementModule"]
+        assert (
+            "Module FirstModule was replaced by module ReplacementModule"
+            in caplog.text
+        )
+
+    def test_unknown_selected_module_warns_and_stops(self, caplog):
+        cmd = RecordingCommand(module_name="NoSuchModule")
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == []
+        assert not hasattr(cmd, "initialized")
+        assert (
+            "No module named NoSuchModule is available for the check-backup "
+            "command" in caplog.text
+        )
+
+    def test_selected_module_name_matches_the_replacement(self):
+        cmd = RecordingCommand(module_name="FirstModule")
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [SameNameReplacementModule]
+
+        cmd.run()
+
+        assert len(cmd.executed) == 1
+        assert isinstance(cmd.executed[0], SameNameReplacementModule)
+        assert cmd.executed[0].results == ["replacement"]
+
+    def test_list_modules_reflects_replacements(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule, IndependentModule]
+        cmd.custom_modules = [ReplacementModule]
+
+        with caplog.at_level(logging.INFO):
+            cmd.list_modules()
+
+        listed = [
+            record.getMessage()
+            for record in caplog.records
+            if "Modules from" in record.getMessage()
+        ]
+        assert any("ReplacementModule" in message for message in listed)
+        assert not any("FirstModule" in message for message in listed)
+
+    def test_modules_sharing_a_slug_are_reported(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.custom_modules = [SharedSlugModule, OtherSharedSlugModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert RecordingModule.run_order == [
+            "SharedSlugModule",
+            "OtherSharedSlugModule",
+        ]
+        collisions = [
+            record.getMessage()
+            for record in caplog.records
+            if "both use the slug" in record.getMessage()
+        ]
+        assert len(collisions) == 1
+        assert "Modules SharedSlugModule from" in collisions[0]
+        assert "and OtherSharedSlugModule from" in collisions[0]
+        assert "both use the slug shared_slug" in collisions[0]
+        assert "overwrites the results of the other in shared_slug.json" in (
+            collisions[0]
+        )
+
+    def test_replacement_keeping_the_replaced_slug_is_not_reported(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule]
+        cmd.custom_modules = [ReplacementKeepingTheSlug]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        # The replaced module is no longer part of the run, so taking over its
+        # slug is what the replacement is for, not a collision.
+        assert RecordingModule.run_order == ["ReplacementKeepingTheSlug"]
+        assert ReplacementKeepingTheSlug.get_slug() == FirstModule.get_slug()
+        assert "both use the slug" not in caplog.text
+
+    def test_modules_with_distinct_slugs_are_not_reported(self, caplog):
+        cmd = RecordingCommand()
+        cmd.platform = "ios"
+        cmd.name = "check-backup"
+        cmd.modules = [FirstModule, IndependentModule]
+        cmd.custom_modules = [CustomIOSBackupModule]
+
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert "both use the slug" not in caplog.text

tests/common/test_command_modules.py

@@ -0,0 +1,30 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from mvt.android.command_modules import ANDROID_CHECK_IOCS_MODULES
+from mvt.android.modules.androidqf import ANDROIDQF_MODULES
+from mvt.android.modules.backup import BACKUP_MODULES as ANDROID_BACKUP_MODULES
+from mvt.android.modules.bugreport import BUGREPORT_MODULES
+from mvt.android.modules.intrusion_logs import INTRUSION_LOGS_MODULES
+from mvt.ios.command_modules import IOS_CHECK_IOCS_MODULES
+from mvt.ios.modules.backup import BACKUP_MODULES as IOS_BACKUP_MODULES
+from mvt.ios.modules.fs import FS_MODULES
+from mvt.ios.modules.mixed import MIXED_MODULES
+from mvt.ios.modules.sysdiagnose import SYSDIAGNOSE_MODULES
+
+
+def test_the_check_iocs_lists_are_the_families_of_their_platform():
+    # The CLI reads these same lists, so nothing composing one elsewhere can
+    # drift from what the command runs. This pins what the lists are composed
+    # of.
+    assert IOS_CHECK_IOCS_MODULES == (
+        IOS_BACKUP_MODULES + FS_MODULES + MIXED_MODULES + SYSDIAGNOSE_MODULES
+    )
+    assert ANDROID_CHECK_IOCS_MODULES == (
+        ANDROID_BACKUP_MODULES
+        + BUGREPORT_MODULES
+        + ANDROIDQF_MODULES
+        + INTRUSION_LOGS_MODULES
+    )

tests/common/test_config.py

@@ -0,0 +1,30 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import os
+
+import yaml
+
+from mvt.common import config
+from mvt.common.config import MVTSettings
+
+
+def test_env_variables_are_not_persisted_to_config_file(tmp_path, monkeypatch):
+    config_path = tmp_path / "config.yaml"
+    monkeypatch.setattr(config, "MVT_CONFIG_FOLDER", str(tmp_path))
+    monkeypatch.setattr(config, "MVT_CONFIG_PATH", str(config_path))
+    monkeypatch.setenv("MVT_NETWORK_ACCESS_ALLOWED", "false")
+    monkeypatch.setenv("MVT_IOS_BACKUP_PASSWORD", "env-only-password")
+
+    settings = MVTSettings.initialise()
+
+    assert os.path.isfile(config_path)
+    saved = yaml.safe_load(config_path.read_text()) or {}
+    assert "NETWORK_ACCESS_ALLOWED" not in saved
+    assert "IOS_BACKUP_PASSWORD" not in saved
+
+    # The environment must still apply to the settings in use.
+    assert settings.NETWORK_ACCESS_ALLOWED is False
+    assert settings.IOS_BACKUP_PASSWORD == "env-only-password"

tests/common/test_indicators.py

@@ -311,3 +311,31 @@ class TestIndicators:
         ind = Indicators(log=logging)
         ind.load_indicators_files([], load_default=False)
         assert ind.total_ioc_count == 9
+
+    def test_check_url_matches_w_prefixed_subdomain(self, tmp_path):
+        import json
+
+        stix_file = tmp_path / "w-domain.stix2"
+        stix_file.write_text(
+            json.dumps(
+                {
+                    "objects": [
+                        {
+                            "type": "indicator",
+                            "pattern": "[domain-name:value = 'web.evil.com']",
+                        }
+                    ]
+                }
+            ),
+            encoding="utf-8",
+        )
+        ind = Indicators(log=logging)
+        ind.load_indicators_files([str(stix_file)], load_default=False)
+
+        for url in (
+            "https://web.evil.com/path",
+            "https://www.web.evil.com/path",
+        ):
+            match = ind.check_url(url)
+            assert match is not None
+            assert match.ioc.value == "web.evil.com"

tests/common/test_module_loader.py

@@ -1,9 +1,14 @@
+from pathlib import Path
+
 import pytest
 
+from mvt.common.cli_plugins import _module_name_for_path as _command_module_name
 from mvt.common.module import MVTModule
 from mvt.common.module_loader import (
     CustomModuleLoadError,
+    _module_name_for_path,
     get_module_logger,
+    get_plugin_logger,
     load_custom_modules,
     load_custom_modules_from_path,
     module_supports_command,
@@ -168,9 +173,9 @@ def test_get_module_logger_strips_the_plugin_package_prefix():
     class PluginModule(MVTModule):
         pass
 
-    PluginModule.__module__ = "mvt_plugin_amnesty_custom.ios.custom"
+    PluginModule.__module__ = "mvt_plugin_example_org.ios.custom"
 
-    assert get_module_logger(PluginModule).name == "mvt.ext.amnesty_custom.ios.custom"
+    assert get_module_logger(PluginModule).name == "mvt.ext.example_org.ios.custom"
 
 
 def test_get_module_logger_only_strips_the_prefix_from_the_top_level():
@@ -187,3 +192,25 @@ def test_get_module_logger_names_path_modules_after_their_file(tmp_path):
     module = load_custom_modules_from_path(str(module_path))[0]
 
     assert get_module_logger(module).name == "mvt.ext.my_custom_module"
+
+
+def test_get_plugin_logger_uses_the_same_namespace_as_modules():
+    assert (
+        get_plugin_logger("mvt_plugin_example_org.commands.summarize").name
+        == "mvt.ext.example_org.commands.summarize"
+    )
+    assert get_plugin_logger("example_plugin.cli").name == "mvt.ext.example_plugin.cli"
+
+
+def test_get_plugin_logger_keeps_builtin_names():
+    assert get_plugin_logger("mvt.ios.cli").name == "mvt.ios.cli"
+
+
+def test_get_plugin_logger_names_loaded_files_after_the_file():
+    # A file loaded with --load-command or --load-module is imported under a
+    # mangled name. The log names the file instead.
+    command_name = _command_module_name(Path("/tmp/case_summary.py"))
+    module_name = _module_name_for_path(Path("/tmp/my_custom_module.py"))
+
+    assert get_plugin_logger(command_name).name == "mvt.ext.case_summary"
+    assert get_plugin_logger(module_name).name == "mvt.ext.my_custom_module"

tests/common/test_plugin.py

@@ -0,0 +1,34 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import mvt.plugin
+from mvt.android.modules.backup.base import BackupModule
+from mvt.common.config import settings
+
+from ..plugin_fixtures import run_isolated_python
+
+
+def test_the_exported_names_are_the_public_names():
+    public = {name for name in vars(mvt.plugin) if not name.startswith("_")}
+
+    assert public == set(mvt.plugin.__all__)
+    assert mvt.plugin.settings is settings
+    assert mvt.plugin.AndroidBackupModule is BackupModule
+
+
+def test_the_surface_imports_before_anything_else_of_mvt(tmp_path):
+    # A plugin can import the surface as its first import of MVT. The
+    # subprocess gets a temporary home because importing MVT writes its
+    # configuration file.
+    result = run_isolated_python(
+        "from mvt.plugin import IOSExtraction, MVT_VERSION, settings\n"
+        "assert MVT_VERSION\n"
+        "assert settings.NETWORK_TIMEOUT > 0\n"
+        "assert IOSExtraction.__name__ == 'IOSExtraction'\n",
+        home=tmp_path,
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert result.stderr == ""

