Merge branch 'main' into fix/tcc

catch sqlite exception in safari_browserstate.py

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/add-issue-to-project.yml

@@ -0,0 +1,19 @@
+name: Add issue to project
+
+on:
+  issues:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v0.5.0
+        with:
+          # You can target a project in a different organization
+          # to the issue
+          project-url: https://github.com/orgs/mvt-project/projects/1
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/mypy.yml

@@ -0,0 +1,23 @@
+name: Mypy
+on: workflow_dispatch
+
+jobs:
+  mypy_py3:
+    name: Mypy check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.9
+          cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
+      - name: Install Dependencies
+        run: |
+          pip install mypy
+      - name: mypy
+        run: |
+          make mypy

.github/workflows/publish-release-docker.yml

@@ -0,0 +1,61 @@
+#
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a release is published.
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      #
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+

.github/workflows/python-package.yml

@@ -1,43 +0,0 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
-
-name: CI
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.8', '3.9', '3.10']
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade setuptools
-        python -m pip install --upgrade pip
-        python -m pip install flake8 pytest safety stix2 pytest-mock
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-        python -m pip install .
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Safety checks
-      run: safety check
-    - name: Test with pytest
-      run: pytest

.github/workflows/ruff.yml

@@ -1,16 +1,22 @@
 name: Ruff
-on: [push]
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
 
 jobs:
   ruff_py3:
     name: Ruff syntax check
     runs-on: ubuntu-latest
+
     steps:
+      - uses: actions/checkout@v4
       - name: Setup Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
           python-version: 3.9
-          architecture: x64
+          cache: 'pip'
       - name: Checkout
         uses: actions/checkout@master
       - name: Install Dependencies
@@ -18,4 +24,4 @@ jobs:
           pip install ruff
       - name: ruff
         run: |
-          ruff check .
+          make ruff

.github/workflows/scripts/update-ios-releases.py

@@ -0,0 +1,96 @@
+"""
+Python script to download the Apple RSS feed and parse it.
+"""
+
+import json
+import os
+import urllib.request
+from xml.dom.minidom import parseString
+
+from packaging import version
+
+
+def download_apple_rss(feed_url):
+    with urllib.request.urlopen(feed_url) as f:
+        rss_feed = f.read().decode("utf-8")
+    print("Downloaded RSS feed from Apple.")
+    return rss_feed
+
+
+def parse_latest_ios_versions(rss_feed_text):
+    latest_ios_versions = []
+
+    parsed_feed = parseString(rss_feed_text)
+    for item in parsed_feed.getElementsByTagName("item"):
+        title = item.getElementsByTagName("title")[0].firstChild.data
+        if not title.startswith("iOS"):
+            continue
+
+        import re
+
+        build_match = re.match(
+            r"iOS (?P<version>[\d\.]+) (?P<beta>beta )?(\S*)?\((?P<build>.*)\)", title
+        )
+        if not build_match:
+            print("Could not parse iOS build:", title)
+            continue
+
+        # Handle iOS beta releases
+        release_info = build_match.groupdict()
+        release_beta = release_info.pop("beta")
+        if release_beta:
+            print("Skipping beta release:", title)
+            continue
+
+        # Some iOS releases have multiple build number for different hardware models.
+        # We will split these into separate entries and record each build number.
+        build_list = release_info.pop("build")
+        build_variants = build_list.split(" | ")
+        for build_number in build_variants:
+            release_info["build"] = build_number
+            latest_ios_versions.append(release_info)
+
+    return latest_ios_versions
+
+
+def update_mvt(mvt_checkout_path, latest_ios_versions):
+    version_path = os.path.join(mvt_checkout_path, "src/mvt/ios/data/ios_versions.json")
+    with open(version_path, "r") as version_file:
+        current_versions = json.load(version_file)
+
+    new_entry_count = 0
+    for new_version in latest_ios_versions:
+        for current_version in current_versions:
+            if new_version["build"] == current_version["build"]:
+                break
+        else:
+            # New version that does not exist in current data
+            current_versions.append(new_version)
+            new_entry_count += 1
+
+    if not new_entry_count:
+        print("No new iOS versions found.")
+    else:
+        print("Found {} new iOS versions.".format(new_entry_count))
+        new_version_list = sorted(
+            current_versions, key=lambda x: version.Version(x["version"])
+        )
+        with open(version_path, "w") as version_file:
+            json.dump(new_version_list, version_file, indent=4)
+
+
+def main():
+    print("Downloading RSS feed...")
+    mvt_checkout_path = os.path.abspath(
+        os.path.join(os.path.dirname(__file__), "../../../")
+    )
+
+    rss_feed = download_apple_rss(
+        "https://developer.apple.com/news/releases/rss/releases.rss"
+    )
+    latest_ios_version = parse_latest_ios_versions(rss_feed)
+    update_mvt(mvt_checkout_path, latest_ios_version)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/tests.yml

@@ -0,0 +1,38 @@
+name: Tests
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+    name: Run Python Tests
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install Python dependencies
+        run: |
+          make install
+          make test-requirements
+      - name: Test with pytest
+        run: |
+          set -o pipefail
+          make test-ci | tee pytest-coverage.txt
+
+      - name: Pytest coverage comment
+        continue-on-error: true # Workflows running on a fork can't post comments
+        uses: MishaKav/pytest-coverage-comment@main
+        if: github.event_name == 'pull_request'
+        with:
+          pytest-coverage-path: ./pytest-coverage.txt
+          junitxml-path: ./pytest.xml

.github/workflows/update-ios-data.yml

@@ -0,0 +1,30 @@
+name: Update iOS releases and version numbers
+run-name: ${{ github.actor }} is finding the latest iOS release version and build numbers
+on:
+  workflow_dispatch:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    - cron:  '0 */6 * * *'
+
+
+jobs:
+  update-ios-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+      - name: Run script to fetch latest iOS releases from Apple RSS feed.
+        run: python3 .github/workflows/scripts/update-ios-releases.py
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v5
+        with:
+          title: '[auto] Update iOS releases and versions'
+          commit-message: Add new iOS versions and build numbers
+          branch: auto/add-new-ios-releases
+          draft: true
+          body: |
+            This is an automated pull request to update the iOS releases and version numbers.
+          add-paths: |
+            *.json
+          labels: |
+            automated pr

.gitignore

@@ -50,6 +50,8 @@ coverage.xml
 *.py,cover
 .hypothesis/
 .pytest_cache/
+pytest-coverage.txt
+pytest.xml
 
 # Translations
 *.mo

.readthedocs.yaml

@@ -5,11 +5,15 @@
 # Required
 version: 2
 
+build:
+  os: "ubuntu-22.04"
+  tools:
+    python: "3.11"
+
 mkdocs:
   configuration: mkdocs.yml
 
 # Optionally set the version of Python and requirements required to build your docs
 python:
-   version: 3.7
    install:
    - requirements: docs/requirements.txt

.safety-policy.yml

@@ -0,0 +1,11 @@
+# Safety Security and License Configuration file
+# We recommend checking this file into your source control in the root of your Python project
+# If this file is named .safety-policy.yml and is in the same directory where you run `safety check` it will be used by default.
+# Otherwise, you can use the flag `safety check --policy-file <path-to-this-file>` to specify a custom location and name for the file.
+# To validate and review your policy file, run the validate command: `safety validate policy_file --path <path-to-this-file>`
+security: # configuration for the `safety check` command
+    ignore-vulnerabilities: # Here you can list multiple specific vulnerabilities you want to ignore (optionally for a time period)
+        67599: # Example vulnerability ID
+            reason: disputed, inapplicable
+        70612:
+            reason: disputed, inapplicable

CONTRIBUTING.md

@@ -1,19 +1,65 @@
-# Contributing
+# Contributing to Mobile Verification Toolkit (MVT)
 
-Thank you for your interest in contributing to Mobile Verification Toolkit (MVT)! Your help is very much appreciated.
+We greatly appreciate contributions to MVT!
+
+Your involvement, whether through identifying issues, improving functionality, or enhancing documentation, is very much appreciated. To ensure smooth collaboration and a welcoming environment, we've outlined some key guidelines for contributing below.
+
+## Getting started
+
+Contributing to an open-source project like MVT might seem overwhelming at first, but we're here to support you!
+
+ Whether you're a technologist, a frontline human rights defender, a field researcher, or someone new to consensual spyware forensics, there are many ways to make meaningful contributions.
+
+ Here's how you can get started:
+
+1. **Explore the codebase:**
+    - Browse the repository to get familar with MVT. Many MVT modules are simple in functionality and easy to understand.
+    - Look for `TODO:` or `FIXME:` comments in the code for areas that need attention.
+
+2. **Check Github issues:**
+    - Look for issues tagged with ["help wanted"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) or ["good first issue"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) to find tasks that are beginner-friendly or where input from the community would be helpful.
+
+3. **Ask for guidance:**
+
+    - If you're unsure where to start, feel free to open a [discussion](https://github.com/mvt-project/mvt/discussions) or comment on an issue.
+
+## How to contribute:
+
+1. **Report issues:**
+
+ - Found a bug? Please check existing issues to see if it's already reported. If not, open a new issue. Mobile operating systems and databases are constantly evolving, an new errors may appear spontaniously in new app versions.
+
+ **Please provide as much information as possible about the prodblem including: any error messages, steps to reproduce the problem, and any logs or screenshots that can help.**
 
 
-## Where to start
+2. **Suggest features:**
+    - If you have an idea for new functionality, create a feature request issue and describe your proposal.
 
-Starting to contribute to a somewhat complex project like MVT might seem intimidating. Unless you have specific ideas of new functionality you would like to submit, some good starting points are searching for `TODO:` and `FIXME:` comments throughout the code. Alternatively you can check if any GitHub issues existed marked with the ["help wanted"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) tag.
+3. **Submit code:**
+    - Fork the repository and create a new branch for your changes.
+    - Ensure your changes align with the code style guidelines (see below).
+    - Open a pull request (PR) with a clear description of your changes and link it to any relevant issues.
 
+4. **Documentation contributions:**
+    - Improving documentation is just as valuable as contributing code! If you notice gaps or inaccuracies in the documentation, feel free to submit changes or suggest updates.
 
 ## Code style
+Please follow these code style guidelines for consistency and readability:
 
-When contributing code to 
+- **Indentation**: use 4 spaces per tab.
+- **Quotes**: Use double quotes (`"`) by default. Use single quotes (`'`) for nested strings instead of escaping (`\"`), or when using f-formatting.
+- **Maximum line length**:
+    - Aim for lines no longer than 80 characters.
+    - Exceptions are allowed for long log lines or strings, which may extend up to 100 characters.
+    - Wrap lines that exceed 100 characters.
 
-- **Indentation**: we use 4-spaces tabs.
+Follow [PEP 8 guidelines](https://peps.python.org/pep-0008/) for indentation and overall Python code style. All MVT code is automatically linted with [Ruff](https://github.com/astral-sh/ruff) before merging.
 
-- **Quotes**: we use double quotes (`"`) as a default. Single quotes (`'`) can be favored with nested strings instead of escaping (`\"`), or when using f-formatting.
+Please check your code before opening a pull request by running `make ruff`
 
-- **Maximum line length**: we strongly encourage to respect a 80 characters long lines and to follow [PEP8 indentation guidelines](https://peps.python.org/pep-0008/#indentation) when having to wrap. However, if breaking at 80 is not possible or is detrimental to the readability of the code, exceptions are tolerated. For example, long log lines, or long strings can be extended to 100 characters long. Please hard wrap anything beyond 100 characters.
+
+## Community and support
+
+We aim to create a supportive and collaborative environment for all contributors. If you run into any challenges, feel free to reach out through the discussions or issues section of the repository.
+
+Your contributions, big or small, help improve MVT and are always appreciated.

Dockerfile

@@ -1,79 +1,158 @@
-FROM ubuntu:22.04
+# Base image for building libraries
+# ---------------------------------
+FROM ubuntu:22.04 as build-base
 
-# Ref. https://github.com/mvt-project/mvt
+ARG DEBIAN_FRONTEND=noninteractive
 
-LABEL url="https://mvt.re"
-LABEL vcs-url="https://github.com/mvt-project/mvt"
-LABEL description="MVT is a forensic tool to look for signs of infection in smartphone devices."
-
-ENV PIP_NO_CACHE_DIR=1
-ENV DEBIAN_FRONTEND=noninteractive
-
-# Fixing major OS dependencies
-# ----------------------------
-RUN apt update \
-  && apt install -y python3 python3-pip libusb-1.0-0-dev wget unzip default-jre-headless adb \
-
-# Install build tools for libimobiledevice
-# ----------------------------------------
+# Install build tools and dependencies
+RUN apt-get update \
+  && apt-get install -y \
   build-essential \
-  checkinstall \
   git \
   autoconf \
   automake \
   libtool-bin \
-  libplist-dev \
-  libusbmuxd-dev \
-  libssl-dev \
-  sqlite3 \
   pkg-config \
+  libcurl4-openssl-dev \
+  libusb-1.0-0-dev \
+  libssl-dev \
+  udev \
+  && rm -rf /var/lib/apt/lists/*
 
-# Clean up
+
+# libplist
 # --------
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/* /var/cache/apt
+FROM build-base as build-libplist
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libplist
 
 
-# Build libimobiledevice
-# ----------------------
-RUN git clone https://github.com/libimobiledevice/libplist \
-  && git clone https://github.com/libimobiledevice/libimobiledevice-glue \
-  && git clone https://github.com/libimobiledevice/libusbmuxd \
-  && git clone https://github.com/libimobiledevice/libimobiledevice \
-  && git clone https://github.com/libimobiledevice/usbmuxd \
+# libimobiledevice-glue
+# ---------------------
+FROM build-base as build-libimobiledevice-glue
 
-  && cd libplist && ./autogen.sh && make && make install && ldconfig \
+# Install dependencies
+COPY --from=build-libplist /build /
 
-  && cd ../libimobiledevice-glue && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr && make && make install && ldconfig \
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice-glue
 
-  && cd ../libusbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh && make && make install && ldconfig \
 
-  && cd ../libimobiledevice && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --enable-debug && make && make install && ldconfig \
+# libtatsu
+# --------
+FROM build-base as build-libtatsu
 
-  && cd ../usbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make && make install \
+# Install dependencies
+COPY --from=build-libplist /build /
 
-  # Clean up.
-  && cd .. && rm -rf libplist libimobiledevice-glue libusbmuxd libimobiledevice usbmuxd
+# Build
+RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libtatsu
 
-# Installing MVT
-# --------------
-RUN pip3 install mvt
+
+# libusbmuxd
+# ----------
+FROM build-base as build-libusbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libusbmuxd
+
+
+# libimobiledevice
+# ----------------
+FROM build-base as build-libimobiledevice
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
+  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice
+
+
+# usbmuxd
+# -------
+FROM build-base as build-usbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
+  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
+
+
+# Create main image
+FROM ubuntu:24.04 as main
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/ubuntu:22.04
+
+# Install runtime dependencies
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+  && apt-get install -y \
+  adb \
+  default-jre-headless \
+  libcurl4 \
+  libssl3 \
+  libusb-1.0-0 \
+  python3 \
+  sqlite3
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+COPY --from=build-usbmuxd /build /
+
+# Install mvt using the locally checked out source
+COPY . mvt/
+RUN apt-get update \
+   && apt-get install -y git python3-pip \
+   && PIP_NO_CACHE_DIR=1 pip3 install --break-system-packages ./mvt \
+   && apt-get remove -y python3-pip git && apt-get autoremove -y \
+   && rm -rf /var/lib/apt/lists/* \
+   && rm -rf mvt
 
 # Installing ABE
-# --------------
-RUN mkdir /opt/abe \
-  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/20210709062403-4c55371/abe.jar -O /opt/abe/abe.jar \
+ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
+  https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar /opt/abe/abe.jar
 # Create alias for abe
-  && echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
-# Generate adb key folder 
-# ------------------------------ 
-RUN mkdir /root/.android && adb keygen /root/.android/adbkey
+# Generate adb key folder
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
+RUN mkdir /root/.android
 
 # Setup investigations environment
-# --------------------------------
 RUN mkdir /home/cases
-WORKDIR /home/cases 
+WORKDIR /home/cases
 RUN echo 'echo "Mobile Verification Toolkit @ Docker\n------------------------------------\n\nYou can find information about how to use this image for Android (https://github.com/mvt-project/mvt/tree/master/docs/android) and iOS (https://github.com/mvt-project/mvt/tree/master/docs/ios) in the official docs of the project.\n"' >> ~/.bashrc \
   && echo 'echo "Note that to perform the debug via USB you might need to give the Docker image access to the USB using \"docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt\" or, preferably, the \"--device=\" parameter.\n"' >> ~/.bashrc
 

Dockerfile.android

@@ -0,0 +1,36 @@
+# Create main image
+FROM python:3.10.14-alpine3.20 as main
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit (Android)"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+
+# Install runtime dependencies
+RUN apk add --no-cache \
+  android-tools \
+  git \
+  libusb \
+  openjdk11-jre-headless \
+  sqlite
+
+# Install mvt
+COPY ./ mvt
+RUN apk add --no-cache --virtual .build-deps gcc musl-dev \
+  && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
+  && apk del .build-deps gcc musl-dev && rm -rf ./mvt
+
+# Installing ABE
+ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
+  https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar /opt/abe/abe.jar
+# Create alias for abe
+RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+
+# Generate adb key folder
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
+RUN mkdir /root/.android
+
+ENTRYPOINT [ "/usr/local/bin/mvt-android" ]

Dockerfile.ios

@@ -0,0 +1,137 @@
+# Base image for building libraries
+# ---------------------------------
+FROM ubuntu:22.04 as build-base
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+# Install build tools and dependencies
+RUN apt-get update \
+  && apt-get install -y \
+  build-essential \
+  git \
+  autoconf \
+  automake \
+  libtool-bin \
+  pkg-config \
+  libcurl4-openssl-dev \
+  libusb-1.0-0-dev \
+  libssl-dev \
+  udev \
+  && rm -rf /var/lib/apt/lists/*
+
+
+# libplist
+# --------
+FROM build-base as build-libplist
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libplist
+
+
+# libimobiledevice-glue
+# ---------------------
+FROM build-base as build-libimobiledevice-glue
+
+# Install dependencies
+COPY --from=build-libplist /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice-glue
+
+
+# libtatsu
+# --------
+FROM build-base as build-libtatsu
+
+# Install dependencies
+COPY --from=build-libplist /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libtatsu
+
+
+# libusbmuxd
+# ----------
+FROM build-base as build-libusbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libusbmuxd
+
+
+# libimobiledevice
+# ----------------
+FROM build-base as build-libimobiledevice
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
+  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice
+
+
+# usbmuxd
+# -------
+FROM build-base as build-usbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
+  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
+
+
+# Main image
+# ----------
+FROM python:3.10.14-alpine3.20 as main
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit (iOS)"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+
+# Install runtime dependencies
+RUN apk add --no-cache \
+  gcompat \
+  libcurl \
+  libssl3 \
+  libusb \
+  sqlite
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+COPY --from=build-usbmuxd /build /
+
+# Install mvt using the locally checked out source
+COPY ./ mvt
+RUN apk add --no-cache --virtual .build-deps git gcc musl-dev \
+  && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
+  && apk del .build-deps git gcc musl-dev && rm -rf ./mvt
+
+ENTRYPOINT [ "/usr/local/bin/mvt-ios" ]

Makefile

@@ -1,21 +1,44 @@
 PWD = $(shell pwd)
 
-check:
-	flake8
-	pytest -q
+autofix:
+	ruff format .
+	ruff check --fix .
+
+check: ruff mypy
+
+ruff:
+	ruff format --check .
 	ruff check -q .
 
+mypy:
+	mypy
+
+test:
+	python3 -m pytest
+
+test-ci:
+	python3 -m pytest -v
+
+install:
+	python3 -m pip install --upgrade -e .
+
+test-requirements:
+	python3 -m pip install --upgrade -r test-requirements.txt
+
+generate-proto-parsers:
+	# Generate python parsers for protobuf files
+	PROTO_FILES=$$(find src/mvt/android/parsers/proto/ -iname "*.proto"); \
+	protoc -Isrc/mvt/android/parsers/proto/ --python_betterproto_out=src/mvt/android/parsers/proto/ $$PROTO_FILES
+
 clean:
-	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/mvt.egg-info
+	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/src/mvt.egg-info
 
 dist:
-	python3 setup.py sdist bdist_wheel
+	python3 -m pip install --upgrade build
+	python3 -m build
 
 upload:
 	python3 -m twine upload dist/*
 
 test-upload:
 	python3 -m twine upload --repository testpypi dist/*
-
-pylint:
-	pylint --rcfile=setup.cfg mvt

README.md

@@ -6,19 +6,33 @@
 
 [![](https://img.shields.io/pypi/v/mvt)](https://pypi.org/project/mvt/)
 [![Documentation Status](https://readthedocs.org/projects/mvt/badge/?version=latest)](https://docs.mvt.re/en/latest/?badge=latest)
-[![CI](https://github.com/mvt-project/mvt/actions/workflows/python-package.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/python-package.yml)
+[![CI](https://github.com/mvt-project/mvt/actions/workflows/tests.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/tests.yml)
 [![Downloads](https://pepy.tech/badge/mvt)](https://pepy.tech/project/mvt)
 
 Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
 
-It has been developed and released by the [Amnesty International Security Lab](https://www.amnesty.org/en/tech/) in July 2021 in the context of the [Pegasus project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology and forensic evidence](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/).
+It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
 
-*Warning*: MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
+> **Note**
+> MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.
+>
 
+### Indicators of Compromise
+
+MVT supports using public [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other  research groups.
+
+> **Warning**
+> Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
+>
+> Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
+>
+>Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/?c=mvt_docs) or through our forensic partnership with [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
+
+More information about using indicators of compromise with MVT is available in the [documentation](https://docs.mvt.re/en/latest/iocs/).
 
 ## Installation
 
-MVT can be installed from sources or from [PyPi](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
+MVT can be installed from sources or from [PyPI](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
 
 ```
 pip3 install mvt

dev/mvt-android

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2022 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from mvt import android
-
-android.cli()

dev/mvt-ios

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2022 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from mvt import ios
-
-ios.cli()

docs/android/backup.md

@@ -35,7 +35,11 @@ $ mvt-android check-backup --output /path/to/results/ /path/to/backup.ab
          INFO     [mvt.android.modules.backup.sms] Extracted a total of 64 SMS messages
 ```
 
-If the backup is encrypted, MVT will prompt you to enter the password.
+If the backup is encrypted, MVT will prompt you to enter the password. A backup password can also be provided with the `--backup-password` command line option or through the `MVT_ANDROID_BACKUP_PASSWORD` environment variable. The same options can also be used to when analysing an encrypted backup collected through AndroidQF in the `mvt-android check-androidqf` command:
+
+```bash
+$ mvt-android check-backup --backup-password "password123" --output /path/to/results/ /path/to/backup.ab
+```
 
 Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.
 

docs/android/download_apks.md

@@ -1,6 +1,6 @@
 # Downloading APKs from an Android phone
 
-MVT allows to attempt to download all available installed packages (APKs) in order to further inspect them and potentially identify any which might be malicious in nature.
+MVT allows you to attempt to download all available installed packages (APKs) from a device in order to further inspect them and potentially identify any which might be malicious in nature.
 
 You can do so by launching the following command:
 

docs/command_completion.md

@@ -0,0 +1,43 @@
+# Command Completion 
+
+MVT utilizes the [Click](https://click.palletsprojects.com/en/stable/) library for creating its command line interface. 
+
+Click provides tab completion support for Bash (version 4.4 and up), Zsh, and Fish.
+
+To enable it, you need to manually register a special function with your shell, which varies depending on the shell you are using.
+
+The following describes how to generate the command completion scripts and add them to your shell configuration. 
+
+> **Note: You will need to start a new shell for the changes to take effect.**
+
+### For Bash
+
+```bash
+# Generates bash completion scripts
+echo "$(_MVT_IOS_COMPLETE=bash_source mvt-ios)" > ~/.mvt-ios-complete.bash &&
+echo "$(_MVT_ANDROID_COMPLETE=bash_source mvt-android)" > ~/.mvt-android-complete.bash
+```
+
+Add the following to `~/.bashrc`:
+```bash
+# source mvt completion scripts
+. ~/.mvt-ios-complete.bash && .  ~/.mvt-android-complete.bash
+```
+
+### For Zsh
+
+```bash
+# Generates zsh completion scripts
+echo "$(_MVT_IOS_COMPLETE=zsh_source mvt-ios)" >  ~/.mvt-ios-complete.zsh &&
+echo "$(_MVT_ANDROID_COMPLETE=zsh_source mvt-android)" > ~/.mvt-android-complete.zsh
+```
+
+Add the following to `~/.zshrc`:
+```bash
+# source mvt completion scripts
+.  ~/.mvt-ios-complete.zsh  && .  ~/.mvt-android-complete.zsh
+```
+
+For more information, visit the official [Click Docs](https://click.palletsprojects.com/en/stable/shell-completion/#enabling-completion).
+
+

docs/development.md

@@ -0,0 +1,27 @@
+# Development
+
+The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
+
+## Testing
+
+MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `flake8`, `ruff` and `black`. All can
+be run automatically with:
+
+```bash
+make check
+```
+
+Run these tests before making new commits or opening pull requests.
+
+## Profiling
+
+Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
+take to avoid inefficient code paths as we add new modules.
+
+MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
+
+```bash
+MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
+```
+
+Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/docker.md

@@ -2,7 +2,22 @@ Using Docker simplifies having all the required dependencies and tools (includin
 
 Install Docker following the [official documentation](https://docs.docker.com/get-docker/).
 
