Initial commit of anonymous usage telemetry

.github/workflows/add-issue-to-project.yml

@@ -11,7 +11,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1
+      - uses: actions/add-to-project@v0.5.0
         with:
           # You can target a project in a different organization
           # to the issue

.github/workflows/mypy.yml

@@ -7,13 +7,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v4
         with:
           python-version: 3.9
           cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
       - name: Install Dependencies
         run: |
           pip install mypy

.github/workflows/publish-release-docker.yml

@@ -4,8 +4,6 @@ name: Create and publish a Docker image
 # Configures this workflow to run every time a release is published.
 on:
   workflow_dispatch:
-  push:
-    branches: [main]
   release:
     types: [published]
 
@@ -25,18 +23,9 @@ jobs:
       attestations: write
       id-token: write
       #
-    strategy:
-      matrix:
-        platform:
-          - dockerfile: "Dockerfile"
-            tag-suffix: ""
-          - dockerfile: "Dockerfile.ios"
-            tag-suffix: "-ios"
-          - dockerfile: "Dockerfile.android"
-            tag-suffix: "-android"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
       # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
       - name: Log in to the Container registry
         uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
@@ -47,33 +36,26 @@ jobs:
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=latest,enable={{ is_default_branch }},suffix=${{ matrix.platform.tag-suffix }}
-            type=raw,enable=${{ github.event_name == 'release' || github.ref_type == 'tag' }},value=stable,suffix=${{ matrix.platform.tag-suffix }}
-            type=raw,enable=${{ github.event_name == 'release' }},value=${{ github.event.release.tag_name }},suffix=${{ matrix.platform.tag-suffix }}
-            type=raw,enable=${{ github.ref_type == 'tag' }},value=${{ github.ref_name }},suffix=${{ matrix.platform.tag-suffix }}
-            type=sha,suffix=${{ matrix.platform.tag-suffix }}
-            type=sha,format=long,suffix=${{ matrix.platform.tag-suffix }}
-      # This step sets up some additional capabilities to generate the provenance and sbom attestations
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
         with:
-          file: ${{ matrix.platform.dockerfile }}
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: mode=max
-          sbom: true
+
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
 

.github/workflows/ruff.yml

@@ -11,13 +11,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Setup Python
         uses: actions/setup-python@v4
         with:
           python-version: 3.9
           cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
       - name: Install Dependencies
         run: |
           pip install ruff

.github/workflows/tests.yml

@@ -12,12 +12,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install Python dependencies

.github/workflows/update-ios-data.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Run script to fetch latest iOS releases from Apple RSS feed.
         run: python3 .github/workflows/scripts/update-ios-releases.py
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@v5
         with:
           title: '[auto] Update iOS releases and versions'
           commit-message: Add new iOS versions and build numbers
@@ -27,4 +27,4 @@ jobs:
           add-paths: |
             *.json
           labels: |
-            automated pr
+            automated pr

Dockerfile

@@ -1,6 +1,6 @@
 # Base image for building libraries
 # ---------------------------------
-FROM ubuntu:22.04 AS build-base
+FROM ubuntu:22.04 as build-base
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -22,7 +22,7 @@ RUN apt-get update \
 
 # libplist
 # --------
-FROM build-base AS build-libplist
+FROM build-base as build-libplist
 
 # Build
 RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
@@ -32,7 +32,7 @@ RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
 
 # libimobiledevice-glue
 # ---------------------
-FROM build-base AS build-libimobiledevice-glue
+FROM build-base as build-libimobiledevice-glue
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -45,7 +45,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd li
 
 # libtatsu
 # --------
-FROM build-base AS build-libtatsu
+FROM build-base as build-libtatsu
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -58,7 +58,7 @@ RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
 
 # libusbmuxd
 # ----------
-FROM build-base AS build-libusbmuxd
+FROM build-base as build-libusbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -72,7 +72,7 @@ RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
 
 # libimobiledevice
 # ----------------
-FROM build-base AS build-libimobiledevice
+FROM build-base as build-libimobiledevice
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -88,7 +88,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimob
 
 # usbmuxd
 # -------
-FROM build-base AS build-usbmuxd
+FROM build-base as build-usbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -103,7 +103,7 @@ RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
 
 
 # Create main image
-FROM ubuntu:24.04 AS main
+FROM ubuntu:24.04 as main
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"

Dockerfile.android

@@ -1,5 +1,5 @@
 # Create main image
-FROM python:3.10.14-alpine3.20 AS main
+FROM python:3.10.14-alpine3.20 as main
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"

Dockerfile.ios

@@ -1,6 +1,6 @@
 # Base image for building libraries
 # ---------------------------------
-FROM ubuntu:22.04 AS build-base
+FROM ubuntu:22.04 as build-base
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -22,7 +22,7 @@ RUN apt-get update \
 