tests/common/test_plugin_config.py

@@ -0,0 +1,391 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import os
+import stat
+import sys
+from typing import Optional
+
+import pytest
+import yaml
+
+from mvt.common.plugin_config import (
+    MVTPluginSettings,
+    PluginConfigLoadError,
+    plugin_config_folder,
+    plugin_config_path,
+    plugin_data_folder,
+    plugin_env_prefix,
+)
+
+
+class ExamplePluginSettings(MVTPluginSettings):
+    plugin_name = "example-plugin"
+
+    API_KEY: Optional[str] = None
+    CACHE_FOLDER: str = "cache"
+    MAX_RESULTS: int = 25
+
+
+class OtherPluginSettings(MVTPluginSettings):
+    plugin_name = "other-plugin"
+
+    API_KEY: Optional[str] = None
+
+
+@pytest.fixture
+def config_folder(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        "mvt.common.plugin_config.user_config_dir",
+        lambda *args, **kwargs: str(tmp_path),
+    )
+    return tmp_path
+
+
+@pytest.fixture
+def data_folder(tmp_path, monkeypatch):
+    folder = tmp_path / "data"
+    monkeypatch.setattr(
+        "mvt.common.plugin_config.user_data_dir",
+        lambda *args, **kwargs: str(folder),
+    )
+    return folder
+
+
+def _write_plugin_file(plugin_name, values):
+    config_path = plugin_config_path(plugin_name)
+    os.makedirs(os.path.dirname(config_path), exist_ok=True)
+    content = values if isinstance(values, str) else yaml.dump(values)
+    with open(config_path, "w") as config_file:
+        config_file.write(content)
+    return config_path
+
+
+def test_plugin_paths_and_prefixes_are_namespaced(config_folder):
+    assert plugin_config_folder() == str(config_folder / "plugins")
+    assert plugin_config_path("example-plugin") == str(
+        config_folder / "plugins" / "example-plugin.yaml"
+    )
+    assert plugin_env_prefix("example-plugin") == "MVT_PLUGIN_EXAMPLE_PLUGIN_"
+    assert plugin_env_prefix("other-plugin") == "MVT_PLUGIN_OTHER_PLUGIN_"
+
+
+def test_defaults_are_used_without_file_or_environment(config_folder):
+    settings = ExamplePluginSettings.load()
+
+    assert settings.API_KEY is None
+    assert settings.CACHE_FOLDER == "cache"
+    assert settings.MAX_RESULTS == 25
+    assert not os.path.exists(plugin_config_path("example-plugin"))
+
+
+def test_values_are_loaded_from_the_plugin_file(config_folder):
+    _write_plugin_file("example-plugin", {"API_KEY": "from-file", "MAX_RESULTS": 5})
+
+    settings = ExamplePluginSettings.load()
+
+    assert settings.API_KEY == "from-file"
+    assert settings.MAX_RESULTS == 5
+    assert settings.CACHE_FOLDER == "cache"
+
+
+def test_environment_overrides_the_plugin_file(config_folder, monkeypatch):
+    _write_plugin_file("example-plugin", {"API_KEY": "from-file", "MAX_RESULTS": 5})
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY", "from-environment")
+
+    settings = ExamplePluginSettings.load()
+
+    assert settings.API_KEY == "from-environment"
+    assert settings.MAX_RESULTS == 5
+
+
+def test_arguments_override_the_environment_and_the_plugin_file(
+    config_folder, monkeypatch
+):
+    _write_plugin_file("example-plugin", {"API_KEY": "from-file", "MAX_RESULTS": 5})
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY", "from-environment")
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_MAX_RESULTS", "10")
+
+    settings = ExamplePluginSettings(API_KEY="from-argument")
+
+    assert settings.API_KEY == "from-argument"
+    assert settings.MAX_RESULTS == 10
+
+
+def test_save_and_load_round_trip(config_folder):
+    settings = ExamplePluginSettings.load()
+    settings.API_KEY = "saved-key"
+    settings.MAX_RESULTS = 100
+
+    settings.save()
+
+    config_path = plugin_config_path("example-plugin")
+    assert os.path.isfile(config_path)
+    with open(config_path) as config_file:
+        assert yaml.safe_load(config_file) == {
+            "API_KEY": "saved-key",
+            "MAX_RESULTS": 100,
+        }
+
+    reloaded = ExamplePluginSettings.load()
+    assert reloaded.API_KEY == "saved-key"
+    assert reloaded.MAX_RESULTS == 100
+    assert reloaded.CACHE_FOLDER == "cache"
+
+
+@pytest.mark.skipif(
+    sys.platform == "win32", reason="POSIX file permissions are not available"
+)
+def test_saved_file_is_only_readable_by_the_user(config_folder):
+    settings = ExamplePluginSettings.load()
+    settings.API_KEY = "saved-key"
+
+    settings.save()
+
+    config_path = plugin_config_path("example-plugin")
+    assert stat.S_IMODE(os.stat(config_path).st_mode) == 0o600
+    folder_mode = stat.S_IMODE(os.stat(plugin_config_folder()).st_mode)
+    assert folder_mode & 0o077 == 0
+
+
+@pytest.mark.skipif(
+    sys.platform == "win32", reason="POSIX file permissions are not available"
+)
+def test_save_restricts_the_permissions_of_an_existing_file(config_folder):
+    config_path = _write_plugin_file("example-plugin", {"API_KEY": "from-file"})
+    os.chmod(config_path, 0o644)
+
+    settings = ExamplePluginSettings.load()
+    settings.MAX_RESULTS = 100
+    settings.save()
+
+    assert stat.S_IMODE(os.stat(config_path).st_mode) == 0o600
+    assert os.listdir(plugin_config_folder()) == ["example-plugin.yaml"]
+
+
+def test_save_only_persists_non_default_values(config_folder):
+    settings = ExamplePluginSettings.load()
+    settings.CACHE_FOLDER = "another-cache"
+
+    settings.save()
+
+    with open(plugin_config_path("example-plugin")) as config_file:
+        assert yaml.safe_load(config_file) == {"CACHE_FOLDER": "another-cache"}
+
+
+def test_save_does_not_persist_values_coming_from_the_environment(
+    config_folder, monkeypatch
+):
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY", "environment-secret")
+
+    settings = ExamplePluginSettings.load()
+    assert settings.API_KEY == "environment-secret"
+    settings.MAX_RESULTS = 100
+    settings.save()
+
+    with open(plugin_config_path("example-plugin")) as config_file:
+        assert yaml.safe_load(config_file) == {"MAX_RESULTS": 100}
+
+
+def test_an_invalid_environment_variable_still_protects_the_other_values(
+    config_folder, monkeypatch
+):
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY", "environment-secret")
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_MAX_RESULTS", "not-an-int")
+
+    settings = ExamplePluginSettings(MAX_RESULTS=100)
+    assert settings.API_KEY == "environment-secret"
+    settings.save()
+
+    with open(plugin_config_path("example-plugin")) as config_file:
+        saved_values = yaml.safe_load(config_file)
+    assert saved_values == {"MAX_RESULTS": 100}
+    assert "API_KEY" not in saved_values
+
+
+def test_save_persists_values_which_differ_from_the_environment(
+    config_folder, monkeypatch
+):
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY", "environment-secret")
+
+    settings = ExamplePluginSettings.load()
+    settings.API_KEY = "chosen-key"
+    settings.save()
+
+    with open(plugin_config_path("example-plugin")) as config_file:
+        assert yaml.safe_load(config_file) == {"API_KEY": "chosen-key"}
+
+
+def test_save_does_not_write_the_mvt_configuration_file(config_folder):
+    settings = ExamplePluginSettings.load()
+    settings.API_KEY = "saved-key"
+
+    settings.save()
+
+    assert os.listdir(config_folder) == ["plugins"]
+
+
+def test_unknown_keys_in_the_plugin_file_are_ignored(config_folder):
+    _write_plugin_file(
+        "example-plugin",
+        {"API_KEY": "from-file", "UNKNOWN_SETTING": "ignored"},
+    )
+
+    settings = ExamplePluginSettings.load()
+
+    assert settings.API_KEY == "from-file"
+    assert not hasattr(settings, "UNKNOWN_SETTING")
+
+
+def test_unparsable_plugin_file_is_reported_with_its_path(config_folder):
+    config_path = _write_plugin_file("example-plugin", "API_KEY: [unclosed\n")
+
+    with pytest.raises(PluginConfigLoadError) as raised:
+        ExamplePluginSettings.load()
+
+    assert config_path in str(raised.value)
+
+
+def test_plugin_file_which_is_not_a_mapping_is_reported_with_its_path(config_folder):
+    config_path = _write_plugin_file("example-plugin", "- one\n- two\n")
+
+    with pytest.raises(PluginConfigLoadError) as raised:
+        ExamplePluginSettings.load()
+
+    assert config_path in str(raised.value)
+    assert "mapping of setting names" in str(raised.value)
+
+
+def test_plugins_do_not_interfere_with_each_other(config_folder, monkeypatch):
+    _write_plugin_file("other-plugin", {"API_KEY": "other-file-key"})
+    monkeypatch.setenv("MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY", "example-environment-key")
+
+    example_settings = ExamplePluginSettings.load()
+    other_settings = OtherPluginSettings.load()
+
+    assert example_settings.API_KEY == "example-environment-key"
+    assert other_settings.API_KEY == "other-file-key"
+
+    example_settings.MAX_RESULTS = 100
+    example_settings.save()
+    assert sorted(os.listdir(plugin_config_folder())) == [
+        "example-plugin.yaml",
+        "other-plugin.yaml",
+    ]
+    with open(plugin_config_path("other-plugin")) as config_file:
+        assert yaml.safe_load(config_file) == {"API_KEY": "other-file-key"}
+
+
+def test_subclass_without_plugin_name_is_rejected():
+    with pytest.raises(TypeError, match="plugin_name"):
+
+        class MissingNameSettings(MVTPluginSettings):
+            API_KEY: Optional[str] = None
+
+
+def test_subclass_with_invalid_plugin_name_is_rejected():
+    with pytest.raises(ValueError, match="Invalid plugin name"):
+
+        class InvalidNameSettings(MVTPluginSettings):
+            plugin_name = "Bad/Name"
+
+
+def test_underscores_are_not_allowed_in_plugin_names():
+    # Underscores are replaced by dashes in the environment prefix, so allowing
+    # both would let two plugin names share one environment namespace.
+    with pytest.raises(ValueError, match="Invalid plugin name"):
+
+        class UnderscoreNameSettings(MVTPluginSettings):
+            plugin_name = "under_score"
+
+    with pytest.raises(ValueError, match="Invalid plugin name"):
+        plugin_config_path("under_score")
+    with pytest.raises(ValueError, match="Invalid plugin name"):
+        plugin_env_prefix("under_score")
+
+
+@pytest.mark.parametrize(
+    "plugin_name", ["../escape", "folder/name", "UPPER", "-dash", ""]
+)
+def test_unsafe_plugin_names_have_no_configuration_path(plugin_name):
+    with pytest.raises(ValueError, match="Invalid plugin name"):
+        plugin_config_path(plugin_name)
+
+
+def test_data_folder_is_namespaced_and_created(data_folder):
+    folder = plugin_data_folder("example-plugin")
+
+    assert folder == str(data_folder / "plugin-data" / "example-plugin")
+    assert os.path.isdir(folder)
+
+
+def test_data_folder_can_be_requested_repeatedly(data_folder):
+    folder = plugin_data_folder("example-plugin")
+    with open(os.path.join(folder, "kept.json"), "w") as data_file:
+        data_file.write("{}")
+
+    assert plugin_data_folder("example-plugin") == folder
+    assert os.listdir(folder) == ["kept.json"]
+
+
+@pytest.mark.skipif(
+    sys.platform == "win32", reason="POSIX file permissions are not available"
+)
+def test_data_folder_is_only_accessible_by_the_user(data_folder):
+    folder = plugin_data_folder("example-plugin")
+
+    assert stat.S_IMODE(os.stat(folder).st_mode) & 0o077 == 0
+    parent_mode = stat.S_IMODE(os.stat(os.path.dirname(folder)).st_mode)
+    assert parent_mode & 0o077 == 0
+
+
+def test_plugins_get_their_own_data_folder(data_folder):
+    example_folder = plugin_data_folder("example-plugin")
+    other_folder = plugin_data_folder("other-plugin")
+
+    assert example_folder != other_folder
+    assert sorted(os.listdir(data_folder / "plugin-data")) == [
+        "example-plugin",
+        "other-plugin",
+    ]
+
+
+def test_data_folder_does_not_touch_the_configuration_folder(
+    config_folder, data_folder
+):
+    plugin_data_folder("example-plugin")
+
+    assert not os.path.exists(plugin_config_folder())
+
+
+@pytest.mark.parametrize(
+    "plugin_name", ["../escape", "folder/name", "UPPER", "-dash", ""]
+)
+def test_unsafe_plugin_names_have_no_data_folder(data_folder, plugin_name):
+    with pytest.raises(ValueError, match="Invalid plugin name"):
+        plugin_data_folder(plugin_name)
+
+    assert not os.path.exists(data_folder)
+
+
+def test_settings_class_knows_its_data_folder(data_folder):
+    folder = ExamplePluginSettings.data_folder()
+
+    assert folder == plugin_data_folder("example-plugin")
+    assert os.path.isdir(folder)
+    assert OtherPluginSettings.data_folder() != folder
+
+
+def test_settings_instance_uses_the_same_data_folder(config_folder, data_folder):
+    settings = ExamplePluginSettings.load()
+
+    assert settings.data_folder() == ExamplePluginSettings.data_folder()
+
+
+def test_subclass_without_its_own_name_shares_the_data_folder(data_folder):
+    class InheritingSettings(ExamplePluginSettings):
+        pass
+
+    assert InheritingSettings.data_folder() == ExamplePluginSettings.data_folder()

