besendorf
b795ea3129
Add root_binaries androidqf module ( #676 )
...
* Add root_binaries androidqf module
* Fix AndroidQF file count test
* fix ruff
---------
Co-authored-by: User <user@DESKTOP-3T8T346.localdomain >
2025-10-23 15:12:01 +02:00
Tek
4757cff262
Fixes date parsing issue in tombstones ( #635 )
2025-06-12 20:49:31 +02:00
Donncha Ó Cearbhaill
b184eeedf4
Handle XML encoded ADB keystore and fix parsing bugs ( #605 )
2025-02-07 02:00:24 +01:00
Donncha Ó Cearbhaill
b7595b62eb
Add initial tombstone parser
...
This supports parsing tombstone files from Android bugreports. The parser
can load both the legacy text format and the new binary protobuf format.
2025-02-06 20:07:05 +01:00
Donncha Ó Cearbhaill
02c02ca15c
Merge branch 'main' into feature/tombstone-parser
2025-02-03 18:44:00 +01:00
tes
9d81b5bfa8
Add a module to parse uninstalled apps from dumpsys data, for both bugreport and AndroidQF output, and match them against package name IoCs.
2024-12-11 16:47:19 -03:00
Donncha Ó Cearbhaill
bc09e2a394
Initial tests for tombstone parsing
2024-10-28 10:51:58 +01:00
Donncha Ó Cearbhaill
3afe218c7c
Add support for check APK certificate hash IOCs ( #557 )
...
* Fix bug loading indicators which I introduced in 81b647b
2024-10-18 16:35:50 +02:00
Donncha Ó Cearbhaill
665806db98
Add initial parser for ADB state in Dumpsys ( #547 )
...
* Add initial parser for ADB dumpsys
* Add ADBState tests and support for AndroidQF and
check-adb
* Handle case where ADB is not available in device dumpsys
2024-10-18 15:31:25 +02:00
Tek
a03f4e55ff
Adds androidqf files module ( #541 )
...
* Adds androidqf files module
* Add new files module to module list
---------
Co-authored-by: Donncha Ó Cearbhaill <donncha.ocearbhaill@amnesty.org >
2024-10-17 18:32:23 +02:00
Donncha Ó Cearbhaill
81b647beac
Add basic support for IP indicators in MVT ( #556 )
...
* Add prelimary ipv4-addr ioc matching support under collection domains
* Add IP addresses as a valid IOC type
This currently just supports IPv4 addresses which
are treated as domains internally in MVT.
---------
Co-authored-by: renini <renini@local>
2024-10-17 18:20:17 +02:00
Tek
052c4e207b
Improves STIX2 support and testing ( #523 )
...
* Improves STIX2 support and testing
* Adds documentation on STIX2 support in MVT
---------
Co-authored-by: Donncha Ó Cearbhaill <donncha.ocearbhaill@amnesty.org >
2024-10-16 16:47:10 +02:00
Rory Flynn
caeeec2816
Add packages module for androidqf ( #506 )
...
* Add Packages module for androidqf
* Update test
2024-06-24 19:00:07 +02:00
Rory Flynn
a6d32e1c88
Fix dumpsys accessibility detections for v14+ ( #483 )
2024-05-19 22:27:28 +02:00
Rory Flynn
2838bac63f
Circular reference in SMS module serialization ( #444 )
...
* Fix circular reference in SMS module serialization
* Modify SMS test artifact to include date_read
2024-01-03 18:55:32 +01:00
Nex
9988887d27
Updated copyright notice
2023-09-09 17:55:27 +02:00
tek
a2ee46b8f8
Refactors dumpsys receiver parsing into an artifact
2023-08-08 20:23:09 +02:00
tek
e60e5fdc6e
Refactors DumpsysBatteryHistory and adds related androidqf module
2023-08-04 19:20:14 +02:00
tek
7e0e071c5d
Refactor DumpsysBatteryDaily module and add related artifact
2023-08-04 16:17:52 +02:00
tek
9a831b5930
Adds GlobalPreferences iOS module
2023-08-02 15:28:16 +02:00
tek
6356a4ff87
Refactor code of DumpsysDBInfo
2023-07-31 23:43:20 +02:00
tek
f96f2fe34a
refactor dumpsys package activity code
2023-07-31 18:38:41 +02:00
tek
4c175530a8
Refactor dumpsys accessibility in an artifact
2023-07-27 19:42:06 +02:00
Tek
3ec3b86a45
Adds support for zip files in check-androidqf command ( #372 )
2023-07-26 13:53:54 +02:00
Donncha Ó Cearbhaill
57d4aca72e
Refactor Android modules to remove duplication ( #368 )
...