 # libplist
 # --------
-FROM build-base AS build-libplist
+FROM build-base as build-libplist
 
 # Build
 RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
@@ -32,7 +32,7 @@ RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
 
 # libimobiledevice-glue
 # ---------------------
-FROM build-base AS build-libimobiledevice-glue
+FROM build-base as build-libimobiledevice-glue
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -45,7 +45,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd li
 
 # libtatsu
 # --------
-FROM build-base AS build-libtatsu
+FROM build-base as build-libtatsu
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -58,7 +58,7 @@ RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
 
 # libusbmuxd
 # ----------
-FROM build-base AS build-libusbmuxd
+FROM build-base as build-libusbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -72,7 +72,7 @@ RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
 
 # libimobiledevice
 # ----------------
-FROM build-base AS build-libimobiledevice
+FROM build-base as build-libimobiledevice
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -88,7 +88,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimob
 
 # usbmuxd
 # -------
-FROM build-base AS build-usbmuxd
+FROM build-base as build-usbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -104,7 +104,7 @@ RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
 
 # Main image
 # ----------
-FROM python:3.10.14-alpine3.20 AS main
+FROM python:3.10.14-alpine3.20 as main
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"

Makefile

@@ -1,9 +1,14 @@
 PWD = $(shell pwd)
 
+autofix:
+	ruff format .
+	ruff check --fix .
+
 check: ruff mypy
 
 ruff:
-	ruff check .
+	ruff format --check .
+	ruff check -q .
 
 mypy:
 	mypy

SECURITY.md

@@ -2,61 +2,4 @@
 
 Thank you for your interest in reporting security issues and vulnerabilities! Security research is of utmost importance and we take all reports seriously. If you discover an issue please report it to us right away!
 