tests/common/test_plugin_updates.py

@@ -0,0 +1,711 @@
+import json
+import shlex
+from datetime import datetime, timedelta
+from types import SimpleNamespace
+
+import pytest
+
+from mvt.common import logo
+from mvt.common.cli_plugins import (
+    ANDROID_CLI_PLUGIN_GROUP,
+    IOS_CLI_PLUGIN_GROUP,
+    NEUTRAL_CLI_PLUGIN_GROUP,
+)
+from mvt.common.module_loader import MODULES_ENTRY_POINT_GROUP
+from mvt.common.updates import (
+    MVTUpdates,
+    PluginUpdates,
+    installed_plugin_distributions,
+)
+
+
+REPOSITORY_URL = "https://example.org/plugin.git"
+INSTALLED_COMMIT = "a" * 40
+REMOTE_COMMIT = "b" * 40
+
+
+class FakeDistribution:
+    def __init__(self, name, version="1.0.0", direct_url=None):
+        self.name = name
+        self.version = version
+        self.direct_url = direct_url
+
+    def read_text(self, file_name):
+        if file_name == "direct_url.json" and self.direct_url is not None:
+            return json.dumps(self.direct_url)
+        return None
+
+
+class FakeResponse:
+    def __init__(self, status_code=200, payload=None):
+        self.status_code = status_code
+        self.payload = payload or {}
+
+    def json(self):
+        return self.payload
+
+
+def _entry_point(name, distribution, value="plugin:modules"):
+    return SimpleNamespace(name=name, value=value, dist=distribution)
+
+
+def _git_distribution(requested_revision=None, commit=INSTALLED_COMMIT):
+    vcs_info = {"vcs": "git", "commit_id": commit}
+    if requested_revision:
+        vcs_info["requested_revision"] = requested_revision
+
+    return FakeDistribution(
+        "example-plugin",
+        direct_url={"url": REPOSITORY_URL, "vcs_info": vcs_info},
+    )
+
+
+def _fake_git(stdout="", returncode=0, exception=None, calls=None):
+    def run(command, **kwargs):
+        if calls is not None:
+            calls.append((command, kwargs))
+        if exception is not None:
+            raise exception
+        return SimpleNamespace(returncode=returncode, stdout=stdout, stderr="")
+
+    return run
+
+
+@pytest.fixture
+def data_folder(tmp_path, monkeypatch):
+    folder = tmp_path / "mvt-data"
+    monkeypatch.setattr("mvt.common.updates.MVT_DATA_FOLDER", str(folder))
+    return folder
+
+
+@pytest.fixture
+def one_plugin(monkeypatch):
+    def install(distribution):
+        monkeypatch.setattr(
+            "mvt.common.updates.installed_plugin_distributions",
+            lambda: [distribution],
+        )
+        return distribution
+
+    return install
+
+
+def test_installed_plugin_distributions_covers_every_plugin_group(monkeypatch):
+    zeta = FakeDistribution("zeta-plugin")
+    alpha = FakeDistribution("alpha-plugin")
+    neutral = FakeDistribution("neutral-plugin")
+
+    def entry_points(*, group):
+        if group == MODULES_ENTRY_POINT_GROUP:
+            return [_entry_point("zeta", zeta), _entry_point("alpha", alpha)]
+        if group == IOS_CLI_PLUGIN_GROUP:
+            return [_entry_point("zeta-ios", zeta)]
+        if group == ANDROID_CLI_PLUGIN_GROUP:
+            return [_entry_point("alpha-android", alpha)]
+        if group == NEUTRAL_CLI_PLUGIN_GROUP:
+            return [_entry_point("shared", neutral)]
+        return []
+
+    monkeypatch.setattr(
+        "mvt.common.updates.importlib.metadata.entry_points", entry_points
+    )
+
+    distributions = installed_plugin_distributions()
+
+    assert [distribution.name for distribution in distributions] == [
+        "alpha-plugin",
+        "neutral-plugin",
+        "zeta-plugin",
+    ]
+
+
+def test_installed_plugin_distributions_skips_mvt_and_orphan_entry_points(monkeypatch):
+    entry_points = [
+        _entry_point("builtin", FakeDistribution("mvt")),
+        SimpleNamespace(name="orphan", value="plugin:modules", dist=None),
+        _entry_point("plugin", FakeDistribution("example-plugin")),
+    ]
+    monkeypatch.setattr(
+        "mvt.common.updates.importlib.metadata.entry_points",
+        lambda **kwargs: entry_points,
+    )
+
+    distributions = installed_plugin_distributions()
+
+    assert [distribution.name for distribution in distributions] == ["example-plugin"]
+
+
+def test_installed_plugin_distributions_survives_broken_metadata(monkeypatch, caplog):
+    def entry_points(*, group):
+        raise RuntimeError("invalid package metadata")
+
+    monkeypatch.setattr(
+        "mvt.common.updates.importlib.metadata.entry_points", entry_points
+    )
+
+    assert installed_plugin_distributions() == []
+    assert "Unable to discover installed plugin packages" in caplog.text
+
+
+def test_index_plugin_update_is_reported(monkeypatch, data_folder, one_plugin):
+    one_plugin(FakeDistribution("example-plugin", version="1.0.0"))
+    monkeypatch.setattr(
+        "mvt.common.updates.requests.get",
+        lambda url, **kwargs: FakeResponse(payload={"info": {"version": "1.2.0"}}),
+    )
+
+    findings = PluginUpdates().check()
+
+    assert findings == [
+        {
+            "name": "example-plugin",
+            "installed": "1.0.0",
+            "latest": "1.2.0",
+            "origin": "pypi",
+            "upgrade_command": "pip install -U example-plugin",
+        }
+    ]
+
+
+def test_index_plugin_queries_the_package_index_with_the_configured_timeout(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(FakeDistribution("example-plugin"))
+    requests_made = []
+
+    def get(url, **kwargs):
+        requests_made.append((url, kwargs))
+        return FakeResponse(payload={"info": {"version": "1.0.0"}})
+
+    monkeypatch.setattr("mvt.common.updates.requests.get", get)
+    monkeypatch.setattr("mvt.common.updates.settings.NETWORK_TIMEOUT", 3)
+
+    PluginUpdates().check()
+
+    assert requests_made == [
+        ("https://pypi.org/pypi/example-plugin/json", {"timeout": 3})
+    ]
+
+
+def test_up_to_date_index_plugin_is_not_reported(monkeypatch, data_folder, one_plugin):
+    one_plugin(FakeDistribution("example-plugin", version="1.2.0"))
+    monkeypatch.setattr(
+        "mvt.common.updates.requests.get",
+        lambda url, **kwargs: FakeResponse(payload={"info": {"version": "1.2.0"}}),
+    )
+
+    assert PluginUpdates().check() == []
+
+
+def test_unpublished_plugin_is_skipped_silently(monkeypatch, data_folder, one_plugin):
+    one_plugin(FakeDistribution("private-plugin"))
+    monkeypatch.setattr(
+        "mvt.common.updates.requests.get",
+        lambda url, **kwargs: FakeResponse(status_code=404),
+    )
+
+    assert PluginUpdates().check() == []
+
+
+def test_repository_plugin_following_a_branch_is_reported(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision="main"))
+    calls = []
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout=f"{REMOTE_COMMIT}\trefs/heads/main\n", calls=calls),
+    )
+    monkeypatch.delenv("GIT_SSH_COMMAND", raising=False)
+
+    findings = PluginUpdates().check()
+
+    assert findings == [
+        {
+            "name": "example-plugin",
+            "installed": "aaaaaaaa",
+            "latest": "bbbbbbbb",
+            "origin": "git",
+            "upgrade_command": (
+                f"pip install -U 'example-plugin @ git+{REPOSITORY_URL}@main'"
+            ),
+        }
+    ]
+    command, options = calls[0]
+    assert command == ["git", "ls-remote", REPOSITORY_URL, "main"]
+    assert options["env"]["GIT_TERMINAL_PROMPT"] == "0"
+    # ssh asks the terminal for a passphrase or a host key unless it is told
+    # not to, which git itself cannot prevent.
+    assert options["env"]["GIT_SSH_COMMAND"] == (
+        "ssh -o BatchMode=yes -o ConnectTimeout=10"
+    )
+
+
+def test_batch_mode_options_come_before_the_configured_ssh_options(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision="main"))
+    calls = []
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout=f"{REMOTE_COMMIT}\trefs/heads/main\n", calls=calls),
+    )
+    monkeypatch.setenv("GIT_SSH_COMMAND", "ssh -o BatchMode=no -i /home/analyst/key")
+
+    PluginUpdates().check()
+
+    # ssh uses the first value it is given for a keyword, so an analyst asking
+    # for prompts cannot bring them back, while their other options still
+    # apply.
+    assert calls[0][1]["env"]["GIT_SSH_COMMAND"] == (
+        "ssh -o BatchMode=yes -o ConnectTimeout=10 -o BatchMode=no -i /home/analyst/key"
+    )
+
+
+def test_repository_plugin_without_a_revision_follows_the_default_branch(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution())
+    calls = []
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout=f"{REMOTE_COMMIT}\tHEAD\n", calls=calls),
+    )
+
+    findings = PluginUpdates().check()
+
+    assert calls[0][0] == ["git", "ls-remote", REPOSITORY_URL, "HEAD"]
+    assert findings[0]["upgrade_command"] == (
+        f"pip install -U 'example-plugin @ git+{REPOSITORY_URL}'"
+    )
+
+
+def test_hostile_revision_cannot_inject_into_the_upgrade_command(
+    monkeypatch, data_folder, one_plugin
+):
+    revision = "main$(id)`id`;id"
+    one_plugin(_git_distribution(requested_revision=revision))
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout=f"{REMOTE_COMMIT}\trefs/heads/{revision}\n"),
+    )
+
+    upgrade_command = PluginUpdates().check()[0]["upgrade_command"]
+
+    # Single quotes are the only quoting a shell does not expand anything in.
+    assert upgrade_command == (
+        f"pip install -U 'example-plugin @ git+{REPOSITORY_URL}@{revision}'"
+    )
+    assert shlex.split(upgrade_command) == [
+        "pip",
+        "install",
+        "-U",
+        f"example-plugin @ git+{REPOSITORY_URL}@{revision}",
+    ]
+
+
+def test_repository_plugin_with_an_option_like_url_is_skipped(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(
+        FakeDistribution(
+            "example-plugin",
+            direct_url={
+                "url": "--upload-pack=touch /tmp/mvt",
+                "vcs_info": {"vcs": "git", "commit_id": INSTALLED_COMMIT},
+            },
+        )
+    )
+    calls = []
+    monkeypatch.setattr("mvt.common.updates.subprocess.run", _fake_git(calls=calls))
+
+    assert PluginUpdates().check() == []
+    assert calls == []
+
+
+def test_repository_plugin_with_an_option_like_revision_is_skipped(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision="--upload-pack=touch /tmp/mvt"))
+    calls = []
+    monkeypatch.setattr("mvt.common.updates.subprocess.run", _fake_git(calls=calls))
+
+    assert PluginUpdates().check() == []
+    assert calls == []
+
+
+def test_repository_plugin_at_the_latest_commit_is_not_reported(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision="main"))
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout=f"{INSTALLED_COMMIT}\trefs/heads/main\n"),
+    )
+
+    assert PluginUpdates().check() == []
+
+
+def test_commit_pinned_repository_plugin_is_never_outdated(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision=INSTALLED_COMMIT))
+    calls = []
+    monkeypatch.setattr("mvt.common.updates.subprocess.run", _fake_git(calls=calls))
+
+    assert PluginUpdates().check() == []
+    assert calls == []
+
+
+def test_short_commit_pinned_repository_plugin_is_never_outdated(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision=INSTALLED_COMMIT[:10]))
+    calls = []
+    monkeypatch.setattr("mvt.common.updates.subprocess.run", _fake_git(calls=calls))
+
+    assert PluginUpdates().check() == []
+    assert calls == []
+
+
+def test_tag_pinned_repository_plugin_is_never_outdated(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision="v1.0.0"))
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout=f"{REMOTE_COMMIT}\trefs/tags/v1.0.0\n"),
+    )
+
+    assert PluginUpdates().check() == []
+
+
+def test_repository_plugin_is_skipped_without_git(monkeypatch, data_folder, one_plugin):
+    one_plugin(_git_distribution(requested_revision="main"))
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(exception=FileNotFoundError("git")),
+    )
+
+    assert PluginUpdates().check() == []
+
+
+def test_repository_plugin_is_skipped_when_git_fails(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(_git_distribution(requested_revision="main"))
+    monkeypatch.setattr(
+        "mvt.common.updates.subprocess.run",
+        _fake_git(stdout="", returncode=128),
+    )
+
+    assert PluginUpdates().check() == []
+
+
+def test_local_plugin_install_is_skipped(monkeypatch, data_folder, one_plugin):
+    one_plugin(
+        FakeDistribution(
+            "example-plugin",
+            direct_url={
+                "url": "file:///home/analyst/example-plugin",
+                "dir_info": {"editable": True},
+            },
+        )
+    )
+
+    def fail(*args, **kwargs):
+        raise AssertionError("a local plugin install must not be checked")
+
+    monkeypatch.setattr("mvt.common.updates.requests.get", fail)
+    monkeypatch.setattr("mvt.common.updates.subprocess.run", fail)
+
+    assert PluginUpdates().check() == []
+
+
+def test_check_stores_the_findings_and_the_check_timestamp(
+    monkeypatch, data_folder, one_plugin
+):
+    one_plugin(FakeDistribution("example-plugin", version="1.0.0"))
+    monkeypatch.setattr(
+        "mvt.common.updates.requests.get",
+        lambda url, **kwargs: FakeResponse(payload={"info": {"version": "1.2.0"}}),
+    )
+    plugin_updates = PluginUpdates()
+
+    findings = plugin_updates.check()
+
+    assert json.loads((data_folder / "plugin_updates.json").read_text()) == findings
+    assert (data_folder / "latest_plugins_check").read_text().isdigit()
+    assert PluginUpdates().get_findings() == findings
+
+
+def test_findings_are_empty_before_the_first_check(data_folder):
+    assert PluginUpdates().get_findings() == []
+
+
+def test_malformed_cached_findings_are_dropped(data_folder):
+    plugin_updates = PluginUpdates()
+    usable = {
+        "name": "example-plugin",
+        "installed": "1.0.0",
+        "latest": "1.2.0",
+        "origin": "pypi",
+        "upgrade_command": "pip install -U example-plugin",
+    }
+    data_folder.mkdir(parents=True, exist_ok=True)
+    (data_folder / "plugin_updates.json").write_text(
+        json.dumps(
+            [
+                {"oops": 1},
+                "not a finding",
+                {"name": "half-plugin", "installed": "1.0.0"},
+                {**usable, "latest": None},
+                usable,
+            ]
+        ),
+        encoding="utf-8",
+    )
+
+    assert plugin_updates.get_findings() == [usable]
+
+
+def test_corrupt_cached_findings_are_ignored(data_folder):
+    data_folder.mkdir(parents=True, exist_ok=True)
+    (data_folder / "plugin_updates.json").write_text("{ not json", encoding="utf-8")
+
+    assert PluginUpdates().get_findings() == []
+
+
+def test_cached_findings_of_upgraded_and_removed_plugins_are_dropped(
+    monkeypatch, data_folder
+):
+    findings = [
+        {
+            "name": "upgraded-plugin",
+            "installed": "1.0.0",
+            "latest": "1.2.0",
+            "origin": "pypi",
+            "upgrade_command": "pip install -U upgraded-plugin",
+        },
+        {
+            "name": "removed-plugin",
+            "installed": "1.0.0",
+            "latest": "1.2.0",
+            "origin": "pypi",
+            "upgrade_command": "pip install -U removed-plugin",
+        },
+        {
+            "name": "example-plugin",
+            "installed": "1.0.0",
+            "latest": "1.2.0",
+            "origin": "pypi",
+            "upgrade_command": "pip install -U example-plugin",
+        },
+    ]
+    plugin_updates = PluginUpdates()
+    plugin_updates.set_findings(findings)
+    monkeypatch.setattr(
+        "mvt.common.updates.installed_plugin_distributions",
+        lambda: [
+            # The analyst upgraded this plugin since the latest check.
+            FakeDistribution("upgraded-plugin", version="1.2.0"),
+            FakeDistribution("example-plugin", version="1.0.0"),
+        ],
+    )
+
+    assert plugin_updates.current_findings() == [findings[2]]
+
+
+def test_cached_findings_of_updated_repository_plugins_are_dropped(data_folder):
+    findings = [
+        {
+            "name": "example-plugin",
+            "installed": "aaaaaaaa",
+            "latest": "bbbbbbbb",
+            "origin": "git",
+            "upgrade_command": "pip install -U example-plugin",
+        }
+    ]
+    plugin_updates = PluginUpdates()
+    plugin_updates.set_findings(findings)
+
+    assert plugin_updates.current_findings([_git_distribution()]) == findings
+    assert (
+        plugin_updates.current_findings([_git_distribution(commit=REMOTE_COMMIT)]) == []
+    )
+
+
+def test_corrupt_check_timestamp_does_not_raise(data_folder):
+    plugin_updates = PluginUpdates()
+    data_folder.mkdir(parents=True, exist_ok=True)
+    (data_folder / "latest_plugins_check").write_text("truncated", encoding="utf-8")
+
+    assert plugin_updates.get_latest_check() == 0
+    assert plugin_updates.should_check() == (True, 0)
+
+
+def test_should_check_is_throttled_for_twelve_hours(data_folder):
+    plugin_updates = PluginUpdates()
+    plugin_updates.set_findings([])
+
+    recent = datetime.now() - timedelta(hours=4)
+    with open(plugin_updates.latest_check_path, "w", encoding="utf-8") as handle:
+        handle.write(str(int(recent.timestamp())))
+
+    should_check, hours = plugin_updates.should_check()
+    assert not should_check
+    assert hours == 8
+
+    old = datetime.now() - timedelta(hours=13)
+    with open(plugin_updates.latest_check_path, "w", encoding="utf-8") as handle:
+        handle.write(str(int(old.timestamp())))
+
+    assert plugin_updates.should_check() == (True, 0)
+
+
+def test_should_check_without_a_previous_check(data_folder):
+    assert PluginUpdates().should_check() == (True, 0)
+
+
+@pytest.fixture
+def no_version_check(monkeypatch):
+    monkeypatch.setattr(MVTUpdates, "check", lambda self: "")
+    # Keep rich from wrapping the plugin lines while they are being asserted.
+    monkeypatch.setenv("COLUMNS", "200")
+
+
+@pytest.fixture
+def throttled_cache(monkeypatch, data_folder):
+    """Fill the findings cache and put the check inside its throttle window."""
+
+    def fill(findings, distributions):
+        PluginUpdates().set_findings(findings)
+        monkeypatch.setattr(
+            logo, "installed_plugin_distributions", lambda: distributions
+        )
+        monkeypatch.setattr(PluginUpdates, "should_check", lambda self: (False, 8))
+        monkeypatch.setattr(
+            PluginUpdates,
+            "check",
+            lambda self: pytest.fail("the check must be throttled"),
+        )
+
+    return fill
+
+
+def test_logo_prints_the_cached_plugin_updates(
+    capsys, no_version_check, throttled_cache
+):
+    throttled_cache(
+        [
+            {
+                "name": "example-plugin",
+                "installed": "1.0.0",
+                "latest": "1.2.0",
+                "origin": "pypi",
+                "upgrade_command": "pip install -U example-plugin",
+            }
+        ],
+        [FakeDistribution("example-plugin", version="1.0.0")],
+    )
+
+    logo.check_updates(disable_indicator_check=True)
+
+    output = capsys.readouterr().out
+    assert "Plugin updates available:" in output
+    assert "example-plugin  1.0.0 → 1.2.0   (pip install -U example-plugin)" in output
+
+
+def test_logo_does_not_print_a_cached_update_of_an_upgraded_plugin(
+    capsys, no_version_check, throttled_cache
+):
+    throttled_cache(
+        [
+            {
+                "name": "example-plugin",
+                "installed": "1.0.0",
+                "latest": "1.2.0",
+                "origin": "pypi",
+                "upgrade_command": "pip install -U example-plugin",
+            }
+        ],
+        # The analyst already upgraded the plugin the cached finding is about.
+        [FakeDistribution("example-plugin", version="1.2.0")],
+    )
+
+    logo.check_updates(disable_indicator_check=True)
+
+    assert "Plugin updates" not in capsys.readouterr().out
+
+
+def test_logo_prints_nothing_when_throttled_without_findings(
+    capsys, no_version_check, throttled_cache
+):
+    throttled_cache([], [FakeDistribution("example-plugin")])
+
+    logo.check_updates(disable_indicator_check=True)
+
+    assert "Plugin updates" not in capsys.readouterr().out
+
+
+def test_logo_survives_a_corrupt_plugin_cache(
+    monkeypatch, capsys, data_folder, no_version_check
+):
+    data_folder.mkdir(parents=True, exist_ok=True)
+    (data_folder / "plugin_updates.json").write_text(
+        json.dumps([{"oops": 1}]), encoding="utf-8"
+    )
+    monkeypatch.setattr(
+        logo,
+        "installed_plugin_distributions",
+        lambda: [FakeDistribution("example-plugin")],
+    )
+    monkeypatch.setattr(PluginUpdates, "should_check", lambda self: (False, 8))
+
+    logo.check_updates(disable_indicator_check=True)
+
+    assert "Plugin updates" not in capsys.readouterr().out
+
+
+def test_logo_skips_the_plugin_check_without_plugins(
+    monkeypatch, capsys, no_version_check
+):
+    monkeypatch.setattr(logo, "installed_plugin_distributions", list)
+    monkeypatch.setattr(
+        PluginUpdates,
+        "should_check",
+        lambda self: pytest.fail("plugins must not be checked without plugins"),
+    )
+
+    logo.check_updates(disable_indicator_check=True)
+
+    assert "Plugin updates" not in capsys.readouterr().out
+
+
+def test_logo_skips_the_plugin_check_without_network_access(
+    monkeypatch, capsys, no_version_check
+):
+    monkeypatch.setattr("mvt.common.logo.settings.NETWORK_ACCESS_ALLOWED", False)
+    monkeypatch.setattr(
+        logo,
+        "installed_plugin_distributions",
+        lambda: pytest.fail("plugins must not be listed without network access"),
+    )
+
+    logo.check_updates(disable_indicator_check=True)
+
+    assert "Plugin updates" not in capsys.readouterr().out
+
+
+def test_logo_skips_the_plugin_check_when_update_checks_are_disabled(
+    monkeypatch, capsys
+):
+    monkeypatch.setattr(
+        logo,
+        "installed_plugin_distributions",
+        lambda: pytest.fail("plugins must not be checked with --disable-update-check"),
+    )
+
+    logo.check_updates(disable_version_check=True, disable_indicator_check=True)
+
+    assert capsys.readouterr().out == ""