-Once installed, you can clone MVT's repository and build its Docker image:
+Once Docker is installed, you can run MVT by downloading a prebuilt MVT Docker image, or by building a Docker image yourself from the MVT source repo.
+
+### Using the prebuilt Docker image
+
+```bash
+docker pull ghcr.io/mvt-project/mvt
+```
+
+You can then run the Docker container with:
+
+```
+docker run -it ghcr.io/mvt-project/mvt
+```
+
+
+### Build and run Docker image from source
 
 ```bash
 git clone https://github.com/mvt-project/mvt.git
@@ -18,6 +33,9 @@ docker run -it mvt
 
 If a prompt is spawned successfully, you can close it with `exit`.
 
+
+## Docker usage with Android devices
+
 If you wish to use MVT to test an Android device you will need to enable the container's access to the host's USB devices. You can do so by enabling the `--privileged` flag and mounting the USB bus device as a volume:
 
 ```bash

docs/index.md

@@ -6,6 +6,9 @@
 
 Mobile Verification Toolkit (MVT) is a tool to facilitate the [consensual forensic analysis](introduction.md#consensual-forensics) of Android and iOS devices, for the purpose of identifying traces of compromise.
 
+It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
+
+
 In this documentation you will find instructions on how to install and run the `mvt-ios` and `mvt-android` commands, and guidance on how to interpret the extracted results.
 
 ## Resources

docs/install.md

@@ -7,11 +7,27 @@ Before proceeding, please note that MVT requires Python 3.6+ to run. While it sh
 First install some basic dependencies that will be necessary to build all required tools:
 
 ```bash
-sudo apt install python3 python3-pip libusb-1.0-0 sqlite3
+sudo apt install python3 python3-venv python3-pip sqlite3 libusb-1.0-0
 ```
 
 *libusb-1.0-0* is not required if you intend to only use `mvt-ios` and not `mvt-android`.
 
+(Recommended) Set up `pipx`
+
+For Ubuntu 23.04 or above:
+```bash
+sudo apt install pipx
+pipx ensurepath
+```
+
+For Ubuntu 22.04 or below:
+```
+python3 -m pip install --user pipx
+python3 -m pipx ensurepath
+```
+
+Other distributions: check for a `pipx` or `python-pipx` via your package manager.
+
 When working with Android devices you should additionally install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you prefer to install a package made available by your distribution of choice, please make sure the version is recent to ensure compatibility with modern Android devices.
 
 ## Dependencies on macOS
@@ -21,7 +37,7 @@ Running MVT on macOS requires Xcode and [homebrew](https://brew.sh) to be instal
 In order to install dependencies use:
 
 ```bash
-brew install python3 libusb sqlite3
+brew install python3 pipx libusb sqlite3
 ```
 
 *libusb* is not required if you intend to only use `mvt-ios` and not `mvt-android`.
@@ -42,24 +58,47 @@ It is recommended to try installing and running MVT from [Windows Subsystem Linu
 
 ## Installing MVT
 
-If you haven't done so, you can add this to your `.bashrc` or `.zshrc` file in order to add locally installed Pypi binaries to your `$PATH`:
+### Installing from PyPI with pipx (recommended)
+1. Install `pipx` following the instructions above for your OS/distribution. Make sure to run `pipx ensurepath` and open a new terminal window.
+2. ```bash
+   pipx install mvt
+   ```
 
+You now should have the `mvt-ios` and `mvt-android` utilities installed. If you run into problems with these commands not being found, ensure you have run `pipx ensurepath` and opened a new terminal window.
+
+### Installing from PyPI directly into a virtual environment
+You can use `pipenv`, `poetry` etc. for your virtual environment, but the provided example is with the built-in `venv` tool:
+
+1. Create the virtual environment in a folder in the current directory named `env`:
 ```bash
-export PATH=$PATH:~/.local/bin
+python3 -m venv env
 ```
 
-Then you can install MVT directly from [pypi](https://pypi.org/project/mvt/)
-
+2. Activate the virtual environment:
 ```bash
-pip3 install mvt
+source env/bin/activate
 ```
 
-If you want to have the latest features in development, you can install MVT directly from the source code. If you installed MVT previously from pypi, you should first uninstall it using `pip3 uninstall mvt` and then install from the source code:
+3. Install `mvt` into the virtual environment:
+```bash
+pip install mvt
+```
+
+The `mvt-ios` and `mvt-android` utilities should now be available as commands whenever the virtual environment is active.
+
+### Installing from git source with pipx
+If you want to have the latest features in development, you can install MVT directly from the source code in git.
 
 ```bash
-git clone https://github.com/mvt-project/mvt.git
-cd mvt
-pip3 install .
+pipx install --force git+https://github.com/mvt-project/mvt.git
 ```
 
 You now should have the `mvt-ios` and `mvt-android` utilities installed.
+
+**Notes:**
+1. The `--force` flag is necessary to force the reinstallation of the package.
+2. To revert to using a PyPI version, it will be necessary to `pipx uninstall mvt` first.
+
+## Setting up command completions
+
+See ["Command completions"](command_completion.md)

docs/introduction.md

@@ -12,6 +12,20 @@ Mobile Verification Toolkit (MVT) is a collection of utilities designed to facil
 
 MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. MVT is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
 
+## Indicators of Compromise
+
+MVT supports using [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other research groups.
+
+!!! warning
+    Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
+
+    Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
+
+    Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/?c=mvt_docs) or [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
+
+More information about using indicators of compromise with MVT is available in the [documentation](iocs.md).
+
+
 ## Consensual Forensics
 
 While MVT is capable of extracting and processing various types of very personal records typically found on a mobile phone (such as calls history, SMS and WhatsApp messages, etc.), this is intended to help identify potential attack vectors such as malicious SMS messages leading to exploitation.

docs/iocs.md

@@ -34,6 +34,13 @@ It is also possible to load STIX2 files automatically from the environment varia
 export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 ```
 
+## STIX2 Support
+
+So far MVT implements only a subset of [STIX2 specifications](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html):
+
+* It only supports checks for one value (such as `[domain-name:value='DOMAIN']`) and not boolean expressions over multiple comparisons
+* It only supports the following types: `domain-name:value`, `process:name`, `email-addr:value`, `file:name`, `file:path`, `file:hashes.md5`, `file:hashes.sha1`, `file:hashes.sha256`, `app:id`, `configuration-profile:id`, `android-property:name`, `url:value` (but each type will only be checked by a module if it is relevant to the type of data obtained)
+
 ## Known repositories of STIX2 IOCs
 
 - The [Amnesty International investigations repository](https://github.com/AmnestyTech/investigations) contains STIX-formatted IOCs for:
@@ -43,6 +50,9 @@ export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 - [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/generated/stalkerware.stix2).
 - We are also maintaining [a list of IOCs](https://github.com/mvt-project/mvt-indicators) in STIX format from public spyware campaigns.
 
-You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators listed [here](https://github.com/mvt-project/mvt/blob/main/public_indicators.json) and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
+You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.
+
+
+

docs/ios/backup/itunes.md

@@ -10,7 +10,7 @@ To do that:
 4. If you want to have a more accurate detection, ensure that the encrypted backup option is activated and choose a secure password for the backup.
 5. Start the backup and wait for it to finish (this may take up to 30 minutes).
 
-![](../../../img/macos-backup.jpg)
+![](../../img/macos-backup.jpg)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 Once the backup is done, find its location and copy it to a place where it can be analyzed by MVT. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On macOS, the backup is stored in `~/Library/Application Support/MobileSync/`.
@@ -25,13 +25,13 @@ On more recent MacOS versions, this feature is included in Finder. To do a backu
 4. In the General tab, select `Back up all the data on your iPhone to this Mac` from the options under the Backups section.
 5. Check the box that says `Encrypt local backup`. If it is your first time selecting this option, you may need to enter a password to encrypt the backup.
 
-![](../../../img/macos-backup2.png)
+![](../../img/macos-backup2.png)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 6. Click `Back Up Now` to start the back-up process.
 7. The encrypted backup for your iPhone should now start. Once the process finishes, you can check the backup by opening `Finder`, clicking on the `General` tab, then click on `Manage Backups`. Now you should see a list of your backups like the image below:
 
-![](../../../img/macos-backups.png)
+![](../../img/macos-backups.png)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 If your backup has a lock next to it like in the image above, then the backup is encrypted. You should also see the date and time when the encrypted backup was created. The backup files are stored in `~/Library/Application Support/MobileSync/`.

docs/ios/install.md

@@ -45,10 +45,10 @@ Once the idevice tools are available you can check if everything works fine by c
 ideviceinfo
 ```
 
-This should some many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
+This should show many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
 
 ```bash
-sudo usbmuxd -f -d
+sudo usbmuxd -f -v
 idevicepair pair
 ```
 

docs/ios/records.md

@@ -142,6 +142,16 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
+### `global_preferences.json`
+
+!!! info "Availability"
+    Backup: :material-check:
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `GlobalPreferences` module. The module extracts records from a Plist file located at */private/var/mobile/Library/Preferences/.GlobalPreferences.plist*, which contains a system preferences including if Lockdown Mode is enabled.
+
+---
+
 ### `id_status_cache.json`
 
 !!! info "Availability"

docs/requirements.txt

@@ -1,5 +1,5 @@
-mkdocs==1.2.3
-mkdocs-autorefs
-mkdocs-material
-mkdocs-material-extensions
-mkdocstrings
+mkdocs==1.6.1
+mkdocs-autorefs==1.4.2
+mkdocs-material==9.6.14
+mkdocs-material-extensions==1.3.1
+mkdocstrings==0.29.1

mkdocs.yml

@@ -1,14 +1,14 @@
 site_name: Mobile Verification Toolkit
 repo_url: https://github.com/mvt-project/mvt
 edit_uri: edit/main/docs/
-copyright: Copyright © 2021-2022 MVT Project Developers
+copyright: Copyright © 2021-2023 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
 markdown_extensions:
     - attr_list
     - admonition
     - pymdownx.emoji:
-        emoji_index: !!python/name:materialx.emoji.twemoji
-        emoji_generator: !!python/name:materialx.emoji.to_svg
+        emoji_index: !!python/name:material.extensions.emoji.twemoji
+        emoji_generator: !!python/name:material.extensions.emoji.to_svg
     - pymdownx.superfences
     - pymdownx.inlinehilite
     - pymdownx.highlight:
@@ -46,4 +46,5 @@ nav:
         - Check an Android Backup (SMS messages): "android/backup.md"
         - Download APKs: "android/download_apks.md"
     - Indicators of Compromise: "iocs.md"
+    - Development: "development.md"
     - License: "license.md"

mvt/android/cli.py

@@ -1,264 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-
-import click
-
-from mvt.common.cmd_check_iocs import CmdCheckIOCS
-from mvt.common.help import (HELP_MSG_FAST, HELP_MSG_HASHES, HELP_MSG_IOC,
-                             HELP_MSG_LIST_MODULES, HELP_MSG_MODULE,
-                             HELP_MSG_OUTPUT, HELP_MSG_SERIAL,
-                             HELP_MSG_VERBOSE)
-from mvt.common.logo import logo
-from mvt.common.updates import IndicatorsUpdates
-from mvt.common.utils import init_logging, set_verbose_logging
-
-from .cmd_check_adb import CmdAndroidCheckADB
-from .cmd_check_androidqf import CmdAndroidCheckAndroidQF
-from .cmd_check_backup import CmdAndroidCheckBackup
-from .cmd_check_bugreport import CmdAndroidCheckBugreport
-from .cmd_download_apks import DownloadAPKs
-from .modules.adb import ADB_MODULES
-from .modules.adb.packages import Packages
-from .modules.backup import BACKUP_MODULES
-from .modules.bugreport import BUGREPORT_MODULES
-
-init_logging()
-log = logging.getLogger("mvt")
-CONTEXT_SETTINGS = dict(help_option_names=['-h', '--help'])
-
-
-#==============================================================================
-# Main
-#==============================================================================
-@click.group(invoke_without_command=False)
-def cli():
-    logo()
-
-
-#==============================================================================
-# Command: version
-#==============================================================================
-@cli.command("version", help="Show the currently installed version of MVT")
-def version():
-    return
-
-
-#==============================================================================
-# Command: download-apks
-#==============================================================================
-@cli.command("download-apks", help="Download all or only non-system installed APKs",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option("--all-apks", "-a", is_flag=True,
-              help="Extract all packages installed on the phone, including system packages")
-@click.option("--virustotal", "-v", is_flag=True, help="Check packages on VirusTotal")
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help="Specify a path to a folder where you want to store the APKs")
-@click.option("--from-file", "-f", type=click.Path(exists=True),
-              help="Instead of acquiring from phone, load an existing packages.json file for "
-                   "lookups (mainly for debug purposes)")
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.pass_context
-def download_apks(ctx, all_apks, virustotal, output, from_file, serial, verbose):
-    set_verbose_logging(verbose)
-    try:
-        if from_file:
-            download = DownloadAPKs.from_json(from_file)
-        else:
-            # TODO: Do we actually want to be able to run without storing any
-            #       file?
-            if not output:
-                log.critical("You need to specify an output folder with --output!")
-                ctx.exit(1)
-
-            download = DownloadAPKs(results_path=output, all_apks=all_apks)
-            if serial:
-                download.serial = serial
-            download.run()
-
-        packages_to_lookup = []
-        if all_apks:
-            packages_to_lookup = download.packages
-        else:
-            for package in download.packages:
-                if not package.get("system", False):
-                    packages_to_lookup.append(package)
-
-            if len(packages_to_lookup) == 0:
-                return
-
-        if virustotal:
-            m = Packages()
-            m.check_virustotal(packages_to_lookup)
-    except KeyboardInterrupt:
-        print("")
-        ctx.exit(1)
-
-
-#==============================================================================
-# Command: check-adb
-#==============================================================================
-@cli.command("check-adb", help="Check an Android device over adb",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.pass_context
-def check_adb(ctx, serial, iocs, output, fast, list_modules, module, verbose):
-    set_verbose_logging(verbose)
-    cmd = CmdAndroidCheckADB(results_path=output, ioc_files=iocs,
-                             module_name=module, serial=serial, fast_mode=fast)
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking Android device over debug bridge")
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning("The analysis of the Android device produced %d detections!",
-                    cmd.detected_count)
-
-
-#==============================================================================
-# Command: check-bugreport
-#==============================================================================
-@cli.command("check-bugreport", help="Check an Android Bug Report",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.argument("BUGREPORT_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_bugreport(ctx, iocs, output, list_modules, module, verbose, bugreport_path):
-    set_verbose_logging(verbose)
-    # Always generate hashes as bug reports are small.
-    cmd = CmdAndroidCheckBugreport(target_path=bugreport_path,
-                                   results_path=output, ioc_files=iocs,
-                                   module_name=module, hashes=True)
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking Android bug report at path: %s", bugreport_path)
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning("The analysis of the Android bug report produced %d detections!",
-                    cmd.detected_count)
-
-
-#==============================================================================
-# Command: check-backup
-#==============================================================================
-@cli.command("check-backup", help="Check an Android Backup",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_backup(ctx, iocs, output, list_modules, verbose, backup_path):
-    set_verbose_logging(verbose)
-    # Always generate hashes as backups are generally small.
-    cmd = CmdAndroidCheckBackup(target_path=backup_path, results_path=output,
-                                ioc_files=iocs, hashes=True)
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking Android backup at path: %s", backup_path)
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning("The analysis of the Android backup produced %d detections!",
-                    cmd.detected_count)
-
-
-#==============================================================================
-# Command: check-androidqf
-#==============================================================================
-@cli.command("check-androidqf", help="Check data collected with AndroidQF",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.argument("ANDROIDQF_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_androidqf(ctx, iocs, output, list_modules, module, hashes, verbose, androidqf_path):
-    set_verbose_logging(verbose)
-    cmd = CmdAndroidCheckAndroidQF(target_path=androidqf_path,
-                                   results_path=output, ioc_files=iocs,
-                                   module_name=module, hashes=hashes)
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking AndroidQF acquisition at path: %s", androidqf_path)
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning("The analysis of the AndroidQF acquisition produced %d detections!",
-                    cmd.detected_count)
-
-
-#==============================================================================
-# Command: check-iocs
-#==============================================================================
-@cli.command("check-iocs", help="Compare stored JSON results to provided indicators",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.argument("FOLDER", type=click.Path(exists=True))
-@click.pass_context
-def check_iocs(ctx, iocs, list_modules, module, folder):
-    cmd = CmdCheckIOCS(target_path=folder, ioc_files=iocs, module_name=module)
-    cmd.modules = BACKUP_MODULES + ADB_MODULES + BUGREPORT_MODULES
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    cmd.run()
-
-
-#==============================================================================
-# Command: download-iocs
-#==============================================================================
-@cli.command("download-iocs", help="Download public STIX2 indicators",
-             context_settings=CONTEXT_SETTINGS)
-def download_indicators():
-    ioc_updates = IndicatorsUpdates()
-    ioc_updates.update()

mvt/android/cmd_check_androidqf.py

@@ -1,34 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.common.command import Command
-
-from .modules.androidqf import ANDROIDQF_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckAndroidQF(Command):
-
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        hashes: Optional[bool] = False,
-    ) -> None:
-        super().__init__(target_path=target_path, results_path=results_path,
-                         ioc_files=ioc_files, module_name=module_name,
-                         serial=serial, fast_mode=fast_mode, hashes=hashes,
-                         log=log)
-
-        self.name = "check-androidqf"
-        self.modules = ANDROIDQF_MODULES

mvt/android/modules/adb/dumpsys_accessibility.py

@@ -1,53 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_accessibility
-
-from .base import AndroidExtraction
-
-
-class DumpsysAccessibility(AndroidExtraction):
-    """This module extracts stats on accessibility."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys accessibility")
-        self._adb_disconnect()
-
-        self.results = parse_dumpsys_accessibility(output)
-
-        for result in self.results:
-            self.log.info("Found installed accessibility service \"%s\"",
-                          result.get("service"))
-
-        self.log.info("Identified a total of %d accessibility services",
-                      len(self.results))

mvt/android/modules/adb/dumpsys_activities.py

@@ -1,51 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_activity_resolver_table
-
-from .base import AndroidExtraction
-
-
-class DumpsysActivities(AndroidExtraction):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = results if results else {}
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for intent, activities in self.results.items():
-            for activity in activities:
-                ioc = self.indicators.check_app_id(activity["package_name"])
-                if ioc:
-                    activity["matched_indicator"] = ioc
-                    self.detected.append({intent: activity})
-                    continue
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys package")
-        self._adb_disconnect()
-
-        self.results = parse_dumpsys_activity_resolver_table(output)
-
-        self.log.info("Extracted activities for %d intents", len(self.results))

mvt/android/modules/adb/dumpsys_appops.py

@@ -1,73 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from mvt.android.parsers.dumpsys import parse_dumpsys_appops
-
-from .base import AndroidExtraction
-
-
-class DumpsysAppOps(AndroidExtraction):
-    """This module extracts records from App-op Manager."""
-
-    slug = "dumpsys_appops"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-        for perm in record["permissions"]:
-            if "entries" not in perm:
-                continue
-
-            for entry in perm["entries"]:
-                if "timestamp" in entry:
-                    records.append({
-                        "timestamp": entry["timestamp"],
-                        "module": self.__class__.__name__,
-                        "event": entry["access"],
-                        "data": f"{record['package_name']} access to "
-                                f"{perm['name']}: {entry['access']}",
-                    })
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            for perm in result["permissions"]:
-                if (perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                        and perm["access"] == "allow"):
-                    self.log.info("Package %s with REQUEST_INSTALL_PACKAGES "
-                                  "permission", result["package_name"])
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys appops")
-        self._adb_disconnect()
-
-        self.results = parse_dumpsys_appops(output)
-
-        self.log.info("Extracted a total of %d records from app-ops manager",
-                      len(self.results))

mvt/android/modules/adb/dumpsys_battery_daily.py

@@ -1,58 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from mvt.android.parsers import parse_dumpsys_battery_daily
-
-from .base import AndroidExtraction
-
-
-class DumpsysBatteryDaily(AndroidExtraction):
-    """This module extracts records from battery daily updates."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["from"],
-            "module": self.__class__.__name__,
-            "event": "battery_daily",
-            "data": f"Recorded update of package {record['package_name']} "
-                    f"with vers {record['vers']}"
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys batterystats --daily")
-        self._adb_disconnect()
-
-        self.results = parse_dumpsys_battery_daily(output)
-
-        self.log.info("Extracted %d records from battery daily stats",
-                      len(self.results))

mvt/android/modules/adb/dumpsys_battery_history.py

@@ -1,49 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_battery_history
-
-from .base import AndroidExtraction
-
-
-class DumpsysBatteryHistory(AndroidExtraction):
-    """This module extracts records from battery history events."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys batterystats --history")
-        self._adb_disconnect()
-
-        self.results = parse_dumpsys_battery_history(output)
-
-        self.log.info("Extracted %d records from battery history",
-                      len(self.results))

mvt/android/modules/adb/dumpsys_dbinfo.py

@@ -1,53 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_dbinfo
-
-from .base import AndroidExtraction
-
-
-class DumpsysDBInfo(AndroidExtraction):
-    """This module extracts records from battery daily updates."""
-
-    slug = "dumpsys_dbinfo"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            path = result.get("path", "")
-            for part in path.split("/"):
-                ioc = self.indicators.check_app_id(part)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys dbinfo")
-        self._adb_disconnect()
-
-        self.results = parse_dumpsys_dbinfo(output)
-
-        self.log.info("Extracted a total of %d records from database information",
-                      len(self.results))

mvt/android/modules/adb/dumpsys_receivers.py

@@ -1,73 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_receiver_resolver_table
-
-from .base import AndroidExtraction
-
-INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
-INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
-INTENT_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
-INTENT_PHONE_STATE = "android.intent.action.PHONE_STATE"
-INTENT_NEW_OUTGOING_CALL = "android.intent.action.NEW_OUTGOING_CALL"
-
-
-class DumpsysReceivers(AndroidExtraction):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = results if results else {}
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for intent, receivers in self.results.items():
-            for receiver in receivers:
-                if intent == INTENT_NEW_OUTGOING_SMS:
-                    self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_SMS_RECEIVED:
-                    self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_DATA_SMS_RECEIVED:
-                    self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_PHONE_STATE:
-                    self.log.info("Found a receiver monitoring "
-                                  "telephony state/incoming calls: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_NEW_OUTGOING_CALL:
-                    self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
-                                  receiver["receiver"])
-
-                ioc = self.indicators.check_app_id(receiver["package_name"])
-                if ioc:
-                    receiver["matched_indicator"] = ioc
-                    self.detected.append({intent: receiver})
-                    continue
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys package")
-        self.results = parse_dumpsys_receiver_resolver_table(output)
-
-        self._adb_disconnect()

mvt/android/modules/adb/getprop.py

@@ -1,61 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from datetime import datetime, timedelta
-from typing import Optional
-
-from mvt.android.parsers import parse_getprop
-
-from .base import AndroidExtraction
-
-
-class Getprop(AndroidExtraction):
-    """This module extracts device properties from getprop command."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = {} if not results else results
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_android_property_name(result.get("name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("getprop")
-        self._adb_disconnect()
-
-        self.results = parse_getprop(output)
-
-        # Alert if phone is outdated.
-        for entry in self.results:
-            if entry.get("name", "") != "ro.build.version.security_patch":
-                continue
-            patch_date = datetime.strptime(entry["value"], "%Y-%m-%d")
-            if (datetime.now() - patch_date) > timedelta(days=6*30):
-                self.log.warning("This phone has not received security updates "
-                                 "for more than six months (last update: %s)",
-                                 entry["value"])
-
-        self.log.info("Extracted %d Android system properties",
-                      len(self.results))