-Please DO NOT file a public issue, instead send your report privately to the MVT maintainers at Amnesty International via `security [at] amnesty [dot] tech`.
-
-You can also write PGP-encrypted emails to key `CFBF9698DCA8EB2A80F48ADEA035A030FA04ED13`. The corresponding PGP public key is lited below.
-
-```
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGlFPwsBEADQ+d7SeHrFPYv3wPOjWs2oMpp0DPdfIyGbg+iYWOC36FegZhKY
-+WeK96GqJWt8wD6kwFUVwQI795WZrjSd1q4a7wR+kj/h7xlRB6ZfVICA6O5DOOm6
-GNMvqy7ESm8g1XZDpb2u1BXmSS9X8f6rjB0e86kYsF1mB5/2USTM63jgDs0GGTkZ
-Q1z4Mq4gYyqH32b3gvXkbb68LeQmONUIM3cgmec9q8/pNc1l7fcoLWhOVADRj17Q
-plisa/EUf/SYqdtk9w7EHGggNenKNwVM235mkPcMqmE72bTpjT6XCxvZY3ByG5yi
-7L+tHJU45ZuXtt62EvX03azxThVfSmH/WbRk8lH8+CW8XMmiWZphG4ydPWqgVKCB
-2UOXm+6CQnKA+7Dt1AeK2t5ciATrv9LvwgSxk5WKc3288XFLA6eGMrTdQygYlLjJ
-+42RSdK/7fCt/qk4q13oUw8ZTVcCia98uZFi704XuuYTH6NrntIB7j/0oucIS4Y9
-cTWNO5LBerez4v8VI4YHcYESPeIWGFkXhvJzo0VMg1zidBLtiPoGF2JKZGwaK7/p
-yY1xALskLp4H+5OY4eB1kf8kl4vGsEK8xA/NNzOiapVmwBXpvVvmXIQJE2k+olNf
-sAuyB8+aO1Ws7tFYt3D+olC7iaprOdK7uA4GCgmYYhq6QQPg+cxfczgHfwARAQAB
-tD1TZWN1cml0eSBMYWIgYXQgQW1uZXN0eSBJbnRlcm5hdGlvbmFsIDxzZWN1cml0
-eUBhbW5lc3R5LnRlY2g+iQJRBBMBCAA7FiEEz7+WmNyo6yqA9IreoDWgMPoE7RMF
-AmlFPwsCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQoDWgMPoE7RNr
-2w//a88uP90uSN6lgeIwKsHr1ri27QIBbzCV6hLN/gZBFR2uaiOn/xfFDbnR0Cjo
-5nMCJCT1k4nrPbMTlfmWLCD+YKELBzVqWlw4J2SOg3nznPl2JrL8QBKjwts0sF+h
-QbRWDsT54wBZnl6ZJJ79eLShNTokBbKnQ7071dMrENr5e2P2sClQXyiIc51ga4FM
-fHyhsx+GsrdiZNd2AH8912ljW1GuEi3epTO7KMZprmr37mjpZSUToiV59Yhl1Gbo
-2pixkYJqi62DG02/gTpCjq9NH3cEMxcxjh4E7yCA8ggLG6+IN6woIvPIdOsnQ+Yj
-d3H4rMNBjPSKoL+bdHILkCnp5HokcbVjNY3QAyOAF4qWhk4GtgpTshwxUmb4Tbay
-tWLJC2bzjuUBxLkGzMVFfU3B96sVS4Fi0sBaEMBtHskl2f45X8LJhSq//Lw/2L/8
-34uP/RxDSn+DPvj/yqMpekdCcmeFSTX1A19xkPcc0rVhMRde4VL338R86vzh0gMI
-1LySDAhXZyVWzrQ5s3n6N3EvCaHCn3qu7ieyFJifCSR7gZqevCEznMQRVpkMTzUt
-rk13Z6NOOb4IlTW7HFoY3omJG8Z5jV4kMIE7n6nb0qpNYQiG+YvjenQ3VrMoISyh
-lpS2De8+oOtwrxBVX3+qKWvQqzufeE3416kw2Z+5mxH7bx25Ag0EaUU/CwEQALyZ
-b+kwLN1yHObTm2yDBEn5HbCT3H1GremvPNmbAaTnfrjUngoKa8MuWWzbX5ptgmZR
-UpYY/ylOYcgGydz58vUNrPlhIZT9UhmiifPgZLEXyd0uFpr/NsbRajHMkK10iEZf
-h5bHNobiB7pGCu4Uj9e1cMiIZ4yEaYeyXYUoNHf6ISP39mJhHy6ov5yIpm9q0wzm
-tGUQPupxGXmEZlOPr3lxqXQ3Ekdv6cWDY5r/oOq71QJ/HUQ13QUuGFIbhnMbT8zd
-zaS6f/v772YKsWPc4NNUhtlf25VnQ4FuUtjCe3p6iYP4OVD8gJm0GvXyvyTuiQbL
-CSk/378JiNT7nZzYXxrWchMwvEoMIU55+/UaBc50HI5xvDQ858CX7PYGiimcdsO1
-EkQzhVxRfjlILfWrC2lgt+H5qhTn4Fah250Xe1PnLjXGHVUQnY/f3MFeiWQgf92b
-02+MfvOeC5OKttP1z5lcx6RFWCIa1E/u8Nj7YrH9hk0ZBRAnBaeAncDFY8dfX2zX
-VMoc0dV16gM7RrZ6i7D3CG3eLLkQlX0jbW9dzTuG/3f098EWB1p8vOfS/RbNCBRX
-jqGiqacL/aFF3Ci3nQ4O5tSv1XipbgrUhvXnwm9pxrLPS/45iaO59WN4RRGWLLQ7
-LHmeBxoa9avv0SdBYUL+eBxY46GXb/j5VLzHYhSnABEBAAGJAjYEGAEIACAWIQTP
-v5aY3KjrKoD0it6gNaAw+gTtEwUCaUU/CwIbDAAKCRCgNaAw+gTtEyvsEACnyFFD
-alOZTrrJTXNnUejuiExLh+qTO3T91p5bte597jpwCZnYGwkxEfffsqqhlY6ftEOf
-d5tNWE5isai4v8XCbplWomz4KBpepxcn2b+9o5dSyr1vohEFuCJziZDsta1J2DX5
-IE9U48kTgLDfdIBhuOyHNRkvXRHP2OVLCaiw4d9q+hlrraR8pehHt2BJSxh+QZoe
-n0iHvIZCBIUA45zLEGmXFpNTGeEf2dKPp3xOkAXOhAMPptE0V1itkF3R7kEW4aFO
-SZo8L3C1aWSz/gQ4/vvW5t1IJxirNMUgTMQFvqEkAwX3fm6GCxlgRSvTTRXdcrS8
-6qyFdH1nkCNsavPahN3N2RGGIlWtODEMTO1Hjy0kZtTYdW+JH9sendliCoJES+yN
-DjM125SgdAgrqlSYm/g8n9knWpxZv1QM6jU/sVz1J+l6/ixugL2i+CAL2d6uv4tT
-QmXnu7Ei4/2kHBUu3Lf59MNgmLHm6F7AhOWErszSeoJKsp+3yA1oTT/npz67sRzY
-VVyxz4NBIollna59a1lz0RhlWzNKqNB27jhylyM4ltdzHB7r4VMAVJyttozmIIOC
-35ucYxl5BHLuapaRSaYHdUId1LOccYyaOOFF/PSyCu9dKzXk7zEz2HNcIboWSkAE
-8ZDExMYM4WVpVCOj+frdsaBvzItHacRWuijtkw==
-=JAXX
------END PGP PUBLIC KEY BLOCK-----
-```
+Please DO NOT file a public issue, instead send your report privately to *nex [at] nex [dot] sx*. You can also write PGP-encrypted emails to [this key](https://keybase.io/nex/pgp_keys.asc?fingerprint=05216f3b86848a303c2fe37dd166f1667359d880).