tests/common/test_url.py

@@ -22,3 +22,23 @@ def test_google_maps_url_is_not_shortened(url):
 
 def test_other_google_short_url_is_shortened():
     assert URL("https://goo.gl/example").check_if_shortened() is True
+
+
+@pytest.mark.parametrize(
+    "url, domain",
+    [
+        ("https://www.example.com/path", "example.com"),
+        # Only the whole "www." prefix comes off, not any leading "w" or "." character.
+        ("https://web.example.com", "web.example.com"),
+        ("https://wow.com", "wow.com"),
+        ("https://wired.com", "wired.com"),
+        ("https://www.wow.com", "wow.com"),
+    ],
+)
+def test_get_domain_strips_only_a_whole_www_prefix(url, domain):
+    assert URL(url).domain == domain
+
+
+def test_shortener_starting_with_w_is_detected():
+    assert URL("https://w3t.org/example").check_if_shortened() is True
+    assert URL("https://www.w3t.org/example").check_if_shortened() is True

tests/common/test_utils.py

@@ -18,6 +18,7 @@ from mvt.common.utils import (
     generate_hashes_from_path,
     get_sha256_from_file_path,
     init_logging,
+    set_verbose_logging,
 )
 
 from ..utils import get_artifact_folder
@@ -122,3 +123,29 @@ class TestInitLogging:
             sum(isinstance(handler, MVTLogHandler) for handler in log.handlers)
             == handler_count
         )
+
+    def test_verbose_logging_finds_the_console_handler_among_others(self):
+        # Something else may have attached a handler to the "mvt" logger
+        # before MVT did, so the console handler is not always the first.
+        log = logging.getLogger("mvt")
+        init_logging()
+        foreign_handler = logging.NullHandler()
+        foreign_handler.setLevel(logging.CRITICAL)
+        log.handlers.insert(0, foreign_handler)
+
+        try:
+            set_verbose_logging(True)
+            console_handlers = [
+                handler
+                for handler in log.handlers
+                if isinstance(handler, MVTLogHandler)
+            ]
+            assert console_handlers
+            assert all(handler.level == logging.DEBUG for handler in console_handlers)
+            assert foreign_handler.level == logging.CRITICAL
+
+            set_verbose_logging(False)
+            assert all(handler.level == logging.INFO for handler in console_handlers)
+            assert foreign_handler.level == logging.CRITICAL
+        finally:
+            log.handlers.remove(foreign_handler)

tests/conftest.py

@@ -3,15 +3,26 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+import atexit
 import logging
 import os
+import shutil
+import tempfile
 
 import pytest
 
-from mvt.common.indicators import Indicators
-
 from .artifacts.generate_stix import generate_test_stix_file
 
+# The suite must neither read nor write the developer's own MVT settings,
+# downloaded indicators or update-check state, and mvt.common.config saves
+# the settings file as soon as it is imported. Both folders are redirected
+# before any mvt module is imported, which is why this file imports none at
+# the top; the subprocesses the tests start inherit the variables.
+MVT_TEST_HOME = tempfile.mkdtemp(prefix="mvt-tests-")
+atexit.register(shutil.rmtree, MVT_TEST_HOME, ignore_errors=True)
+os.environ["MVT_CONFIG_FOLDER"] = os.path.join(MVT_TEST_HOME, "config")
+os.environ["MVT_DATA_FOLDER"] = os.path.join(MVT_TEST_HOME, "data")
+
 
 @pytest.fixture(scope="session", autouse=True)
 def indicator_file(request, tmp_path_factory):
@@ -42,6 +53,8 @@ def indicators_factory(indicator_file):
         android_property_names=[],
         files_sha256=[],
     ):
+        from mvt.common.indicators import Indicators
+
         ind = Indicators(log=logging.getLogger())
         ind.parse_stix2(indicator_file)
 
@@ -58,3 +71,38 @@ def indicators_factory(indicator_file):
         return ind
 
     return f
+
+
+@pytest.fixture()
+def restore_cli_commands(monkeypatch):
+    """Keep the external commands a test registers out of the next test.
+
+    Each CLI group is a module-level object shared by every test, so a test
+    registering plugin or environment commands on one has to put it back. The
+    groups are imported here rather than at the top of the file, so that
+    collecting the tests does not import three CLIs for the sake of one
+    fixture.
+    """
+    from mvt.android.cli import cli as android_cli
+    from mvt.cli import cli as neutral_cli
+    from mvt.common.cli_plugins import (
+        MVT_ANDROID_CUSTOM_COMMANDS_ENV,
+        MVT_CUSTOM_COMMANDS_ENV,
+        MVT_IOS_CUSTOM_COMMANDS_ENV,
+    )
+    from mvt.ios.cli import cli as ios_cli
+
+    groups = (neutral_cli, ios_cli, android_cli)
+    for variable in (
+        MVT_CUSTOM_COMMANDS_ENV,
+        MVT_IOS_CUSTOM_COMMANDS_ENV,
+        MVT_ANDROID_CUSTOM_COMMANDS_ENV,
+    ):
+        monkeypatch.delenv(variable, raising=False)
+    originals = [dict(group.commands) for group in groups]
+    yield
+    for group, commands in zip(groups, originals):
+        group.commands.clear()
+        group.commands.update(commands)
+        if hasattr(group, "_mvt_external_command_sources"):
+            delattr(group, "_mvt_external_command_sources")

tests/ios_backup/test_decrypt.py

@@ -0,0 +1,203 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import threading
+from pathlib import Path
+
+import pytest
+from Crypto.Cipher import AES
+
+from mvt.ios.decrypt import DecryptBackup, MVTEncryptedBackup
+
+
+def _encrypted_file(backup_path, file_id, key, plaintext):
+    padding_length = AES.block_size - (len(plaintext) % AES.block_size)
+    padded = plaintext + bytes([padding_length]) * padding_length
+    encrypted = AES.new(key, AES.MODE_CBC, iv=b"\x00" * AES.block_size).encrypt(
+        padded
+    )
+    source_path = backup_path / file_id[:2] / file_id
+    source_path.parent.mkdir(parents=True)
+    source_path.write_bytes(encrypted)
+
+
+def test_extract_file_by_id_preserves_bytes_with_wrong_manifest_size(
+    mocker, tmp_path
+):
+    file_id = "ab" + "1" * 38
+    plaintext = b"complete decrypted content"
+    inner_key = b"k" * 32
+    _encrypted_file(tmp_path, file_id, inner_key, plaintext)
+
+    file_plist = mocker.Mock(
+        encryption_key=b"wrapped-key",
+        protection_class=1,
+        filesize=1,
+        mtime=None,
+    )
+    mocker.patch("mvt.ios.decrypt.FilePlist", return_value=file_plist)
+
+    backup = MVTEncryptedBackup(
+        backup_directory=str(tmp_path), derived_key=b"d" * 32
+    )
+    mocker.patch.object(backup, "_read_and_unlock_keybag", return_value=True)
+    backup._keybag = mocker.Mock()
+    backup._keybag.unwrapKeyForClass.return_value = inner_key
+    streaming_decrypt = mocker.spy(backup, "_decrypt_file_to_disk")
+    output_path = tmp_path / "output"
+
+    backup.extract_file_by_id(
+        file_id=file_id,
+        file_bplist=b"plist",
+        output_filename=str(output_path),
+    )
+
+    assert output_path.read_bytes() == plaintext
+    streaming_decrypt.assert_called_once()
+
+
+def test_extract_file_by_id_copies_unencrypted_files(mocker, tmp_path):
+    file_id = "cd" + "2" * 38
+    source_path = tmp_path / file_id[:2] / file_id
+    source_path.parent.mkdir(parents=True)
+    source_path.write_bytes(b"plain content")
+
+    file_plist = mocker.Mock(encryption_key=None)
+    mocker.patch("mvt.ios.decrypt.FilePlist", return_value=file_plist)
+    backup = MVTEncryptedBackup(
+        backup_directory=str(tmp_path), derived_key=b"d" * 32
+    )
+    mocker.patch.object(backup, "_read_and_unlock_keybag", return_value=True)
+    output_path = tmp_path / "output"
+
+    backup.extract_file_by_id(
+        file_id=file_id,
+        file_bplist=b"plist",
+        output_filename=str(output_path),
+    )
+
+    assert output_path.read_bytes() == b"plain content"
+
+
+@pytest.mark.parametrize("with_symlink", [False, True], ids=["file-id", "symlink"])
+def test_process_backup_rejects_unsafe_file_ids_and_destinations(
+    mocker, tmp_path, with_symlink
+):
+    backup_path = tmp_path / "backup"
+    destination = tmp_path / "destination"
+    outside = tmp_path / "outside"
+    backup_path.mkdir()
+    destination.mkdir()
+    outside.mkdir()
+
+    safe_file_id = "ef" + "3" * 38
+    unsafe_file_id = "../../outside-file"
+    symlink_file_id = "ab" + "4" * 38
+    file_ids = [safe_file_id]
+    if with_symlink:
+        file_ids.append(symlink_file_id)
+    for file_id in file_ids:
+        source_path = backup_path / file_id[:2] / file_id
+        source_path.parent.mkdir(parents=True, exist_ok=True)
+        source_path.write_bytes(b"encrypted")
+    if with_symlink:
+        try:
+            (destination / "ab").symlink_to(outside, target_is_directory=True)
+        except OSError:
+            pytest.skip("creating symbolic links is not permitted on this system")
+
+    cursor = mocker.MagicMock()
+    records = [
+        (safe_file_id, "Domain", "safe", b"plist"),
+        (unsafe_file_id, "Domain", "unsafe", b"plist"),
+    ]
+    if with_symlink:
+        records.append((symlink_file_id, "Domain", "symlink", b"plist"))
+    cursor.__iter__.return_value = iter(records)
+    cursor_context = mocker.MagicMock()
+    cursor_context.__enter__.return_value = cursor
+
+    backup = mocker.MagicMock()
+    backup.manifest_db_cursor.return_value = cursor_context
+
+    def extract_file_by_id(*, output_filename, **kwargs):
+        Path(output_filename).write_bytes(b"decrypted")
+
+    backup.extract_file_by_id.side_effect = extract_file_by_id
+    decryptor = DecryptBackup(
+        str(backup_path), str(destination), max_workers=1
+    )
+    decryptor._backup = backup
+
+    decryptor.process_backup()
+
+    assert (destination / safe_file_id[:2] / safe_file_id).read_bytes() == b"decrypted"
+    if with_symlink:
+        assert not (outside / symlink_file_id).exists()
+    backup.extract_file_by_id.assert_called_once()
+    assert backup.extract_file_by_id.call_args.kwargs["file_id"] == safe_file_id
+
+
+def test_process_backup_decrypts_files_concurrently(mocker, tmp_path):
+    backup_path = tmp_path / "backup"
+    destination = tmp_path / "destination"
+    backup_path.mkdir()
+
+    file_ids = ["ab" + "1" * 38, "cd" + "2" * 38]
+    for file_id in file_ids:
+        source_path = backup_path / file_id[:2] / file_id
+        source_path.parent.mkdir()
+        source_path.write_bytes(b"encrypted")
+
+    cursor = mocker.MagicMock()
+    cursor.__iter__.return_value = iter(
+        (file_id, "Domain", file_id, b"plist") for file_id in file_ids
+    )
+    cursor_context = mocker.MagicMock()
+    cursor_context.__enter__.return_value = cursor
+
+    barrier = threading.Barrier(2)
+    backup = mocker.MagicMock()
+    backup.manifest_db_cursor.return_value = cursor_context
+
+    def extract_file_by_id(*, file_id, output_filename, **kwargs):
+        barrier.wait(timeout=5)
+        Path(output_filename).write_bytes(file_id.encode())
+
+    backup.extract_file_by_id.side_effect = extract_file_by_id
+    decryptor = DecryptBackup(str(backup_path), str(destination), max_workers=2)
+    decryptor._backup = backup
+
+    decryptor.process_backup()
+
+    for file_id in file_ids:
+        assert (destination / file_id[:2] / file_id).read_bytes() == file_id.encode()
+
+
+def test_process_backup_logs_worker_errors(mocker, tmp_path, caplog):
+    backup_path = tmp_path / "backup"
+    destination = tmp_path / "destination"
+    backup_path.mkdir()
+    file_id = "ef" + "3" * 38
+    source_path = backup_path / file_id[:2] / file_id
+    source_path.parent.mkdir()
+    source_path.write_bytes(b"encrypted")
+
+    cursor = mocker.MagicMock()
+    cursor.__iter__.return_value = iter([(file_id, "Domain", "failing-file", b"plist")])
+    cursor_context = mocker.MagicMock()
+    cursor_context.__enter__.return_value = cursor
+
+    backup = mocker.MagicMock()
+    backup.manifest_db_cursor.return_value = cursor_context
+    backup.extract_file_by_id.side_effect = ValueError("broken file")
+    decryptor = DecryptBackup(str(backup_path), str(destination))
+    decryptor._backup = backup
+
+    with caplog.at_level(logging.ERROR, logger="mvt.ios.decrypt"):
+        decryptor.process_backup()
+
+    assert "Failed to decrypt file failing-file: broken file" in caplog.text