* Remove duplicated detection logic from GetProp modules
* Deduplicate settings and processes
* Refactor detection in artifacts
* Improves Artifact class
---------
Co-authored-by: tek <tek@randhome.io >
2023-07-26 13:42:17 +02:00
Donncha Ó Cearbhaill
a2386dbdf7
Refactor Android backup password handling and add tests
2023-07-22 19:17:27 +02:00
tek
e7270d6a07
Fixes import and adds test for PR 361
2023-07-10 22:55:22 +02:00
Nex
e1677639c4
Linted code using isort + autoflake + black, fixed wrong use of Optional[bool]
2023-06-01 23:40:26 +02:00
tek
33d092692e
Adds calendar iOS plugin
2023-04-12 10:21:17 +02:00
tek
b5d7e528de
Adds indicators for android properties
2023-03-29 12:57:41 +02:00
tek
81ed0b0c19
Update copyright information
2023-02-08 20:18:16 +01:00
tek
1042354be5
Adds serializing to iOS module webkit_resource_load_statistics
2023-01-13 12:58:26 +01:00
tek
66c015bc23
Improves check-androidqf tests
2022-10-11 13:07:24 +02:00
tek
ba0106c476
Adds SMS androidqf module and improves tests
2022-10-11 12:41:42 +02:00
tek
5356a399c9
Moves dumpsys parsing to android parsers and use the same parser for adb and bugreport modules
2022-08-17 18:24:51 +02:00
tek
5fe88098b9
Improves dumpsys battery history parsing
2022-08-16 18:57:18 +02:00
tek
0622357a64
Adds support for MMS parsing in android backups
2022-06-23 11:05:04 +02:00
Nex
d82c788a18
Removed AUTHORS file in favor of explicit copyright notice
2022-05-08 14:53:50 +02:00
tek
9950b3d6c2
Add appops dumpsys parser and modules
2022-03-30 01:16:22 +02:00
tek
0d5377597f
Merge branch 'main' into feature/read-sms-adb-backup
2022-03-04 12:30:45 +01:00
tek
b07fb092aa
Adds tests for SMS module
2022-03-01 13:11:50 +01:00
tek
639c163297
Adds partial compression support in Android Backup parsing
2022-02-23 16:18:45 +01:00
tek
8eb30e3a02
Improves android backup parsing for check-backup and check-adb
2022-02-23 15:07:13 +01:00
Nex
eb5f07a75d
Updated copyright notice
2022-01-30 20:15:01 +01:00
Yallxe
43b1612dfe
Set utf-8 as an encoding for open()
...
Not every system uses 'utf-8' as a default encoding for opening files in Python.
Before you say that there must be a way to set default encoding in one line, no, there is not. At least, I didn't found a way to do this.
2022-01-29 12:18:18 +01:00
tek
cf88740f6a
Fixes bugs in SafariBrowserState module and add tests
2022-01-26 14:50:34 +01:00
tek
95205d8e17
Adds indicators check to iOS TCC module
2022-01-18 17:12:20 +01:00
Nex
1460828c30
Uniforming style in test units
2022-01-18 16:33:13 +01:00
Nex
b697874f56
Conforming the test files
2022-01-18 16:00:03 +01:00
Donncha Ó Cearbhaill
e85c70c603
Generate stix2 for each test run
2022-01-07 17:51:21 +01:00