docs/android/adb.md

@@ -16,12 +16,6 @@ Now you can try launching MVT with:
 mvt-android check-adb --output /path/to/results
 ```
 
-!!! warning
-    The `check-adb` command is deprecated and will be removed in a future release.
-    Whenever possible, prefer acquiring device data using the AndroidQF project (https://github.com/mvt-project/androidqf/) and then analyze those acquisitions with MVT.
-
-    Running `mvt-android check-adb` will also emit a runtime deprecation warning advising you to migrate to AndroidQF.
-
 If you have previously started an adb daemon MVT will alert you and require you to kill it with `adb kill-server` and relaunch the command.
 
 !!! warning
@@ -43,14 +37,6 @@ mvt-android check-adb --serial 192.168.1.20:5555 --output /path/to/results
 
 Where `192.168.1.20` is the correct IP address of your device.
 
-!!! warning
-    The `check-adb` workflow shown above is deprecated. If you can acquire an AndroidQF acquisition from the device (recommended), use the AndroidQF project to create that acquisition: https://github.com/mvt-project/androidqf/
-    
-    AndroidQF acquisitions provide a more stable, reproducible analysis surface and are the preferred workflow going forward.
-
 ## MVT modules requiring root privileges
 
-!!! warning
-    Deprecated: many `mvt-android check-adb` workflows are deprecated and will be removed in a future release. Whenever possible, prefer acquiring an AndroidQF acquisition using the AndroidQF project (https://github.com/mvt-project/androidqf/). 
-
 Of the currently available `mvt-android check-adb` modules a handful require root privileges to function correctly. This is because certain files, such as browser history and SMS messages databases are not accessible with user privileges through adb. These modules are to be considered OPTIONALLY available in case the device was already jailbroken. **Do NOT jailbreak your own device unless you are sure of what you are doing!** Jailbreaking your phone exposes it to considerable security risks!

docs/requirements.txt

@@ -2,4 +2,4 @@ mkdocs==1.6.1
 mkdocs-autorefs==1.4.3
 mkdocs-material==9.6.20
 mkdocs-material-extensions==1.3.1
-mkdocstrings==1.0.0
+mkdocstrings==0.30.1

pyproject.toml

@@ -17,25 +17,25 @@ classifiers = [
     "Programming Language :: Python",
 ]
 dependencies = [
-    "click==8.3.1",
+    "click==8.2.1",
     "rich==14.1.0",
     "tld==0.13.1",
-    "requests==2.33.1",
-    "simplejson==3.20.2",
-    "packaging==26.0",
+    "requests==2.32.4",
+    "simplejson==3.20.1",
+    "packaging==25.0",
     "appdirs==1.4.4",
     "iOSbackup==0.9.925",
     "adb-shell[usb]==0.4.4",
     "libusb1==3.3.1",
-    "cryptography==46.0.6",
+    "cryptography==45.0.6",
     "PyYAML>=6.0.2",
     "pyahocorasick==2.2.0",
     "betterproto==1.2.5",
-    "pydantic==2.12.5",
-    "pydantic-settings==2.13.1",
+    "pydantic==2.11.7",
+    "pydantic-settings==2.10.1",
     "NSKeyedUnArchiver==1.5.2",
     "python-dateutil==2.9.0.post0",
-    "tzdata==2025.3",
+    "tzdata==2025.2",
 ]
 requires-python = ">= 3.10"
 
@@ -80,9 +80,9 @@ packages = "src"
 addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
 testpaths = ["tests"]
 
-[tool.ruff]
-lint.select = ["C90", "E", "F", "W"] # flake8 default set
-lint.ignore = [
+[tool.ruff.lint]
+select = ["C90", "E", "F", "W"] # flake8 default set
+ignore = [
     "E501", # don't enforce line length violations
     "C901", # complex-structure
 

src/mvt/android/artifacts/dumpsys_battery_daily.py

@@ -14,23 +14,12 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
     """
 
     def serialize(self, record: dict) -> Union[dict, list]:
-        action = record.get("action", "update")
-        package_name = record["package_name"]
-        vers = record["vers"]
-
-        if vers == "0":
-            data = f"Recorded uninstall of package {package_name} (vers 0)"
-        elif action == "downgrade":
-            prev_vers = record.get("previous_vers", "unknown")
-            data = f"Recorded downgrade of package {package_name} from vers {prev_vers} to vers {vers}"
-        else:
-            data = f"Recorded update of package {package_name} with vers {vers}"
-
         return {
             "timestamp": record["from"],
             "module": self.__class__.__name__,
             "event": "battery_daily",
-            "data": data,
+            "data": f"Recorded update of package {record['package_name']} "
+            f"with vers {record['vers']}",
         }
 
     def check_indicators(self) -> None:
@@ -47,7 +36,6 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
     def parse(self, output: str) -> None:
         daily = None
         daily_updates = []
-        package_versions = {}  # Track package versions to detect downgrades
