Bump requests to 2.33.0 and cryptography to 46.0.6 to fix security vulnerabilities

- requests 2.33.0: fixes insecure temp file reuse in extract_zipped_paths() (moderate)
- cryptography 46.0.6: fixes incomplete DNS name constraint enforcement (low)

.github/dependabot.yml

@@ -5,9 +5,7 @@
 
 version: 2
 updates:
-  - package-ecosystem: "uv" # See documentation for possible values
+  - package-ecosystem: "pip" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7

.github/workflows/add-issue-to-project.yml

@@ -11,7 +11,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2
+      - uses: actions/add-to-project@v0.5.0
         with:
           # You can target a project in a different organization
           # to the issue

.github/workflows/mypy.yml

@@ -1,8 +1,5 @@
 name: Mypy
-on:
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
+on: workflow_dispatch
 
 jobs:
   mypy_py3:
@@ -10,19 +7,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
+      - uses: actions/checkout@v4
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.10"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.0
-        with:
-          enable-cache: true
+          python-version: 3.9
+          cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
       - name: Install Dependencies
         run: |
-          uv sync --locked --group dev
+          pip install mypy
       - name: mypy
         run: |
           make mypy

.github/workflows/publish-release-docker.yml

@@ -4,8 +4,6 @@ name: Create and publish a Docker image
 # Configures this workflow to run every time a release is published.
 on:
   workflow_dispatch:
-  push:
-    branches: [main]
   release:
     types: [published]
 
@@ -25,21 +23,12 @@ jobs:
       attestations: write
       id-token: write
       #
-    strategy:
-      matrix:
-        platform:
-          - dockerfile: "Dockerfile"
-            tag-suffix: ""
-          - dockerfile: "Dockerfile.ios"
-            tag-suffix: "-ios"
-          - dockerfile: "Dockerfile.android"
-            tag-suffix: "-android"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
       # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
       - name: Log in to the Container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -47,36 +36,26 @@ jobs:
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=latest,enable={{ is_default_branch }},suffix=${{ matrix.platform.tag-suffix }}
-            type=raw,enable=${{ github.event_name == 'release' || github.ref_type == 'tag' }},value=stable,suffix=${{ matrix.platform.tag-suffix }}
-            type=raw,enable=${{ github.event_name == 'release' }},value=${{ github.event.release.tag_name }},suffix=${{ matrix.platform.tag-suffix }}
-            type=raw,enable=${{ github.ref_type == 'tag' }},value=${{ github.ref_name }},suffix=${{ matrix.platform.tag-suffix }}
-            type=sha,suffix=${{ matrix.platform.tag-suffix }}
-            type=sha,format=long,suffix=${{ matrix.platform.tag-suffix }}
-      # Register emulators so Buildx can build the ARM64 images on the AMD64 runner.
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-      # This step sets up some additional capabilities to generate the provenance and sbom attestations
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
         with:
-          file: ${{ matrix.platform.dockerfile }}
           context: .
-          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: mode=max
-          sbom: true
+
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+

.github/workflows/ruff.yml

@@ -11,19 +11,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
+      - uses: actions/checkout@v4
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.10"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.0
-        with:
-          enable-cache: true
+          python-version: 3.9
+          cache: 'pip'
+      - name: Checkout
+        uses: actions/checkout@master
       - name: Install Dependencies
         run: |
-          uv sync --locked --group dev
+          pip install ruff
       - name: ruff
         run: |
           make ruff

.github/workflows/tests.yml

@@ -15,18 +15,15 @@ jobs:
         python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-      - uses: actions/checkout@v7
-      - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.0
-        with:
-          enable-cache: true
+      - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install Python dependencies
         run: |
-          uv sync --locked --group dev --python ${{ matrix.python-version }}
+          make install
+          make test-requirements
       - name: Test with pytest
         run: |
           set -o pipefail

.github/workflows/update-ios-data.yml

@@ -11,14 +11,12 @@ jobs:
   update-ios-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-      - name: Install script dependencies
-        run: python -m pip install "packaging==26.3"
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
       - name: Run script to fetch latest iOS releases from Apple RSS feed.
-        run: python .github/workflows/scripts/update-ios-releases.py
+        run: python3 .github/workflows/scripts/update-ios-releases.py
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@v5
         with:
           title: '[auto] Update iOS releases and versions'
           commit-message: Add new iOS versions and build numbers
@@ -29,4 +27,4 @@ jobs:
           add-paths: |
             *.json
           labels: |
-            automated pr
+            automated pr

.gitignore

@@ -86,9 +86,6 @@ ipython_config.py
 # pyenv
 .python-version
 
-# uv project Python version
-!.python-version
-
 # pipenv
 #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
@@ -141,4 +138,4 @@ dmypy.json
 .idea
 
 # Sublime Text project files
-*.sublime*
+*.sublime*

.python-version

@@ -1 +0,0 @@
-3.10

.readthedocs.yaml

@@ -6,16 +6,14 @@
 version: 2
 
 build:
-  os: "ubuntu-24.04"
+  os: "ubuntu-22.04"
   tools:
     python: "3.11"
 
 mkdocs:
   configuration: mkdocs.yml
 
+# Optionally set the version of Python and requirements required to build your docs
 python:
-  install:
-    - method: uv
-      command: sync
-      groups:
-        - docs
+   install:
+   - requirements: docs/requirements.txt