tests/ios_backup/test_manifest.py

@@ -5,7 +5,12 @@
 
 import gc
 import logging
+import os
+import shutil
 import warnings
+from pathlib import Path
+
+import pytest
 
 from mvt.common.indicators import Indicators
 from mvt.common.module import run_module
@@ -14,8 +19,58 @@ from mvt.ios.modules.backup.manifest import Manifest
 
 from ..utils import get_ios_backup_folder
 
+# fileID of HomeDomain::Library/SMS/sms.db in the test backup. It is one of the
+# few files the test backup actually stores.
+SMS_FILE_ID = "3d0d7e5fb2ce288813306e4d4636395e047a3d28"
+
+
+@pytest.fixture
+def backup_without_stored_files(tmp_path):
+    """A copy of the test backup with every stored file removed.
+
+    The test backup only ships a handful of the files its manifest lists, so
+    dropping what it does store leaves a backup where every regular file the
+    manifest mentions is missing from the folder.
+    """
+    backup_path = tmp_path / "backup"
+    shutil.copytree(get_ios_backup_folder(), backup_path)
+
+    for file_id_folder in backup_path.iterdir():
+        if not file_id_folder.is_dir():
+            continue
+        for backup_file in file_id_folder.iterdir():
+            backup_file.unlink()
+
+    return str(backup_path)
+
 
 class TestIOSExtraction:
+    @pytest.mark.parametrize("link_directory", [False, True], ids=["file", "directory"])
+    @pytest.mark.parametrize("inside_backup", [False, True], ids=["outside", "inside"])
+    def test_stored_file_inventory_matches_symlink_resolution(
+        self, tmp_path, link_directory, inside_backup
+    ):
+        backup_path = tmp_path / "backup"
+        backup_path.mkdir()
+        destination = (backup_path if inside_backup else tmp_path) / "contents"
+        destination.mkdir()
+        (destination / SMS_FILE_ID).write_bytes(b"backup file")
+        bucket = backup_path / SMS_FILE_ID[:2]
+        try:
+            if link_directory:
+                bucket.symlink_to(destination, target_is_directory=True)
+            else:
+                bucket.mkdir()
+                (bucket / SMS_FILE_ID).symlink_to(destination / SMS_FILE_ID)
+        except OSError:
+            pytest.skip("creating symbolic links is not permitted on this system")
+
+        m = IOSExtraction(target_path=str(backup_path))
+        assert bool(m._get_backup_file_from_id(SMS_FILE_ID)) is inside_backup
+        assert m._get_stored_backup_file_ids() == (
+            {SMS_FILE_ID} if inside_backup else set()
+        )
+
     def test_get_backup_files_from_manifest_closes_connection(self):
         m = IOSExtraction(target_path=get_ios_backup_folder())
 
@@ -41,6 +96,103 @@ class TestManifestModule:
         assert len(m.timeline) == 5881
         assert len(m.alertstore.alerts) == 0
 
+    def test_manifest_flags_the_files_missing_from_an_incomplete_backup(self):
+        m = Manifest(target_path=get_ios_backup_folder())
+        run_module(m)
+
+        missing = [result for result in m.results if result.get("missing")]
+        # The test backup only stores a handful of the files its manifest
+        # lists, and every one of the rest is a regular file (flags 1).
+        assert len(missing) == 1079
+        assert all(result["flags"] == 1 for result in missing)
+
+        stored = [result for result in m.results if result["file_id"] == SMS_FILE_ID]
+        assert len(stored) == 1
+        assert "missing" not in stored[0]
+
+    def test_manifest_flags_every_stored_file_removed_from_the_backup_folder(
+        self, backup_without_stored_files
+    ):
+        m = Manifest(target_path=backup_without_stored_files)
+        run_module(m)
+
+        missing = [result for result in m.results if result.get("missing")]
+        assert len(missing) == 1089
+
+    def test_manifest_flags_a_file_removed_from_the_backup_folder(self, tmp_path):
+        backup_path = tmp_path / "backup"
+        shutil.copytree(get_ios_backup_folder(), backup_path)
+        (backup_path / SMS_FILE_ID[:2] / SMS_FILE_ID).unlink()
+
+        m = Manifest(target_path=str(backup_path))
+        run_module(m)
+
+        removed = [result for result in m.results if result["file_id"] == SMS_FILE_ID]
+        assert len(removed) == 1
+        assert removed[0]["missing"] is True
+
+    @pytest.mark.parametrize("failed_folder", ["", "3d"], ids=["root", "bucket"])
+    def test_manifest_skips_missing_check_when_inventory_fails(
+        self, monkeypatch, caplog, failed_folder
+    ):
+        backup_path = Path(get_ios_backup_folder())
+        failed_path = backup_path / failed_folder
+        scandir = os.scandir
+
+        def fail_listing(path):
+            if Path(path) == failed_path:
+                raise PermissionError("cannot list backup folder")
+            return scandir(path)
+
+        monkeypatch.setattr(os, "scandir", fail_listing)
+        m = Manifest(target_path=str(backup_path))
+        with caplog.at_level(logging.INFO):
+            m.run()
+
+        assert len(m.results) == 3721
+        assert m._get_backup_file_from_id(SMS_FILE_ID) is not None
+        assert all("missing" not in result for result in m.results)
+        assert "Skipping the missing-file check" in caplog.text
+        assert "The backup might be incomplete" not in caplog.text
+
+    def test_manifest_ignores_unreadable_unrelated_folders(self, tmp_path, monkeypatch):
+        backup_path = tmp_path / "backup"
+        shutil.copytree(get_ios_backup_folder(), backup_path)
+        unrelated = backup_path / "notes"
+        unrelated.mkdir()
+        scandir = os.scandir
+
+        def fail_listing(path):
+            if Path(path) == unrelated:
+                raise PermissionError("cannot list unrelated folder")
+            return scandir(path)
+
+        monkeypatch.setattr(os, "scandir", fail_listing)
+        m = Manifest(target_path=str(backup_path))
+        m.run()
+
+        assert sum(bool(result.get("missing")) for result in m.results) == 1079
+        stored = next(
+            result for result in m.results if result["file_id"] == SMS_FILE_ID
+        )
+        assert "missing" not in stored
+
+    @pytest.mark.parametrize("wrong_folder", ["ab", "notes"])
+    def test_manifest_flags_files_in_the_wrong_folder(self, tmp_path, wrong_folder):
+        backup_path = tmp_path / "backup"
+        shutil.copytree(get_ios_backup_folder(), backup_path)
+        destination = backup_path / wrong_folder
+        destination.mkdir(exist_ok=True)
+        (backup_path / SMS_FILE_ID[:2] / SMS_FILE_ID).rename(destination / SMS_FILE_ID)
+
+        m = Manifest(target_path=str(backup_path))
+        m.run()
+
+        assert m._get_backup_file_from_id(SMS_FILE_ID) is None
+        moved = next(result for result in m.results if result["file_id"] == SMS_FILE_ID)
+        assert moved["missing"] is True
+        assert sum(bool(result.get("missing")) for result in m.results) == 1080
+
     def test_detection(self, indicator_file):
         m = Manifest(target_path=get_ios_backup_folder())
         ind = Indicators(log=logging.getLogger())

tests/ios_backup/test_sqlite_handling.py

@@ -9,6 +9,8 @@ import plistlib
 import shutil
 import sqlite3
 
+import pytest
+
 from mvt.ios.modules.base import IOSExtraction
 from mvt.ios.modules.fs.analytics import Analytics
 
@@ -45,6 +47,9 @@ def test_open_sqlite_reads_wal_without_modifying_evidence(tmp_path):
     assert not os.path.exists(str(evidence_path) + "-shm")
 
 
+@pytest.mark.skipif(
+    shutil.which("sqlite3") is None, reason="the recovery needs the sqlite3 binary"
+)
 def test_recovery_preserves_source_database(tmp_path):
     database_path = tmp_path / "source.db"
     conn = sqlite3.connect(database_path)

tests/ios_fs/test_filesystem.py

@@ -3,15 +3,45 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 import logging
+import ntpath
+from types import SimpleNamespace
 
 from mvt.common.indicators import Indicators
 from mvt.common.module import run_module
+from mvt.ios.modules.fs import filesystem
 from mvt.ios.modules.fs.filesystem import Filesystem
 
 from ..utils import get_ios_backup_folder
 
 
 class TestFilesystem:
+    def test_windows_paths_are_normalized_for_indicators(
+        self, monkeypatch, indicators_factory
+    ):
+        m = Filesystem(target_path=r"C:\dump")
+        m.indicators = indicators_factory(
+            file_paths=["matched/directory"], processes=["matched"]
+        )
+        monkeypatch.setattr(
+            filesystem,
+            "os",
+            SimpleNamespace(
+                sep="\\",
+                path=ntpath,
+                walk=lambda _: [(r"C:\dump\matched", ["directory"], ["file.txt"])],
+                stat=lambda _: SimpleNamespace(st_mtime=0),
+            ),
+        )
+
+        m.run()
+        m.check_indicators()
+
+        assert {result["path"] for result in m.results} == {
+            "matched/directory",
+            "matched/file.txt",
+        }
+        assert len(m.alertstore.alerts) == 3
+
     def test_filesystem(self):
         m = Filesystem(target_path=get_ios_backup_folder())
         run_module(m)