mvt/android/modules/adb/processes.py

@@ -1,86 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from .base import AndroidExtraction
-
-
-class Processes(AndroidExtraction):
-    """This module extracts details on running processes."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            proc_name = result.get("proc_name", "")
-            if not proc_name:
-                continue
-
-            # Skipping this process because of false positives.
-            if result["proc_name"] == "gatekeeperd":
-                continue
-
-            ioc = self.indicators.check_app_id(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-            ioc = self.indicators.check_process(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        output = self._adb_command("ps -A")
-
-        for line in output.splitlines()[1:]:
-            line = line.strip()
-            if line == "":
-                continue
-
-            fields = line.split()
-            proc = {
-                "user": fields[0],
-                "pid": fields[1],
-                "parent_pid": fields[2],
-                "vsize": fields[3],
-                "rss": fields[4],
-            }
-
-            # Sometimes WCHAN is empty, so we need to re-align output fields.
-            if len(fields) == 8:
-                proc["wchan"] = ""
-                proc["pc"] = fields[5]
-                proc["name"] = fields[7]
-            elif len(fields) == 9:
-                proc["wchan"] = fields[5]
-                proc["pc"] = fields[6]
-                proc["name"] = fields[8]
-
-            self.results.append(proc)
-
-        self._adb_disconnect()
-
-        self.log.info("Extracted records on a total of %d processes",
-                      len(self.results))

mvt/android/modules/androidqf/__init__.py

@@ -1,18 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .dumpsys_accessibility import DumpsysAccessibility
-from .dumpsys_activities import DumpsysActivities
-from .dumpsys_appops import DumpsysAppops
-from .dumpsys_packages import DumpsysPackages
-from .dumpsys_receivers import DumpsysReceivers
-from .getprop import Getprop
-from .processes import Processes
-from .settings import Settings
-from .sms import SMS
-
-ANDROIDQF_MODULES = [DumpsysActivities, DumpsysReceivers, DumpsysAccessibility,
-                     DumpsysAppops, Processes, Getprop, Settings, SMS,
-                     DumpsysPackages]

mvt/android/modules/androidqf/base.py

@@ -1,38 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import fnmatch
-import logging
-import os
-from typing import Any, Dict, List, Optional, Union
-
-from mvt.common.module import MVTModule
-
-
-class AndroidQFModule(MVTModule):
-    """This class provides a base for all Android Data analysis modules."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Union[List[Dict[str, Any]], Dict[str, Any], None] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self._path = target_path
-        self._files = []
-
-        for root, dirs, files in os.walk(target_path):
-            for name in files:
-                self._files.append(os.path.join(root, name))
-
-    def _get_files_by_pattern(self, pattern):
-        return fnmatch.filter(self._files, pattern)

mvt/android/modules/androidqf/dumpsys_accessibility.py

@@ -1,68 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_accessibility
-
-from .base import AndroidQFModule
-
-
-class DumpsysAccessibility(AndroidQFModule):
-    """This module analyse dumpsys accessbility"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        lines = []
-        in_accessibility = False
-        with open(dumpsys_file[0]) as handle:
-            for line in handle:
-                if line.strip().startswith("DUMP OF SERVICE accessibility:"):
-                    in_accessibility = True
-                    continue
-
-                if not in_accessibility:
-                    continue
-
-                if line.strip().startswith("-------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                    break
-
-                lines.append(line.rstrip())
-
-        self.results = parse_dumpsys_accessibility("\n".join(lines))
-
-        for result in self.results:
-            self.log.info("Found installed accessibility service \"%s\"",
-                          result.get("service"))
-
-        self.log.info("Identified a total of %d accessibility services",
-                      len(self.results))

mvt/android/modules/androidqf/dumpsys_activities.py

@@ -1,66 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_activity_resolver_table
-
-from .base import AndroidQFModule
-
-
-class DumpsysActivities(AndroidQFModule):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = results if results else {}
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for intent, activities in self.results.items():
-            for activity in activities:
-                ioc = self.indicators.check_app_id(activity["package_name"])
-                if ioc:
-                    activity["matched_indicator"] = ioc
-                    self.detected.append({intent: activity})
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        lines = []
-        in_package = False
-        with open(dumpsys_file[0]) as handle:
-            for line in handle:
-                if line.strip() == "DUMP OF SERVICE package:":
-                    in_package = True
-                    continue
-
-                if not in_package:
-                    continue
-
-                if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                    break
-
-                lines.append(line.rstrip())
-
-        self.results = parse_dumpsys_activity_resolver_table("\n".join(lines))
-
-        self.log.info("Extracted activities for %d intents", len(self.results))

mvt/android/modules/androidqf/dumpsys_appops.py

@@ -1,83 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from mvt.android.parsers import parse_dumpsys_appops
-
-from .base import AndroidQFModule
-
-
-class DumpsysAppops(AndroidQFModule):
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-        for perm in record["permissions"]:
-            if "entries" not in perm:
-                continue
-
-            for entry in perm["entries"]:
-                if "timestamp" in entry:
-                    records.append({
-                        "timestamp": entry["timestamp"],
-                        "module": self.__class__.__name__,
-                        "event": entry["access"],
-                        "data": f"{record['package_name']} access to "
-                                f"{perm['name']} : {entry['access']}",
-                    })
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            for perm in result["permissions"]:
-                if (perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                        and perm["access"] == "allow"):
-                    self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission",
-                                  result["package_name"])
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        lines = []
-        in_package = False
-        with open(dumpsys_file[0]) as handle:
-            for line in handle:
-                if line.startswith("DUMP OF SERVICE appops:"):
-                    in_package = True
-                    continue
-
-                if in_package:
-                    if line.startswith("-------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                        break
-
-                    lines.append(line.rstrip())
-
-        self.results = parse_dumpsys_appops("\n".join(lines))
-        self.log.info("Identified %d applications in AppOps Manager",
-                      len(self.results))

mvt/android/modules/androidqf/dumpsys_packages.py

@@ -1,106 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Any, Dict, List, Optional, Union
-
-from mvt.android.modules.adb.packages import (DANGEROUS_PERMISSIONS,
-                                              DANGEROUS_PERMISSIONS_THRESHOLD,
-                                              ROOT_PACKAGES)
-from mvt.android.parsers.dumpsys import parse_dumpsys_packages
-
-from .base import AndroidQFModule
-
-
-class DumpsysPackages(AndroidQFModule):
-    """This module analyse dumpsys packages"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[List[Dict[str, Any]]] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        entries = []
-        for entry in ["timestamp", "first_install_time", "last_update_time"]:
-            if entry in record:
-                entries.append({
-                    "timestamp": record[entry],
-                    "module": self.__class__.__name__,
-                    "event": entry,
-                    "data": f"Package {record['package_name']} "
-                            f"({record['uid']})",
-                })
-
-        return entries
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if result["package_name"] in ROOT_PACKAGES:
-                self.log.warning("Found an installed package related to "
-                                 "rooting/jailbreaking: \"%s\"",
-                                 result["package_name"])
-                self.detected.append(result)
-                continue
-
-            if not self.indicators:
-                continue
-
-            ioc = self.indicators.check_app_id(result.get("package_name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if len(dumpsys_file) != 1:
-            self.log.info("Dumpsys file not found")
-            return
-
-        with open(dumpsys_file[0]) as handle:
-            data = handle.read().split("\n")
-
-        package = []
-        in_service = False
-        in_package_list = False
-        for line in data:
-            if line.strip().startswith("DUMP OF SERVICE package:"):
-                in_service = True
-                continue
-
-            if in_service and line.startswith("Packages:"):
-                in_package_list = True
-                continue
-
-            if not in_service or not in_package_list:
-                continue
-
-            if line.strip() == "":
-                break
-
-            package.append(line)
-
-        self.results = parse_dumpsys_packages("\n".join(package))
-
-        for result in self.results:
-            dangerous_permissions_count = 0
-            for perm in result["permissions"]:
-                if perm["name"] in DANGEROUS_PERMISSIONS:
-                    dangerous_permissions_count += 1
-
-            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
-                self.log.info("Found package \"%s\" requested %d potentially dangerous permissions",
-                              result["package_name"],
-                              dangerous_permissions_count)
-
-        self.log.info("Extracted details on %d packages", len(self.results))

mvt/android/modules/androidqf/dumpsys_receivers.py

@@ -1,86 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Any, Dict, List, Optional, Union
-
-from mvt.android.modules.adb.dumpsys_receivers import (
-    INTENT_DATA_SMS_RECEIVED, INTENT_NEW_OUTGOING_CALL,
-    INTENT_NEW_OUTGOING_SMS, INTENT_PHONE_STATE, INTENT_SMS_RECEIVED)
-from mvt.android.parsers import parse_dumpsys_receiver_resolver_table
-
-from .base import AndroidQFModule
-
-
-class DumpsysReceivers(AndroidQFModule):
-    """This module analyse dumpsys receivers"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Union[List[Any], Dict[str, Any], None] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = results if results else {}
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for intent, receivers in self.results.items():
-            for receiver in receivers:
-                if intent == INTENT_NEW_OUTGOING_SMS:
-                    self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_SMS_RECEIVED:
-                    self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_DATA_SMS_RECEIVED:
-                    self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_PHONE_STATE:
-                    self.log.info("Found a receiver monitoring "
-                                  "telephony state/incoming calls: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_NEW_OUTGOING_CALL:
-                    self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
-                                  receiver["receiver"])
-
-                ioc = self.indicators.check_app_id(receiver["package_name"])
-                if ioc:
-                    receiver["matched_indicator"] = ioc
-                    self.detected.append({intent: receiver})
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        in_receivers = False
-        lines = []
-        with open(dumpsys_file[0]) as handle:
-            for line in handle:
-                if line.strip() == "DUMP OF SERVICE package:":
-                    in_receivers = True
-                    continue
-
-                if not in_receivers:
-                    continue
-
-                if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                    break
-
-                lines.append(line.rstrip())
-
-        self.results = parse_dumpsys_receiver_resolver_table("\n".join(lines))
-
-        self.log.info("Extracted receivers for %d intents", len(self.results))

mvt/android/modules/androidqf/getprop.py

@@ -1,76 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from datetime import datetime, timedelta
-from typing import Optional
-
-from mvt.android.parsers.getprop import parse_getprop
-
-from .base import AndroidQFModule
-
-INTERESTING_PROPERTIES = [
-    "gsm.sim.operator.alpha",
-    "gsm.sim.operator.iso-country",
-    "persist.sys.timezone",
-    "ro.boot.serialno",
-    "ro.build.version.sdk",
-    "ro.build.version.security_patch",
-    "ro.product.cpu.abi",
-    "ro.product.locale",
-    "ro.product.vendor.manufacturer",
-    "ro.product.vendor.model",
-    "ro.product.vendor.name"
-]
-
-
-class Getprop(AndroidQFModule):
-    """This module extracts data from get properties."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-        self.results = []
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_android_property_name(result.get("name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-
-    def run(self) -> None:
-        getprop_files = self._get_files_by_pattern("*/getprop.txt")
-        if not getprop_files:
-            self.log.info("getprop.txt file not found")
-            return
-
-        with open(getprop_files[0]) as f:
-            data = f.read()
-
-        self.results = parse_getprop(data)
-        for entry in self.results:
-            if entry["name"] in INTERESTING_PROPERTIES:
-                self.log.info("%s: %s", entry["name"], entry["value"])
-            if entry["name"] == "ro.build.version.security_patch":
-                last_patch = datetime.strptime(entry["value"], "%Y-%m-%d")
-                if (datetime.now() - last_patch) > timedelta(days=6*31):
-                    self.log.warning("This phone has not received security "
-                                     "updates for more than six months "
-                                     "(last update: %s)", entry["value"])
-
-        self.log.info("Extracted a total of %d properties", len(self.results))

mvt/android/modules/androidqf/processes.py

@@ -1,92 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from .base import AndroidQFModule
-
-
-class Processes(AndroidQFModule):
-    """This module analyse running processes"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            proc_name = result.get("proc_name", "")
-            if not proc_name:
-                continue
-
-            # Skipping this process because of false positives.
-            if result["proc_name"] == "gatekeeperd":
-                continue
-
-            ioc = self.indicators.check_app_id(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-            ioc = self.indicators.check_process(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-
-    def _parse_ps(self, data):
-        for line in data.split("\n")[1:]:
-            proc = line.split()
-
-            # Sometimes WCHAN is empty.
-            if len(proc) == 8:
-                proc = proc[:5] + [''] + proc[5:]
-
-            # Sometimes there is the security label.
-            if proc[0].startswith("u:r"):
-                label = proc[0]
-                proc = proc[1:]
-            else:
-                label = ""
-
-            # Sometimes there is no WCHAN.
-            if len(proc) < 9:
-                proc = proc[:5] + [""] + proc[5:]
-
-            self.results.append({
-                "user": proc[0],
-                "pid": int(proc[1]),
-                "ppid": int(proc[2]),
-                "virtual_memory_size": int(proc[3]),
-                "resident_set_size": int(proc[4]),
-                "wchan": proc[5],
-                "aprocress": proc[6],
-                "stat": proc[7],
-                "proc_name": proc[8].strip("[]"),
-                "label": label,
-            })
-
-    def run(self) -> None:
-        ps_files = self._get_files_by_pattern("*/ps.txt")
-        if not ps_files:
-            return
-
-        with open(ps_files[0]) as handle:
-            self._parse_ps(handle.read())
-
-        self.log.info("Identified %d running processes", len(self.results))

mvt/android/modules/androidqf/settings.py

@@ -1,58 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.modules.adb.settings import ANDROID_DANGEROUS_SETTINGS
-
-from .base import AndroidQFModule
-
-
-class Settings(AndroidQFModule):
-    """This module analyse setting files"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-        self.results = {}
-
-    def run(self) -> None:
-        for setting_file in self._get_files_by_pattern("*/settings_*.txt"):
-            namespace = setting_file[setting_file.rfind("_")+1:-4]
-
-            self.results[namespace] = {}
-
-            with open(setting_file) as handle:
-                for line in handle:
-                    line = line.strip()
-                    try:
-                        key, value = line.split("=", 1)
-                    except ValueError:
-                        continue
-
-                    try:
-                        self.results[namespace][key] = value
-                    except IndexError:
-                        continue
-
-                    for danger in ANDROID_DANGEROUS_SETTINGS:
-                        if (danger["key"] == key
-                                and danger["safe_value"] != value):
-                            self.log.warning("Found suspicious setting \"%s = %s\" (%s)",
-                                             key, value, danger["description"])
-                            break
-
-        self.log.info("Identified %d settings",
-                      sum([len(val) for val in self.results.values()]))

mvt/android/modules/bugreport/accessibility.py

@@ -1,69 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_accessibility
-
-from .base import BugReportModule
-
-
-class Accessibility(BugReportModule):
-    """This module extracts stats on accessibility."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        lines = []
-        in_accessibility = False
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE accessibility:":
-                in_accessibility = True
-                continue
-
-            if not in_accessibility:
-                continue
-
-            if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_accessibility("\n".join(lines))
-        for result in self.results:
-            self.log.info("Found installed accessibility service \"%s\"",
-                          result.get("service"))
-
-        self.log.info("Identified a total of %d accessibility services",
-                      len(self.results))

mvt/android/modules/bugreport/activities.py

@@ -1,68 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_activity_resolver_table
-
-from .base import BugReportModule
-
-
-class Activities(BugReportModule):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = results if results else {}
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for intent, activities in self.results.items():
-            for activity in activities:
-                ioc = self.indicators.check_app_id(activity["package_name"])
-                if ioc:
-                    activity["matched_indicator"] = ioc
-                    self.detected.append({intent: activity})
-                    continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        lines = []
-        in_package = False
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE package:":
-                in_package = True
-                continue
-
-            if not in_package:
-                continue
-
-            if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_activity_resolver_table("\n".join(lines))
-
-        self.log.info("Extracted activities for %d intents", len(self.results))

mvt/android/modules/bugreport/appops.py

@@ -1,88 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from mvt.android.parsers import parse_dumpsys_appops
-
-from .base import BugReportModule
-
-
-class Appops(BugReportModule):
-    """This module extracts information on package from App-Ops Manager."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-        for perm in record["permissions"]:
-            if "entries" not in perm:
-                continue
-
-            for entry in perm["entries"]:
-                if "timestamp" in entry:
-                    records.append({
-                        "timestamp": entry["timestamp"],
-                        "module": self.__class__.__name__,
-                        "event": entry["access"],
-                        "data": f"{record['package_name']} access to "
-                                f"{perm['name']}: {entry['access']}",
-                    })
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            for perm in result["permissions"]:
-                if (perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                        and perm["access"] == "allow"):
-                    self.log.info("Package %s with REQUEST_INSTALL_PACKAGES permission",
-                                  result["package_name"])
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        lines = []
-        in_appops = False
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE appops:":
-                in_appops = True
-                continue
-
-            if not in_appops:
-                continue
-
-            if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_appops("\n".join(lines))
-
-        self.log.info("Identified a total of %d packages in App-Ops Manager",
-                      len(self.results))

mvt/android/modules/bugreport/battery_daily.py

@@ -1,84 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from mvt.android.parsers import parse_dumpsys_battery_daily
-
-from .base import BugReportModule
-
-
-class BatteryDaily(BugReportModule):
-    """This module extracts records from battery daily updates."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["from"],
-            "module": self.__class__.__name__,
-            "event": "battery_daily",
-            "data": f"Recorded update of package {record['package_name']} "
-                    f"with vers {record['vers']}"
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        lines = []
-        in_batterystats = False
-        in_daily = False
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE batterystats:":
-                in_batterystats = True
-                continue
-
-            if not in_batterystats:
-                continue
-
-            if line.strip() == "Daily stats:":
-                lines.append(line)
-                in_daily = True
-                continue
-
-            if not in_daily:
-                continue
-
-            if line.strip() == "":
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_battery_daily("\n".join(lines))
-
-        self.log.info("Extracted a total of %d battery daily stats",
-                      len(self.results))

mvt/android/modules/bugreport/battery_history.py

@@ -1,67 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_battery_history
-
-from .base import BugReportModule
-
-
-class BatteryHistory(BugReportModule):
-    """This module extracts records from battery daily updates."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        lines = []
-        in_history = False
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip().startswith("Battery History "):
-                lines.append(line)
-                in_history = True
-                continue
-
-            if not in_history:
-                continue
-
-            if line.strip() == "":
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_battery_history("\n".join(lines))
-
-        self.log.info("Extracted a total of %d battery history records",
-                      len(self.results))

mvt/android/modules/bugreport/dbinfo.py

@@ -1,70 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_dbinfo
-
-from .base import BugReportModule
-
-
-class DBInfo(BugReportModule):
-    """This module extracts records from battery daily updates."""
-
-    slug = "dbinfo"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            path = result.get("path", "")
-            for part in path.split("/"):
-                ioc = self.indicators.check_app_id(part)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        in_dbinfo = False
-        lines = []
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE dbinfo:":
-                in_dbinfo = True
-                continue
-
-            if not in_dbinfo:
-                continue
-
-            if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_dbinfo("\n".join(lines))
-
-        self.log.info("Extracted a total of %d database connection pool records",
-                      len(self.results))

mvt/android/modules/bugreport/getprop.py

@@ -1,69 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from datetime import datetime, timedelta
-from typing import Optional
-
-from mvt.android.parsers import parse_getprop
-
-from .base import BugReportModule
-
-
-class Getprop(BugReportModule):
-    """This module extracts device properties from getprop command."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = {} if not results else results
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        lines = []
-        in_getprop = False
-
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip().startswith("------ SYSTEM PROPERTIES"):
-                in_getprop = True
-                continue
-
-            if not in_getprop:
-                continue
-
-            if line.strip() == "------":
-                break
-
-            lines.append(line)
-
-        self.results = parse_getprop("\n".join(lines))
-
-        # Alert if phone is outdated.
-        for entry in self.results:
-            if entry["name"] == "ro.build.version.security_patch":
-                security_patch = entry["value"]
-                patch_date = datetime.strptime(security_patch, "%Y-%m-%d")
-                if (datetime.now() - patch_date) > timedelta(days=6*30):
-                    self.log.warning("This phone has not received security updates "
-                                     "for more than six months (last update: %s)",
-                                     security_patch)
-
-        self.log.info("Extracted %d Android system properties",
-                      len(self.results))

mvt/android/modules/bugreport/packages.py

@@ -1,122 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from mvt.android.modules.adb.packages import (DANGEROUS_PERMISSIONS,
-                                              DANGEROUS_PERMISSIONS_THRESHOLD,
-                                              ROOT_PACKAGES)
-from mvt.android.parsers.dumpsys import parse_dumpsys_packages
-
-from .base import BugReportModule
-
-
-class Packages(BugReportModule):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-
-        timestamps = [
-            {
-                "event": "package_install",
-                "timestamp": record["timestamp"]
-            },
-            {
-                "event": "package_first_install",
-                "timestamp": record["first_install_time"]
-            },
-            {
-                "event": "package_last_update",
-                "timestamp": record["last_update_time"]
-            },
-        ]
-
-        for timestamp in timestamps:
-            records.append({
-                "timestamp": timestamp["timestamp"],
-                "module": self.__class__.__name__,
-                "event": timestamp["event"],
-                "data": f"Install or update of package {record['package_name']}",
-            })
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if result["package_name"] in ROOT_PACKAGES:
-                self.log.warning("Found an installed package related to "
-                                 "rooting/jailbreaking: \"%s\"",
-                                 result["package_name"])
-                self.detected.append(result)
-                continue
-
-            if not self.indicators:
-                continue
-
-            ioc = self.indicators.check_app_id(result.get("package_name"))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        in_package = False
-        in_packages_list = False
-        lines = []
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE package:":
-                in_package = True
-                continue
-
-            if not in_package:
-                continue
-
-            if line.strip() == "Packages:":
-                in_packages_list = True
-                continue
-
-            if not in_packages_list:
-                continue
-
-            if line.strip() == "":
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_packages("\n".join(lines))
-
-        for result in self.results:
-            dangerous_permissions_count = 0
-            for perm in result["permissions"]:
-                if perm["name"] in DANGEROUS_PERMISSIONS:
-                    dangerous_permissions_count += 1
-
-            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
-                self.log.info("Found package \"%s\" requested %d potentially dangerous permissions",
-                              result["package_name"],
-                              dangerous_permissions_count)
-
-        self.log.info("Extracted details on %d packages", len(self.results))

mvt/android/modules/bugreport/receivers.py

@@ -1,91 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.parsers import parse_dumpsys_receiver_resolver_table
-
-from .base import BugReportModule
-
-INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
-INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
-INTENT_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
-INTENT_PHONE_STATE = "android.intent.action.PHONE_STATE"
-INTENT_NEW_OUTGOING_CALL = "android.intent.action.NEW_OUTGOING_CALL"
-
-
-class Receivers(BugReportModule):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = results if results else {}
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for intent, receivers in self.results.items():
-            for receiver in receivers:
-                if intent == INTENT_NEW_OUTGOING_SMS:
-                    self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_SMS_RECEIVED:
-                    self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_DATA_SMS_RECEIVED:
-                    self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_PHONE_STATE:
-                    self.log.info("Found a receiver monitoring "
-                                  "telephony state/incoming calls: \"%s\"",
-                                  receiver["receiver"])
-                elif intent == INTENT_NEW_OUTGOING_CALL:
-                    self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
-                                  receiver["receiver"])
-
-                ioc = self.indicators.check_app_id(receiver["package_name"])
-                if ioc:
-                    receiver["matched_indicator"] = ioc
-                    self.detected.append({intent: receiver})
-                    continue
-
-    def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
-            self.log.error("Unable to find dumpstate file. "
-                           "Did you provide a valid bug report archive?")
-            return
-
-        in_receivers = False
-        lines = []
-        for line in content.decode(errors="ignore").splitlines():
-            if line.strip() == "DUMP OF SERVICE package:":
-                in_receivers = True
-                continue
-
-            if not in_receivers:
-                continue
-
-            if line.strip().startswith("------------------------------------------------------------------------------"):  # pylint: disable=line-too-long
-                break
-
-            lines.append(line)
-
-        self.results = parse_dumpsys_receiver_resolver_table("\n".join(lines))
-
-        self.log.info("Extracted receivers for %d intents", len(self.results))

mvt/android/parsers/__init__.py

@@ -1,11 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .dumpsys import (parse_dumpsys_accessibility,
-                      parse_dumpsys_activity_resolver_table,
-                      parse_dumpsys_appops, parse_dumpsys_battery_daily,
-                      parse_dumpsys_battery_history, parse_dumpsys_dbinfo,
-                      parse_dumpsys_receiver_resolver_table)
-from .getprop import parse_getprop