Dockerfile

@@ -1,6 +1,6 @@
 # Base image for building libraries
 # ---------------------------------
-FROM ubuntu:22.04 AS build-base
+FROM ubuntu:22.04 as build-base
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -22,7 +22,7 @@ RUN apt-get update \
 
 # libplist
 # --------
-FROM build-base AS build-libplist
+FROM build-base as build-libplist
 
 # Build
 RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
@@ -32,7 +32,7 @@ RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
 
 # libimobiledevice-glue
 # ---------------------
-FROM build-base AS build-libimobiledevice-glue
+FROM build-base as build-libimobiledevice-glue
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -45,7 +45,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd li
 
 # libtatsu
 # --------
-FROM build-base AS build-libtatsu
+FROM build-base as build-libtatsu
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -58,7 +58,7 @@ RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
 
 # libusbmuxd
 # ----------
-FROM build-base AS build-libusbmuxd
+FROM build-base as build-libusbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -72,7 +72,7 @@ RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
 
 # libimobiledevice
 # ----------------
-FROM build-base AS build-libimobiledevice
+FROM build-base as build-libimobiledevice
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -88,7 +88,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimob
 
 # usbmuxd
 # -------
-FROM build-base AS build-usbmuxd
+FROM build-base as build-usbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -103,8 +103,7 @@ RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
 
 
 # Create main image
-FROM ubuntu:24.04 AS main
-COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+FROM ubuntu:24.04 as main
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
@@ -119,23 +118,12 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
   && apt-get install -y \
   adb \
-  binutils \
   default-jre-headless \
-  file \
-  jq \
-  less \
   libcurl4 \
-  libimage-exiftool-perl \
   libssl3 \
   libusb-1.0-0 \
-  moreutils \
-  p7zip-full \
   python3 \
-  ripgrep \
-  sqlite3 \
-  tree \
-  unzip \
-  xxd
+  sqlite3
 COPY --from=build-libplist /build /
 COPY --from=build-libimobiledevice-glue /build /
 COPY --from=build-libtatsu /build /
@@ -145,8 +133,12 @@ COPY --from=build-usbmuxd /build /
 
 # Install mvt using the locally checked out source
 COPY . mvt/
-RUN uv pip install --system --break-system-packages --no-cache ./mvt \
-  && rm -rf mvt
+RUN apt-get update \
+   && apt-get install -y git python3-pip \
+   && PIP_NO_CACHE_DIR=1 pip3 install --break-system-packages ./mvt \
+   && apt-get remove -y python3-pip git && apt-get autoremove -y \
+   && rm -rf /var/lib/apt/lists/* \
+   && rm -rf mvt
 
 # Installing ABE
 ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
@@ -155,7 +147,7 @@ ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2
 RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
 # Generate adb key folder
-RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey > /dev/null 2>&1; fi' >> ~/.bashrc
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
 RUN mkdir /root/.android
 
 # Setup investigations environment

Dockerfile.android

@@ -1,6 +1,5 @@
 # Create main image
-FROM python:3.10.14-alpine3.20 AS main
-COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+FROM python:3.10.14-alpine3.20 as main
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
@@ -21,7 +20,7 @@ RUN apk add --no-cache \
 # Install mvt
 COPY ./ mvt
 RUN apk add --no-cache --virtual .build-deps gcc musl-dev \
-  && uv pip install --system --no-cache ./mvt \
+  && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
   && apk del .build-deps gcc musl-dev && rm -rf ./mvt
 
 # Installing ABE
@@ -31,7 +30,7 @@ ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2
 RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
 # Generate adb key folder
-RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey > /dev/null 2>&1; fi' >> ~/.bashrc
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
 RUN mkdir /root/.android
 
 ENTRYPOINT [ "/usr/local/bin/mvt-android" ]

Dockerfile.ios

@@ -1,6 +1,6 @@
 # Base image for building libraries
 # ---------------------------------
-FROM ubuntu:22.04 AS build-base
+FROM ubuntu:22.04 as build-base
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -22,7 +22,7 @@ RUN apt-get update \
 
 # libplist
 # --------
-FROM build-base AS build-libplist
+FROM build-base as build-libplist
 
 # Build
 RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
@@ -32,7 +32,7 @@ RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
 
 # libimobiledevice-glue
 # ---------------------
-FROM build-base AS build-libimobiledevice-glue
+FROM build-base as build-libimobiledevice-glue
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -45,7 +45,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd li
 
 # libtatsu
 # --------
-FROM build-base AS build-libtatsu
+FROM build-base as build-libtatsu
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -58,7 +58,7 @@ RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
 
 # libusbmuxd
 # ----------
-FROM build-base AS build-libusbmuxd
+FROM build-base as build-libusbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -72,7 +72,7 @@ RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
 
 # libimobiledevice
 # ----------------
-FROM build-base AS build-libimobiledevice
+FROM build-base as build-libimobiledevice
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -88,7 +88,7 @@ RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimob
 
 # usbmuxd
 # -------
-FROM build-base AS build-usbmuxd
+FROM build-base as build-usbmuxd
 
 # Install dependencies
 COPY --from=build-libplist /build /
@@ -104,8 +104,7 @@ RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
 
 # Main image
 # ----------
-FROM python:3.10.14-alpine3.20 AS main
-COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+FROM python:3.10.14-alpine3.20 as main
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
@@ -132,7 +131,7 @@ COPY --from=build-usbmuxd /build /
 # Install mvt using the locally checked out source
 COPY ./ mvt
 RUN apk add --no-cache --virtual .build-deps git gcc musl-dev \
-  && uv pip install --system --no-cache ./mvt \
+  && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
   && apk del .build-deps git gcc musl-dev && rm -rf ./mvt
 