tests/ios_sysdiagnose/__init__.py

@@ -0,0 +1,4 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/

tests/ios_sysdiagnose/test_sysdiagnose_info.py

@@ -0,0 +1,161 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import json
+import plistlib
+import sqlite3
+import tarfile
+
+from mvt.common.module import run_module
+from mvt.ios.cmd_check_sysdiagnose import CmdIOSCheckSysdiagnose
+from mvt.ios.modules.sysdiagnose.sysdiagnose_info import SysdiagnoseInfo
+from mvt.ios.versions import get_device_desc_from_id
+
+# The name sysdiagnose gives its archive: the time it ran, then the OS and build.
+ARCHIVE_NAME = "sysdiagnose_2024.01.02_03-04-05+0200_iPhone-OS_iPhone_21C62"
+
+DUMPSTATE = (
+    "Found device: ...\n"
+    "\tProperties: {\n"
+    "\t\tProductType => iPhone12,1\n"
+    "\t\tOSVersion => 17.2\n"
+    "\t\tSerialNumber => C0FFEE000000\n"
+    "\t\tRegionCode => LL\n"
+    "\t}\n"
+    "\tServices: {\n"
+    "\t\tcom.apple.example => ignored\n"
+    "\t}\n"
+)
+
+ACTIVATION_BODY = {
+    "serial-number": "C0FFEE000000",
+    "productType": "iPhone12,1",
+    "productName": "iPhone OS",
+    "imei": "000000000000000",
+    "os-version": "17.2",
+    "os-build": "21C62",
+    "udid": "00000000-0000000000000000",
+    "meid": "00000000000000",
+}
+
+
+def make_sysdiagnose(tmp_path, activation_body=None):
+    folder = tmp_path / ARCHIVE_NAME
+    folder.mkdir()
+    (folder / "sysdiagnose.log").write_text(
+        f"Output available at '/private/var/tmp/{ARCHIVE_NAME}.tar.gz'\n",
+        encoding="utf-8",
+    )
+    (folder / "remotectl_dumpstate.txt").write_text(DUMPSTATE, encoding="utf-8")
+
+    activation = folder / "logs" / "MobileActivation"
+    activation.mkdir(parents=True)
+    body = json.dumps(
+        activation_body if activation_body is not None else ACTIVATION_BODY
+    )
+    (activation / "collection_oob_request.txt").write_text(
+        f"HEADERS: {{}}\nBODY: {body}\nEND\n", encoding="utf-8"
+    )
+
+    appinstallation = folder / "logs" / "appinstallation"
+    appinstallation.mkdir(parents=True)
+    conn = sqlite3.connect(appinstallation / "appstored.sqlitedb")
+    conn.execute("CREATE TABLE asset (sinfs_data BLOB)")
+    conn.execute(
+        "INSERT INTO asset VALUES (?)",
+        (plistlib.dumps([{"sinf": b"\x00\x10nameExample Person\x00\x00rest"}]),),
+    )
+    conn.execute("CREATE TABLE job_software (store_account_name TEXT)")
+    conn.execute("INSERT INTO job_software VALUES (NULL)")
+    conn.execute("INSERT INTO job_software VALUES ('person@example.com')")
+    conn.commit()
+    conn.close()
+    return folder
+
+
+def run_command(target, results_path=None):
+    command = CmdIOSCheckSysdiagnose(target_path=str(target), results_path=results_path)
+    command.run()
+    (module,) = [m for m in command.executed if isinstance(m, SysdiagnoseInfo)]
+    return module
+
+
+def test_device_details_from_a_sysdiagnose_folder(tmp_path):
+    results_path = tmp_path / "results"
+    results_path.mkdir()
+    module = run_command(make_sysdiagnose(tmp_path), str(results_path))
+
+    assert module.results["SerialNumber"] == "C0FFEE000000"
+    assert module.results["ProductType"] == "iPhone12,1"
+    assert module.results["ProductName"] == get_device_desc_from_id("iPhone12,1")
+    assert module.results["ProductName"] != "iPhone OS"
+    assert module.results["OSVersion"] == "17.2"
+    assert module.results["BuildVersion"] == "21C62"
+    assert module.results["UniqueIdentifier"] == "00000000-0000000000000000"
+    assert module.results["RegionCode"] == "LL"
+    assert "com.apple.example" not in module.results
+    assert module.results["Account Name"] == "Example Person"
+    assert module.results["Email Address"] == "person@example.com"
+    assert module.results["OriginalFilename"] == f"{ARCHIVE_NAME}.tar.gz"
+    assert module.results["CreatedTimestamp"] == "2024-01-02 01:04:05.000000"
+    assert (results_path / "sysdiagnose_info.json").exists()
+
+
+def test_device_details_from_a_sysdiagnose_archive(tmp_path):
+    folder = make_sysdiagnose(tmp_path)
+    archive_path = tmp_path / f"{ARCHIVE_NAME}.tar.gz"
+    with tarfile.open(archive_path, "w:gz") as archive:
+        archive.add(folder, arcname=ARCHIVE_NAME)
+
+    module = run_command(archive_path)
+
+    assert module.results["SerialNumber"] == "C0FFEE000000"
+    assert module.results["Account Name"] == "Example Person"
+    assert module.results["OriginalFilename"] == f"{ARCHIVE_NAME}.tar.gz"
+
+
+def test_wal_sidecars_are_copied_beside_the_database(tmp_path):
+    folder = tmp_path / ARCHIVE_NAME
+    (folder / "logs").mkdir(parents=True)
+    (folder / "logs" / "db.sqlite").write_bytes(b"main")
+    (folder / "logs" / "db.sqlite-wal").write_bytes(b"wal")
+    module = SysdiagnoseInfo()
+    module.from_sysdiagnose_folder(
+        str(folder),
+        [f"{ARCHIVE_NAME}/logs/db.sqlite", f"{ARCHIVE_NAME}/logs/db.sqlite-wal"],
+    )
+    copies = tmp_path / "copies"
+    copies.mkdir()
+
+    db_path = module._copy_sqlite_db(f"{ARCHIVE_NAME}/logs/db.sqlite", str(copies))
+
+    assert db_path == str(copies / "db.sqlite")
+    assert (copies / "db.sqlite").read_bytes() == b"main"
+    assert (copies / "db.sqlite-wal").read_bytes() == b"wal"
+    assert not (copies / "db.sqlite-shm").exists()
+
+
+def test_a_sysdiagnose_without_the_files_yields_nothing(tmp_path):
+    folder = tmp_path / ARCHIVE_NAME
+    folder.mkdir()
+    (folder / "other.txt").write_text("nothing here", encoding="utf-8")
+
+    module = SysdiagnoseInfo()
+    module.from_sysdiagnose_folder(str(folder), [f"{ARCHIVE_NAME}/other.txt"])
+    run_module(module)
+
+    assert module.results == {}
+
+
+def test_a_malformed_activation_request_is_skipped(tmp_path):
+    folder = make_sysdiagnose(tmp_path)
+    (folder / "logs" / "MobileActivation" / "collection_oob_request.txt").write_text(
+        "BODY: {not json}\n", encoding="utf-8"
+    )
+
+    module = run_command(folder)
+
+    assert "IMEI" not in module.results
+    assert module.results["SerialNumber"] == "C0FFEE000000"

tests/plugin_fixtures.py

@@ -0,0 +1,86 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+"""Helpers building throwaway plugin distributions for the tests.
+
+Some plugin behaviour only shows up in a fresh interpreter: what an import
+executes, and what a plugin sees when MVT is imported before or after it.
+These helpers write an importable distribution with a real entry point and
+run a script against it in a subprocess, with a temporary home so that the
+subprocess cannot touch the configuration of whoever runs the tests.
+"""
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+from typing import Optional
+
+FIXTURE_COMMAND_NAME = "fixture-plugin"
+FIXTURE_MODULE_NAME = "fixture_cli_plugin"
+FIXTURE_DISTRIBUTION_NAME = "fixture-cli-plugin"
+
+
+def write_cli_plugin_distribution(
+    site_path: Path,
+    entry_point_group: str,
+    module_source: str,
+) -> Path:
+    """Write a distribution registering a CLI plugin entry point.
+
+    :param site_path: Folder to write the distribution into, to be added to
+                      the import path of the interpreter loading it.
+    :param entry_point_group: Entry-point group to register the command in.
+    :param module_source: Source of the plugin module, which must define a
+                          Click command named `cli`.
+    :returns: The folder the distribution was written to.
+    """
+    site_path.mkdir(parents=True, exist_ok=True)
+    (site_path / f"{FIXTURE_MODULE_NAME}.py").write_text(
+        module_source, encoding="utf-8"
+    )
+
+    dist_info = (
+        site_path / f"{FIXTURE_DISTRIBUTION_NAME.replace('-', '_')}-1.0.dist-info"
+    )
+    dist_info.mkdir(exist_ok=True)
+    (dist_info / "METADATA").write_text(
+        f"Metadata-Version: 2.1\nName: {FIXTURE_DISTRIBUTION_NAME}\nVersion: 1.0\n",
+        encoding="utf-8",
+    )
+    (dist_info / "entry_points.txt").write_text(
+        f"[{entry_point_group}]\n{FIXTURE_COMMAND_NAME} = {FIXTURE_MODULE_NAME}:cli\n",
+        encoding="utf-8",
+    )
+    return site_path
+
+
+def run_isolated_python(
+    script: str,
+    home: Path,
+    site_path: Optional[Path] = None,
+    **environment: str,
+) -> subprocess.CompletedProcess:
+    """Run a script in a fresh interpreter with its own configuration folder.
+
+    Importing MVT writes its configuration file, so the subprocess gets a
+    temporary home and no MVT environment variables from the test session.
+    """
+    isolated_environment = {
+        key: value for key, value in os.environ.items() if not key.startswith("MVT_")
+    }
+    isolated_environment["HOME"] = str(home)
+    isolated_environment["XDG_CONFIG_HOME"] = str(home / "config")
+    isolated_environment["XDG_DATA_HOME"] = str(home / "data")
+    if site_path is not None:
+        isolated_environment["PYTHONPATH"] = str(site_path)
+    isolated_environment.update(environment)
+
+    return subprocess.run(
+        [sys.executable, "-c", script],
+        capture_output=True,
+        text=True,
+        env=isolated_environment,
+    )

tests/test_check_android_androidqf.py

@@ -85,7 +85,7 @@ class TestCheckAndroidqfCommand:
     def test_acquisition_context_falls_back_to_public_key_file(self, tmp_path):
         data_path = tmp_path / "androidqf"
         data_path.mkdir()
-        (data_path / "adb_host_key.pub").write_text("QUJDRA== acquisition@host\n")
+        (data_path / "adb_host_key.pub").write_bytes(b"QUJDRA== acquisition@host\n")
         command = CmdAndroidCheckAndroidQF(target_path=str(data_path))
 
         command.init()
@@ -155,7 +155,7 @@ class TestCheckAndroidqfCommand:
             result = runner.invoke(check_androidqf, [str(path)])
 
         assert result.exit_code == 0
-        assert "Skipping backup modules as backup.ab is malformed" in caplog.text
+        assert "Skipping backup modules: Invalid backup format" in caplog.text
         assert not any(
             record.levelname in {"CRITICAL", "FATAL"} for record in caplog.records
         )

tests/test_check_android_bugreport.py

@@ -3,11 +3,16 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+import datetime
+import logging
 import os
+import shutil
+import zipfile
 
 from click.testing import CliRunner
 
 from mvt.android.cli import check_bugreport
+from mvt.android.cmd_check_bugreport import CmdAndroidCheckBugreport
 
 from .utils import get_artifact_folder
 
@@ -28,3 +33,90 @@ class TestCheckBugreportCommand:
         assert result.exit_code == 1
         assert "Invalid bugreport archive" in result.output
         assert "Traceback" not in result.output
+
+
+PROPERTIES = (
+    "------ SYSTEM PROPERTIES (getprop) ------\n"
+    "[persist.sys.timezone]: [Africa/Nairobi]\n"
+    "------ 0.01s was the duration of 'SYSTEM PROPERTIES' ------\n"
+)
+TOMBSTONE = "android_data/bugreport/FS/data/tombstones/tombstone_00"
+
+
+def _bugreport_zip(tmp_path, dumpstate=PROPERTIES):
+    """A bugreport zip holding one tombstone written at 11:38:10 device time.
+
+    An even second: zip entry times have a two-second resolution.
+    """
+    path = tmp_path / "bugreport.zip"
+    with open(os.path.join(get_artifact_folder(), TOMBSTONE), "rb") as handle:
+        tombstone = handle.read()
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr("main_entry.txt", "dumpstate.txt")
+        archive.writestr("dumpstate.txt", dumpstate)
+        entry = zipfile.ZipInfo(
+            "FS/data/tombstones/tombstone_00", date_time=(2023, 3, 10, 11, 38, 10)
+        )
+        archive.writestr(entry, tombstone)
+    return str(path)
+
+
+def _tombstone_timestamp(target, **options):
+    cmd = CmdAndroidCheckBugreport(
+        target_path=target,
+        module_name="Tombstones",
+        disable_version_check=True,
+        disable_indicator_check=True,
+        **options,
+    )
+    cmd.run()
+    return cmd, cmd.executed[0].results[0]["file_timestamp"]
+
+
+class TestCheckBugreportTimezone:
+    def test_zip_entry_times_are_read_in_the_device_timezone(self, tmp_path):
+        cmd, file_timestamp = _tombstone_timestamp(_bugreport_zip(tmp_path))
+
+        assert cmd.module_options["device_timezone"] == "Africa/Nairobi"
+        # 11:38:10 in Nairobi is 08:38:10 UTC.
+        assert file_timestamp == "2023-03-10 08:38:10.000000"
+
+    def test_timezone_option_wins_over_the_bugreport(self, tmp_path):
+        _, file_timestamp = _tombstone_timestamp(
+            _bugreport_zip(tmp_path), module_options={"device_timezone": "Europe/Paris"}
+        )
+
+        assert file_timestamp == "2023-03-10 10:38:10.000000"
+
+        result = CliRunner().invoke(
+            check_bugreport,
+            ["-t", "Europe/Paris", "-m", "Tombstones", _bugreport_zip(tmp_path)],
+        )
+        assert result.exit_code == 0, result.output
+
+    def test_without_a_timezone_the_wall_clock_is_kept_and_a_warning_given(
+        self, tmp_path, caplog
+    ):
+        with caplog.at_level(logging.WARNING, logger="mvt"):
+            _, file_timestamp = _tombstone_timestamp(_bugreport_zip(tmp_path, ""))
+
+        assert file_timestamp == "2023-03-10 11:38:10.000000"
+        assert "persist.sys.timezone not found" in caplog.text
+
+    def test_unpacked_bugreport_warns_and_reads_mtimes_as_utc(self, tmp_path, caplog):
+        unpacked = tmp_path / "bugreport"
+        shutil.copytree(
+            os.path.join(get_artifact_folder(), "android_data/bugreport"), unpacked
+        )
+        instant = datetime.datetime(
+            2023, 3, 10, 8, 38, 11, tzinfo=datetime.timezone.utc
+        ).timestamp()
+        for name in ("tombstone_00", "tombstone_01"):
+            os.utime(unpacked / "FS" / "data" / "tombstones" / name, (instant, instant))
+
+        with caplog.at_level(logging.WARNING, logger="mvt"):
+            _, file_timestamp = _tombstone_timestamp(str(unpacked))
+
+        assert "unpacked bugreport" in caplog.text
+        # Whatever the zone of the machine running the analysis.
+        assert file_timestamp == "2023-03-10 08:38:11.000000"

tests/test_check_ios_backup.py

@@ -19,6 +19,14 @@ class TestCheckBackupCommand:
         result = runner.invoke(check_backup, [path])
         assert result.exit_code == 0
 