mvt/android/parsers/dumpsys.py

@@ -1,521 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-from datetime import datetime
-from typing import Any, Dict, List
-
-from mvt.common.utils import convert_datetime_to_iso
-
-
-def parse_dumpsys_accessibility(output: str) -> List[Dict[str, str]]:
-    results = []
-
-    in_services = False
-    for line in output.splitlines():
-        if line.strip().startswith("installed services:"):
-            in_services = True
-            continue
-
-        if not in_services:
-            continue
-
-        if line.strip() == "}":
-            break
-
-        service = line.split(":")[1].strip()
-
-        results.append({
-            "package_name": service.split("/")[0],
-            "service": service,
-        })
-
-    return results
-
-
-def parse_dumpsys_activity_resolver_table(output: str) -> Dict[str, Any]:
-    results = {}
-
-    in_activity_resolver_table = False
-    in_non_data_actions = False
-    intent = None
-    for line in output.splitlines():
-        if line.startswith("Activity Resolver Table:"):
-            in_activity_resolver_table = True
-            continue
-
-        if not in_activity_resolver_table:
-            continue
-
-        if line.startswith("  Non-Data Actions:"):
-            in_non_data_actions = True
-            continue
-
-        if not in_non_data_actions:
-            continue
-
-        # If we hit an empty line, the Non-Data Actions section should be
-        # finished.
-        if line.strip() == "":
-            break
-
-        # We detect the action name.
-        if (line.startswith(" " * 6) and not line.startswith(" " * 8)
-                and ":" in line):
-            intent = line.strip().replace(":", "")
-            results[intent] = []
-            continue
-
-        # If we are not in an intent block yet, skip.
-        if not intent:
-            continue
-
-        # If we are in a block but the line does not start with 8 spaces
-        # it means the block ended a new one started, so we reset and
-        # continue.
-        if not line.startswith(" " * 8):
-            intent = None
-            continue
-
-        # If we got this far, we are processing receivers for the
-        # activities we are interested in.
-        activity = line.strip().split(" ")[1]
-        package_name = activity.split("/")[0]
-
-        results[intent].append({
-            "package_name": package_name,
-            "activity": activity,
-        })
-
-    return results
-
-
-def parse_dumpsys_battery_daily(output: str) -> list:
-    results = []
-    daily = None
-    daily_updates = []
-    for line in output.splitlines():
-        if line.startswith("  Daily from "):
-            if len(daily_updates) > 0:
-                results.extend(daily_updates)
-                daily_updates = []
-
-            timeframe = line[13:].strip()
-            date_from, date_to = timeframe.strip(":").split(" to ", 1)
-            daily = {"from": date_from[0:10], "to": date_to[0:10]}
-            continue
-
-        if not daily:
-            continue
-
-        if not line.strip().startswith("Update "):
-            continue
-
-        line = line.strip().replace("Update ", "")
-        package_name, vers = line.split(" ", 1)
-        vers_nr = vers.split("=", 1)[1]
-
-        already_seen = False
-        for update in daily_updates:
-            if (package_name == update["package_name"]
-                    and vers_nr == update["vers"]):
-                already_seen = True
-                break
-
-        if not already_seen:
-            daily_updates.append({
-                "action": "update",
-                "from": daily["from"],
-                "to": daily["to"],
-                "package_name": package_name,
-                "vers": vers_nr,
-            })
-
-    if len(daily_updates) > 0:
-        results.extend(daily_updates)
-
-    return results
-
-
-def parse_dumpsys_battery_history(output: str) -> List[Dict[str, Any]]:
-    results = []
-
-    for line in output.splitlines():
-        if line.startswith("Battery History "):
-            continue
-
-        if line.strip() == "":
-            break
-
-        time_elapsed = line.strip().split(" ", 1)[0]
-
-        event = ""
-        if line.find("+job") > 0:
-            event = "start_job"
-            uid = line[line.find("+job")+5:line.find(":")]
-            service = line[line.find(":")+1:].strip('"')
-            package_name = service.split("/")[0]
-        elif line.find("-job") > 0:
-            event = "end_job"
-            uid = line[line.find("-job")+5:line.find(":")]
-            service = line[line.find(":")+1:].strip('"')
-            package_name = service.split("/")[0]
-        elif line.find("+running +wake_lock=") > 0:
-            uid = line[line.find("+running +wake_lock=")+21:line.find(":")]
-            event = "wake"
-            service = line[line.find("*walarm*:")+9:].split(" ")[0].strip('"').strip()
-            if service == "" or "/" not in service:
-                continue
-
-            package_name = service.split("/")[0]
-        elif (line.find("+top=") > 0) or (line.find("-top") > 0):
-            if line.find("+top=") > 0:
-                event = "start_top"
-                top_pos = line.find("+top=")
-            else:
-                event = "end_top"
-                top_pos = line.find("-top=")
-            colon_pos = top_pos+line[top_pos:].find(":")
-            uid = line[top_pos+5:colon_pos]
-            service = ""
-            package_name = line[colon_pos+1:].strip('"')
-        else:
-            continue
-
-        results.append({
-            "time_elapsed": time_elapsed,
-            "event": event,
-            "uid": uid,
-            "package_name": package_name,
-            "service": service,
-        })
-
-    return results
-
-
-def parse_dumpsys_dbinfo(output: str) -> List[Dict[str, Any]]:
-    results = []
-
-    rxp = re.compile(r'.*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\"')  # pylint: disable=line-too-long
-    rxp_no_pid = re.compile(r'.*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\"')  # pylint: disable=line-too-long
-
-    pool = None
-    in_operations = False
-    for line in output.splitlines():
-        if line.startswith("Connection pool for "):
-            pool = line.replace("Connection pool for ", "").rstrip(":")
-
-        if not pool:
-            continue
-
-        if line.strip() == "Most recently executed operations:":
-            in_operations = True
-            continue
-
-        if not in_operations:
-            continue
-
-        if not line.startswith("        "):
-            in_operations = False
-            pool = None
-            continue
-
-        matches = rxp.findall(line)
-        if not matches:
-            matches = rxp_no_pid.findall(line)
-            if not matches:
-                continue
-
-            match = matches[0]
-            results.append({
-                "isodate": match[0],
-                "action": match[1],
-                "sql": match[2],
-                "path": pool,
-            })
-        else:
-            match = matches[0]
-            results.append({
-                "isodate": match[0],
-                "pid": match[1],
-                "action": match[2],
-                "sql": match[3],
-                "path": pool,
-            })
-
-    return results
-
-
-def parse_dumpsys_receiver_resolver_table(output: str) -> Dict[str, Any]:
-    results = {}
-
-    in_receiver_resolver_table = False
-    in_non_data_actions = False
-    intent = None
-    for line in output.splitlines():
-        if line.startswith("Receiver Resolver Table:"):
-            in_receiver_resolver_table = True
-            continue
-
-        if not in_receiver_resolver_table:
-            continue
-
-        if line.startswith("  Non-Data Actions:"):
-            in_non_data_actions = True
-            continue
-
-        if not in_non_data_actions:
-            continue
-
-        # If we hit an empty line, the Non-Data Actions section should be
-        # finished.
-        if line.strip() == "":
-            break
-
-        # We detect the action name.
-        if (line.startswith(" " * 6) and not line.startswith(" " * 8)
-                and ":" in line):
-            intent = line.strip().replace(":", "")
-            results[intent] = []
-            continue
-
-        # If we are not in an intent block yet, skip.
-        if not intent:
-            continue
-
-        # If we are in a block but the line does not start with 8 spaces
-        # it means the block ended a new one started, so we reset and
-        # continue.
-        if not line.startswith(" " * 8):
-            intent = None
-            continue
-
-        # If we got this far, we are processing receivers for the
-        # activities we are interested in.
-        receiver = line.strip().split(" ")[1]
-        package_name = receiver.split("/")[0]
-
-        results[intent].append({
-            "package_name": package_name,
-            "receiver": receiver,
-        })
-
-    return results
-
-
-def parse_dumpsys_appops(output: str) -> List[Dict[str, Any]]:
-    results = []
-    perm = {}
-    package = {}
-    entry = {}
-    uid = None
-    in_packages = False
-
-    for line in output.splitlines():
-        if line.startswith("  Uid 0:"):
-            in_packages = True
-
-        if not in_packages:
-            continue
-
-        if line.startswith("  Uid "):
-            uid = line[6:-1]
-            continue
-
-        if line.startswith("    Package "):
-            if entry:
-                perm["entries"].append(entry)
-                entry = {}
-
-            if package:
-                if perm:
-                    package["permissions"].append(perm)
-
-                perm = {}
-                results.append(package)
-
-            package = {
-                "package_name": line[12:-1],
-                "permissions": [],
-                "uid": uid,
-            }
-            continue
-
-        if line.startswith("      ") and line[6] != " ":
-            if entry:
-                perm["entries"].append(entry)
-                entry = {}
-            if perm:
-                package["permissions"].append(perm)
-                perm = {}
-
-            perm["name"] = line.split()[0]
-            perm["entries"] = []
-            if len(line.split()) > 1:
-                perm["access"] = line.split()[1][1:-2]
-
-            continue
-
-        if line.startswith("          "):
-            # Permission entry like:
-            # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
-            if entry:
-                perm["entries"].append(entry)
-                entry = {}
-
-            entry["access"] = line.split(":")[0].strip()
-            entry["type"] = line[line.find("[")+1:line.find("]")]
-
-            try:
-                entry["timestamp"] = convert_datetime_to_iso(
-                    datetime.strptime(
-                        line[line.find("]")+1:line.find("(")].strip(),
-                        "%Y-%m-%d %H:%M:%S.%f"))
-            except ValueError:
-                # Invalid date format
-                pass
-
-        if line.strip() == "":
-            break
-
-    if entry:
-        perm["entries"].append(entry)
-    if perm:
-        package["permissions"].append(perm)
-    if package:
-        results.append(package)
-
-    return results
-
-
-def parse_dumpsys_package_for_details(output: str) -> Dict[str, Any]:
-    """
-    Parse one entry of a dumpsys package information
-    """
-    details = {
-        "uid": "",
-        "version_name": "",
-        "version_code": "",
-        "timestamp": "",
-        "first_install_time": "",
-        "last_update_time": "",
-        "permissions": [],
-        "requested_permissions": [],
-    }
-
-    in_install_permissions = False
-    in_runtime_permissions = False
-    in_declared_permissions = False
-    in_requested_permissions = True
-    for line in output.splitlines():
-        if in_install_permissions:
-            if line.startswith(" " * 4) and not line.startswith(" " * 6):
-                in_install_permissions = False
-            else:
-                lineinfo = line.strip().split(":")
-                permission = lineinfo[0]
-                granted = None
-                if "granted=" in lineinfo[1]:
-                    granted = ("granted=true" in lineinfo[1])
-
-                details["permissions"].append({
-                    "name": permission,
-                    "granted": granted,
-                    "type": "install"
-                })
-
-        if in_runtime_permissions:
-            if not line.startswith(" " * 8):
-                in_runtime_permissions = False
-            else:
-                lineinfo = line.strip().split(":")
-                permission = lineinfo[0]
-                granted = None
-                if "granted=" in lineinfo[1]:
-                    granted = ("granted=true" in lineinfo[1])
-
-                details["permissions"].append({
-                    "name": permission,
-                    "granted": granted,
-                    "type": "runtime"
-                })
-
-        if in_declared_permissions:
-            if not line.startswith(" " * 6):
-                in_declared_permissions = False
-            else:
-                permission = line.strip().split(":")[0]
-                details["permissions"].append({
-                    "name": permission,
-                    "type": "declared"
-                })
-        if in_requested_permissions:
-            if not line.startswith(" " * 6):
-                in_requested_permissions = False
-            else:
-                details["requested_permissions"].append(line.strip())
-
-        if line.strip().startswith("userId="):
-            details["uid"] = line.split("=")[1].strip()
-        elif line.strip().startswith("versionName="):
-            details["version_name"] = line.split("=")[1].strip()
-        elif line.strip().startswith("versionCode="):
-            details["version_code"] = line.split("=", 1)[1].strip()
-        elif line.strip().startswith("timeStamp="):
-            details["timestamp"] = line.split("=")[1].strip()
-        elif line.strip().startswith("firstInstallTime="):
-            details["first_install_time"] = line.split("=")[1].strip()
-        elif line.strip().startswith("lastUpdateTime="):
-            details["last_update_time"] = line.split("=")[1].strip()
-        elif line.strip() == "install permissions:":
-            in_install_permissions = True
-        elif line.strip() == "runtime permissions:":
-            in_runtime_permissions = True
-        elif line.strip() == "declared permissions:":
-            in_declared_permissions = True
-        elif line.strip() == "requested permissions:":
-            in_requested_permissions = True
-
-    return details
-
-
-def parse_dumpsys_packages(output: str) -> List[Dict[str, Any]]:
-    """
-    Parse the dumpsys package service data
-    """
-    pkg_rxp = re.compile(r"  Package \[(.+?)\].*")
-
-    results = []
-    package_name = None
-    package = {}
-    lines = []
-    for line in output.splitlines():
-        if line.startswith("  Package ["):
-            if len(lines) > 0:
-                details = parse_dumpsys_package_for_details("\n".join(lines))
-                package.update(details)
-                results.append(package)
-                lines = []
-                package = {}
-
-            matches = pkg_rxp.findall(line)
-            if not matches:
-                continue
-
-            package_name = matches[0]
-            package["package_name"] = package_name
-            continue
-
-        if not package_name:
-            continue
-
-        lines.append(line)
-
-    if len(lines) > 0:
-        details = parse_dumpsys_package_for_details("\n".join(lines))
-        package.update(details)
-        results.append(package)
-
-    return results

mvt/android/parsers/getprop.py

@@ -1,29 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-from typing import Dict, List
-
-
-def parse_getprop(output: str) -> List[Dict[str, str]]:
-    results = []
-    rxp = re.compile(r"\[(.+?)\]: \[(.+?)\]")
-
-    for line in output.splitlines():
-        line = line.strip()
-        if line == "":
-            continue
-
-        matches = re.findall(rxp, line)
-        if not matches or len(matches[0]) != 2:
-            continue
-
-        entry = {
-            "name": matches[0][0],
-            "value": matches[0][1]
-        }
-        results.append(entry)
-
-    return results

mvt/common/help.py

@@ -1,16 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-# Help messages of repeating options.
-HELP_MSG_OUTPUT = "Specify a path to a folder where you want to store JSON results"
-HELP_MSG_IOC = "Path to indicators file (can be invoked multiple time)"
-HELP_MSG_FAST = "Avoid running time/resource consuming features"
-HELP_MSG_LIST_MODULES = "Print list of available modules and exit"
-HELP_MSG_MODULE = "Name of a single module you would like to run instead of all"
-HELP_MSG_HASHES = "Generate hashes of all the files analyzed"
-HELP_MSG_VERBOSE = "Verbose mode"
-
-# Android-specific.
-HELP_MSG_SERIAL = "Specify a device serial number or HOST:PORT connection string"

mvt/common/indicators.py

@@ -1,553 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import logging
-import os
-from typing import Any, Dict, Iterator, List, Optional, Union
-
-from appdirs import user_data_dir
-
-from .url import URL
-
-MVT_DATA_FOLDER = user_data_dir("mvt")
-MVT_INDICATORS_FOLDER = os.path.join(MVT_DATA_FOLDER, "indicators")
-
-logger = logging.getLogger(__name__)
-
-
-class Indicators:
-    """This class is used to parse indicators from a STIX2 file and provide
-    functions to compare extracted artifacts to the indicators.
-    """
-
-    def __init__(self, log=logger) -> None:
-        self.log = log
-        self.ioc_collections: List[Dict[str, Any]] = []
-        self.total_ioc_count = 0
-
-    def _load_downloaded_indicators(self) -> None:
-        if not os.path.isdir(MVT_INDICATORS_FOLDER):
-            return
-
-        for ioc_file_name in os.listdir(MVT_INDICATORS_FOLDER):
-            if ioc_file_name.lower().endswith(".stix2"):
-                self.parse_stix2(os.path.join(MVT_INDICATORS_FOLDER,
-                                              ioc_file_name))
-
-    def _check_stix2_env_variable(self) -> None:
-        """
-        Checks if a variable MVT_STIX2 contains path to a STIX files.
-        """
-        if "MVT_STIX2" not in os.environ:
-            return
-
-        paths = os.environ["MVT_STIX2"].split(":")
-        for path in paths:
-            if os.path.isfile(path):
-                self.parse_stix2(path)
-            else:
-                self.log.error("Path specified with env MVT_STIX2 is not a valid file: %s",
-                               path)
-
-    def _new_collection(
-        self,
-        cid: Optional[str] = None,
-        name: Optional[str] = None,
-        description: Optional[str] = None,
-        file_name: Optional[str] = None,
-        file_path: Optional[str] = None
-    ) -> dict:
-        return {
-            "id": cid,
-            "name": name,
-            "description": description,
-            "stix2_file_name": file_name,
-            "stix2_file_path": file_path,
-            "domains": [],
-            "processes": [],
-            "emails": [],
-            "file_names": [],
-            "file_paths": [],
-            "files_sha256": [],
-            "app_ids": [],
-            "ios_profile_ids": [],
-            "android_property_names": [],
-            "count": 0,
-        }
-
-    def _add_indicator(self, ioc: str, ioc_coll: dict,
-                       ioc_coll_list: list) -> None:
-        ioc = ioc.strip("'")
-        if ioc not in ioc_coll_list:
-            ioc_coll_list.append(ioc)
-            ioc_coll["count"] += 1
-            self.total_ioc_count += 1
-
-    def _process_indicator(self, indicator: dict, collection: dict) -> None:
-        key, value = indicator.get("pattern", "").strip("[]").split("=")
-
-        if key == "domain-name:value":
-            # We force domain names to lower case.
-            self._add_indicator(ioc=value.lower(),
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["domains"])
-        elif key == "process:name":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["processes"])
-        elif key == "email-addr:value":
-            # We force email addresses to lower case.
-            self._add_indicator(ioc=value.lower(),
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["emails"])
-        elif key == "file:name":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["file_names"])
-        elif key == "file:path":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["file_paths"])
-        elif key == "file:hashes.sha256":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["files_sha256"])
-        elif key == "app:id":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["app_ids"])
-        elif key == "configuration-profile:id":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["ios_profile_ids"])
-
-        elif key == "android-property:name":
-            self._add_indicator(ioc=value,
-                                ioc_coll=collection,
-                                ioc_coll_list=collection["android_property_names"])
-
-    def parse_stix2(self, file_path: str) -> None:
-        """Extract indicators from a STIX2 file.
-
-        :param file_path: Path to the STIX2 file to parse
-        :type file_path: str
-
-        """
-        self.log.info("Parsing STIX2 indicators file at path %s", file_path)
-
-        with open(file_path, "r", encoding="utf-8") as handle:
-            try:
-                data = json.load(handle)
-            except json.decoder.JSONDecodeError:
-                self.log.critical("Unable to parse STIX2 indicator file. "
-                                  "The file is corrupted or in the wrong format!")
-                return
-
-        malware = {}
-        indicators = []
-        relationships = []
-        for entry in data.get("objects", []):
-            entry_type = entry.get("type", "")
-            if entry_type == "malware":
-                malware[entry["id"]] = {
-                    "name": entry["name"],
-                    "description": entry.get("description", ""),
-                }
-            elif entry_type == "indicator":
-                indicators.append(entry)
-            elif entry_type == "relationship":
-                relationships.append(entry)
-
-        collections = []
-        for mal_id, mal_values in malware.items():
-            collection = self._new_collection(mal_id, mal_values.get("name"),
-                                              mal_values.get("description"),
-                                              os.path.basename(file_path),
-                                              file_path)
-            collections.append(collection)
-
-        # We loop through all indicators.
-        for indicator in indicators:
-            malware_id = None
-
-            # We loop through all relationships and find the one pertinent to
-            # the current indicator.
-            for relationship in relationships:
-                if relationship["source_ref"] != indicator["id"]:
-                    continue
-
-                # Look for a malware definition with the correct identifier.
-                if relationship["target_ref"] in malware.keys():
-                    malware_id = relationship["target_ref"]
-                    break
-
-            # Now we look for the correct collection matching the malware ID we
-            # got from the relationship.
-            for collection in collections:
-                if collection["id"] == malware_id:
-                    self._process_indicator(indicator, collection)
-                    break
-
-        for coll in collections:
-            self.log.info("Extracted %d indicators for collection with name \"%s\"",
-                          coll["count"], coll["name"])
-
-        self.ioc_collections.extend(collections)
-
-    def load_indicators_files(self, files: list,
-                              load_default: Optional[bool] = True) -> None:
-        """
-        Load a list of indicators files.
-        """
-        for file_path in files:
-            if os.path.isfile(file_path):
-                self.parse_stix2(file_path)
-            else:
-                self.log.warning("No indicators file exists at path %s",
-                                 file_path)
-
-        # Load downloaded indicators and any indicators from env variable.
-        if load_default:
-            self._load_downloaded_indicators()
-
-        self._check_stix2_env_variable()
-        self.log.info("Loaded a total of %d unique indicators",
-                      self.total_ioc_count)
-
-    def get_iocs(self, ioc_type: str) -> Iterator[Dict[str, Any]]:
-        for ioc_collection in self.ioc_collections:
-            for ioc in ioc_collection.get(ioc_type, []):
-                yield {
-                    "value": ioc,
-                    "type": ioc_type,
-                    "name": ioc_collection["name"],
-                    "stix2_file_name": ioc_collection["stix2_file_name"],
-                }
-
-    def check_domain(self, url: str) -> Union[dict, None]:
-        """Check if a given URL matches any of the provided domain indicators.
-
-        :param url: URL to match against domain indicators
-        :type url: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not url:
-            return None
-        if not isinstance(url, str):
-            return None
-
-        try:
-            # First we use the provided URL.
-            orig_url = URL(url)
-
-            if orig_url.check_if_shortened():
-                # If it is, we try to retrieve the actual URL making an
-                # HTTP HEAD request.
-                unshortened = orig_url.unshorten()
-
-                self.log.debug("Found a shortened URL %s -> %s",
-                               url, unshortened)
-                if unshortened is None:
-                    return None
-
-                # Now we check for any nested URL shorteners.
-                dest_url = URL(unshortened)
-                if dest_url.check_if_shortened():
-                    self.log.debug("Original URL %s appears to shorten another "
-                                   "shortened URL %s ... checking!",
-                                   orig_url.url, dest_url.url)
-                    return self.check_domain(dest_url.url)
-
-                final_url = dest_url
-            else:
-                # If it's not shortened, we just use the original URL object.
-                final_url = orig_url
-        except Exception:
-            # If URL parsing failed, we just try to do a simple substring
-            # match.
-            for ioc in self.get_iocs("domains"):
-                if ioc["value"].lower() in url:
-                    self.log.warning("Maybe found a known suspicious domain %s "
-                                     "matching indicators from \"%s\"",
-                                     url, ioc["name"])
-                    return ioc
-
-            # If nothing matched, we can quit here.
-            return None
-
-        # If all parsing worked, we start walking through available domain
-        # indicators.
-        for ioc in self.get_iocs("domains"):
-            # First we check the full domain.
-            if final_url.domain.lower() == ioc["value"]:
-                if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning("Found a known suspicious domain %s "
-                                     "shortened as %s matching indicators from \"%s\"",
-                                     final_url.url, orig_url.url, ioc["name"])
-                else:
-                    self.log.warning("Found a known suspicious domain %s "
-                                     "matching indicators from \"%s\"",
-                                     final_url.url, ioc["name"])
-
-                return ioc
-
-            # Then we just check the top level domain.
-            if final_url.top_level.lower() == ioc["value"]:
-                if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning("Found a sub-domain with suspicious top "
-                                     "level %s shortened as %s matching "
-                                     "indicators from \"%s\"", final_url.url,
-                                     orig_url.url, ioc["name"])
-                else:
-                    self.log.warning("Found a sub-domain with a suspicious top "
-                                     "level %s matching indicators from \"%s\"",
-                                     final_url.url, ioc["name"])
-
-                return ioc
-
-        return None
-
-    def check_domains(self, urls: list) -> Union[dict, None]:
-        """Check a list of URLs against the provided list of domain indicators.
-
-        :param urls: List of URLs to check against domain indicators
-        :type urls: list
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not urls:
-            return None
-
-        for url in urls:
-            check = self.check_domain(url)
-            if check:
-                return check
-
-        return None
-
-    def check_process(self, process: str) -> Union[dict, None]:
-        """Check the provided process name against the list of process
-        indicators.
-
-        :param process: Process name to check against process indicators
-        :type process: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not process:
-            return None
-
-        proc_name = os.path.basename(process)
-        for ioc in self.get_iocs("processes"):
-            if proc_name == ioc["value"]:
-                self.log.warning("Found a known suspicious process name \"%s\" "
-                                 "matching indicators from \"%s\"",
-                                 process, ioc["name"])
-                return ioc
-
-            if len(proc_name) == 16:
-                if ioc["value"].startswith(proc_name):
-                    self.log.warning("Found a truncated known suspicious "
-                                     "process name \"%s\" matching indicators from \"%s\"",
-                                     process, ioc["name"])
-                    return ioc
-
-        return None
-
-    def check_processes(self, processes: list) -> Union[dict, None]:
-        """Check the provided list of processes against the list of
-        process indicators.
-
-        :param processes: List of processes to check against process indicators
-        :type processes: list
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not processes:
-            return None
-
-        for process in processes:
-            check = self.check_process(process)
-            if check:
-                return check
-
-        return None
-
-    def check_email(self, email: str) -> Union[dict, None]:
-        """Check the provided email against the list of email indicators.
-
-        :param email: Email address to check against email indicators
-        :type email: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not email:
-            return None
-
-        for ioc in self.get_iocs("emails"):
-            if email.lower() == ioc["value"].lower():
-                self.log.warning("Found a known suspicious email address \"%s\" "
-                                 "matching indicators from \"%s\"",
-                                 email, ioc["name"])
-                return ioc
-
-        return None
-
-    def check_file_name(self, file_name: str) -> Union[dict, None]:
-        """Check the provided file name against the list of file indicators.
-
-        :param file_name: File name to check against file
-        indicators
-        :type file_name: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not file_name:
-            return None
-
-        for ioc in self.get_iocs("file_names"):
-            if ioc["value"] == file_name:
-                self.log.warning("Found a known suspicious file name \"%s\" "
-                                 "matching indicators from \"%s\"",
-                                 file_name, ioc["name"])
-                return ioc
-
-        return None
-
-    def check_file_path(self, file_path: str) -> Union[dict, None]:
-        """Check the provided file path against the list of file indicators
-        (both path and name).
-
-        :param file_path: File path or file name to check against file
-        indicators
-        :type file_path: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not file_path:
-            return None
-
-        ioc = self.check_file_name(os.path.basename(file_path))
-        if ioc:
-            return ioc
-
-        for ioc in self.get_iocs("file_paths"):
-            # Strip any trailing slash from indicator paths to match
-            # directories.
-            if file_path.startswith(ioc["value"].rstrip("/")):
-                self.log.warning("Found a known suspicious file path \"%s\" "
-                                 "matching indicators form \"%s\"",
-                                 file_path, ioc["name"])
-                return ioc
-
-        return None
-
-    def check_file_path_process(self, file_path: str) -> Optional[Dict[str, Any]]:
-        """Check the provided file path contains a process name from the
-        list of indicators
-
-        :param file_path: File path or file name to check against file
-        indicators
-        :type file_path: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not file_path:
-            return None
-
-        for ioc in self.get_iocs("processes"):
-            parts = file_path.split("/")
-            if ioc["value"] in parts:
-                self.log.warning("Found known suspicious process name mentioned in file at "
-                                  "path \"%s\" matching indicators from \"%s\"",
-                                  file_path, ioc["name"])
-                return ioc
-
-        return None
-
-    def check_profile(self, profile_uuid: str) -> Union[dict, None]:
-        """Check the provided configuration profile UUID against the list of
-        indicators.
-
-        :param profile_uuid: Profile UUID to check against configuration profile
-                             indicators
-        :type profile_uuid: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not profile_uuid:
-            return None
-
-        for ioc in self.get_iocs("ios_profile_ids"):
-            if profile_uuid in ioc["value"]:
-                self.log.warning("Found a known suspicious profile ID \"%s\" "
-                                 "matching indicators from \"%s\"",
-                                 profile_uuid, ioc["name"])
-                return ioc
-
-        return None
-
-    def check_file_hash(self, file_hash: str) -> Union[dict, None]:
-        """Check the provided SHA256 file hash against the list of indicators.
-
-        :param file_hash: SHA256 hash to check
-        :type file_hash: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not file_hash:
-            return None
-
-        for ioc in self.get_iocs("files_sha256"):
-            if file_hash.lower() == ioc["value"].lower():
-                self.log.warning("Found a known suspicious file with hash \"%s\" "
-                                 "matching indicators from \"%s\"",
-                                 file_hash, ioc["name"])
-                return ioc
-
-        return None
-
-    def check_app_id(self, app_id: str) -> Union[dict, None]:
-        """Check the provided app identifier (typically an Android package name)
-        against the list of indicators.
-
-        :param app_id: App ID to check against the list of indicators
-        :type app_id: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not app_id:
-            return None
-
-        for ioc in self.get_iocs("app_ids"):
-            if app_id.lower() == ioc["value"].lower():
-                self.log.warning("Found a known suspicious app with ID \"%s\" "
-                                 "matching indicators from \"%s\"", app_id,
-                                 ioc["name"])
-                return ioc
-
-        return None
-
-    def check_android_property_name(self, property_name: str) -> Optional[dict]:
-        """Check the android property name against the list of indicators.
-
-        :param property_name: Name of the Android property
-        :type property_name: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if property_name is None:
-            return None
-
-        for ioc in self.get_iocs("android_property_names"):
-            if property_name.lower() == ioc["value"].lower():
-                self.log.warning("Found a known suspicious Android property \"%s\" "
-                                 "matching indicators from \"%s\"", property_name,
-                                 ioc["name"])
-                return ioc
-
-        return None