 ENTRYPOINT [ "/usr/local/bin/mvt-ios" ]

Makefile

@@ -1,39 +1,39 @@
 PWD = $(shell pwd)
-UV ?= uv
 
 check: ruff mypy
 
 ruff:
-	$(UV) run ruff check .
+	ruff check .
 
 mypy:
-	$(UV) run mypy
+	mypy
 
 test:
-	$(UV) run pytest
+	python3 -m pytest
 
 test-ci:
-	$(UV) run pytest -v
+	python3 -m pytest -v
 
 install:
-	$(UV) sync
+	python3 -m pip install --upgrade -e .
 
 test-requirements:
-	$(UV) sync --group dev
+	python3 -m pip install --upgrade --group dev
 
 generate-proto-parsers:
 	# Generate python parsers for protobuf files
 	PROTO_FILES=$$(find src/mvt/android/parsers/proto/ -iname "*.proto"); \
-	$(UV) run protoc -Isrc/mvt/android/parsers/proto/ --python_betterproto2_out=src/mvt/android/parsers/proto/ $$PROTO_FILES
+	protoc -Isrc/mvt/android/parsers/proto/ --python_betterproto_out=src/mvt/android/parsers/proto/ $$PROTO_FILES
 
 clean:
 	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/src/mvt.egg-info
 
 dist:
-	$(UV) build
+	python3 -m pip install --upgrade build
+	python3 -m build
 
 upload:
-	$(UV) tool run twine upload dist/*
+	python3 -m twine upload dist/*
 
 test-upload:
-	$(UV) tool run twine upload --repository testpypi dist/*
+	python3 -m twine upload --repository testpypi dist/*

README.md

@@ -4,9 +4,6 @@
 
 # Mobile Verification Toolkit
 
-> [!IMPORTANT]
-> We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757
-
 [![](https://img.shields.io/pypi/v/mvt)](https://pypi.org/project/mvt/)
 [![Documentation Status](https://readthedocs.org/projects/mvt/badge/?version=latest)](https://docs.mvt.re/en/latest/?badge=latest)
 [![CI](https://github.com/mvt-project/mvt/actions/workflows/tests.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/tests.yml)
@@ -41,50 +38,12 @@ MVT can be installed from sources or from [PyPI](https://pypi.org/project/mvt/)
 pip3 install mvt
 ```
 
-You can also install MVT from PyPI with [uv](https://docs.astral.sh/uv/). First, install uv:
-
-```bash
-curl -LsSf https://astral.sh/uv/install.sh | sh
-```
-
-Then install MVT as a command-line tool:
-
-```bash
-uv tool install mvt
-```
-
 For alternative installation options and known issues, please refer to the [documentation](https://docs.mvt.re/en/latest/install/) as well as [GitHub Issues](https://github.com/mvt-project/mvt/issues).
 
 
 ## Usage
 
-MVT provides three commands: `mvt-ios` and `mvt-android` analyse acquisitions from devices of that platform, and `mvt` hosts what belongs to neither: `version`, `completion`, `plugins` and `download-iocs` (`version` and `download-iocs` remain available on the platform commands for now). Running `mvt` on its own shows the installed version, update notices and the available commands. [Check out the documentation to learn how to use them!](https://docs.mvt.re/)
-
-Pass `--verbose` to any of the three commands, before the command name (`mvt-ios --verbose check-backup ...`), for debug output. The `--verbose` option the `check-*` commands accept after their name still works but is kept for compatibility only and will be removed in a future release.
-
-### Shell completion
-
-MVT can generate a shell completion script for Bash, Zsh, and Fish which covers `mvt`, `mvt-ios` and `mvt-android`:
-
-```bash
-mvt completion
-```
-
-The command prints setup instructions by default. To generate the completion script directly, pass the shell name:
-
-```bash
-mvt completion bash
-```
-
-MVT only writes completion files or shell configuration when `--install` is passed. See the [command completion documentation](https://docs.mvt.re/en/latest/command_completion/) for details.
-
-Plugin packages extend MVT with additional forensic modules, which run inside
-the `check-*` commands, and with top-level commands on `mvt`, `mvt-ios` and
-`mvt-android`. See the
-[development documentation](https://docs.mvt.re/en/latest/development/) for
-writing and installing them, and the
-[custom CLI command documentation](https://docs.mvt.re/en/latest/development/custom_commands/)
-for the entry points a package registers commands in.
+MVT provides two commands `mvt-ios` and `mvt-android`. [Check out the documentation to learn how to use them!](https://docs.mvt.re/)
 
 
 ## License

docs/android/adb.md

@@ -1,29 +1,50 @@
-# ADB Analysis Removed
+# Check over ADB
 
-The ability to analyze Android devices directly over the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb) has been removed from MVT.
+In order to check an Android device over the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb) you will first need to install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you have installed [Android Studio](https://developer.android.com/studio/) you should already have access to `adb` and other utilities.
 
-Use [AndroidQF](https://github.com/mvt-project/androidqf) to collect forensic artifacts from an Android device, then analyze the collected output with:
+While many Linux distributions already package Android Platform Tools (for example `android-platform-tools-base` on Debian), it is preferable to install the most recent version from the official website. Packaged versions might be outdated and incompatible with most recent Android handsets.
+
+Next you will need to enable debugging on the Android device you are testing. [Please follow the official instructions on how to do so.](https://developer.android.com/studio/command-line/adb)
+
+## Connecting over USB
+
+The easiest way to check the device is over a USB transport. You will need to have USB debugging enabled and the device plugged into your computer. If everything is configured appropriately you should see your device when launching the command `adb devices`.
+
+Now you can try launching MVT with:
 