         for line in output.splitlines():
             if line.startswith("  Daily from "):
                 if len(daily_updates) > 0:
@@ -76,44 +64,15 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
                     break
 
             if not already_seen:
-                update_record = {
-                    "action": "update",
-                    "from": daily["from"],
-                    "to": daily["to"],
-                    "package_name": package_name,
-                    "vers": vers_nr,
-                }
-
-                # Check for uninstall (version 0)
-                if vers_nr == "0":
-                    self.log.warning(
-                        "Detected uninstall of package %s (vers 0) on %s",
-                        package_name,
-                        daily["from"],
-                    )
-                # Check for downgrade
-                elif package_name in package_versions:
-                    try:
-                        current_vers = int(vers_nr)
-                        previous_vers = int(package_versions[package_name])
-                        if current_vers < previous_vers:
-                            update_record["action"] = "downgrade"
-                            update_record["previous_vers"] = str(previous_vers)
-                            self.log.warning(
-                                "Detected downgrade of package %s from vers %d to vers %d on %s",
-                                package_name,
-                                previous_vers,
-                                current_vers,
-                                daily["from"],
-                            )
-                    except ValueError:
-                        # If version numbers aren't integers, skip comparison
-                        pass
-
-                # Update tracking dictionary
-                package_versions[package_name] = vers_nr
-
-                daily_updates.append(update_record)
+                daily_updates.append(
+                    {
+                        "action": "update",
+                        "from": daily["from"],
+                        "to": daily["to"],
+                        "package_name": package_name,
+                        "vers": vers_nr,
+                    }
+                )
 
         if len(daily_updates) > 0:
             self.results.extend(daily_updates)

src/mvt/android/cli.py

@@ -9,34 +9,34 @@ import click
 
 from mvt.common.cmd_check_iocs import CmdCheckIOCS
 from mvt.common.help import (
-    HELP_MSG_ANDROID_BACKUP_PASSWORD,
+    HELP_MSG_VERSION,
+    HELP_MSG_OUTPUT,
+    HELP_MSG_SERIAL,
+    HELP_MSG_DOWNLOAD_APKS,
+    HELP_MSG_DOWNLOAD_ALL_APKS,
+    HELP_MSG_VIRUS_TOTAL,
     HELP_MSG_APK_OUTPUT,
     HELP_MSG_APKS_FROM_FILE,
+    HELP_MSG_VERBOSE,
     HELP_MSG_CHECK_ADB,
-    HELP_MSG_CHECK_ANDROID_BACKUP,
-    HELP_MSG_CHECK_ANDROIDQF,
-    HELP_MSG_CHECK_BUGREPORT,
-    HELP_MSG_CHECK_IOCS,
-    HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
-    HELP_MSG_DISABLE_UPDATE_CHECK,
-    HELP_MSG_DOWNLOAD_ALL_APKS,
-    HELP_MSG_DOWNLOAD_APKS,
-    HELP_MSG_FAST,
-    HELP_MSG_HASHES,
     HELP_MSG_IOC,
+    HELP_MSG_FAST,
     HELP_MSG_LIST_MODULES,
     HELP_MSG_MODULE,
     HELP_MSG_NONINTERACTIVE,
-    HELP_MSG_OUTPUT,
-    HELP_MSG_SERIAL,
+    HELP_MSG_ANDROID_BACKUP_PASSWORD,
+    HELP_MSG_CHECK_BUGREPORT,
+    HELP_MSG_CHECK_ANDROID_BACKUP,
+    HELP_MSG_CHECK_ANDROIDQF,
+    HELP_MSG_HASHES,
+    HELP_MSG_CHECK_IOCS,
     HELP_MSG_STIX2,
-    HELP_MSG_VERBOSE,
-    HELP_MSG_VERSION,
-    HELP_MSG_VIRUS_TOTAL,
+    HELP_MSG_DISABLE_UPDATE_CHECK,
+    HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
 )
 from mvt.common.logo import logo
 from mvt.common.updates import IndicatorsUpdates
-from mvt.common.utils import init_logging, set_verbose_logging
+from mvt.common.utils import init_logging, set_verbose_logging, CommandWrapperGroup
 
 from .cmd_check_adb import CmdAndroidCheckADB
 from .cmd_check_androidqf import CmdAndroidCheckAndroidQF
@@ -68,7 +68,7 @@ def _get_disable_flags(ctx):
 # ==============================================================================
 # Main
 # ==============================================================================
-@click.group(invoke_without_command=False)
+@click.group(invoke_without_command=False, cls=CommandWrapperGroup)
 @click.option(
     "--disable-update-check", is_flag=True, help=HELP_MSG_DISABLE_UPDATE_CHECK
 )
@@ -201,11 +201,6 @@ def check_adb(
         cmd.list_modules()
         return
 
-    log.warning(
-        "DEPRECATION: The 'check-adb' command is deprecated and may be removed in a future release. "
-        "Prefer acquiring device data using the AndroidQF project (https://github.com/mvt-project/androidqf/) and analyzing that acquisition with MVT."