+    def test_check_logs_the_backup_path_to_the_command_log(self, tmp_path):
+        path = get_ios_backup_folder()
+        output_path = tmp_path / "out"
+        result = CliRunner().invoke(check_backup, ["--output", str(output_path), path])
+        assert result.exit_code == 0
+        command_log = (output_path / "command.log").read_text(encoding="utf-8")
+        assert f"Checking iTunes backup located at: {path}" in command_log
+
     def test_check_finds_backup_in_subfolder(self, tmp_path, caplog):
         runner = CliRunner()
         backup_path = tmp_path / "MobileSync" / "Backup" / "device-id"

tests/test_check_ios_sysdiagnose.py

@@ -1,3 +1,7 @@
+import logging
+import os
+import tarfile
+
 from click.testing import CliRunner
 
 from mvt.ios.cli import check_sysdiagnose
@@ -50,8 +54,39 @@ def test_check_sysdiagnose_runs_explicitly_scoped_custom_module(tmp_path):
     assert (output_path / "custom_sysdiagnose_module.json").exists()
 
 
-def test_check_sysdiagnose_requires_an_explicitly_scoped_module(tmp_path):
-    result = CliRunner().invoke(check_sysdiagnose, [str(_create_sysdiagnose_folder(tmp_path))])
+def test_check_sysdiagnose_warns_without_a_custom_module(tmp_path, caplog):
+    # The built-in SysdiagnoseInfo alone performs no check, so the run goes
+    # ahead but says so.
+    with caplog.at_level(logging.WARNING, logger="mvt"):
+        result = CliRunner().invoke(
+            check_sysdiagnose, [str(_create_sysdiagnose_folder(tmp_path))]
+        )
 
-    assert result.exit_code != 0
-    assert "No custom modules support mvt-ios check-sysdiagnose" in result.output
+    assert result.exit_code == 0
+    assert "No forensic sysdiagnose modules have been loaded" in caplog.text
+
+
+def _create_truncated_sysdiagnose_archive(tmp_path):
+    folder = tmp_path / "sysdiagnose_2026.01.01_00-00-00+0000_iPhone-OS_iPhone_23A000"
+    folder.mkdir()
+    (folder / "sysdiagnose.log").write_bytes(os.urandom(200_000))
+    archive = tmp_path / "sysdiagnose.tar.gz"
+    with tarfile.open(archive, "w:gz") as tar:
+        tar.add(folder, arcname=folder.name)
+    data = archive.read_bytes()
+    archive.write_bytes(data[: len(data) // 2])
+    return archive
+
+
+def test_check_sysdiagnose_reports_a_truncated_archive(tmp_path, caplog):
+    # A download that stopped halfway ends in EOFError from gzip, which Click
+    # would otherwise turn into a bare "Aborted!" with no reason given.
+    archive = _create_truncated_sysdiagnose_archive(tmp_path)
+
+    with caplog.at_level(logging.CRITICAL, logger="mvt"):
+        result = CliRunner().invoke(check_sysdiagnose, [str(archive)])
+
+    assert result.exit_code == 1
+    assert "Unable to read the sysdiagnose archive" in caplog.text
+    assert "truncated" in caplog.text
+    assert "Aborted!" not in result.output

tests/test_cli.py

@@ -0,0 +1,48 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from click.testing import CliRunner
+
+from mvt.cli import cli
+from mvt.common.updates import IndicatorsUpdates
+from mvt.common.version import MVT_VERSION
+
+# Keep the banner of the group callback from checking for updates online.
+OFFLINE = ["--disable-update-check", "--disable-indicator-update-check"]
+
+
+class TestMvtCommand:
+    def test_running_mvt_alone_shows_the_logo_and_the_commands(self):
+        result = CliRunner().invoke(cli, OFFLINE)
+
+        assert result.exit_code == 0
+        logo_at = result.output.index("Mobile Verification Toolkit")
+        usage_at = result.output.index("Usage:")
+        assert logo_at < usage_at
+        assert "mvt-ios" in result.output and "mvt-android" in result.output
+
+    def test_help_reminds_where_the_analysis_runs(self):
+        result = CliRunner().invoke(cli, ["--help"])
+
+        assert result.exit_code == 0
+        assert "mvt-ios" in result.output
+        assert "mvt-android" in result.output
+
+    def test_version_prints_the_installed_version(self):
+        result = CliRunner().invoke(cli, [*OFFLINE, "version"])
+
+        assert result.exit_code == 0
+        assert f"Version: {MVT_VERSION}" in result.output
+
+    def test_download_iocs_updates_the_indicators(self, monkeypatch):
+        updates = []
+        monkeypatch.setattr(
+            IndicatorsUpdates, "update", lambda self: updates.append(self)
+        )
+
+        result = CliRunner().invoke(cli, [*OFFLINE, "download-iocs"])
+
+        assert result.exit_code == 0
+        assert len(updates) == 1

tests/test_cli_entry_points.py

@@ -0,0 +1,280 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import sys
+from types import SimpleNamespace
+
+import click
+import pytest
+
+import mvt.android
+import mvt.cli
+import mvt.ios
+from mvt.android.cli import cli as android_cli
+from mvt.android.cli import main as android_main
+from mvt.cli import cli as mvt_cli
+from mvt.cli import main as mvt_main
+from mvt.common.cli_plugins import (
+    ANDROID_CLI_PLUGIN_GROUP,
+    IOS_CLI_PLUGIN_GROUP,
+    MVT_ANDROID_CUSTOM_COMMANDS_ENV,
+    MVT_CUSTOM_COMMANDS_ENV,
+    MVT_IOS_CUSTOM_COMMANDS_ENV,
+    NEUTRAL_CLI_PLUGIN_GROUP,
+)
+from mvt.ios.cli import cli as ios_cli
+from mvt.ios.cli import main as ios_main
+
+from .plugin_fixtures import (
+    FIXTURE_COMMAND_NAME,
+    run_isolated_python,
+    write_cli_plugin_distribution,
+)
+
+MARKER_PLUGIN_TEMPLATE = """
+import os
+
+import click
+
+# Touched when this module is imported, so a test can tell whether loading MVT
+# executed the plugin.
+open(os.environ["FIXTURE_PLUGIN_MARKER"], "a").close()
+
+
+@click.command()
+def cli():
+    click.echo("fixture plugin ran")
+"""
+
+PROGRAMS = {
+    "mvt": (mvt.cli, mvt_cli, NEUTRAL_CLI_PLUGIN_GROUP, MVT_CUSTOM_COMMANDS_ENV),
+    "mvt-ios": (mvt.ios, ios_cli, IOS_CLI_PLUGIN_GROUP, MVT_IOS_CUSTOM_COMMANDS_ENV),
+    "mvt-android": (
+        mvt.android,
+        android_cli,
+        ANDROID_CLI_PLUGIN_GROUP,
+        MVT_ANDROID_CUSTOM_COMMANDS_ENV,
+    ),
+}
+
+CASE_SUMMARY_COMMAND = """
+import click
+
+
+@click.command("case-summary")
+def cli():
+    click.echo("case summary ran")
+"""
+
+# The entry-point group of another program, for each program: no group may add
+# its commands to a CLI other than its own.
+OTHER_PROGRAMS_GROUP = {
+    "mvt": IOS_CLI_PLUGIN_GROUP,
+    "mvt-ios": NEUTRAL_CLI_PLUGIN_GROUP,
+    "mvt-android": NEUTRAL_CLI_PLUGIN_GROUP,
+}
+
+
+def _install_fixture_entry_point(monkeypatch, entry_point_group, command):
+    def entry_points(*, group):
+        if group != entry_point_group:
+            return []
+        return [
+            SimpleNamespace(
+                name=FIXTURE_COMMAND_NAME,
+                value="fixture_cli_plugin:cli",
+                load=lambda: command,
+                dist=SimpleNamespace(
+                    metadata={"Name": "fixture-cli-plugin"}, version="1.0"
+                ),
+            )
+        ]
+
+    monkeypatch.setattr(
+        "mvt.common.cli_plugins.importlib.metadata.entry_points", entry_points
+    )
+
+
+def _offline_argv(program, *arguments):
+    """Build an argument list which keeps the CLI from checking for updates."""
+    return [
+        program,
+        "--disable-update-check",
+        "--disable-indicator-update-check",
+        *arguments,
+    ]
+
+
+@pytest.mark.parametrize("program", sorted(PROGRAMS))
+def test_main_registers_installed_plugins_before_running_the_cli(
+    program, monkeypatch, capsys, restore_cli_commands
+):
+    package, group, entry_point_group, _ = PROGRAMS[program]
+
+    @click.command()
+    def fixture_command():
+        click.echo("fixture plugin ran")
+
+    _install_fixture_entry_point(monkeypatch, entry_point_group, fixture_command)
+    monkeypatch.setattr(sys, "argv", _offline_argv(program, FIXTURE_COMMAND_NAME))
+
+    with pytest.raises(SystemExit) as exit_info:
+        package.main()
+
+    assert exit_info.value.code == 0
+    assert "fixture plugin ran" in capsys.readouterr().out
+    assert FIXTURE_COMMAND_NAME in group.commands
+
+
+@pytest.mark.parametrize("program", sorted(PROGRAMS))
+def test_main_completes_plugin_command_names(
+    program, monkeypatch, capsys, restore_cli_commands
+):
+    package, _, entry_point_group, _ = PROGRAMS[program]
+
+    @click.command()
+    def fixture_command():
+        pass
+
+    _install_fixture_entry_point(monkeypatch, entry_point_group, fixture_command)
+    complete_variable = f"_{program.upper().replace('-', '_')}_COMPLETE"
+    monkeypatch.setenv(complete_variable, "bash_complete")
+    monkeypatch.setenv("COMP_WORDS", f"{program} fixture")
+    monkeypatch.setenv("COMP_CWORD", "1")
+    monkeypatch.setattr(sys, "argv", [program])
+
+    with pytest.raises(SystemExit):
+        package.main()
+
+    assert f"plain,{FIXTURE_COMMAND_NAME}" in capsys.readouterr().out
+
+
+@pytest.mark.parametrize("program", sorted(PROGRAMS))
+def test_main_still_loads_commands_from_a_file(
+    program, monkeypatch, capsys, tmp_path, restore_cli_commands
+):
+    package, _, entry_point_group, _ = PROGRAMS[program]
+    command_path = tmp_path / "case_summary.py"
+    command_path.write_text(CASE_SUMMARY_COMMAND, encoding="utf-8")
+    _install_fixture_entry_point(
+        monkeypatch, entry_point_group, click.Command("unused")
+    )
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        _offline_argv(program, "--load-command", str(command_path), "case-summary"),
+    )
+
+    with pytest.raises(SystemExit) as exit_info:
+        package.main()
+
+    assert exit_info.value.code == 0
+    assert "case summary ran" in capsys.readouterr().out
+
+
+@pytest.mark.parametrize("program", sorted(PROGRAMS))
+def test_main_loads_commands_from_the_environment_variable(
+    program, monkeypatch, capsys, tmp_path, restore_cli_commands
+):
+    # Each CLI reads its own variable, so a main() reading another CLI's would
+    # go unnoticed without this.
+    package, _, _, environment_variable = PROGRAMS[program]
+    command_path = tmp_path / "case_summary.py"
+    command_path.write_text(CASE_SUMMARY_COMMAND, encoding="utf-8")
+    monkeypatch.setenv(environment_variable, str(command_path))
+    monkeypatch.setattr(sys, "argv", _offline_argv(program, "case-summary"))
+
+    with pytest.raises(SystemExit) as exit_info:
+        package.main()
+
+    assert exit_info.value.code == 0
+    assert "case summary ran" in capsys.readouterr().out
+
+
+@pytest.mark.parametrize("program", sorted(PROGRAMS))
+def test_main_ignores_the_entry_point_groups_of_the_other_programs(
+    program, monkeypatch, capsys, restore_cli_commands
+):
+    package, group, _, _ = PROGRAMS[program]
+    _install_fixture_entry_point(
+        monkeypatch,
+        OTHER_PROGRAMS_GROUP[program],
+        click.Command(FIXTURE_COMMAND_NAME),
+    )
+    monkeypatch.setattr(sys, "argv", _offline_argv(program, "--help"))
+
+    with pytest.raises(SystemExit) as exit_info:
+        package.main()
+
+    assert exit_info.value.code == 0
+    assert FIXTURE_COMMAND_NAME not in group.commands
+    assert FIXTURE_COMMAND_NAME not in capsys.readouterr().out
+
+
+def test_the_console_script_targets_are_importable():
+    # [project.scripts] points at these, so they must stay where they are.
+    assert mvt.cli.main is mvt_main
+    assert mvt.ios.main is ios_main
+    assert mvt.android.main is android_main
+
+
+def test_importing_mvt_does_not_import_a_cli(tmp_path):
+    # The mvt package deliberately re-exports nothing of mvt.cli, so that
+    # importing MVT stays cheap and free of side effects.
+    result = run_isolated_python(
+        "import sys\n"
+        "import mvt\n"
+        "print('imported a cli' if 'mvt.cli' in sys.modules else 'imported mvt')\n",
+        home=tmp_path / "home",
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.strip() == "imported mvt"
+
+
+def test_importing_mvt_does_not_run_installed_plugins(tmp_path):
+    site_path = write_cli_plugin_distribution(
+        tmp_path / "site", IOS_CLI_PLUGIN_GROUP, MARKER_PLUGIN_TEMPLATE
+    )
+    marker = tmp_path / "plugin-imported"
+
+    result = run_isolated_python(
+        "import mvt.ios.cli\nimport mvt.android.cli\nprint('imported')",
+        home=tmp_path / "home",
+        site_path=site_path,
+        FIXTURE_PLUGIN_MARKER=str(marker),
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert "imported" in result.stdout
+    assert not marker.exists()
+
+
+def test_registering_the_plugins_runs_the_entry_point(tmp_path):
+    site_path = write_cli_plugin_distribution(
+        tmp_path / "site", IOS_CLI_PLUGIN_GROUP, MARKER_PLUGIN_TEMPLATE
+    )
+    marker = tmp_path / "plugin-imported"
+
+    result = run_isolated_python(
+        "import click\n"
+        "from mvt.common.cli_plugins import (\n"
+        "    IOS_CLI_PLUGIN_GROUP,\n"
+        "    BrokenPluginCommand,\n"
+        "    register_installed_cli_commands,\n"
+        ")\n"
+        "group = click.Group()\n"
+        "register_installed_cli_commands(group, IOS_CLI_PLUGIN_GROUP)\n"
+        f"command = group.commands[{FIXTURE_COMMAND_NAME!r}]\n"
+        "assert not isinstance(command, BrokenPluginCommand), command.help\n"
+        "print('registered')\n",
+        home=tmp_path / "home",
+        site_path=site_path,
+        FIXTURE_PLUGIN_MARKER=str(marker),
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert "registered" in result.stdout
+    assert marker.exists()