 ```bash
-mvt-android check-androidqf /path/to/androidqf-output
+mvt-android check-adb --output /path/to/results
 ```
 
-For a standalone Android bug report, use:
+!!! warning
+    The `check-adb` command is deprecated and will be removed in a future release.
+    Whenever possible, prefer acquiring device data using the AndroidQF project (https://github.com/mvt-project/androidqf/) and then analyze those acquisitions with MVT.
 
-```bash
-mvt-android check-bugreport /path/to/bugreport.zip
-```
+    Running `mvt-android check-adb` will also emit a runtime deprecation warning advising you to migrate to AndroidQF.
 
-## Reasons for Removal
+If you have previously started an adb daemon MVT will alert you and require you to kill it with `adb kill-server` and relaunch the command.
+
+!!! warning
+
+    The `mvt-android check-adb` command has been deprecated and removed from MVT.
+
+The ability to analyze Android devices over ADB (`mvt-android check-adb`) has been removed from MVT due to several technical and forensic limitations.
+
+## Reasons for Deprecation
 
 1. **Inconsistent Data Collection Across Devices**
-   Android devices vary significantly in system architecture, security policy, and diagnostic log availability. This made it difficult to collect reliable forensic data across devices.
+   Android devices vary significantly in their system architecture, security policies, and available diagnostic logs. This inconsistency makes it difficult to ensure that MVT can reliably collect necessary forensic data across all devices.
 
 2. **Incomplete Forensic Data Acquisition**
-   Direct ADB analysis did not retrieve a complete forensic snapshot. Critical artifacts such as full bug reports could be missing.
+   The `check-adb` command did not retrieve a full forensic snapshot of all available data on the device. For example, critical logs such as the **full bugreport** were not systematically collected, leading to potential gaps in forensic analysis. This can be a serious problem in scenarios where the analyst only had one time access to the Android device.
 
-3. **Duplicated Analysis Paths**
-   Similar artifacts were parsed through separate ADB, AndroidQF, and bugreport modules, which made behavior harder to keep consistent.
+4. **Code Duplication and Difficulty Ensuring Consistent Behavior Across Sources**
+    Similar forensic data such as "dumpsys" logs were being loaded and parsed by MVT's ADB, AndroidQF and Bugreport commands. Multiple modules were needed to handle each source format which created duplication leading to inconsistent
+    behavior and difficulties in maintaining the code base.
 
-4. **Workflow Consistency**
-   MVT now focuses on analyzing acquired artifacts rather than interacting with live devices directly.
+5. **Alignment with iOS Workflow**
+   MVT’s forensic workflow for iOS relies on pre-extracted artifacts, such as iTunes backups or filesystem dumps, rather than preforming commands or interactions directly on a live device. Removing the ADB functionality ensures a more consistent methodology across both Android and iOS mobile forensic.
+
+## Alternative: Using AndroidQF for Forensic Data Collection
+
+To replace the deprecated ADB-based approach, forensic analysts should use [AndroidQF](https://github.com/mvt-project/androidqf) for comprehensive data collection, followed by MVT for forensic analysis. The workflow is outlined in the MVT [Android methodology](./methodology.md)

docs/android/backup.md

@@ -57,9 +57,3 @@ If the backup is encrypted, ABE will prompt you to enter the password.
 Alternatively, [ab-decrypt](https://github.com/joernheissler/ab-decrypt) can be used for that purpose.
 
 You can then extract SMSs with MVT by passing the folder path as parameter instead of the `.ab` file: `mvt-android check-backup --output /path/to/results/ /path/to/backup/` (the path to backup given should be the folder containing the `apps` folder).
-
-When an output folder is specified, URLs extracted from SMS and MMS messages
-are also written to `urls.json`. Each entry contains the URL, its expanded
-destination when MVT resolved a shortened URL during indicator checking, the
-message timestamp, and the `sms` source. The same file is created by
-`check-androidqf` when its nested Android backup contains messages with URLs.

docs/android/download_apks.md

@@ -0,0 +1,28 @@
+# Downloading APKs from an Android phone
+
+MVT allows you to attempt to download all available installed packages (APKs) from a device in order to further inspect them and potentially identify any which might be malicious in nature.
+
+You can do so by launching the following command:
+
+```bash
+mvt-android download-apks --output /path/to/folder
+```
+
+It might take several minutes to complete.
+
+!!! info
+    MVT will likely warn you it was unable to download certain installed packages. There is no reason to be alarmed: this is typically expected behavior when MVT attempts to download a system package it has no privileges to access.
+
+Optionally, you can decide to enable lookups of the SHA256 hash of all the extracted APKs on [VirusTotal](https://www.virustotal.com). While these lookups do not provide any conclusive assessment on all of the extracted APKs, they might highlight any known malicious ones:
+
+```bash
+MVT_VT_API_KEY=<key> mvt-android download-apks --output /path/to/folder --virustotal
+```
+