-    )
-
     log.info("Checking Android device over debug bridge")
 
     cmd.run()

src/mvt/android/modules/bugreport/base.py

@@ -84,17 +84,13 @@ class BugReportModule(MVTModule):
                 return self._get_file_content(main_content.decode().strip())
             except KeyError:
                 return None
+        else:
+            dumpstate_logs = self._get_files_by_pattern("dumpState_*.log")
+            if not dumpstate_logs:
+                return None
 
-        dumpstate_logs = self._get_files_by_pattern("dumpState_*.log")
-        if dumpstate_logs:
             return self._get_file_content(dumpstate_logs[0])
 
-        dumpsys_files = self._get_files_by_pattern("*/dumpsys.txt")
-        if dumpsys_files:
-            return self._get_file_content(dumpsys_files[0])
-
-        return None
-
     def _get_file_modification_time(self, file_path: str) -> dict:
         if self.zip_archive:
             file_timetuple = self.zip_archive.getinfo(file_path).date_time

src/mvt/android/modules/bugreport/dumpsys_receivers.py

@@ -34,20 +34,6 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
 
         self.results = results if results else {}
 
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                receiver_name = self.results[result][0]["receiver"]
-
-                # return IoC if the stix2 process name a substring of the receiver name
-                ioc = self.indicators.check_receiver_prefix(receiver_name)
-                if ioc:
-                    self.results[result][0]["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-
-
     def run(self) -> None:
         content = self._get_dumpstate_file()
         if not content:

src/mvt/common/config.py

@@ -1,10 +1,11 @@
 import os
 import yaml
 import json
+import uuid
 
 from typing import Tuple, Type, Optional
 from appdirs import user_config_dir
-from pydantic import AnyHttpUrl, Field
+from pydantic import AnyHttpUrl, BaseModel, Field
 from pydantic_settings import (
     BaseSettings,
     InitSettingsSource,
@@ -17,6 +18,22 @@ MVT_CONFIG_FOLDER = user_config_dir("mvt")
 MVT_CONFIG_PATH = os.path.join(MVT_CONFIG_FOLDER, "config.yaml")
 
 
+class TelemetrySettings(BaseModel):
+    """
+    Settings used by the Telemetry module.
+    """
+
+    ENABLED: bool = Field(True, description="Flag for telemetry collection")
+    ENDPOINT: AnyHttpUrl = Field(
+        "https://t.mvt.re/events", description="Telemetry collection endpoint"
+    )
+    DEVICE_ID: str | None = Field(
+        default=None,
+        required=True,
+        description="Anonymous Unique ID for use in telemetry",
+    )
+
+
 class MVTSettings(BaseSettings):
     model_config = SettingsConfigDict(
         env_prefix="MVT_",
@@ -24,7 +41,7 @@ class MVTSettings(BaseSettings):
         extra="ignore",
         nested_model_default_partial_updates=True,
     )
-    # Allow to decided if want to load environment variables
+    # Flag to enable or disable loading of environment variables.
     load_env: bool = Field(True, exclude=True)
 
     # General settings
@@ -51,6 +68,9 @@ class MVTSettings(BaseSettings):
     PROFILE: bool = Field(False, description="Profile the execution of MVT modules")
     HASH_FILES: bool = Field(False, description="Should MVT hash output files")
 
+    # Telemetry settings
+    TELEMETRY: TelemetrySettings = TelemetrySettings(include=True)
+
     @classmethod
     def settings_customise_sources(
         cls,
@@ -95,6 +115,8 @@ class MVTSettings(BaseSettings):
         """
         # Set invalid env prefix to avoid loading env variables.
         settings = MVTSettings(load_env=False)
+        if not settings.TELEMETRY.DEVICE_ID:
+            settings.TELEMETRY.DEVICE_ID = str(uuid.uuid4())
         settings.save_settings()
 
         # Load the settings again with any ENV variables.

src/mvt/common/help.py

@@ -47,7 +47,7 @@ HELP_MSG_APKS_FROM_FILE = (
     "Instead of acquiring APKs from a phone, load an existing packages.json file for "
     "lookups (mainly for debug purposes)"
 )
-HELP_MSG_CHECK_ADB = "Deprecated: Check an Android device over ADB. Prefer using the external AndroidQF project (https://github.com/mvt-project/androidqf) to acquire AndroidQF images for analysis."
+HELP_MSG_CHECK_ADB = "Check an Android device over ADB"
 HELP_MSG_CHECK_BUGREPORT = "Check an Android Bug Report"
 HELP_MSG_CHECK_ANDROID_BACKUP = "Check an Android Backup"
 HELP_MSG_CHECK_ANDROIDQF = "Check data collected with AndroidQF"

src/mvt/common/indicators.py

@@ -52,7 +52,9 @@ class Indicators:
             if os.path.isfile(path) and path.lower().endswith(".stix2"):
                 self.parse_stix2(path)
             elif os.path.isdir(path):