mvt/common/logo.py

@@ -1,63 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from rich import print as rich_print
-
-from .updates import IndicatorsUpdates, MVTUpdates
-from .version import MVT_VERSION
-
-
-def check_updates() -> None:
-    # First we check for MVT version udpates.
-    mvt_updates = MVTUpdates()
-    try:
-        latest_version = mvt_updates.check()
-    except Exception:
-        pass
-    else:
-        if latest_version:
-            rich_print(f"\t\t[bold]Version {latest_version} is available! "
-                       "Upgrade mvt with `pip3 install -U mvt`[/bold]")
-
-    # Then we check for indicators files updates.
-    ioc_updates = IndicatorsUpdates()
-
-    # Before proceeding, we check if we have downloaded an indicators index.
-    # If not, there's no point in proceeding with the updates check.
-    if ioc_updates.get_latest_update() == 0:
-        rich_print("\t\t[bold]You have not yet downloaded any indicators, check "
-                   "the `download-iocs` command![/bold]")
-        return
-
-    # We only perform this check at a fixed frequency, in order to not
-    # overburden the user with too many lookups if the command is being run
-    # multiple times.
-    should_check, hours = ioc_updates.should_check()
-    if not should_check:
-        rich_print(f"\t\tIndicators updates checked recently, next automatic check "
-                   f"in {int(hours)} hours")
-        return
-
-    try:
-        ioc_to_update = ioc_updates.check()
-    except Exception:
-        pass
-    else:
-        if ioc_to_update:
-            rich_print("\t\t[bold]There are updates to your indicators files! "
-                       "Run the `download-iocs` command to update![/bold]")
-        else:
-            rich_print("\t\tYour indicators files seem to be up to date.")
-
-
-def logo() -> None:
-    rich_print("\n")
-    rich_print("\t[bold]MVT[/bold] - Mobile Verification Toolkit")
-    rich_print("\t\thttps://mvt.re")
-    rich_print(f"\t\tVersion: {MVT_VERSION}")
-
-    check_updates()
-
-    rich_print("\n")

mvt/common/version.py

@@ -1,6 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-MVT_VERSION = "2.2.6"

mvt/ios/cli.py

@@ -1,253 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import logging
-import os
-
-import click
-from rich.prompt import Prompt
-
-from mvt.common.cmd_check_iocs import CmdCheckIOCS
-from mvt.common.help import (HELP_MSG_FAST, HELP_MSG_HASHES, HELP_MSG_IOC,
-                             HELP_MSG_LIST_MODULES, HELP_MSG_MODULE,
-                             HELP_MSG_OUTPUT, HELP_MSG_VERBOSE)
-from mvt.common.logo import logo
-from mvt.common.options import MutuallyExclusiveOption
-from mvt.common.updates import IndicatorsUpdates
-from mvt.common.utils import (generate_hashes_from_path, init_logging,
-                              set_verbose_logging)
-
-from .cmd_check_backup import CmdIOSCheckBackup
-from .cmd_check_fs import CmdIOSCheckFS
-from .decrypt import DecryptBackup
-from .modules.backup import BACKUP_MODULES
-from .modules.fs import FS_MODULES
-from .modules.mixed import MIXED_MODULES
-
-init_logging()
-log = logging.getLogger("mvt")
-
-# Set this environment variable to a password if needed.
-MVT_IOS_BACKUP_PASSWORD = "MVT_IOS_BACKUP_PASSWORD"
-CONTEXT_SETTINGS = dict(help_option_names=['-h', '--help'])
-
-
-#==============================================================================
-# Main
-#==============================================================================
-@click.group(invoke_without_command=False)
-def cli():
-    logo()
-
-
-#==============================================================================
-# Command: version
-#==============================================================================
-@cli.command("version", help="Show the currently installed version of MVT")
-def version():
-    return
-
-
-#==============================================================================
-# Command: decrypt-backup
-#==============================================================================
-@cli.command("decrypt-backup", help="Decrypt an encrypted iTunes backup",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--destination", "-d", required=True,
-              help="Path to the folder where to store the decrypted backup")
-@click.option("--password", "-p", cls=MutuallyExclusiveOption,
-              help="Password to use to decrypt the backup (or, set "
-                   f"{MVT_IOS_BACKUP_PASSWORD} environment variable)",
-              mutually_exclusive=["key_file"])
-@click.option("--key-file", "-k", cls=MutuallyExclusiveOption,
-              type=click.Path(exists=True),
-              help="File containing raw encryption key to use to decrypt "
-                   "the backup",
-              mutually_exclusive=["password"])
-@click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def decrypt_backup(ctx, destination, password, key_file, hashes, backup_path):
-    backup = DecryptBackup(backup_path, destination)
-
-    if key_file:
-        if MVT_IOS_BACKUP_PASSWORD in os.environ:
-            log.info("Ignoring %s environment variable, using --key-file"
-                     "'%s' instead", MVT_IOS_BACKUP_PASSWORD, key_file)
-
-        backup.decrypt_with_key_file(key_file)
-    elif password:
-        log.info("Your password may be visible in the process table because it "
-                 "was supplied on the command line!")
-
-        if MVT_IOS_BACKUP_PASSWORD in os.environ:
-            log.info("Ignoring %s environment variable, using --password"
-                     "argument instead", MVT_IOS_BACKUP_PASSWORD)
-
-        backup.decrypt_with_password(password)
-    elif MVT_IOS_BACKUP_PASSWORD in os.environ:
-        log.info("Using password from %s environment variable",
-                  MVT_IOS_BACKUP_PASSWORD)
-        backup.decrypt_with_password(os.environ[MVT_IOS_BACKUP_PASSWORD])
-    else:
-        sekrit = Prompt.ask("Enter backup password", password=True)
-        backup.decrypt_with_password(sekrit)
-
-    if not backup.can_process():
-        ctx.exit(1)
-
-    backup.process_backup()
-
-    if hashes:
-        info = {"encrypted": [], "decrypted": []}
-        for file in generate_hashes_from_path(backup_path, log):
-            info["encrypted"].append(file)
-        for file in generate_hashes_from_path(destination, log):
-            info["decrypted"].append(file)
-        info_path = os.path.join(destination, "info.json")
-        with open(info_path, "w+", encoding="utf-8") as handle:
-            json.dump(info, handle, indent=4)
-
-
-#==============================================================================
-# Command: extract-key
-#==============================================================================
-@cli.command("extract-key", help="Extract decryption key from an iTunes backup",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--password", "-p",
-              help="Password to use to decrypt the backup (or, set "
-                   f"{MVT_IOS_BACKUP_PASSWORD} environment variable)")
-@click.option("--key-file", "-k",
-              help="Key file to be written (if unset, will print to STDOUT)",
-              required=False,
-              type=click.Path(exists=False, file_okay=True, dir_okay=False,
-                              writable=True))
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-def extract_key(password, key_file, backup_path):
-    backup = DecryptBackup(backup_path)
-
-    if password:
-        log.info("Your password may be visible in the process table because it "
-                 "was supplied on the command line!")
-
-        if MVT_IOS_BACKUP_PASSWORD in os.environ:
-            log.info("Ignoring %s environment variable, using --password "
-                     "argument instead", MVT_IOS_BACKUP_PASSWORD)
-    elif MVT_IOS_BACKUP_PASSWORD in os.environ:
-        log.info("Using password from %s environment variable",
-                 MVT_IOS_BACKUP_PASSWORD)
-        password = os.environ[MVT_IOS_BACKUP_PASSWORD]
-    else:
-        password = Prompt.ask("Enter backup password", password=True)
-
-    backup.decrypt_with_password(password)
-    backup.get_key()
-
-    if key_file:
-        backup.write_key(key_file)
-
-
-#==============================================================================
-# Command: check-backup
-#==============================================================================
-@cli.command("check-backup", help="Extract artifacts from an iTunes backup",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.argument("BACKUP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_backup(ctx, iocs, output, fast, list_modules, module, hashes, verbose, backup_path):
-    set_verbose_logging(verbose)
-
-    cmd = CmdIOSCheckBackup(target_path=backup_path, results_path=output,
-                            ioc_files=iocs, module_name=module, fast_mode=fast,
-                            hashes=hashes)
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking iTunes backup located at: %s", backup_path)
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning("The analysis of the backup produced %d detections!",
-                    cmd.detected_count)
-
-
-#==============================================================================
-# Command: check-fs
-#==============================================================================
-@cli.command("check-fs", help="Extract artifacts from a full filesystem dump",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--output", "-o", type=click.Path(exists=False),
-              help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.argument("DUMP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_fs(ctx, iocs, output, fast, list_modules, module, hashes, verbose, dump_path):
-    set_verbose_logging(verbose)
-    cmd = CmdIOSCheckFS(target_path=dump_path, results_path=output,
-                        ioc_files=iocs, module_name=module, fast_mode=fast,
-                        hashes=hashes)
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking iOS filesystem located at: %s", dump_path)
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning("The analysis of the iOS filesystem produced %d detections!",
-                    cmd.detected_count)
-
-
-#==============================================================================
-# Command: check-iocs
-#==============================================================================
-@cli.command("check-iocs", help="Compare stored JSON results to provided indicators",
-             context_settings=CONTEXT_SETTINGS)
-@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help=HELP_MSG_IOC)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.argument("FOLDER", type=click.Path(exists=True))
-@click.pass_context
-def check_iocs(ctx, iocs, list_modules, module, folder):
-    cmd = CmdCheckIOCS(target_path=folder, ioc_files=iocs, module_name=module)
-    cmd.modules = BACKUP_MODULES + FS_MODULES + MIXED_MODULES
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    cmd.run()
-
-
-#==============================================================================
-# Command: download-iocs
-#==============================================================================
-@cli.command("download-iocs", help="Download public STIX2 indicators",
-             context_settings=CONTEXT_SETTINGS)
-def download_iocs():
-    ioc_updates = IndicatorsUpdates()
-    ioc_updates.update()

mvt/ios/modules/backup/configuration_profiles.py

@@ -1,136 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import plistlib
-from base64 import b64encode
-from typing import Optional, Union
-
-from mvt.common.utils import convert_datetime_to_iso
-
-from ..base import IOSExtraction
-
-CONF_PROFILES_DOMAIN = "SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles"
-
-
-class ConfigurationProfiles(IOSExtraction):
-    """This module extracts the full plist data from configuration profiles."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        if not record["install_date"]:
-            return {}
-
-        payload_name = record['plist'].get('PayloadDisplayName')
-        payload_description = record['plist'].get('PayloadDescription')
-        return {
-            "timestamp": record["install_date"],
-            "module": self.__class__.__name__,
-            "event": "configuration_profile_install",
-            "data": f"{record['plist']['PayloadType']} installed: {record['plist']['PayloadUUID']} "
-                    f"- {payload_name}: {payload_description}"
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if result["plist"].get("PayloadUUID"):
-                payload_content = result["plist"]["PayloadContent"][0]
-
-                # Alert on any known malicious configuration profiles in the
-                # indicator list.
-                ioc = self.indicators.check_profile(result["plist"]["PayloadUUID"])
-                if ioc:
-                    self.log.warning("Found a known malicious configuration "
-                                     "profile \"%s\" with UUID %s",
-                                     result['plist']['PayloadDisplayName'],
-                                     result['plist']['PayloadUUID'])
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-                # Highlight suspicious configuration profiles which may be used
-                # to hide notifications.
-                if payload_content["PayloadType"] in ["com.apple.notificationsettings"]:
-                    self.log.warning("Found a potentially suspicious configuration profile "
-                                     "\"%s\" with payload type %s",
-                                     result['plist']['PayloadDisplayName'],
-                                     payload_content['PayloadType'])
-                    self.detected.append(result)
-                    continue
-
-    def run(self) -> None:
-        for conf_file in self._get_backup_files_from_manifest(
-                domain=CONF_PROFILES_DOMAIN):
-            conf_rel_path = conf_file["relative_path"]
-
-            # Filter out all configuration files that are not configuration
-            # profiles.
-            if not conf_rel_path or not os.path.basename(
-                    conf_rel_path).startswith("profile-"):
-                continue
-
-            conf_file_path = self._get_backup_file_from_id(conf_file["file_id"])
-            if not conf_file_path:
-                continue
-
-            with open(conf_file_path, "rb") as handle:
-                try:
-                    conf_plist = plistlib.load(handle)
-                except Exception:
-                    conf_plist = {}
-
-            # TODO: Tidy up the following code hell.
-
-            if "SignerCerts" in conf_plist:
-                conf_plist["SignerCerts"] = [b64encode(x) for x in conf_plist["SignerCerts"]]
-
-            if "OTAProfileStub" in conf_plist:
-                if "SignerCerts" in conf_plist["OTAProfileStub"]:
-                    conf_plist["OTAProfileStub"]["SignerCerts"] = [b64encode(x) for x in conf_plist["OTAProfileStub"]["SignerCerts"]]
-
-                if "PayloadContent" in conf_plist["OTAProfileStub"]:
-                    if "EnrollmentIdentityPersistentID" in conf_plist["OTAProfileStub"]["PayloadContent"]:
-                        conf_plist["OTAProfileStub"]["PayloadContent"]["EnrollmentIdentityPersistentID"] = b64encode(conf_plist["OTAProfileStub"]["PayloadContent"]["EnrollmentIdentityPersistentID"])
-
-            if "PushTokenDataSentToServerKey" in conf_plist:
-                conf_plist["PushTokenDataSentToServerKey"] = b64encode(conf_plist["PushTokenDataSentToServerKey"])
-
-            if "LastPushTokenHash" in conf_plist:
-                conf_plist["LastPushTokenHash"] = b64encode(conf_plist["LastPushTokenHash"])
-
-            if "PayloadContent" in conf_plist:
-                for content_entry in range(len(conf_plist["PayloadContent"])):
-                    if "PERSISTENT_REF" in conf_plist["PayloadContent"][content_entry]:
-                        conf_plist["PayloadContent"][content_entry]["PERSISTENT_REF"] = b64encode(conf_plist["PayloadContent"][content_entry]["PERSISTENT_REF"])
-
-                    if "IdentityPersistentRef" in conf_plist["PayloadContent"][content_entry]:
-                        conf_plist["PayloadContent"][content_entry]["IdentityPersistentRef"] = b64encode(conf_plist["PayloadContent"][content_entry]["IdentityPersistentRef"])
-
-            self.results.append({
-                "file_id": conf_file["file_id"],
-                "relative_path": conf_file["relative_path"],
-                "domain": conf_file["domain"],
-                "plist": conf_plist,
-                "install_date": convert_datetime_to_iso(conf_plist.get("InstallDate")),
-            })
-
-        self.log.info("Extracted details about %d configuration profiles",
-                      len(self.results))

mvt/ios/modules/mixed/calls.py

@@ -1,68 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import sqlite3
-from typing import Union
-
-from mvt.common.utils import convert_mactime_to_iso
-
-from ..base import IOSExtraction
-
-CALLS_BACKUP_IDS = [
-    "5a4935c78a5255723f707230a451d79c540d2741",
-]
-CALLS_ROOT_PATHS = [
-    "private/var/mobile/Library/CallHistoryDB/CallHistory.storedata"
-]
-
-
-class Calls(IOSExtraction):
-    """This module extracts phone calls details"""
-
-    def __init__(self, file_path: str = None, target_path: str = None,
-                 results_path: str = None, fast_mode: bool = False,
-                 log: logging.Logger = logging.getLogger(__name__),
-                 results: list = []) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "call",
-            "data": f"From {record['number']} using {record['provider']} "
-                    f"during {record['duration']} seconds"
-        }
-
-    def run(self) -> None:
-        self._find_ios_database(backup_ids=CALLS_BACKUP_IDS,
-                                root_paths=CALLS_ROOT_PATHS)
-        self.log.info("Found Calls database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                ZDATE, ZDURATION, ZLOCATION, ZADDRESS, ZSERVICE_PROVIDER
-            FROM ZCALLRECORD;
-        """)
-        # names = [description[0] for description in cur.description]
-
-        for row in cur:
-            self.results.append({
-                "isodate": convert_mactime_to_iso(row[0]),
-                "duration": row[1],
-                "location": row[2],
-                "number": row[3].decode("utf-8") if row[3] and row[3] is bytes else row[3],
-                "provider": row[4]
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d calls", len(self.results))

mvt/ios/modules/mixed/contacts.py

@@ -1,64 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import sqlite3
-from typing import Optional
-
-from ..base import IOSExtraction
-
-CONTACTS_BACKUP_IDS = [
-    "31bb7ba8914766d4ba40d6dfb6113c8b614be442",
-]
-CONTACTS_ROOT_PATHS = [
-    "private/var/mobile/Library/AddressBook/AddressBook.sqlitedb",
-]
-
-
-class Contacts(IOSExtraction):
-    """This module extracts all contact details from the phone's address book."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self) -> None:
-        self._find_ios_database(backup_ids=CONTACTS_BACKUP_IDS,
-                                root_paths=CONTACTS_ROOT_PATHS)
-        self.log.info("Found Contacts database at path: %s", self.file_path)
-
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                multi.value, person.first, person.middle, person.last,
-                person.organization
-            FROM ABPerson person, ABMultiValue multi
-            WHERE person.rowid = multi.record_id and multi.value not null
-            ORDER by person.rowid ASC;
-        """)
-        names = [description[0] for description in cur.description]
-
-        for row in cur:
-            new_contact = {}
-            for index, value in enumerate(row):
-                new_contact[names[index]] = value
-
-            self.results.append(new_contact)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d contacts from the address book",
-                      len(self.results))