+Please note that in order to use VirusTotal lookups you are required to provide your own API key through the `MVT_VT_API_KEY` environment variable. You should also note that VirusTotal enforces strict API usage. Be mindful that MVT might consume your hourly search quota.
+
+In case you have a previous extraction of APKs you want to later check against VirusTotal, you can do so with the following arguments:
+
+```bash
+MVT_VT_API_KEY=<key> mvt-android download-apks --from-file /path/to/folder/apks.json --virustotal
+```

docs/android/intrusion_logs.md

@@ -1,82 +0,0 @@
-# Check Android Intrusion Logs
-
-Recent versions of Android can produce structured *Intrusion Logs* — newline-delimited JSON records derived from the platform's [SecurityLog API](https://developer.android.com/reference/android/app/admin/SecurityLog). Intrusion Logging is offered as a new option under Android's **Advanced Protection Mode**, which users can opt into on their device; no MDM or device-policy configuration is required. When enabled, these logs provide a high-fidelity record of process starts, DNS queries, outbound network connections, ADB activity, keyguard events, and other security-relevant operations. The initial Intrusion Logging feature was released for Android 16 in May 2026. The feature and supported events is likely to be expanded over time.
-
-For background on how this data source was introduced and why it is forensically valuable, see the Amnesty International Security Lab announcement: [Android Intrusion Logging as a new source of data for consensual forensic analysis](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/).
-
-## Recommended workflow: collect with AndroidQF
-
-[AndroidQF](https://github.com/mvt-project/androidqf) is the recommended way to acquire data from an Android device for analysis with MVT. During acquisition AndroidQF will prompt the user to also collect intrusion logs from the device, and writes them into an `intrusion-logs/` subdirectory of the acquisition output.
-
-When you analyse such an acquisition with `mvt-android check-androidqf`, MVT automatically detects the `intrusion-logs/` directory and runs the same intrusion-log checks described below — there is no need to invoke a separate command:
-
-```bash
-mvt-android check-androidqf --output /path/to/results/ /path/to/androidqf-output/
-```
-
-The device timezone is read from the AndroidQF acquisition (`getprop.txt`) and applied to event timestamps automatically.
-
-## Standalone command: `check-intrusion-logs`
-
-The `mvt-android check-intrusion-logs` command runs the intrusion-log analysis directly against a set of log files. Prefer the AndroidQF workflow above; use the standalone command when the intrusion logs were collected outside of an AndroidQF acquisition, or when re-analysing only a set of intrusion logs.
-
-## Expected input
-
-`check-intrusion-logs` accepts either:
-
-- a **directory** containing one or more `.txt` files (recursively), or
-- a **`.zip` archive** containing such `.txt` files (nested `.zip` archives are also walked).
-
-Each `.txt` file is expected to contain newline-delimited JSON, with one JSON object per line. Each object wraps a single event under a top-level key indicating its type, for example:
-
-```json
-{"dns_event": {"event_time": 1746979200000, "hostname": "example.com", "ip_addresses": ["93.184.216.34"], "package_name": "com.example.app"}}
-{"connect_event": {"event_time": 1746979201000, "ip_address": "93.184.216.34", "port": 443, "package_name": "com.example.app"}}
-{"security_event": {"event_time": 1746979202000, "tag": 210005, "data": ["..."]}}
-```
-
-Identical events that appear across multiple overlapping log files (e.g. daily rotations) are de-duplicated on a first-seen basis.
-
-## Running the analysis
-
-```bash
-mvt-android check-intrusion-logs --output /path/to/results/ /path/to/intrusion-logs/
-```
-
-A `.zip` archive can be passed directly in place of the directory:
-
-```bash
-mvt-android check-intrusion-logs --output /path/to/results/ /path/to/intrusion-logs.zip
-```
-
-### Options
-
-| Option | Description |
-| --- | --- |
-| `-i, --iocs PATH` | Path to a STIX2 indicator file. May be passed multiple times. |
-| `-o, --output PATH` | Directory where JSON results and the timeline CSV will be written. |
-| `-l, --list-modules` | List the available intrusion-log modules and exit. |
-| `-m, --module NAME` | Run a single module (e.g. `DnsEvent`) instead of all of them. |
-| `-t, --timezone TZ` | IANA timezone name for the device (e.g. `Europe/Paris`). When set, event timestamps are converted to the device's local time instead of UTC. |
-| `-v, --verbose` | Verbose logging. Kept for compatibility and to be removed in a future release: pass `--verbose` to `mvt-android` itself instead. |
-
-## Modules
-
-The command runs the following modules over the parsed events:
-
-- **`DnsEvent`** — DNS resolution events. Hostnames and resolved IP addresses are checked against domain indicators, and the requesting `package_name` is checked against app-identifier indicators.
-- **`ConnectEvent`** — Outbound network connection events. Destination IPs (with localhost addresses skipped) are checked against domain indicators, and `package_name` is checked against app-identifier indicators.
-- **`SecurityEvent`** — Security log events keyed by Android `SecurityLog` tag IDs (e.g. `app_process_start`, `adb_shell_cmd`, `keyguard_dismissed`, `os_startup`, `cert_*` events). These are surfaced in the timeline to help reconstruct device activity around suspected events.
-