-                for file in glob.glob(os.path.join(path, "**", "*.stix2"), recursive=True):
+                for file in glob.glob(
+                    os.path.join(path, "**", "*.stix2", recursive=True)
+                ):
                     self.parse_stix2(file)
             else:
                 self.log.error(
@@ -766,30 +768,6 @@ class Indicators:
 
         return None
 
-
-    def check_receiver_prefix(self, receiver_name: str) -> Union[dict, None]:
-        """Check the provided receiver name against the list of indicators.
-        An IoC match is detected when a substring of the receiver matches the indicator
-        :param app_id: App ID to check against the list of indicators
-        :type app_id: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not receiver_name:
-            return None
-
-        for ioc in self.get_iocs("app_ids"):
-            if ioc["value"].lower() in receiver_name.lower():
-                self.log.warning(
-                    'Found a known suspicious receiver with name "%s" '
-                    'matching indicators from "%s"',
-                    receiver_name,
-                    ioc["name"],
-                )
-                return ioc
-
-        return None
-
     def check_android_property_name(self, property_name: str) -> Optional[dict]:
         """Check the android property name against the list of indicators.
 

src/mvt/common/telemetry.py

@@ -0,0 +1,113 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import os
+import sys
+import platform
+import requests
+import json
+import logging
+import threading
+
+from mvt.common.config import settings
+from mvt.common.version import MVT_VERSION
+
+
+logger = logging.getLogger(__name__)
+
+
+class Telemetry(object):
+    """
+    MVT collects anonymous telemetry to understand how MVT is used.
+
+    This data is helpful to prioritize features, identify platforms and versions. It
+    will also how many users are using custom indicators, modules and packages.
+    """
+
+    def __init__(self):
+        self.endpoint = settings.TELEMETRY.ENDPOINT
+        self.device_id = settings.TELEMETRY.DEVICE_ID
+
+    def is_telemetry_enabled(self):
+        return settings.TELEMETRY.ENABLED
+
+    @staticmethod
+    def _installation_type():
+        """Check if MVT is installed via pip, docker or source."""
+        if "site-packages" in __file__:
+            return "pypi"
+        elif os.environ.get("MVT_DOCKER_IMAGE", None):
+            return "docker"
+        else:
+            return "source"
+
+    def _get_device_properties(self):
+        return {
+            "os_type": platform.system(),
+            "os_version": platform.platform(),
+            "python_version": f"{platform.python_version()}/{platform.python_implementation()}",
+            "mvt_version": MVT_VERSION,
+            "mvt_installation_type": self._installation_type(),
+            "mvt_package_name": __package__,
+            "mvt_command": os.path.basename(sys.argv[0]),
+            "telemetry_version": "0.0.1",
+        }
+
+    def _build_event(self, event_name, event_properties):
+        return {
+            "event": event_name,
+            "distinct_id": self.device_id,
+            "properties": {
+                **self._get_device_properties(),
+                **event_properties,
+            },
+        }
+
+    def _send_event(self, event):
+        if not self.is_telemetry_enabled():
+            # Telemetry is disabled. Do not send any data.
+            return
+
+        event_json = json.dumps(event)
+
+        try:
+            telemetry_thread = threading.Thread(
+                target=self._send_event_thread, args=(event_json,)
+            )
+            telemetry_thread.start()
+        except Exception as e:
+            logger.debug(f"Failed to send telemetry data in a thread: {e}")
+
+    def _send_event_thread(self, event):
+        try:
+            response = requests.post(
+                self.endpoint,
+                data=json.dumps(event),
+                timeout=5,
+                headers={
+                    "Content-Type": "application/json",
+                    "User-Agent": f"mvt/{MVT_VERSION}",
+                },
+            )
+            response.raise_for_status()
+        except requests.RequestException as e:
+            logger.debug(f"Failed to send telemetry data: {e}")
+
+    def send_cli_command_event(self, command_name):
+        event = self._build_event(
+            event_name="run_mvt_cli_command",
+            event_properties={"cli_command_name": command_name},
+        )
+        self._send_event(event)
+
+    def send_module_detections_event(self, module_name, detections):
+        event = self._build_event(
+            event_name="module_detections",