mvt/ios/modules/net_base.py

@@ -1,275 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import operator
-import sqlite3
-from pathlib import Path
-from typing import Optional, Union
-
-from mvt.common.utils import convert_mactime_to_iso
-
-from .base import IOSExtraction
-
-
-class NetBase(IOSExtraction):
-    """This class provides a base for DataUsage and NetUsage extraction
-    modules."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def _extract_net_data(self):
-        conn = sqlite3.connect(self.file_path)
-        cur = conn.cursor()
-        cur.execute("""
-            SELECT
-                ZPROCESS.ZFIRSTTIMESTAMP,
-                ZPROCESS.ZTIMESTAMP,
-                ZPROCESS.ZPROCNAME,
-                ZPROCESS.ZBUNDLENAME,
-                ZPROCESS.Z_PK,
-                ZLIVEUSAGE.ZWIFIIN,
-                ZLIVEUSAGE.ZWIFIOUT,
-                ZLIVEUSAGE.ZWWANIN,
-                ZLIVEUSAGE.ZWWANOUT,
-                ZLIVEUSAGE.Z_PK,
-                ZLIVEUSAGE.ZHASPROCESS,
-                ZLIVEUSAGE.ZTIMESTAMP
-            FROM ZLIVEUSAGE
-            LEFT JOIN ZPROCESS ON ZLIVEUSAGE.ZHASPROCESS = ZPROCESS.Z_PK
-            UNION
-            SELECT ZFIRSTTIMESTAMP, ZTIMESTAMP, ZPROCNAME, ZBUNDLENAME, Z_PK,
-                   NULL, NULL, NULL, NULL, NULL, NULL, NULL
-            FROM ZPROCESS WHERE Z_PK NOT IN
-                (SELECT ZHASPROCESS FROM ZLIVEUSAGE);
-        """)
-
-        for row in cur:
-            # ZPROCESS records can be missing after the JOIN.
-            # Handle NULL timestamps.
-            if row[0] and row[1]:
-                first_isodate = convert_mactime_to_iso(row[0])
-                isodate = convert_mactime_to_iso(row[1])
-            else:
-                first_isodate = row[0]
-                isodate = row[1]
-
-            if row[11]:
-                live_timestamp = convert_mactime_to_iso(row[11])
-            else:
-                live_timestamp = ""
-
-            self.results.append({
-                "first_isodate": first_isodate,
-                "isodate": isodate,
-                "proc_name": row[2],
-                "bundle_id": row[3],
-                "proc_id": row[4],
-                "wifi_in": row[5],
-                "wifi_out": row[6],
-                "wwan_in": row[7],
-                "wwan_out": row[8],
-                "live_id": row[9],
-                "live_proc_id": row[10],
-                "live_isodate": live_timestamp if row[10] else first_isodate,
-            })
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted information on %d processes",
-                      len(self.results))
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        record_data = (f"{record['proc_name']} (Bundle ID: {record['bundle_id']},"
-                       f" ID: {record['proc_id']})")
-        record_data_usage = (record_data + " "
-                             f"WIFI IN: {record['wifi_in']}, "
-                             f"WIFI OUT: {record['wifi_out']} - "
-                             f"WWAN IN: {record['wwan_in']}, "
-                             f"WWAN OUT: {record['wwan_out']}")
-
-        records = [{
-            "timestamp": record["live_isodate"],
-            "module": self.__class__.__name__,
-            "event": "live_usage",
-            "data": record_data_usage,
-        }]
-
-        # Only included first_usage and current_usage records when a
-        # ZPROCESS entry exists.
-        if ("MANIPULATED" not in record["proc_name"]
-                and "MISSING" not in record["proc_name"]
-                and record["live_proc_id"] is not None):
-            records.extend([
-                {
-                    "timestamp": record["first_isodate"],
-                    "module": self.__class__.__name__,
-                    "event": "first_usage",
-                    "data": record_data,
-                },
-                {
-                    "timestamp": record["isodate"],
-                    "module": self.__class__.__name__,
-                    "event": "current_usage",
-                    "data": record_data,
-                }
-            ])
-
-        return records
-
-    def _find_suspicious_processes(self):
-        if not self.is_fs_dump:
-            return
-
-        if not self.results:
-            return
-
-        # If we are instructed to run fast, we skip this.
-        if self.fast_mode:
-            self.log.info("Flag --fast was enabled: skipping extended "
-                          "search for suspicious processes")
-            return
-
-        self.log.info("Extended search for suspicious processes ...")
-
-        files = []
-        for posix_path in Path(self.target_path).rglob("*"):
-            try:
-                if not posix_path.is_file():
-                    continue
-            except PermissionError:
-                continue
-
-            files.append([posix_path.name, str(posix_path)])
-
-        for proc in self.results:
-            if not proc["bundle_id"]:
-                self.log.debug("Found process with no Bundle ID with name: %s",
-                               proc["proc_name"])
-
-                binary_path = None
-                for file in files:
-                    if proc["proc_name"] == file[0]:
-                        binary_path = file[1]
-                        break
-
-                if binary_path:
-                    self.log.debug("Located at %s", binary_path)
-                else:
-                    msg = ("Could not find the binary associated with the "
-                           f"process with name {proc['proc_name']}")
-                    if not proc["proc_name"]:
-                        msg = ("Found process entry with empty 'proc_name': "
-                               f"{proc['live_proc_id']} at {proc['live_isodate']}")
-                    elif len(proc["proc_name"]) == 16:
-                        msg += (" (However, the process name might have "
-                                "been truncated in the database)")
-
-                    self.log.warning(msg)
-            if not proc["live_proc_id"]:
-                self.log.info("Found process entry in ZPROCESS but not in ZLIVEUSAGE: %s at %s",
-                              proc['proc_name'], proc['live_isodate'])
-
-    def check_manipulated(self):
-        """Check for missing or manipulate DB entries"""
-        # Don't show duplicates for each missing process.
-        missing_process_cache = set()
-        for result in sorted(
-                self.results, key=operator.itemgetter("live_isodate")):
-            if result["proc_id"]:
-                continue
-
-            # Avoid duplicate warnings for same process.
-            if result["live_proc_id"] not in missing_process_cache:
-                missing_process_cache.add(result["live_proc_id"])
-                self.log.warning("Found manipulated process entry %s. Entry on %s",
-                                 result["live_proc_id"], result["live_isodate"])
-
-            # Set manipulated proc timestamp so it appears in timeline.
-            result["first_isodate"] = result["isodate"] = result["live_isodate"]
-            result["proc_name"] = "MANIPULATED [process record deleted]"
-            self.detected.append(result)
-
-    def find_deleted(self):
-        """Identify process which may have been deleted from the DataUsage
-        database."""
-        results_by_proc = {proc["proc_id"]: proc for proc in self.results if proc["proc_id"]}
-        all_proc_id = sorted(results_by_proc.keys())
-
-        # Fix issue #108
-        if not all_proc_id:
-            return
-
-        missing_procs, last_proc_id = {}, None
-        for proc_id in range(min(all_proc_id), max(all_proc_id)):
-            if proc_id not in all_proc_id:
-                previous_proc = results_by_proc[last_proc_id]
-                self.log.info("Missing process %d. Previous process at \"%s\" (%s)",
-                              proc_id, previous_proc["first_isodate"],
-                              previous_proc["proc_name"])
-
-                missing_procs[proc_id] = {
-                    "proc_id": proc_id,
-                    "prev_proc_id": last_proc_id,
-                    "prev_proc_name": previous_proc["proc_name"],
-                    "prev_proc_bundle": previous_proc["bundle_id"],
-                    "prev_proc_first": previous_proc["first_isodate"],
-                }
-            else:
-                last_proc_id = proc_id
-
-        # Add a placeholder entry for the missing processes.
-        for proc_id, proc in missing_procs.items():
-            # Set default DataUsage keys.
-            result = {key: None for key in self.results[0].keys()}
-            result["first_isodate"] = result["isodate"] = result["live_isodate"] = proc["prev_proc_first"]
-            result["proc_name"] = f"MISSING [follows {proc['prev_proc_name']}]"
-            result["proc_id"] = result["live_proc_id"] = proc["proc_id"]
-            result["bundle_id"] = None
-
-            self.results.append(result)
-
-        self.results = sorted(self.results,
-                              key=operator.itemgetter("first_isodate"))
-
-    def check_indicators(self) -> None:
-        # Check for manipulated process records.
-        # TODO: Catching KeyError for live_isodate for retro-compatibility.
-        #       This is not very good.
-        try:
-            self.check_manipulated()
-            self.find_deleted()
-        except KeyError:
-            pass
-
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            try:
-                proc_name = result["proc_name"]
-            except KeyError:
-                continue
-
-            # Process ID may be empty if process records have been manipulated.
-            if not result["proc_id"]:
-                continue
-
-            ioc = self.indicators.check_process(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)

mvt/ios/versions.py

@@ -1,323 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-from logging import Logger
-from typing import Dict, Optional
-
-import packaging
-
-IPHONE_MODELS = [
-    {"identifier": "iPhone4,1", "description": "iPhone 4S"},
-    {"identifier": "iPhone5,1", "description": "iPhone 5"},
-    {"identifier": "iPhone5,2", "description": "iPhone 5"},
-    {"identifier": "iPhone5,3", "description": "iPhone 5c"},
-    {"identifier": "iPhone5,4", "description": "iPhone 5c"},
-    {"identifier": "iPhone6,1", "description": "iPhone 5s"},
-    {"identifier": "iPhone6,2", "description": "iPhone 5s"},
-    {"identifier": "iPhone7,1", "description": "iPhone 6 Plus"},
-    {"identifier": "iPhone7,2", "description": "iPhone 6"},
-    {"identifier": "iPhone8,1", "description": "iPhone 6s"},
-    {"identifier": "iPhone8,2", "description": "iPhone 6s Plus"},
-    {"identifier": "iPhone8,4", "description": "iPhone SE (1st generation)"},
-    {"identifier": "iPhone9,1", "description": "iPhone 7"},
-    {"identifier": "iPhone9,2", "description": "iPhone 7 Plus"},
-    {"identifier": "iPhone9,3", "description": "iPhone 7"},
-    {"identifier": "iPhone9,4", "description": "iPhone 7 Plus"},
-    {"identifier": "iPhone10,1", "description": "iPhone 8"},
-    {"identifier": "iPhone10,2", "description": "iPhone 8 Plus"},
-    {"identifier": "iPhone10,3", "description": "iPhone X"},
-    {"identifier": "iPhone10,4", "description": "iPhone 8"},
-    {"identifier": "iPhone10,5", "description": "iPhone 8 Plus"},
-    {"identifier": "iPhone10,6", "description": "iPhone X"},
-    {"identifier": "iPhone11,2", "description": "iPhone XS"},
-    {"identifier": "iPhone11,4", "description": "iPhone XS Max"},
-    {"identifier": "iPhone11,6", "description": "iPhone XS Max"},
-    {"identifier": "iPhone11,8", "description": "iPhone XR"},
-    {"identifier": "iPhone12,1", "description": "iPhone 11"},
-    {"identifier": "iPhone12,3", "description": "iPhone 11 Pro"},
-    {"identifier": "iPhone12,5", "description": "iPhone 11 Pro Max"},
-    {"identifier": "iPhone12,8", "description": "iPhone SE (2nd generation)"},
-    {"identifier": "iPhone13,1", "description": "iPhone 12 mini"},
-    {"identifier": "iPhone13,2", "description": "iPhone 12"},
-    {"identifier": "iPhone13,3", "description": "iPhone 12 Pro"},
-    {"identifier": "iPhone13,4", "description": "iPhone 12 Pro Max"},
-    {"identifier": "iPhone14,4", "description": "iPhone 13 Mini"},
-    {"identifier": "iPhone14,5", "description": "iPhone 13"},
-    {"identifier": "iPhone14,2", "description": "iPhone 13 Pro"},
-    {"identifier": "iPhone14,3", "description": "iPhone 13 Pro Max"},
-    {"identifier": "iPhone14,8", "decription": "iPhone 14 Plus"},
-    {"identifier": "iPhone15,2", "description": "iPhone 14 Pro"},
-    {"identifier": "iPhone15,3", "description": "iPhone 14 Pro Max"}
-]
-
-IPHONE_IOS_VERSIONS = [
-    {"build": "1A543a", "version": "1.0"},
-    {"build": "1C25", "version": "1.0.1"},
-    {"build": "1C28", "version": "1.0.2"},
-    {"build": "3A109a", "version": "1.1.1"},
-    {"build": "3B48b", "version": "1.1.2"},
-    {"build": "4A93", "version": "1.1.3"},
-    {"build": "4A102", "version": "1.1.4"},
-    {"build": "5A347", "version": "2.0"},
-    {"build": "5B108", "version": "2.0.1"},
-    {"build": "5C1", "version": "2.0.2"},
-    {"build": "5F136", "version": "2.1"},
-    {"build": "5G77", "version": "2.2"},
-    {"build": "5H11", "version": "2.2.1"},
-    {"build": "7A341", "version": "3.0"},
-    {"build": "7A400", "version": "3.0.1"},
-    {"build": "7C144", "version": "3.1"},
-    {"build": "7D11", "version": "3.1.2"},
-    {"build": "7E18", "version": "3.1.3"},
-    {"build": "8A293", "version": "4.0"},
-    {"build": "8A306", "version": "4.0.1"},
-    {"build": "8B117", "version": "4.1"},
-    {"build": "8C148", "version": "4.2"},
-    {"build": "8C148a", "version": "4.2.1"},
-    {"build": "8C148", "version": "4.2.1"},
-    {"build": "8E600", "version": "4.2.10"},
-    {"build": "8E401", "version": "4.2.8"},
-    {"build": "8E501", "version": "4.2.9"},
-    {"build": "8F190", "version": "4.3"},
-    {"build": "8J2", "version": "4.3.3"},
-    {"build": "8K2", "version": "4.3.4"},
-    {"build": "8L1", "version": "4.3.5"},
-    {"build": "9A334", "version": "5.0"},
-    {"build": "9A405", "version": "5.0.1"},
-    {"build": "9A406", "version": "5.0.1"},
-    {"build": "9B176", "version": "5.1"},
-    {"build": "9B179", "version": "5.1"},
-    {"build": "9B206", "version": "5.1.1"},
-    {"build": "9B208", "version": "5.1.1"},
-    {"build": "10A403", "version": "6.0"},
-    {"build": "10A405", "version": "6.0"},
-    {"build": "10A523", "version": "6.0.1"},
-    {"build": "10A525", "version": "6.0.1"},
-    {"build": "10A551", "version": "6.0.2"},
-    {"build": "10B141", "version": "6.1"},
-    {"build": "10B144", "version": "6.1"},
-    {"build": "10B142", "version": "6.1"},
-    {"build": "10B143", "version": "6.1"},
-    {"build": "10B145", "version": "6.1.1"},
-    {"build": "10B146", "version": "6.1.2"},
-    {"build": "10B329", "version": "6.1.3"},
-    {"build": "10B350", "version": "6.1.4"},
-    {"build": "10B500", "version": "6.1.6"},
-    {"build": "11B511", "version": "7.0.3"},
-    {"build": "11B554a", "version": "7.0.4"},
-    {"build": "11B601", "version": "7.0.5"},
-    {"build": "11B651", "version": "7.0.6"},
-    {"build": "11D169", "version": "7.1"},
-    {"build": "11D167", "version": "7.1"},
-    {"build": "11D201", "version": "7.1.1"},
-    {"build": "11D257", "version": "7.1.2"},
-    {"build": "12A365", "version": "8.0"},
-    {"build": "12A366", "version": "8.0"},
-    {"build": "12A402", "version": "8.0.1"},
-    {"build": "12A405", "version": "8.0.2"},
-    {"build": "12B411", "version": "8.1"},
-    {"build": "12B435", "version": "8.1.1"},
-    {"build": "12B436", "version": "8.1.1"},
-    {"build": "12B440", "version": "8.1.2"},
-    {"build": "12B466", "version": "8.1.3"},
-    {"build": "12D508", "version": "8.2"},
-    {"build": "12F70", "version": "8.3"},
-    {"build": "12H143", "version": "8.4"},
-    {"build": "12H321", "version": "8.4.1"},
-    {"build": "13A344", "version": "9.0"},
-    {"build": "13A342", "version": "9.0"},
-    {"build": "13A343", "version": "9.0"},
-    {"build": "13A404", "version": "9.0.1"},
-    {"build": "13A405", "version": "9.0.1"},
-    {"build": "13A452", "version": "9.0.2"},
-    {"build": "13B143", "version": "9.1"},
-    {"build": "13C75", "version": "9.2"},
-    {"build": "13D15", "version": "9.2.1"},
-    {"build": "13D20", "version": "9.2.1"},
-    {"build": "13E237", "version": "9.3"},
-    {"build": "13E233", "version": "9.3"},
-    {"build": "13E234", "version": "9.3"},
-    {"build": "13E238", "version": "9.3.1"},
-    {"build": "13F69", "version": "9.3.2"},
-    {"build": "13G34", "version": "9.3.3"},
-    {"build": "13G35", "version": "9.3.4"},
-    {"build": "13G36", "version": "9.3.5"},
-    {"build": "13G37", "version": "9.3.6"},
-    {"build": "14A403", "version": "10.0.1"},
-    {"build": "14A456", "version": "10.0.2"},
-    {"build": "14A551", "version": "10.0.3"},
-    {"build": "14B72", "version": "10.1"},
-    {"build": "14B72c", "version": "10.1"},
-    {"build": "14B150", "version": "10.1.1"},
-    {"build": "14B100", "version": "10.1.1"},
-    {"build": "14C92", "version": "10.2"},
-    {"build": "14D27", "version": "10.2.1"},
-    {"build": "14E277", "version": "10.3"},
-    {"build": "14E304", "version": "10.3.1"},
-    {"build": "14F89", "version": "10.3.2"},
-    {"build": "14G60", "version": "10.3.3"},
-    {"build": "14G61", "version": "10.3.4"},
-    {"build": "15A372", "version": "11.0"},
-    {"build": "15A402", "version": "11.0.1"},
-    {"build": "15A421", "version": "11.0.2"},
-    {"build": "15A432", "version": "11.0.3"},
-    {"build": "15B93", "version": "11.1"},
-    {"build": "15B150", "version": "11.1.1"},
-    {"build": "15B202", "version": "11.1.2"},
-    {"build": "15C114", "version": "11.2"},
-    {"build": "15C153", "version": "11.2.1"},
-    {"build": "15C202", "version": "11.2.2"},
-    {"build": "15D60", "version": "11.2.5"},
-    {"build": "15D100", "version": "11.2.6"},
-    {"build": "15E216", "version": "11.3"},
-    {"build": "15E302", "version": "11.3.1"},
-    {"build": "15F79", "version": "11.4"},
-    {"build": "15G77", "version": "11.4.1"},
-    {"build": "16A366", "version": "12.0"},
-    {"build": "16A367", "version": "12.0"},
-    {"build": "16A404", "version": "12.0.1"},
-    {"build": "16A405", "version": "12.0.1"},
-    {"build": "16B92", "version": "12.1"},
-    {"build": "16B94", "version": "12.1"},
-    {"build": "16B93", "version": "12.1"},
-    {"build": "16C50", "version": "12.1.1"},
-    {"build": "16C104", "version": "12.1.2"},
-    {"build": "16C101", "version": "12.1.2"},
-    {"build": "16D39", "version": "12.1.3"},
-    {"build": "16D40", "version": "12.1.3"},
-    {"build": "16D57", "version": "12.1.4"},
-    {"build": "16E227", "version": "12.2"},
-    {"build": "16F156", "version": "12.3"},
-    {"build": "16F203", "version": "12.3.1"},
-    {"build": "16F250", "version": "12.3.2"},
-    {"build": "16G77", "version": "12.4"},
-    {"build": "16G102", "version": "12.4.1"},
-    {"build": "16G114", "version": "12.4.2"},
-    {"build": "16G130", "version": "12.4.3"},
-    {"build": "16G140", "version": "12.4.4"},
-    {"build": "16G161", "version": "12.4.5"},
-    {"build": "16G183", "version": "12.4.6"},
-    {"build": "16G192", "version": "12.4.7"},
-    {"build": "16G201", "version": "12.4.8"},
-    {"build": "16H5", "version": "12.4.9"},
-    {"build": "16H20", "version": "12.5"},
-    {"build": "16H22", "version": "12.5.1"},
-    {"build": "16H30", "version": "12.5.2"},
-    {"build": "16H41", "version": "12.5.3"},
-    {"build": "16H50", "version": "12.5.4"},
-    {"build": "16H62", "version": "12.5.5"},
-    {"build": "16H71", "version": "12.5.6"},
-    {"build": "16H81", "version": "12.5.7"},
-    {"build": "17A577", "version": "13.0"},
-    {"build": "17A844", "version": "13.1"},
-    {"build": "17A854", "version": "13.1.1"},
-    {"build": "17A860", "version": "13.1.2"},
-    {"build": "17A861", "version": "13.1.2"},
-    {"build": "17A878", "version": "13.1.3"},
-    {"build": "17B84", "version": "13.2"},
-    {"build": "17B102", "version": "13.2.2"},
-    {"build": "17B111", "version": "13.2.3"},
-    {"build": "17C54", "version": "13.3"},
-    {"build": "17D50", "version": "13.3.1"},
-    {"build": "17E255", "version": "13.4"},
-    {"build": "17E8255", "version": "13.4"},
-    {"build": "17E262", "version": "13.4.1"},
-    {"build": "17E8258", "version": "13.4.1"},
-    {"build": "17F75", "version": "13.5"},
-    {"build": "17F80", "version": "13.5.1"},
-    {"build": "17G68", "version": "13.6"},
-    {"build": "17G80", "version": "13.6.1"},
-    {"build": "17H35", "version": "13.7"},
-    {"build": "18A373", "version": "14.0"},
-    {"build": "18A393", "version": "14.0.1"},
-    {"build": "18A8395", "version": "14.1"},
-    {"build": "18B92", "version": "14.2"},
-    {"build": "18C66", "version": "14.3"},
-    {"build": "18D52", "version": "14.4"},
-    {"build": "18D61", "version": "14.4.1"},
-    {"build": "18D70", "version": "14.4.2"},
-    {"build": "18E199", "version": "14.5"},
-    {"build": "18E212", "version": "14.5.1"},
-    {"build": "18F72", "version": "14.6"},
-    {"build": "18G69", "version": "14.7"},
-    {"build": "18G82", "version": "14.7.1"},
-    {"build": "18H17", "version": "14.8"},
-    {"build": "18H107", "version": "14.8.1"},
-    {"build": "19A341", "version": "15.0"},
-    {"build": "19A346", "version": "15.0"},
-    {"build": "19A348", "version": "15.0.1"},
-    {"build": "19A404", "version": "15.0.2"},
-    {"build": "19B74", "version": "15.1"},
-    {"build": "19B81", "version": "15.1.1"},
-    {"build": "19C56", "version": "15.2"},
-    {"build": "19C63", "version": "15.2.1"},
-    {"build": "19D50", "version": "15.3"},
-    {"build": "19D52", "version": "15.3.1"},
-    {"build": "19E241", "version": "15.4"},
-    {"build": "19E258", "version": "15.4.1"},
-    {"build": "19F77", "version": "15.5"},
-    {"build": "19G71", "version": "15.6"},
-    {"build": "19G82", "version": "15.6.1"},
-    {"build": "19H12", "version": "15.7"},
-    {"build": "19H117", "version": "15.7.1"},
-    {"build": "19H218", "version": "15.7.2"},
-    {"build": "20A362", "version": "16.0"},
-    {"build": "20A371", "version": "16.0.1"},
-    {"build": "20A380", "version": "16.0.2"},
-    {"build": "20A392", "version": "16.0.3"},
-    {"build": "20B82", "version": "16.1"},
-    {"build": "20B101", "version": "16.1.1"},
-    {"build": "20B110", "version": "16.1.2"},
-    {"build": "20C65", "version": "16.2"},
-    {"build": "20D47", "version": "16.3"},
-    {"build": "20D67", "version": "16.3.1"},
-    {"build": "20E247", "version": "16.4"},
-    {"build": "20E252", "version": "16.4.1"}
-]
-
-
-def get_device_desc_from_id(identifier: str,
-                            devices_list: list = IPHONE_MODELS) -> str:
-    for model in devices_list:
-        if identifier == model["identifier"]:
-            return model["description"]
-
-    return ""
-
-
-def find_version_by_build(build: str) -> str:
-    build = build.upper()
-    for version in IPHONE_IOS_VERSIONS:
-        if build == version["build"]:
-            return version["version"]
-
-    return ""
-
-
-def latest_ios_version() -> Dict[str, str]:
-    return IPHONE_IOS_VERSIONS[-1]
-
-
-def is_ios_version_outdated(version: str, log: Optional[Logger] = None) -> bool:
-    """
-    Check if the given version is below the latest version
-    version can be a build number or version number
-    Returns true if outdated for sure, false otherwise
-    """
-    # Check if it is a build
-    if "." not in version:
-        version = find_version_by_build(version)
-        # If we can't find it
-        if version == "":
-            return False
-
-    latest_parsed = packaging.version.parse(latest_ios_version()["version"])
-    current_parsed = packaging.version.parse(version)
-    if current_parsed < latest_parsed:
-        if log:
-            log.warning("This phone is running an outdated iOS version: %s (latest is %s)",
-                        version,
-                        latest_ios_version()["version"])
-        return True
-    return False