-All three modules share a single pre-parsing pass over the input, so adding more modules in the future does not multiply I/O cost. Additional modules will be added in the future to support new event types which are generated by the Intrusion Logging feature.
-
-## Interpreting results
-
-A successful IOC match raises a `CRITICAL` alert that includes the matched indicator, the offending event, and the event timestamp. Alerts are summarised at the end of the run and persisted alongside the per-module JSON results.
-
-When `--timezone` is provided, timestamps in the timeline and JSON output reflect the device's local wall-clock time. Otherwise timestamps are in UTC, consistent with the rest of MVT.
-
-## Limitations
-
-- This page assumes the intrusion logs have already been collected from the device. The recommended collection path is via AndroidQF (see above); intrusion logging itself must have been enabled on the device beforehand by opting into Android's Advanced Protection mode and also enabling the optional Intrusion Logging feature (see the [Amnesty blog post](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/) for details).
-- As with all IOC-based analysis, public indicators alone are not sufficient to conclude that a device is uncompromised. See the [Indicators of Compromise](../iocs.md) page for context.

docs/android/methodology.md

@@ -38,33 +38,11 @@ By separating artifact collection from forensic analysis, this approach ensures
 
 For more information, refer to the [AndroidQF project documentation](https://github.com/mvt-project/androidqf).
 
-### VirusTotal package lookups
+## Check the device over Android Debug Bridge
 
-AndroidQF records APK file hashes in `packages.json`. MVT can optionally look up non-system APK hashes on VirusTotal while checking an AndroidQF acquisition:
+The ability to analyze Android devices over ADB (`mvt-android check-adb`) has been removed from MVT.
 
-```bash
-MVT_VT_API_KEY=<key> mvt-android check-androidqf --virustotal /path/to/androidqf-output
-```
-
-The `--virustotal` option is disabled by default because it sends APK hashes to VirusTotal and requires network access. It uses the `VT_API_KEY` MVT configuration value, which can also be provided through the `MVT_VT_API_KEY` environment variable.
-
-To avoid exhausting free VirusTotal API quotas, MVT waits 16 seconds between package hash requests by default. Use `--delay` to change the delay, or `--delay 0` to disable throttling:
-
-```bash
-mvt-android check-androidqf --virustotal --delay 30 /path/to/androidqf-output
-```
-
-## Android Intrusion Logs
-
-On devices where the user has opted into Android's [**Advanced Protection Mode**](https://support.google.com/android/answer/16339980) and turned on the optional Intrusion Logging featrue, Android can create and archive structured *Intrusion Logs* in an encrypted format. These logs record DNS queries, outbound network connections, process starts, ADB activity and other security-relevant events, and are a high-fidelity complement to the rest of an AndroidQF acquisition. The logs are generated on-device and encrypted before being stored in the Google account associated with the device. The encryption key is protected by the user device PIN. The intrusion log data is not accessible to Google.
-
-AndroidQF will prompt the user to download, decrypt and collect device intrusion logs as part of an acquisition. When they are present, `mvt-android check-androidqf` will automatically run the intrusion-log checks alongside the other AndroidQF modules — no extra command is required. This is the recommended workflow for Android forensic analysis with MVT.
-
-For cases where intrusion logs were collected outside of an AndroidQF acquisition, the standalone `mvt-android check-intrusion-logs` command can analyse them directly. See [Check Android Intrusion Logs](intrusion_logs.md) for details, and the [feature announcment from Amnesty International's Security Lab](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/) for background on the data source.
-
-## Android Debug Bridge analysis removed
-
-The ability to analyze Android devices directly over ADB has been removed from MVT. Direct extraction of data from ADB was error-prone and frequently resulted in inconsistent data collection between ADB and AndroidQF acquisitions. Use AndroidQF for device acquisition and `mvt-android check-androidqf` for analysis.
+See the [Android ADB documentation](./adb.md) for more information.
 
 ## Check an Android Backup (SMS messages)
 

docs/command_completion.md

@@ -1,66 +1,43 @@
-# Command Completion
+# Command Completion 
 
-MVT utilizes the [Click](https://click.palletsprojects.com/en/stable/) library for creating its command line interface.
+MVT utilizes the [Click](https://click.palletsprojects.com/en/stable/) library for creating its command line interface. 
 
 Click provides tab completion support for Bash (version 4.4 and up), Zsh, and Fish.
 
-To enable it, you need to register a completion script with your shell, which varies depending on the shell you are using.
+To enable it, you need to manually register a special function with your shell, which varies depending on the shell you are using.
 
-`mvt completion` generates one script which covers `mvt`, `mvt-ios` and `mvt-android`. The following describes how to generate that script and add it to your shell configuration.
+The following describes how to generate the command completion scripts and add them to your shell configuration. 
 
 > **Note: You will need to start a new shell for the changes to take effect.**
 
 ### For Bash
 