+            event_properties={"module_name": module_name, "detections": detections},
+        )
+        self._send_event(event)
+
+
+telemetry = Telemetry()

src/mvt/common/utils.py

@@ -10,12 +10,34 @@ import json
 import logging
 import os
 import re
+import click
 from typing import Any, Iterator, Union
 
 from rich.logging import RichHandler
+from mvt.common.telemetry import telemetry
 from mvt.common.config import settings
 
 
+class CommandWrapperGroup(click.Group):
+    """Allow hooks to run before and after MVT CLI commands"""
+
+    def add_command(self, cmd, name=None):
+        click.Group.add_command(self, cmd, name=name)
+        cmd.invoke = self.build_command_invoke(cmd.invoke)
+
+    def build_command_invoke(self, original_invoke):
+        def command_invoke(ctx):
+            """Invoke the Click command"""
+
+            # Run telemetry before the command
+            telemetry.send_cli_command_event(ctx.command.name)
+
+            # Run the original command
+            original_invoke(ctx)
+
+        return command_invoke
+
+
 class CustomJSONEncoder(json.JSONEncoder):
     """
     Custom JSON encoder to handle non-standard types.

src/mvt/common/version.py

@@ -3,4 +3,4 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-MVT_VERSION = "2.7.0"
+MVT_VERSION = "2.6.1"

src/mvt/ios/cli.py

@@ -18,6 +18,7 @@ from mvt.common.utils import (
     generate_hashes_from_path,
     init_logging,
     set_verbose_logging,
+    CommandWrapperGroup,
 )
 from mvt.common.help import (
     HELP_MSG_VERSION,
@@ -68,7 +69,7 @@ def _get_disable_flags(ctx):
 # ==============================================================================
 # Main
 # ==============================================================================
-@click.group(invoke_without_command=False)
+@click.group(invoke_without_command=False, cls=CommandWrapperGroup)
 @click.option(
     "--disable-update-check", is_flag=True, help=HELP_MSG_DISABLE_UPDATE_CHECK
 )

src/mvt/ios/data/ios_models.json

@@ -194,41 +194,5 @@
     {
         "identifier": "iPhone16,2",
         "description": "iPhone 15 Pro Max"
-    },
-    {
-        "identifier": "iPhone17,1",
-        "description": "iPhone 16 Pro"
-    },
-    {
-        "identifier": "iPhone17,2",
-        "description": "iPhone 16 Pro Max"
-    },
-    {
-        "identifier": "iPhone17,3",
-        "description": "iPhone 16"
-    },
-    {
-        "identifier": "iPhone17,4",
-        "description": "iPhone 16 Plus"
-    },
-    {
-        "identifier": "iPhone17,5",
-        "description": "iPhone 16e"
-    },
-    {
-        "identifier": "iPhone18,1",
-        "description": "iPhone 17 Pro"
-    },
-    {
-        "identifier": "iPhone18,2",
-        "description": "iPhone 17 Pro Max"
-    },
-    {
-        "identifier": "iPhone18,3",
-        "description": "iPhone 17"
-    },
-    {
-        "identifier": "iPhone18,4",
-        "description": "iPhone Air"
     }
 ]

src/mvt/ios/data/ios_versions.json

@@ -631,10 +631,6 @@
         "build": "16H81",
         "version": "12.5.7"
     },
-    {
-        "version": "12.5.8",
-        "build": "16H88"
-    },
     {
         "build": "17A577",
         "version": "13.0"
@@ -903,14 +899,6 @@
         "version": "15.8.5",
         "build": "19H394"
     },
-    {
-        "version": "15.8.6",
-        "build": "19H402"
-    },
-    {
-        "version": "15.8.7",
-        "build": "19H411"
-    },
     {
         "build": "20A362",
         "version": "16.0"
@@ -1020,14 +1008,6 @@
         "version": "16.7.12",
         "build": "20H364"
     },
-    {
-        "version": "16.7.14",
-        "build": "20H370"
-    },
-    {
-        "version": "16.7.15",
-        "build": "20H380"
-    },
     {
         "version": "17.0",
         "build": "21A327"
@@ -1180,26 +1160,6 @@
         "version": "18.7.2",
         "build": "22H124"
     },
-    {
-        "version": "18.7.3",
-        "build": "22H217"
-    },
-    {
-        "version": "18.7.4",
-        "build": "22H218"
-    },
-    {
-        "version": "18.7.5",
-        "build": "22H311"
-    },
-    {
-        "version": "18.7.6",
-        "build": "22H320"
-    },
-    {
-        "version": "18.7.7",
-        "build": "22H333"
-    },
     {
         "version": "26",
         "build": "23A341"
@@ -1211,25 +1171,5 @@
     {
         "version": "26.1",
         "build": "23B85"
-    },
-    {
-        "version": "26.2",
-        "build": "23C55"
-    },
-    {
-        "version": "26.2.1",
-        "build": "23C71"
-    },
-    {
-        "version": "26.3",
-        "build": "23D127"
-    },
-    {
-        "version": "26.3.1",
-        "build": "23D8133"
-    },
-    {
-        "version": "26.4",
-        "build": "23E246"
     }
 ]