pyproject.toml

@@ -0,0 +1,107 @@
+[project]
+name = "mvt"
+dynamic = ["version"]
+authors = [
+    {name = "Claudio Guarnieri", email = "nex@nex.sx"}
+]
+maintainers = [
+    {name = "Etienne Maynier", email = "tek@randhome.io"},
+    {name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org"},
+    {name = "Rory Flynn", email = "rory.flynn@amnesty.org"}
+]
+description = "Mobile Verification Toolkit"
+readme = "README.md"
+keywords = ["security", "mobile", "forensics", "malware"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Information Technology",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python"
+]
+dependencies = [
+    "click==8.2.1",
+    "rich==14.0.0",
+    "tld==0.13.1",
+    "requests==2.32.4",
+    "simplejson==3.20.1",
+    "packaging==25.0",
+    "appdirs==1.4.4",
+    "iOSbackup==0.9.925",
+    "adb-shell[usb]==0.4.4",
+    "libusb1==3.3.1",
+    "cryptography==45.0.5",
+    "PyYAML>=6.0.2",
+    "pyahocorasick==2.2.0",
+    "betterproto==1.2.5",
+    "pydantic==2.11.7",
+    "pydantic-settings==2.9.1",
+    "NSKeyedUnArchiver==1.5.2",
+    "python-dateutil==2.9.0.post0",
+]
+requires-python = ">= 3.10"
+
+[project.urls]
+homepage = "https://docs.mvt.re/en/latest/"
+repository = "https://github.com/mvt-project/mvt"
+
+[project.scripts]
+    mvt-ios = "mvt.ios:cli"
+    mvt-android = "mvt.android:cli"
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[tool.coverage.run]
+omit = [
+    "tests/*",
+]
+
+[tool.coverage.html]
+directory= "htmlcov"
+
+[tool.mypy]
+install_types = true
+non_interactive = true
+ignore_missing_imports = true
+packages = "src"
+
+[tool.pytest.ini_options]
+addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
+testpaths = [
+    "tests"
+]
+
+[tool.ruff.lint]
+select = ["C90", "E", "F", "W"]  # flake8 default set
+ignore = [
+    "E501",  # don't enforce line length violations
+    "C901",  # complex-structure
+
+    # These were previously ignored but don't seem to be required:
+    # "E265",  # no-space-after-block-comment
+    # "F401",  # unused-import
+    # "E127",  # not included in ruff
+    # "W503",  # not included in ruff
+    # "E226",  # missing-whitespace-around-arithmetic-operator
+    # "E203",  # whitespace-before-punctuation
+]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"]  # unused-import
+
+[tool.ruff.lint.mccabe]
+max-complexity = 10
+
+[tool.setuptools]
+include-package-data = true
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+mvt = ["ios/data/*.json"]
+
+[tool.setuptools.dynamic]
+version = {attr = "mvt.common.version.MVT_VERSION"}

ruff.toml

@@ -1,6 +0,0 @@
-# Never enforce `E501` (line length violations).
-ignore = ["E501"]
-
-# Ignore `E402` (import violations) in all `__init__.py` files, and in `path/to/file.py`.
-[per-file-ignores]
-"__init__.py" = ["F401"]

setup.cfg

@@ -1,88 +0,0 @@
-[metadata]
-name = mvt
-version = attr: mvt.common.version.MVT_VERSION
-author = Claudio Guarnieri
-author_email = nex@nex.sx
-description = Mobile Verification Toolkit
-long_description = file: README.md
-long_description_content_type = text/markdown
-url = https://github.com/mvt-project/mvt
-keywords = security, mobile, forensics, malware
-license = MVT v1.1
-classifiers =
-    Development Status :: 5 - Production/Stable
-    Intended Audience :: Information Technology
-    Operating System :: OS Independent
-    Programming Language :: Python
-
-[options]
-packages = find:
-package_dir = = ./
-include_package_data = True
-python_requires = >= 3.8
-install_requires =
-    click >=8.1.3
-    rich >=12.6.0
-    tld >=0.12.6
-    requests >=2.28.1
-    simplejson >=3.17.6
-    packaging >=21.3
-    appdirs >=1.4.4
-    iOSbackup >=0.9.923
-    adb-shell >=0.4.3
-    libusb1 >=3.0.0
-    cryptography >=38.0.1
-    pyyaml >=6.0
-
-[options.packages.find]
-where = ./
-
-[options.entry_points]
-console_scripts =
-    mvt-ios = mvt.ios:cli
-    mvt-android = mvt.android:cli
-
-[flake8]
-max-complexity = 10
-max-line-length = 1000
-ignore =
-    C901,
-    E265,
-    F401,
-    E127,
-    W503,
-    E226
-
-[pylint]
-score = no
-reports = no
-output-format = colorized
-
-max-locals = 25
-max-args = 10
-
-good-names = i,m
-
-min-similarity-lines = 10
-ignore-comments = yes
-ignore-docstrings = yes
-ignore-imports = yes
-
-ignored-argument-names=args|kwargs
-
-# https://pylint.pycqa.org/en/stable/technical_reference/features.html
-disable =
-    too-many-instance-attributes,
-    broad-except,
-    abstract-method,
-    dangerous-default-value,
-    too-few-public-methods,
-    missing-docstring,
-    missing-module-docstring,
-    missing-class-docstring,
-    missing-function-docstring,
-    #duplicate-code,
-    #line-too-long,
-
-[mypy]
-ignore_missing_imports = True

setup.py

@@ -1,8 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from setuptools import setup
-
-setup()

src/mvt/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

src/mvt/android/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

src/mvt/android/artifacts/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

src/mvt/android/artifacts/artifact.py

@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+from typing import AnyStr
+
+from mvt.common.artifact import Artifact
+
+
+class AndroidArtifact(Artifact):
+    @staticmethod
+    def extract_dumpsys_section(
+        dumpsys: AnyStr, separator: AnyStr, binary=False
+    ) -> AnyStr:
+        """
+        Extract a section from a full dumpsys file.
+
+        :param dumpsys: content of the full dumpsys file (AnyStr)
+        :param separator: content of the first line separator (AnyStr)
+        :param binary: whether the dumpsys should be pared as binary or not (bool)
+        :return: section extracted (string or bytes)
+        """
+        lines = []
+        in_section = False
+        delimiter = "------------------------------------------------------------------------------"
+        if binary:
+            delimiter = delimiter.encode("utf-8")
+
+        for line in dumpsys.splitlines():
+            if line.strip() == separator:
+                in_section = True
+                continue
+
+            if not in_section:
+                continue
+
+            if line.strip().startswith(delimiter):
+                break
+
+            lines.append(line)
+
+        return b"\n".join(lines) if binary else "\n".join(lines)

src/mvt/android/artifacts/dumpsys_accessibility.py

@@ -0,0 +1,68 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysAccessibilityArtifact(AndroidArtifact):
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def parse(self, content: str) -> None:
+        """
+        Parse the Dumpsys Accessibility section/
+        Adds results to self.results (List[Dict[str, str]])
+
+        :param content: content of the accessibility section (string)
+        """
+
+        # "Old" syntax
+        in_services = False
+        for line in content.splitlines():
+            if line.strip().startswith("installed services:"):
+                in_services = True
+                continue
+
+            if not in_services:
+                continue
+
+            if line.strip() == "}":
+                # At end of installed services
+                break
+
+            service = line.split(":")[1].strip()
+
+            self.results.append(
+                {
+                    "package_name": service.split("/")[0],
+                    "service": service,
+                }
+            )
+
+        # "New" syntax - AOSP >= 14 (?)
+        # Looks like:
+        # Enabled services:{{com.azure.authenticator/com.microsoft.brooklyn.module.accessibility.BrooklynAccessibilityService}, {com.agilebits.onepassword/com.agilebits.onepassword.filling.accessibility.FillingAccessibilityService}}
+
+        for line in content.splitlines():
+            if line.strip().startswith("Enabled services:"):
+                matches = re.finditer(r"{([^{]+?)}", line)
+
+                for match in matches:
+                    # Each match is in format: <package_name>/<service>
+                    package_name, _, service = match.group(1).partition("/")
+
+                    self.results.append(
+                        {"package_name": package_name, "service": service}
+                    )

src/mvt/android/artifacts/dumpsys_adb.py

@@ -0,0 +1,169 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import base64
+import binascii
+import hashlib
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysADBArtifact(AndroidArtifact):
+    multiline_fields = ["user_keys", "keystore"]
+
+    def indented_dump_parser(self, dump_data):
+        """
+        Parse the indented dumpsys output, generated by DualDumpOutputStream in Android.
+        """
+        res = {}
+        stack = [res]
+        cur_indent = 0
+        in_multiline = False
+        for line in dump_data.strip(b"\n").split(b"\n"):
+            # Track the level of indentation
+            indent = len(line) - len(line.lstrip())
+            if indent < cur_indent:
+                # If the current line is less indented than the previous one, back out
+                stack.pop()
+                cur_indent = indent
+            else:
+                cur_indent = indent
+
+            # Split key and value by '='
+            vals = line.lstrip().split(b"=", 1)
+            key = vals[0].decode("utf-8")
+            current_dict = stack[-1]
+
+            # Annoyingly, some values are multiline and don't have a key on each line
+            if in_multiline:
+                if key == "":
+                    # If the line is empty, it's the terminator for the multiline value
+                    in_multiline = False
+                    stack.pop()
+                else:
+                    current_dict.append(line.lstrip())
+                continue
+
+            if key == "}":
+                stack.pop()
+                continue
+
+            if vals[1] == b"{":
+                # If the value is a new dictionary, add it to the stack
+                current_dict[key] = {}
+                stack.append(current_dict[key])
+
+            # Handle continue multiline values
+            elif key in self.multiline_fields:
+                current_dict[key] = []
+                current_dict[key].append(vals[1])
+
+                in_multiline = True
+                stack.append(current_dict[key])
+            else:
+                # If the value something else, store it in the current dictionary
+                current_dict[key] = vals[1]
+
+        return res
+
+    def parse_xml(self, xml_data):
+        """
+        Parse XML data from dumpsys ADB output
+        """
+        import xml.etree.ElementTree as ET
+
+        keystore = []
+        keystore_root = ET.fromstring(xml_data)
+        for adb_key in keystore_root.findall("adbKey"):
+            key_info = self.calculate_key_info(adb_key.get("key").encode("utf-8"))
+            key_info["last_connected"] = adb_key.get("lastConnection")
+            keystore.append(key_info)
+
+        return keystore
+
+    @staticmethod
+    def calculate_key_info(user_key: bytes) -> str:
+        if b" " in user_key:
+            key_base64, user = user_key.split(b" ", 1)
+        else:
+            key_base64, user = user_key, b""
+
+        try:
+            key_raw = base64.b64decode(key_base64)
+            key_fingerprint = hashlib.md5(key_raw).hexdigest().upper()
+            key_fingerprint_colon = ":".join(
+                [key_fingerprint[i : i + 2] for i in range(0, len(key_fingerprint), 2)]
+            )
+        except binascii.Error:
+            # Impossible to parse base64
+            key_fingerprint_colon = ""
+
+        return {
+            "user": user.decode("utf-8"),
+            "fingerprint": key_fingerprint_colon,
+            "key": key_base64,
+        }
+
+    def check_indicators(self) -> None:
+        if not self.results:
+            return
+
+        for entry in self.results:
+            for user_key in entry.get("user_keys", []):
+                self.log.debug(
+                    f"Found trusted ADB key for user '{user_key['user']}' with fingerprint "
+                    f"'{user_key['fingerprint']}'"
+                )
+
+    def parse(self, content: bytes) -> None:
+        """
+        Parse the Dumpsys ADB section
+        Adds results to self.results (List[Dict[str, str]])
+
+        :param content: content of the ADB section (string)
+        """
+        if not content or b"Can't find service: adb" in content:
+            self.log.error(
+                "Could not load ADB data from dumpsys. "
+                "It may not be supported on this device."
+            )
+            return
+
+        # TODO: Parse AdbDebuggingManager line in output.
+        start_of_json = content.find(b"\n{") + 2
+        end_of_json = content.rfind(b"}\n") - 2
+        json_content = content[start_of_json:end_of_json].rstrip()
+
+        parsed = self.indented_dump_parser(json_content)
+        if parsed.get("debugging_manager") is None:
+            self.log.error("Unable to find expected ADB entries in dumpsys output")  # noqa
+            return
+
+        # Keystore can be in different levels, as the basic parser
+        # is not always consistent due to different dumpsys formats.
+        if parsed.get("keystore"):
+            keystore_data = b"\n".join(parsed["keystore"])
+        elif parsed["debugging_manager"].get("keystore"):
+            keystore_data = b"\n".join(parsed["debugging_manager"]["keystore"])
+        else:
+            keystore_data = None
+
+        # Keystore is in XML format on some devices and we need to parse it
+        if keystore_data and keystore_data.startswith(b"<?xml"):
+            parsed["debugging_manager"]["keystore"] = self.parse_xml(keystore_data)
+        else:
+            # Keystore is not XML format
+            parsed["debugging_manager"]["keystore"] = keystore_data
+
+        parsed = parsed["debugging_manager"]
+
+        # Calculate key fingerprints for better readability
+        key_info = []
+        for user_key in parsed.get("user_keys", []):
+            user_info = self.calculate_key_info(user_key)
+            key_info.append(user_info)
+
+        parsed["user_keys"] = key_info
+        self.results = [parsed]

src/mvt/android/artifacts/dumpsys_appops.py

@@ -0,0 +1,183 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from datetime import datetime
+from typing import Any, Dict, List, Union
+
+from mvt.common.utils import convert_datetime_to_iso
+
+from .artifact import AndroidArtifact
+
+
+RISKY_PERMISSIONS = ["REQUEST_INSTALL_PACKAGES"]
+RISKY_PACKAGES = ["com.android.shell"]
+
+
+class DumpsysAppopsArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys app ops info
+    """
+
+    def serialize(self, record: dict) -> Union[dict, list]:
+        records = []
+        for perm in record["permissions"]:
+            if "entries" not in perm:
+                continue
+
+            for entry in perm["entries"]:
+                if "timestamp" in entry:
+                    records.append(
+                        {
+                            "timestamp": entry["timestamp"],
+                            "module": self.__class__.__name__,
+                            "event": entry["access"],
+                            "data": f"{record['package_name']} access to "
+                            f"{perm['name']}: {entry['access']}",
+                        }
+                    )
+
+        return records
+
+    def check_indicators(self) -> None:
+        for result in self.results:
+            if self.indicators:
+                ioc = self.indicators.check_app_id(result.get("package_name"))
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+            detected_permissions = []
+            for perm in result["permissions"]:
+                if (
+                    perm["name"] in RISKY_PERMISSIONS
+                    # and perm["access"] == "allow"
+                ):
+                    detected_permissions.append(perm)
+                    for entry in sorted(perm["entries"], key=lambda x: x["timestamp"]):
+                        self.log.warning(
+                            "Package '%s' had risky permission '%s' set to '%s' at %s",
+                            result["package_name"],
+                            perm["name"],
+                            entry["access"],
+                            entry["timestamp"],
+                        )
+
+                elif result["package_name"] in RISKY_PACKAGES:
+                    detected_permissions.append(perm)
+                    for entry in sorted(perm["entries"], key=lambda x: x["timestamp"]):
+                        self.log.warning(
+                            "Risky package '%s' had '%s' permission set to '%s' at %s",
+                            result["package_name"],
+                            perm["name"],
+                            entry["access"],
+                            entry["timestamp"],
+                        )
+
+            if detected_permissions:
+                # We clean the result to only include the risky permission, otherwise the timeline
+                # will be polluted with all the other irrelevant permissions
+                cleaned_result = result.copy()
+                cleaned_result["permissions"] = detected_permissions
+                self.detected.append(cleaned_result)
+
+    def parse(self, output: str) -> None:
+        self.results: List[Dict[str, Any]] = []
+        perm = {}
+        package = {}
+        entry = {}
+        uid = None
+        in_packages = False
+
+        for line in output.splitlines():
+            if line.startswith("  Uid 0:"):
+                in_packages = True
+
+            if not in_packages:
+                continue
+
+            if line.startswith("  Uid "):
+                uid = line[6:-1]
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+                if package:
+                    if perm:
+                        package["permissions"].append(perm)
+
+                    perm = {}
+                    self.results.append(package)
+                package = {}
+                continue
+
+            if line.startswith("    Package "):
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+
+                if package:
+                    if perm:
+                        package["permissions"].append(perm)
+
+                    perm = {}
+                    self.results.append(package)
+
+                package = {
+                    "package_name": line[12:-1],
+                    "permissions": [],
+                    "uid": uid,
+                }
+                continue
+
+            if package and line.startswith("      ") and line[6] != " ":
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+                if perm:
+                    package["permissions"].append(perm)
+                    perm = {}
+
+                perm["name"] = line.split()[0]
+                perm["entries"] = []
+                if len(line.split()) > 1:
+                    perm["access"] = line.split()[1][1:-2]
+
+                continue
+
+            if line.startswith("          "):
+                # Permission entry like:
+                # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
+                access_type = line.split(":")[0].strip()
+                if access_type not in ["Access", "Reject"]:
+                    # Skipping invalid access type. Some entries are not in the format we expect
+                    continue
+
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+
+                entry["access"] = access_type
+                entry["type"] = line[line.find("[") + 1 : line.find("]")]
+
+                try:
+                    entry["timestamp"] = convert_datetime_to_iso(
+                        datetime.strptime(
+                            line[line.find("]") + 1 : line.find("(")].strip(),
+                            "%Y-%m-%d %H:%M:%S.%f",
+                        )
+                    )
+                except ValueError:
+                    # Invalid date format
+                    pass
+
+            if line.strip() == "":
+                break
+
+        if entry:
+            perm["entries"].append(entry)
+        if perm:
+            package["permissions"].append(perm)
+        if package:
+            self.results.append(package)

src/mvt/android/artifacts/dumpsys_battery_daily.py

@@ -0,0 +1,78 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from typing import Union
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysBatteryDailyArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys dattery daily updates.
+    """
+
+    def serialize(self, record: dict) -> Union[dict, list]:
+        return {
+            "timestamp": record["from"],
+            "module": self.__class__.__name__,
+            "event": "battery_daily",
+            "data": f"Recorded update of package {record['package_name']} "
+            f"with vers {record['vers']}",
+        }
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def parse(self, output: str) -> None:
+        daily = None
+        daily_updates = []
+        for line in output.splitlines():
+            if line.startswith("  Daily from "):
+                if len(daily_updates) > 0:
+                    self.results.extend(daily_updates)
+                    daily_updates = []
+
+                timeframe = line[13:].strip()
+                date_from, date_to = timeframe.strip(":").split(" to ", 1)
+                daily = {"from": date_from[0:10], "to": date_to[0:10]}
+                continue
+
+            if not daily:
+                continue
+
+            if not line.strip().startswith("Update "):
+                continue
+
+            line = line.strip().replace("Update ", "")
+            package_name, vers = line.split(" ", 1)
+            vers_nr = vers.split("=", 1)[1]
+
+            already_seen = False
+            for update in daily_updates:
+                if package_name == update["package_name"] and vers_nr == update["vers"]:
+                    already_seen = True
+                    break
+
+            if not already_seen:
+                daily_updates.append(
+                    {
+                        "action": "update",
+                        "from": daily["from"],
+                        "to": daily["to"],
+                        "package_name": package_name,
+                        "vers": vers_nr,
+                    }
+                )
+
+        if len(daily_updates) > 0:
+            self.results.extend(daily_updates)

src/mvt/android/artifacts/dumpsys_battery_history.py

@@ -0,0 +1,78 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysBatteryHistoryArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys dattery history events.
+    """
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def parse(self, data: str) -> None:
+        for line in data.splitlines():
+            if line.startswith("Battery History "):
+                continue
+
+            if line.strip() == "":
+                break
+
+            time_elapsed = line.strip().split(" ", 1)[0]
+
+            event = ""
+            if line.find("+job") > 0:
+                event = "start_job"
+                uid = line[line.find("+job") + 5 : line.find(":")]
+                service = line[line.find(":") + 1 :].strip('"')
+                package_name = service.split("/")[0]
+            elif line.find("-job") > 0:
+                event = "end_job"
+                uid = line[line.find("-job") + 5 : line.find(":")]
+                service = line[line.find(":") + 1 :].strip('"')
+                package_name = service.split("/")[0]
+            elif line.find("+running +wake_lock=") > 0:
+                uid = line[line.find("+running +wake_lock=") + 21 : line.find(":")]
+                event = "wake"
+                service = (
+                    line[line.find("*walarm*:") + 9 :].split(" ")[0].strip('"').strip()
+                )
+                if service == "" or "/" not in service:
+                    continue
+
+                package_name = service.split("/")[0]
+            elif (line.find("+top=") > 0) or (line.find("-top") > 0):
+                if line.find("+top=") > 0:
+                    event = "start_top"
+                    top_pos = line.find("+top=")
+                else:
+                    event = "end_top"
+                    top_pos = line.find("-top=")
+                colon_pos = top_pos + line[top_pos:].find(":")
+                uid = line[top_pos + 5 : colon_pos]
+                service = ""
+                package_name = line[colon_pos + 1 :].strip('"')
+            else:
+                continue
+
+            self.results.append(
+                {
+                    "time_elapsed": time_elapsed,
+                    "event": event,
+                    "uid": uid,
+                    "package_name": package_name,
+                    "service": service,
+                }
+            )

src/mvt/android/artifacts/dumpsys_dbinfo.py

@@ -0,0 +1,83 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysDBInfoArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys DBInfo service
+    """
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            path = result.get("path", "")
+            for part in path.split("/"):
+                ioc = self.indicators.check_app_id(part)
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+    def parse(self, output: str) -> None:
+        rxp = re.compile(
+            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\""
+        )  # pylint: disable=line-too-long
+        rxp_no_pid = re.compile(
+            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\""
+        )  # pylint: disable=line-too-long
+
+        pool = None
+        in_operations = False
+        for line in output.splitlines():
+            if line.startswith("Connection pool for "):
+                pool = line.replace("Connection pool for ", "").rstrip(":")
+
+            if not pool:
+                continue
+
+            if line.strip() == "Most recently executed operations:":
+                in_operations = True
+                continue
+
+            if not in_operations:
+                continue
+
+            if not line.startswith("        "):
+                in_operations = False
+                pool = None
+                continue
+
+            matches = rxp.findall(line)
+            if not matches:
+                matches = rxp_no_pid.findall(line)
+                if not matches:
+                    continue
+
+                match = matches[0]
+                self.results.append(
+                    {
+                        "isodate": match[0],
+                        "action": match[1],
+                        "sql": match[2],
+                        "path": pool,
+                    }
+                )
+            else:
+                match = matches[0]
+                self.results.append(
+                    {
+                        "isodate": match[0],
+                        "pid": match[1],
+                        "action": match[2],
+                        "sql": match[3],
+                        "path": pool,
+                    }
+                )

src/mvt/android/artifacts/dumpsys_package_activities.py

@@ -0,0 +1,84 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysPackageActivitiesArtifact(AndroidArtifact):
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for activity in self.results:
+            ioc = self.indicators.check_app_id(activity["package_name"])
+            if ioc:
+                activity["matched_indicator"] = ioc
+                self.detected.append(activity)
+                continue
+
+    def parse(self, content: str):
+        """
+        Parse the Dumpsys Package section for activities
+        Adds results to self.results
+
+        :param content: content of the package section (string)
+        """
+        self.results = []
+
+        in_activity_resolver_table = False
+        in_non_data_actions = False
+        intent = None
+        for line in content.splitlines():
+            if line.startswith("Activity Resolver Table:"):
+                in_activity_resolver_table = True
+                continue
+
+            if not in_activity_resolver_table:
+                continue
+
+            if line.startswith("  Non-Data Actions:"):
+                in_non_data_actions = True
+                continue
+
+            if not in_non_data_actions:
+                continue
+
+            # If we hit an empty line, the Non-Data Actions section should be
+            # finished.
+            if line.strip() == "":
+                break
+
+            # We detect the action name.
+            if (
+                line.startswith(" " * 6)
+                and not line.startswith(" " * 8)
+                and ":" in line
+            ):
+                intent = line.strip().replace(":", "")
+                continue
+
+            # If we are not in an intent block yet, skip.
+            if not intent:
+                continue
+
+            # If we are in a block but the line does not start with 8 spaces
+            # it means the block ended a new one started, so we reset and
+            # continue.
+            if not line.startswith(" " * 8):
+                intent = None
+                continue
+
+            # If we got this far, we are processing receivers for the
+            # activities we are interested in.
+            activity = line.strip().split(" ")[1]
+            package_name = activity.split("/")[0]
+
+            self.results.append(
+                {
+                    "intent": intent,
+                    "package_name": package_name,
+                    "activity": activity,
+                }
+            )