 ```bash
-# Generate the bash completion script
-mvt completion bash > ~/.mvt-complete.bash
+# Generates bash completion scripts
+echo "$(_MVT_IOS_COMPLETE=bash_source mvt-ios)" > ~/.mvt-ios-complete.bash &&
+echo "$(_MVT_ANDROID_COMPLETE=bash_source mvt-android)" > ~/.mvt-android-complete.bash
 ```
 
 Add the following to `~/.bashrc`:
 ```bash
-# source the mvt completion script
-[ -f ~/.mvt-complete.bash ] && . ~/.mvt-complete.bash
+# source mvt completion scripts
+. ~/.mvt-ios-complete.bash && .  ~/.mvt-android-complete.bash
 ```
 
 ### For Zsh
 
 ```bash
-# Generate the zsh completion script
-mvt completion zsh > ~/.mvt-complete.zsh
+# Generates zsh completion scripts
+echo "$(_MVT_IOS_COMPLETE=zsh_source mvt-ios)" >  ~/.mvt-ios-complete.zsh &&
+echo "$(_MVT_ANDROID_COMPLETE=zsh_source mvt-android)" > ~/.mvt-android-complete.zsh
 ```
 
 Add the following to `~/.zshrc`:
 ```bash
-# source the mvt completion script
-[ -f ~/.mvt-complete.zsh ] && . ~/.mvt-complete.zsh
+# source mvt completion scripts
+.  ~/.mvt-ios-complete.zsh  && .  ~/.mvt-android-complete.zsh
 ```
 
-### For Fish
-
-```bash
-# Generate the fish completion script
-mkdir -p ~/.config/fish/conf.d
-mvt completion fish > ~/.config/fish/conf.d/mvt-completion.fish
-```
-
-Fish loads the files in `~/.config/fish/conf.d` automatically.
-
-### Automatic Installation
-
-MVT can write the completion file and update the relevant shell configuration for Bash and Zsh when you pass `--install`:
-
-```bash
-mvt completion bash --install
-```
-
-Replace `bash` with `zsh` or `fish` as needed. For Fish, `--install` writes the completion file into `~/.config/fish/conf.d` and changes no shell configuration.
-
-!!! note
-
-    Earlier versions generated one script per command, with `mvt-ios completion`
-    and `mvt-android completion`. Files written by them keep working. When you
-    switch to the single script, remove the old files and the lines which load
-    them from your shell configuration.
-
 For more information, visit the official [Click Docs](https://click.palletsprojects.com/en/stable/shell-completion/#enabling-completion).
+
+

docs/development.md

@@ -0,0 +1,27 @@
+# Development
+
+The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
+
+## Testing
+
+MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `flake8`, `ruff` and `black`. All can
+be run automatically with:
+
+```bash
+make check
+```
+
+Run these tests before making new commits or opening pull requests.
+
+## Profiling
+
+Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
+take to avoid inefficient code paths as we add new modules.
+
+MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
+
+```bash
+MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
+```
+
+Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/development/custom_commands.md

@@ -1,202 +0,0 @@
-# Custom CLI Commands
-
-MVT can load additional top-level commands into `mvt`, `mvt-ios` and
-`mvt-android`. A command package chooses which of the three each of its
-commands is added to.
-Custom commands are different from [custom forensic modules](index.md#custom-modules):
-commands add new CLI operations, while modules add analysis steps to existing
-`check-*` commands.
-
-!!! warning
-
-    Custom commands run as trusted Python code inside the MVT process. Install
-    or load commands only from sources you trust. MVT does not sandbox
-    third-party commands, and the MVT maintainers do not maintain them.
-
-## Install a Command Package
-
-Python packages can register a Click command or group on one or more of the MVT CLIs.
-A minimal package can expose this command from `my_mvt_plugin.py`:
-
-```python
-import click
-
-
-@click.command()
-@click.argument("path", type=click.Path(exists=True))
-def summarize(path):
-    """Summarize an acquisition."""
-    click.echo(f"Summarizing {path}")
-```
-
-Log through `get_plugin_logger(__name__)` from `mvt.plugin`. Records logged
-through `logging.getLogger(__name__)` do not reach `command.log`, and MVT's
-console handler does not show them.
-
-Register the object in the package's `pyproject.toml`. The entry-point name is
-the command users invoke:
-
-```toml
-[project.entry-points."mvt.ios.cli_plugins"]
-summarize = "my_mvt_plugin:summarize"
-
-[project.entry-points."mvt.android.cli_plugins"]
-summarize = "my_mvt_plugin:summarize"
-```
-
-Each entry-point group adds the command to one CLI: `mvt.ios.cli_plugins` to
-`mvt-ios`, `mvt.android.cli_plugins` to `mvt-android` and `mvt.cli_plugins` to
-`mvt`. Register the command in the group of every CLI which should offer it: a
-platform-specific command belongs in one platform group, and a command which
-handles acquisitions of both platforms, as above, in both. After installing the
-package in the same environment as MVT, the command appears directly in those
-CLIs:
-
-```bash
-mvt-ios summarize ./ios-backup
-mvt-android summarize ./androidqf-output
-```
-
-For a `pipx` installation of MVT, inject the plugin into MVT's environment:
-
-```bash
-pipx inject mvt my-mvt-plugin
-```
-
-When MVT is installed in an active virtual environment, install the plugin with
-`pip` in that environment. `mvt plugins list` shows the installed packages and
-the commands they add, see [Managing Plugins](plugins.md).
-
-Command packages that need their own settings, such as an API key, should store
-them in a namespaced [plugin configuration file](plugin_configuration.md)
-rather than in MVT's own `config.yaml`.
-
-### Commands on `mvt`
-
-A MVT plugin command can also add sub-commands to the base `mvt` command. This can be used for commands which are not tied to a particular forensic platform:
-
-```toml
-[project.entry-points."mvt.cli_plugins"]
-my-plugin = "my_mvt_plugin:my_plugin"
-```
-
-Commands in this group are added to `mvt` only, so this one is invoked as
-`mvt my-plugin`. A command on `mvt` has nothing but its name to say which
-plugin it belongs to, so name it after the plugin, and make it a Click group
-when the plugin has several operations to offer, such as