tests/test_cli_startup.py

@@ -0,0 +1,28 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import pytest
+
+from .plugin_fixtures import run_isolated_python
+
+# Importing a platform CLI must only build its command tree: the console
+# scripts import it before Click can answer a shell completion request, which
+# the completion scripts make on every keystroke. Every command imports what
+# it runs when it is invoked. Each of these costs tens of milliseconds to
+# import and is the sign that a command implementation is imported too early.
+HEAVY_MODULES = ("pydantic", "requests", "Crypto", "mvt.common.module")
+
+
+@pytest.mark.parametrize("cli_module", ("mvt.ios.cli", "mvt.android.cli"))
+def test_importing_a_cli_does_not_import_the_module_machinery(cli_module, tmp_path):
+    result = run_isolated_python(
+        "import sys\n"
+        f"import {cli_module}\n"
+        f"print(','.join(name for name in {HEAVY_MODULES!r} if name in sys.modules))\n",
+        home=tmp_path / "home",
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.strip() == "", f"{cli_module} imported {result.stdout.strip()}"

tests/test_cli_verbose.py

@@ -0,0 +1,107 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+import pytest
+from click.testing import CliRunner
+
+from mvt.android.cli import cli as android_cli
+from mvt.cli import cli as mvt_cli
+from mvt.common.log import MVTLogHandler
+from mvt.common.utils import set_verbose_logging
+from mvt.ios.cli import cli as ios_cli
+
+# Keep the banner of the group callback from checking for updates online.
+OFFLINE = ["--disable-update-check", "--disable-indicator-update-check"]
+
+PROGRAMS = {"mvt": mvt_cli, "mvt-ios": ios_cli, "mvt-android": android_cli}
+
+
+@pytest.fixture(autouse=True)
+def _reset_console_level():
+    """Leave the console handler at its default level after every test."""
+    yield
+    set_verbose_logging(False)
+
+
+def _console_level():
+    """Return the level of MVT's own console log handler."""
+    for handler in logging.getLogger("mvt").handlers:
+        if isinstance(handler, MVTLogHandler):
+            return handler.level
+    raise AssertionError("MVT has no console log handler")
+
+
+class TestVerboseOnTheCommands:
+    @pytest.mark.parametrize("program", sorted(PROGRAMS))
+    def test_verbose_before_the_command_name_turns_on_debug(self, program):
+        cli = PROGRAMS[program]
+
+        result = CliRunner().invoke(cli, [*OFFLINE, "--verbose", "version"])
+
+        assert result.exit_code == 0
+        assert _console_level() == logging.DEBUG
+
+    @pytest.mark.parametrize("program", sorted(PROGRAMS))
+    def test_a_run_without_verbose_goes_back_to_info(self, program):
+        cli = PROGRAMS[program]
+        CliRunner().invoke(cli, [*OFFLINE, "--verbose", "version"])
+
+        result = CliRunner().invoke(cli, [*OFFLINE, "version"])
+
+        assert result.exit_code == 0
+        assert _console_level() == logging.INFO
+
+    def test_mvt_verbose_without_a_command_prints_the_help(self):
+        result = CliRunner().invoke(mvt_cli, [*OFFLINE, "--verbose"])
+
+        assert result.exit_code == 0
+        assert "Usage:" in result.output
+        assert _console_level() == logging.DEBUG
+
+
+class TestVerboseOnTheCheckCommands:
+    def test_ios_command_default_does_not_undo_the_cli_choice(self, tmp_path):
+        result = CliRunner().invoke(
+            ios_cli,
+            [*OFFLINE, "--verbose", "check-backup", "--list-modules", str(tmp_path)],
+        )
+
+        assert result.exit_code == 0
+        assert _console_level() == logging.DEBUG
+
+    def test_ios_verbose_after_the_command_name_still_works(self, tmp_path):
+        result = CliRunner().invoke(
+            ios_cli,
+            [*OFFLINE, "check-backup", "--verbose", "--list-modules", str(tmp_path)],
+        )
+
+        assert result.exit_code == 0
+        assert _console_level() == logging.DEBUG
+
+    def test_android_command_default_does_not_undo_the_cli_choice(self, tmp_path):
+        result = CliRunner().invoke(
+            android_cli,
+            [*OFFLINE, "--verbose", "check-bugreport", "--list-modules", str(tmp_path)],
+        )
+
+        assert result.exit_code == 0
+        assert _console_level() == logging.DEBUG
+
+    def test_android_verbose_after_the_command_name_still_works(self, tmp_path):
+        result = CliRunner().invoke(
+            android_cli,
+            [*OFFLINE, "check-bugreport", "--verbose", "--list-modules", str(tmp_path)],
+        )
+
+        assert result.exit_code == 0
+        assert _console_level() == logging.DEBUG
+
+    def test_the_command_option_says_it_is_kept_for_compatibility(self):
+        result = CliRunner().invoke(ios_cli, [*OFFLINE, "check-backup", "--help"])
+
+        assert result.exit_code == 0
+        assert "kept for compatibility" in result.output

tests/test_cmd_check_sysdiagnose.py

@@ -34,6 +34,7 @@ def _create_sysdiagnose_folder(tmp_path):
         "sysdiagnose_2024.01.02_03-04-05+0200.tar.gz", encoding="utf-8"
     )
     (folder / "report.ips").write_text('{"bug_type": 210}\nbody', encoding="utf-8")
+    (folder / "._artifact.txt").write_bytes(b"\x00\x05\x16\x07AppleDouble")
     return folder
 
 
@@ -45,6 +46,11 @@ def _create_sysdiagnose_archive(tmp_path, folder):
     return archive_path
 
 
+def _test_module(command):
+    (module,) = [m for m in command.executed if isinstance(m, SysdiagnoseTestModule)]
+    return module
+
+
 def _run_command(path):
     command = CmdIOSCheckSysdiagnose(
         target_path=str(path), custom_modules=[SysdiagnoseTestModule]
@@ -56,30 +62,30 @@ def _run_command(path):
 def test_check_sysdiagnose_from_folder(tmp_path):
     command = _run_command(_create_sysdiagnose_folder(tmp_path))
 
-    assert command.executed[0].results == [
+    assert _test_module(command).results == [
         {"content": "artifact", "timezone_offset": timedelta(hours=2).seconds}
     ]
-    assert command.executed[0].ips_files == [
+    assert _test_module(command).ips_files == [
         {"file_path": str(tmp_path / "sysdiagnose" / "report.ips"), "bug_type": 210}
     ]
+    assert "sysdiagnose/._artifact.txt" not in command.sysdiagnose_files
 
 
 def test_check_sysdiagnose_from_archive_closes_archive(tmp_path):
     folder = _create_sysdiagnose_folder(tmp_path)
     command = _run_command(_create_sysdiagnose_archive(tmp_path, folder))
 
-    assert command.executed[0].results == [
+    assert _test_module(command).results == [
         {"content": "artifact", "timezone_offset": timedelta(hours=2).seconds}
     ]
-    assert command.executed[0].ips_files == [
+    assert _test_module(command).ips_files == [
         {
-            "file_path": str(
-                Path(command.extracted_sysdiagnose_path) / "report.ips"
-            ),
+            "file_path": str(Path(command.extracted_sysdiagnose_path) / "report.ips"),
             "bug_type": 210,
         }
     ]
     assert command.sysdiagnose_archive is None
+    assert "sysdiagnose/._artifact.txt" not in command.sysdiagnose_files
 
 
 def test_archive_is_extracted_once_and_unsafe_members_are_skipped(tmp_path):
@@ -110,7 +116,7 @@ def test_archive_is_extracted_once_and_unsafe_members_are_skipped(tmp_path):
         module = SysdiagnoseExtraction()
         command.module_init(module)
         assert module.tar is None
-        assert module.parent_path == str(extracted_path.parent)
+        assert Path(module.parent_path) == extracted_path.parent
     finally:
         command.finish()
 

tests/test_completion.py

@@ -6,56 +6,61 @@
 from click.testing import CliRunner
 
 from mvt.android.cli import cli as android_cli
+from mvt.cli import cli as mvt_cli
 from mvt.ios.cli import cli as ios_cli
 
 
 class TestCompletionCommand:
     def test_completion_prints_instructions_by_default(self):
         runner = CliRunner()
-        result = runner.invoke(ios_cli, ["completion"])
+        result = runner.invoke(mvt_cli, ["completion"])
 
         assert result.exit_code == 0
-        assert "Shell completion for mvt-ios" in result.output
-        assert "mvt-ios completion bash > ~/.mvt-ios-complete.bash" in result.output
+        assert "Shell completion for mvt, mvt-ios and mvt-android" in result.output
+        assert "mvt completion bash > ~/.mvt-complete.bash" in result.output
         assert "Mobile Verification Toolkit" not in result.output
 
-    def test_completion_prints_bash_script(self):
+    def test_completion_bash_script_covers_every_cli(self):
         runner = CliRunner()
-        result = runner.invoke(ios_cli, ["completion", "bash"])
+        result = runner.invoke(mvt_cli, ["completion", "bash"])
 
         assert result.exit_code == 0
+        assert "_MVT_COMPLETE=bash_complete" in result.output
         assert "_MVT_IOS_COMPLETE=bash_complete" in result.output
+        assert "_MVT_ANDROID_COMPLETE=bash_complete" in result.output
         assert "complete -o nosort" in result.output
-        assert "mvt-ios" in result.output
         assert "Mobile Verification Toolkit" not in result.output
 
-    def test_completion_prints_fish_script(self):
+    def test_completion_fish_script_covers_every_cli(self):
         runner = CliRunner()
-        result = runner.invoke(android_cli, ["completion", "fish"])
+        result = runner.invoke(mvt_cli, ["completion", "fish"])
 
         assert result.exit_code == 0
-        assert "_MVT_ANDROID_COMPLETE=fish_complete" in result.output
+        assert "complete --no-files --command mvt-ios" in result.output
         assert "complete --no-files --command mvt-android" in result.output
+        assert "complete --no-files --command mvt " in result.output
         assert "Mobile Verification Toolkit" not in result.output
 
     def test_completion_install_updates_bashrc_once(self, tmp_path, monkeypatch):
         monkeypatch.setenv("HOME", str(tmp_path))
+        monkeypatch.setenv("USERPROFILE", str(tmp_path))
         runner = CliRunner()
 
-        result = runner.invoke(ios_cli, ["completion", "bash", "--install"])
+        result = runner.invoke(mvt_cli, ["completion", "bash", "--install"])
         assert result.exit_code == 0
 
-        script_path = tmp_path / ".mvt-ios-complete.bash"
+        script_path = tmp_path / ".mvt-complete.bash"
         bashrc_path = tmp_path / ".bashrc"
         assert script_path.exists()
-        assert "_MVT_IOS_COMPLETE=bash_complete" in script_path.read_text(
-            encoding="utf-8"
-        )
+        script = script_path.read_text(encoding="utf-8")
+        assert "_MVT_COMPLETE=bash_complete" in script
+        assert "_MVT_IOS_COMPLETE=bash_complete" in script
+        assert "_MVT_ANDROID_COMPLETE=bash_complete" in script
         bashrc = bashrc_path.read_text(encoding="utf-8")
         assert "[ -f" in bashrc
-        assert ".mvt-ios-complete.bash" in bashrc
+        assert ".mvt-complete.bash" in bashrc
 
-        result = runner.invoke(ios_cli, ["completion", "bash", "--install"])
+        result = runner.invoke(mvt_cli, ["completion", "bash", "--install"])
         assert result.exit_code == 0
         assert bashrc_path.read_text(encoding="utf-8") == bashrc
 
@@ -63,16 +68,33 @@ class TestCompletionCommand:
         self, tmp_path, monkeypatch
     ):
         monkeypatch.setenv("HOME", str(tmp_path))
+        monkeypatch.setenv("USERPROFILE", str(tmp_path))
         runner = CliRunner()
 
-        result = runner.invoke(android_cli, ["completion", "fish", "--install"])
+        result = runner.invoke(mvt_cli, ["completion", "fish", "--install"])
 
         assert result.exit_code == 0
-        script_path = (
-            tmp_path / ".config" / "fish" / "completions" / "mvt-android.fish"
-        )
+        script_path = tmp_path / ".config" / "fish" / "conf.d" / "mvt-completion.fish"
         assert script_path.exists()
-        assert "_MVT_ANDROID_COMPLETE=fish_complete" in script_path.read_text(
-            encoding="utf-8"
-        )
+        script = script_path.read_text(encoding="utf-8")
+        assert "_MVT_COMPLETE=fish_complete" in script
+        assert "_MVT_IOS_COMPLETE=fish_complete" in script
+        assert "_MVT_ANDROID_COMPLETE=fish_complete" in script
         assert not (tmp_path / ".fishrc").exists()
+        assert not (tmp_path / ".bashrc").exists()
+        assert not (tmp_path / ".zshrc").exists()
+
+    def test_completion_install_without_shell_is_a_usage_error(self):
+        runner = CliRunner()
+        result = runner.invoke(mvt_cli, ["completion", "--install"])
+
+        assert result.exit_code == 2
+        assert "A shell is required when using --install." in result.output
+
+    def test_completion_is_not_a_command_of_the_platform_clis(self):
+        runner = CliRunner()
+
+        assert "completion" not in ios_cli.commands
+        assert "completion" not in android_cli.commands
+        assert runner.invoke(ios_cli, ["completion"]).exit_code == 2
+        assert runner.invoke(android_cli, ["completion"]).exit_code == 2