src/mvt/android/artifacts/dumpsys_packages.py

@@ -0,0 +1,202 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+from typing import Any, Dict, List, Union
+
+from mvt.android.utils import ROOT_PACKAGES
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysPackagesArtifact(AndroidArtifact):
+    def check_indicators(self) -> None:
+        for result in self.results:
+            if result["package_name"] in ROOT_PACKAGES:
+                self.log.warning(
+                    'Found an installed package related to rooting/jailbreaking: "%s"',
+                    result["package_name"],
+                )
+                self.detected.append(result)
+                continue
+
+            if not self.indicators:
+                continue
+
+            ioc = self.indicators.check_app_id(result.get("package_name", ""))
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+
+    def serialize(self, record: dict) -> Union[dict, list]:
+        records = []
+
+        timestamps = [
+            {"event": "package_install", "timestamp": record["timestamp"]},
+            {
+                "event": "package_first_install",
+                "timestamp": record["first_install_time"],
+            },
+            {"event": "package_last_update", "timestamp": record["last_update_time"]},
+        ]
+
+        for timestamp in timestamps:
+            records.append(
+                {
+                    "timestamp": timestamp["timestamp"],
+                    "module": self.__class__.__name__,
+                    "event": timestamp["event"],
+                    "data": f"Install or update of package {record['package_name']}",
+                }
+            )
+
+        return records
+
+    @staticmethod
+    def parse_dumpsys_package_for_details(output: str) -> Dict[str, Any]:
+        """
+        Parse one entry of a dumpsys package information
+        """
+        details = {
+            "uid": "",
+            "version_name": "",
+            "version_code": "",
+            "timestamp": "",
+            "first_install_time": "",
+            "last_update_time": "",
+            "permissions": [],
+            "requested_permissions": [],
+        }
+        in_install_permissions = False
+        in_runtime_permissions = False
+        in_declared_permissions = False
+        in_requested_permissions = True
+        for line in output.splitlines():
+            if in_install_permissions:
+                if line.startswith(" " * 4) and not line.startswith(" " * 6):
+                    in_install_permissions = False
+                else:
+                    lineinfo = line.strip().split(":")
+                    permission = lineinfo[0]
+                    granted = None
+                    if "granted=" in lineinfo[1]:
+                        granted = "granted=true" in lineinfo[1]
+
+                    details["permissions"].append(
+                        {"name": permission, "granted": granted, "type": "install"}
+                    )
+            if in_runtime_permissions:
+                if not line.startswith(" " * 8):
+                    in_runtime_permissions = False
+                else:
+                    lineinfo = line.strip().split(":")
+                    permission = lineinfo[0]
+                    granted = None
+                    if "granted=" in lineinfo[1]:
+                        granted = "granted=true" in lineinfo[1]
+
+                    details["permissions"].append(
+                        {"name": permission, "granted": granted, "type": "runtime"}
+                    )
+            if in_declared_permissions:
+                if not line.startswith(" " * 6):
+                    in_declared_permissions = False
+                else:
+                    permission = line.strip().split(":")[0]
+                    details["permissions"].append(
+                        {"name": permission, "type": "declared"}
+                    )
+            if in_requested_permissions:
+                if not line.startswith(" " * 6):
+                    in_requested_permissions = False
+                else:
+                    details["requested_permissions"].append(line.strip())
+            if line.strip().startswith("userId="):
+                details["uid"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionName="):
+                details["version_name"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionCode="):
+                details["version_code"] = line.split("=", 1)[1].strip()
+            elif line.strip().startswith("timeStamp="):
+                details["timestamp"] = line.split("=")[1].strip()
+            elif line.strip().startswith("firstInstallTime="):
+                details["first_install_time"] = line.split("=")[1].strip()
+            elif line.strip().startswith("lastUpdateTime="):
+                details["last_update_time"] = line.split("=")[1].strip()
+            elif line.strip() == "install permissions:":
+                in_install_permissions = True
+            elif line.strip() == "runtime permissions:":
+                in_runtime_permissions = True
+            elif line.strip() == "declared permissions:":
+                in_declared_permissions = True
+            elif line.strip() == "requested permissions:":
+                in_requested_permissions = True
+
+        return details
+
+    def parse_dumpsys_packages(self, output: str) -> List[Dict[str, Any]]:
+        """
+        Parse the dumpsys package service data
+        """
+        pkg_rxp = re.compile(r"  Package \[(.+?)\].*")
+
+        results = []
+        package_name = None
+        package = {}
+        lines = []
+        for line in output.splitlines():
+            if line.startswith("  Package ["):
+                if len(lines) > 0:
+                    details = self.parse_dumpsys_package_for_details("\n".join(lines))
+                    package.update(details)
+                    results.append(package)
+                    lines = []
+                    package = {}
+
+                matches = pkg_rxp.findall(line)
+                if not matches:
+                    continue
+
+                package_name = matches[0]
+                package["package_name"] = package_name
+                continue
+
+            if not package_name:
+                continue
+
+            lines.append(line)
+
+        if len(lines) > 0:
+            details = self.parse_dumpsys_package_for_details("\n".join(lines))
+            package.update(details)
+            results.append(package)
+
+        return results
+
+    def parse(self, content: str):
+        """
+        Parse the Dumpsys Package section for activities
+        Adds results to self.results
+
+        :param content: content of the package section (string)
+        """
+        self.results = []
+        package = []
+
+        in_package_list = False
+        for line in content.split("\n"):
+            if line.startswith("Packages:"):
+                in_package_list = True
+                continue
+
+            if not in_package_list:
+                continue
+
+            if line.strip() == "":
+                break
+
+            package.append(line)
+
+        self.results = self.parse_dumpsys_packages("\n".join(package))

src/mvt/android/artifacts/dumpsys_platform_compat.py

@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysPlatformCompatArtifact(AndroidArtifact):
+    """
+    Parser for uninstalled apps listed in platform_compat section.
+    """
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def parse(self, data: str) -> None:
+        for line in data.splitlines():
+            if not line.startswith("ChangeId(168419799; name=DOWNSCALED;"):
+                continue
+
+            if line.strip() == "":
+                break
+
+            # Look for rawOverrides field
+            if "rawOverrides={" in line:
+                # Extract the content inside the braces for rawOverrides
+                overrides_field = line.split("rawOverrides={", 1)[1].split("};", 1)[0]
+
+                for entry in overrides_field.split(", "):
+                    # Extract app name
+                    uninstall_app = entry.split("=")[0].strip()
+
+                    self.results.append({"package_name": uninstall_app})

src/mvt/android/artifacts/dumpsys_receivers.py

@@ -0,0 +1,116 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+
+INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
+INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
+INTENT_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
+INTENT_PHONE_STATE = "android.intent.action.PHONE_STATE"
+INTENT_NEW_OUTGOING_CALL = "android.intent.action.NEW_OUTGOING_CALL"
+
+
+class DumpsysReceiversArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys receivers in the package section
+    """
+
+    def check_indicators(self) -> None:
+        for intent, receivers in self.results.items():
+            for receiver in receivers:
+                if intent == INTENT_NEW_OUTGOING_SMS:
+                    self.log.info(
+                        'Found a receiver to intercept outgoing SMS messages: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_SMS_RECEIVED:
+                    self.log.info(
+                        'Found a receiver to intercept incoming SMS messages: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_DATA_SMS_RECEIVED:
+                    self.log.info(
+                        'Found a receiver to intercept incoming data SMS message: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_PHONE_STATE:
+                    self.log.info(
+                        "Found a receiver monitoring "
+                        'telephony state/incoming calls: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_NEW_OUTGOING_CALL:
+                    self.log.info(
+                        'Found a receiver monitoring outgoing calls: "%s"',
+                        receiver["receiver"],
+                    )
+
+                if not self.indicators:
+                    continue
+
+                ioc = self.indicators.check_app_id(receiver["package_name"])
+                if ioc:
+                    receiver["matched_indicator"] = ioc
+                    self.detected.append({intent: receiver})
+                    continue
+
+    def parse(self, output: str) -> None:
+        self.results = {}
+
+        in_receiver_resolver_table = False
+        in_non_data_actions = False
+        intent = None
+        for line in output.splitlines():
+            if line.startswith("Receiver Resolver Table:"):
+                in_receiver_resolver_table = True
+                continue
+
+            if not in_receiver_resolver_table:
+                continue
+
+            if line.startswith("  Non-Data Actions:"):
+                in_non_data_actions = True
+                continue
+
+            if not in_non_data_actions:
+                continue
+
+            # If we hit an empty line, the Non-Data Actions section should be
+            # finished.
+            if line.strip() == "":
+                break
+
+            # We detect the action name.
+            if (
+                line.startswith(" " * 6)
+                and not line.startswith(" " * 8)
+                and ":" in line
+            ):
+                intent = line.strip().replace(":", "")
+                self.results[intent] = []
+                continue
+
+            # If we are not in an intent block yet, skip.
+            if not intent:
+                continue
+
+            # If we are in a block but the line does not start with 8 spaces
+            # it means the block ended a new one started, so we reset and
+            # continue.
+            if not line.startswith(" " * 8):
+                intent = None
+                continue
+
+            # If we got this far, we are processing receivers for the
+            # activities we are interested in.
+            receiver = line.strip().split(" ")[1]
+            package_name = receiver.split("/")[0]
+
+            self.results[intent].append(
+                {
+                    "package_name": package_name,
+                    "receiver": receiver,
+                }
+            )

src/mvt/android/artifacts/file_timestamps.py

@@ -0,0 +1,43 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+from typing import Union
+
+from .artifact import AndroidArtifact
+
+
+class FileTimestampsArtifact(AndroidArtifact):
+    def serialize(self, record: dict) -> Union[dict, list]:
+        records = []
+
+        for ts in set(
+            [
+                record.get("access_time"),
+                record.get("changed_time"),
+                record.get("modified_time"),
+            ]
+        ):
+            if not ts:
+                continue
+
+            macb = ""
+            macb += "M" if ts == record.get("modified_time") else "-"
+            macb += "A" if ts == record.get("access_time") else "-"
+            macb += "C" if ts == record.get("changed_time") else "-"
+            macb += "-"
+
+            msg = record["path"]
+            if record.get("context"):
+                msg += f" ({record['context']})"
+
+            records.append(
+                {
+                    "timestamp": ts,
+                    "module": self.__class__.__name__,
+                    "event": macb,
+                    "data": msg,
+                }
+            )
+
+        return records

src/mvt/android/artifacts/getprop.py

@@ -0,0 +1,71 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+from typing import Dict, List
+
+from mvt.android.utils import warn_android_patch_level
+
+from .artifact import AndroidArtifact
+
+INTERESTING_PROPERTIES = [
+    "gsm.sim.operator.alpha",
+    "gsm.sim.operator.iso-country",
+    "persist.sys.timezone",
+    "ro.boot.serialno",
+    "ro.build.version.sdk",
+    "ro.build.version.security_patch",
+    "ro.product.cpu.abi",
+    "ro.product.locale",
+    "ro.product.vendor.manufacturer",
+    "ro.product.vendor.model",
+    "ro.product.vendor.name",
+]
+
+
+class GetProp(AndroidArtifact):
+    def parse(self, entry: str) -> None:
+        self.results: List[Dict[str, str]] = []
+        rxp = re.compile(r"\[(.+?)\]: \[(.+?)\]")
+
+        for line in entry.splitlines():
+            line = line.strip()
+            if line == "":
+                continue
+
+            matches = re.findall(rxp, line)
+            if not matches or len(matches[0]) != 2:
+                continue
+
+            entry = {"name": matches[0][0], "value": matches[0][1]}
+            self.results.append(entry)
+
+    def get_device_timezone(self) -> str:
+        """
+        Get the device timezone from the getprop results
+
+        Used in other moduels to calculate the timezone offset
+        """
+        for entry in self.results:
+            if entry["name"] == "persist.sys.timezone":
+                return entry["value"]
+        return None
+
+    def check_indicators(self) -> None:
+        for entry in self.results:
+            if entry["name"] in INTERESTING_PROPERTIES:
+                self.log.info("%s: %s", entry["name"], entry["value"])
+
+            if entry["name"] == "ro.build.version.security_patch":
+                warn_android_patch_level(entry["value"], self.log)
+
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_android_property_name(result.get("name", ""))
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)

src/mvt/android/artifacts/processes.py

@@ -0,0 +1,70 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+
+
+class Processes(AndroidArtifact):
+    def parse(self, entry: str) -> None:
+        for line in entry.split("\n")[1:]:
+            proc = line.split()
+
+            # Skip empty lines
+            if len(proc) == 0:
+                continue
+
+            # Sometimes WCHAN is empty.
+            if len(proc) == 8:
+                proc = proc[:5] + [""] + proc[5:]
+
+            # Sometimes there is the security label.
+            if proc[0].startswith("u:r"):
+                label = proc[0]
+                proc = proc[1:]
+            else:
+                label = ""
+
+            # Sometimes there is no WCHAN.
+            if len(proc) < 9:
+                proc = proc[:5] + [""] + proc[5:]
+
+            self.results.append(
+                {
+                    "user": proc[0],
+                    "pid": int(proc[1]),
+                    "ppid": int(proc[2]),
+                    "virtual_memory_size": int(proc[3]),
+                    "resident_set_size": int(proc[4]),
+                    "wchan": proc[5],
+                    "aprocress": proc[6],
+                    "stat": proc[7],
+                    "proc_name": proc[8].strip("[]"),
+                    "label": label,
+                }
+            )
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            proc_name = result.get("proc_name", "")
+            if not proc_name:
+                continue
+
+            # Skipping this process because of false positives.
+            if result["proc_name"] == "gatekeeperd":
+                continue
+
+            ioc = self.indicators.check_app_id(proc_name)
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+            ioc = self.indicators.check_process(proc_name)
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)

src/mvt/android/artifacts/settings.py

@@ -1,12 +1,9 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 Claudio Guarnieri.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import logging
-from typing import Optional
-
-from .base import AndroidExtraction
+from .artifact import AndroidArtifact
 
 ANDROID_DANGEROUS_SETTINGS = [
     {
@@ -19,6 +16,11 @@ ANDROID_DANGEROUS_SETTINGS = [
         "key": "package_verifier_enable",
         "safe_value": "1",
     },
+    {
+        "description": "disabled APK package verification",
+        "key": "package_verifier_state",
+        "safe_value": "1",
+    },
     {
         "description": "disabled Google Play Protect",
         "key": "package_verifier_user_consent",
@@ -53,58 +55,28 @@ ANDROID_DANGEROUS_SETTINGS = [
         "description": "enabled installation of non Google Play apps",
         "key": "install_non_market_apps",
         "safe_value": "0",
-    }
+    },
+    {
+        "description": "enabled accessibility services",
+        "key": "accessibility_enabled",
+        "safe_value": "0",
+    },
 ]
 
 
-class Settings(AndroidExtraction):
-    """This module extracts Android system settings."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        fast_mode: Optional[bool] = False,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None
-    ) -> None:
-        super().__init__(file_path=file_path, target_path=target_path,
-                         results_path=results_path, fast_mode=fast_mode,
-                         log=log, results=results)
-
-        self.results = {} if not results else results
-
+class Settings(AndroidArtifact):
     def check_indicators(self) -> None:
-        for _, settings in self.results.items():
+        for namespace, settings in self.results.items():
             for key, value in settings.items():
                 for danger in ANDROID_DANGEROUS_SETTINGS:
                     # Check if one of the dangerous settings is using an unsafe
                     # value (different than the one specified).
                     if danger["key"] == key and danger["safe_value"] != value:
-                        self.log.warning("Found suspicious setting \"%s = %s\" (%s)",
-                                         key, value, danger["description"])
+                        self.log.warning(
+                            'Found suspicious "%s" setting "%s = %s" (%s)',
+                            namespace,
+                            key,
+                            value,
+                            danger["description"],
+                        )
                         break
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        for namespace in ["system", "secure", "global"]:
-            out = self._adb_command(f"cmd settings list {namespace}")
-            if not out:
-                continue
-
-            self.results[namespace] = {}
-
-            for line in out.splitlines():
-                line = line.strip()
-                if line == "":
-                    continue
-
-                fields = line.split("=", 1)
-                try:
-                    self.results[namespace][fields[0]] = fields[1]
-                except IndexError:
-                    continue
-
-        self._adb_disconnect()

src/mvt/android/artifacts/tombstone_crashes.py

@@ -0,0 +1,270 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import datetime
+from typing import List, Optional, Union
+
+import pydantic
+import betterproto
+from dateutil import parser
+
+from mvt.common.utils import convert_datetime_to_iso
+from mvt.android.parsers.proto.tombstone import Tombstone
+from .artifact import AndroidArtifact
+
+
+TOMBSTONE_DELIMITER = "*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***"
+
+# Map the legacy crash file keys to the new format.
+TOMBSTONE_TEXT_KEY_MAPPINGS = {
+    "Build fingerprint": "build_fingerprint",
+    "Revision": "revision",
+    "ABI": "arch",
+    "Timestamp": "timestamp",
+    "Process uptime": "process_uptime",
+    "Cmdline": "command_line",
+    "pid": "pid",
+    "tid": "tid",
+    "name": "process_name",
+    "binary_path": "binary_path",
+    "uid": "uid",
+    "signal": "signal_info",
+    "code": "code",
+    "Cause": "cause",
+}
+
+
+class SignalInfo(pydantic.BaseModel):
+    code: int
+    code_name: str
+    name: str
+    number: Optional[int] = None
+
+
+class TombstoneCrashResult(pydantic.BaseModel):
+    """
+    MVT Result model for a tombstone crash result.
+
+    Needed for validation and serialization, and consistency between text and protobuf tombstones.
+    """
+
+    file_name: str
+    file_timestamp: str  # We store the timestamp as a string to avoid timezone issues
+    build_fingerprint: str
+    revision: int
+    arch: Optional[str] = None
+    timestamp: str  # We store the timestamp as a string to avoid timezone issues
+    process_uptime: Optional[int] = None
+    command_line: Optional[List[str]] = None
+    pid: int
+    tid: int
+    process_name: Optional[str] = None
+    binary_path: Optional[str] = None
+    selinux_label: Optional[str] = None
+    uid: int
+    signal_info: SignalInfo
+    cause: Optional[str] = None
+    extra: Optional[str] = None
+
+
+class TombstoneCrashArtifact(AndroidArtifact):
+    """ "
+    Parser for Android tombstone crash files.
+
+    This parser can parse both text and protobuf tombstone crash files.
+    """
+
+    def serialize(self, record: dict) -> Union[dict, list]:
+        return {
+            "timestamp": record["timestamp"],
+            "module": self.__class__.__name__,
+            "event": "Tombstone",
+            "data": (
+                f"Crash in '{record['process_name']}' process running as UID '{record['uid']}' in file '{record['file_name']}' "
+                f"Crash type '{record['signal_info']['name']}' with code '{record['signal_info']['code_name']}'"
+            ),
+        }
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_process(result["process_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+            if result.get("command_line", []):
+                command_name = result.get("command_line")[0].split("/")[-1]
+                ioc = self.indicators.check_process(command_name)
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+            SUSPICIOUS_UIDS = [
+                0,  # root
+                1000,  # system
+                2000,  # shell
+            ]
+            if result["uid"] in SUSPICIOUS_UIDS:
+                self.log.warning(
+                    f"Potentially suspicious crash in process '{result['process_name']}' "
+                    f"running as UID '{result['uid']}' in tombstone '{result['file_name']}' at {result['timestamp']}"
+                )
+                self.detected.append(result)
+
+    def parse_protobuf(
+        self, file_name: str, file_timestamp: datetime.datetime, data: bytes
+    ) -> None:
+        """
+        Parse Android tombstone crash files from a protobuf object.
+        """
+        tombstone_pb = Tombstone().parse(data)
+        tombstone_dict = tombstone_pb.to_dict(
+            betterproto.Casing.SNAKE, include_default_values=True
+        )
+
+        # Add some extra metadata
+        tombstone_dict["timestamp"] = self._parse_timestamp_string(
+            tombstone_pb.timestamp
+        )
+        tombstone_dict["file_name"] = file_name
+        tombstone_dict["file_timestamp"] = convert_datetime_to_iso(file_timestamp)
+        tombstone_dict["process_name"] = self._proccess_name_from_thread(tombstone_dict)
+
+        # Confirm the tombstone is valid, and matches the output model
+        tombstone = TombstoneCrashResult.model_validate(tombstone_dict)
+        self.results.append(tombstone.model_dump())
+
+    def parse(
+        self, file_name: str, file_timestamp: datetime.datetime, content: bytes
+    ) -> None:
+        """
+        Parse text Android tombstone crash files.
+        """
+
+        # Split the tombstone file into a dictonary
+        tombstone_dict = {
+            "file_name": file_name,
+            "file_timestamp": convert_datetime_to_iso(file_timestamp),
+        }
+        lines = content.decode("utf-8").splitlines()
+        for line in lines:
+            if not line.strip() or TOMBSTONE_DELIMITER in line:
+                continue
+            for key, destination_key in TOMBSTONE_TEXT_KEY_MAPPINGS.items():
+                self._parse_tombstone_line(line, key, destination_key, tombstone_dict)
+
+        # Validate the tombstone and add it to the results
+        tombstone = TombstoneCrashResult.model_validate(tombstone_dict)
+        self.results.append(tombstone.model_dump())
+
+    def _parse_tombstone_line(
+        self, line: str, key: str, destination_key: str, tombstone: dict
+    ) -> bool:
+        if not line.startswith(f"{key}"):
+            return None
+
+        if key == "pid":
+            return self._load_pid_line(line, tombstone)
+        elif key == "signal":
+            return self._load_signal_line(line, tombstone)
+        elif key == "Timestamp":
+            return self._load_timestamp_line(line, tombstone)
+        else:
+            return self._load_key_value_line(line, key, destination_key, tombstone)
+
+    def _load_key_value_line(
+        self, line: str, key: str, destination_key: str, tombstone: dict
+    ) -> bool:
+        line_key, value = line.split(":", 1)
+        if line_key != key:
+            raise ValueError(f"Expected key {key}, got {line_key}")
+
+        value_clean = value.strip().strip("'")
+        if destination_key in ["uid", "revision"]:
+            tombstone[destination_key] = int(value_clean)
+        elif destination_key == "process_uptime":
+            # eg. "Process uptime: 40s"
+            tombstone[destination_key] = int(value_clean.rstrip("s"))
+        elif destination_key == "command_line":
+            # XXX: Check if command line should be a single string in a list, or a list of strings.
+            tombstone[destination_key] = [value_clean]
+        else:
+            tombstone[destination_key] = value_clean
+        return True
+
+    def _load_pid_line(self, line: str, tombstone: dict) -> bool:
+        pid_part, tid_part, name_part = [part.strip() for part in line.split(",")]
+
+        pid_key, pid_value = pid_part.split(":", 1)
+        if pid_key != "pid":
+            raise ValueError(f"Expected key pid, got {pid_key}")
+        pid_value = int(pid_value.strip())
+
+        tid_key, tid_value = tid_part.split(":", 1)
+        if tid_key != "tid":
+            raise ValueError(f"Expected key tid, got {tid_key}")
+        tid_value = int(tid_value.strip())
+
+        name_key, name_value = name_part.split(":", 1)
+        if name_key != "name":
+            raise ValueError(f"Expected key name, got {name_key}")
+        name_value = name_value.strip()
+        process_name, binary_path = self._parse_process_name(name_value, tombstone)
+
+        tombstone["pid"] = pid_value
+        tombstone["tid"] = tid_value
+        tombstone["process_name"] = process_name
+        tombstone["binary_path"] = binary_path
+        return True
+
+    def _parse_process_name(self, process_name_part, tombstone: dict) -> bool:
+        process_name, process_path = process_name_part.split(">>>")
+        process_name = process_name.strip()
+        binary_path = process_path.strip().split(" ")[0]
+        return process_name, binary_path
+
+    def _load_signal_line(self, line: str, tombstone: dict) -> bool:
+        signal, code, _ = [part.strip() for part in line.split(",", 2)]
+        signal = signal.split("signal ")[1]
+        signal_code, signal_name = signal.split(" ")
+        signal_name = signal_name.strip("()")
+
+        code_part = code.split("code ")[1]
+        code_number, code_name = code_part.split(" ")
+        code_name = code_name.strip("()")
+
+        tombstone["signal_info"] = {
+            "code": int(code_number),
+            "code_name": code_name,
+            "name": signal_name,
+            "number": int(signal_code),
+        }
+        return True
+
+    def _load_timestamp_line(self, line: str, tombstone: dict) -> bool:
+        timestamp = line.split(":", 1)[1].strip()
+        tombstone["timestamp"] = self._parse_timestamp_string(timestamp)
+        return True
+
+    @staticmethod
+    def _parse_timestamp_string(timestamp: str) -> str:
+        timestamp_parsed = parser.parse(timestamp)
+
+        # HACK: Swap the local timestamp to UTC, so keep the original time and avoid timezone conversion.
+        local_timestamp = timestamp_parsed.replace(tzinfo=datetime.timezone.utc)
+        return convert_datetime_to_iso(local_timestamp)
+
+    @staticmethod
+    def _proccess_name_from_thread(tombstone_dict: dict) -> str:
+        if tombstone_dict.get("threads"):
+            for thread in tombstone_dict["threads"].values():
+                if thread.get("id") == tombstone_dict["tid"] and thread.get("name"):
+                    return thread["name"]
+        return "Unknown"