-`mvt my-plugin configure`.
-
-## Developing a Command Locally
-
-A package is how a command is distributed. While a command is being written,
-MVT can load it straight from its file instead, so the package need not be
-reinstalled after every change; an editable install of the package does the
-same through its entry points. Create a Python file that exports one Click
-command or group named `cli`:
-
-```python
-import click
-
-
-@click.command("case-summary")
-@click.argument("path", type=click.Path(exists=True))
-def cli(path):
-    """Summarize a case directory."""
-    click.echo(f"Summarizing {path}")
-```
-
-Pass the file before the custom command name:
-
-```bash
-mvt-ios --load-command ./case_summary.py case-summary ./ios-backup
-```
-
-`--load-command` can be repeated and also accepts a folder. MVT loads
-non-hidden top-level `*.py` files in sorted order and skips `__init__.py`.
-Every loaded file must export one `cli` object.
-
-To load a file or folder on every invocation, set the environment variable of
-the CLI the commands belong on. Like the entry-point groups, each variable adds
-its commands to one CLI only:
-
-```bash
-export MVT_CUSTOM_COMMANDS=./commands
-export MVT_IOS_CUSTOM_COMMANDS=./ios_commands
-export MVT_ANDROID_CUSTOM_COMMANDS=./android_commands
-```
-
-## Building a Module-Running Command
-
-A command which runs forensic modules over an acquisition subclasses `Command`.
-`Command` creates the output folder and writes `command.log`. It orders the
-modules, resolves their dependencies and runs them. It writes the result files,
-`alerts.json` and `info.json`. The subclass sets `platform`, `name` and
-`modules`:
-
-```python
-from mvt.plugin import Command, MVTModule, convert_unix_to_iso, get_plugin_logger
-
-log = get_plugin_logger(__name__)
-
-
-class APKManifest(MVTModule):
-    supported_commands = (("android", "check-apks"),)
-
-    def run(self):
-        self.results = [{"checked_at": convert_unix_to_iso(0)}]
-
-
-class CmdCheckAPKs(Command):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.platform = "android"
-        self.name = "check-apks"
-        self.modules = [APKManifest]
-```
-
-`platform` and `name` are the pair the modules declare in
-`supported_commands`. `modules` lists the module classes the command runs,
-imported directly. A command which runs modules of another plugin depends on
-that package in `pyproject.toml` and imports them the same way. `init()`,
-`module_init(module)` and `finish()` are optional hooks. `run()` calls them
-before the run, before each module and after the run.
-
-Wrap the command in a Click command with an `--output` option. Run it, then
-print the alert summary:
-
-```python
-import click
-
-
-@click.command("check-apks")
-@click.option("--output", "-o", type=click.Path(exists=False))
-@click.argument("TARGET_PATH", type=click.Path(exists=True))
-def cli(output, target_path):
-    cmd = CmdCheckAPKs(target_path=target_path, results_path=output)
-    log.info("Checking APK files at path: %s", target_path)
-    cmd.run()
-    cmd.show_alerts_brief()
-```
-
-The `--verbose` option of `mvt`, `mvt-ios` and `mvt-android` applies to the
-command. The command defines no `--verbose` option of its own. The pair a
-plugin command adds is not listed anywhere in MVT. Name it in the plugin's
-README.
-
-## Naming and Errors
-
-Built-in MVT commands cannot be replaced. External command names must also be
-unique on each CLI; when installed packages or environment paths collide, MVT
-keeps the first command and logs a warning. The environment path of a CLI is
-registered before its installed packages, so a command loaded from there wins a
-collision with a package. A collision from an explicit `--load-command` is a
-usage error.
-
-A package entry point or environment command that cannot be imported appears
-as a marked broken command without preventing other MVT commands from working.
-Invoke that command to see its package or file source and the underlying error.
-An invalid command supplied explicitly with `--load-command` fails immediately
-with a usage error.
-
-Installed command packages use the entry-point name as the CLI command name.
-The entry point must resolve to a `click.Command` or `click.Group`.

docs/development/index.md

@@ -1,391 +0,0 @@
-# Development
-
-The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
-
-## Local environment
-
-MVT uses `uv` for dependency management. To install the project and development dependencies from the locked environment, run:
-
-```bash
-make install
-```
-
-## Testing
-
-MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `ruff` and `mypy`. All can
-be run automatically with:
-
-```bash
-make check
-```
-
-Run these tests before making new commits or opening pull requests.
-
-## Module dependencies
-
-Modules can require other modules to run first by declaring their classes in
-`dependencies`. The command runner uses a stable topological ordering, so the
-existing module list order is preserved wherever dependency constraints allow.
-
-```python
-class DependentModule(MVTModule):
-    dependencies = (PrerequisiteModule,)
-
-    def run(self):
-        prerequisite_results = self.get_dependency_results(PrerequisiteModule)
-```
-
-Selecting a single module also runs its transitive dependencies.
-
-A module can only depend on modules the command it runs in also has. When a
-declared dependency is not among them, the command logs a warning naming the
-module and the missing dependency, skips that module and everything depending
-on it, and runs the rest of the analysis. Selecting such a module with
-`--module` therefore leaves nothing to run, which the warning explains.
-
-A cycle in the dependency graph is a programming error rather than a
-configuration problem: the command logs a warning and runs no modules at all.
-
-## Custom modules
-
-MVT's module-running `check-*` commands can run forensic modules which are not
-part of MVT. Custom modules are distributed as plugin packages. A Python
-package installed next to MVT registers its modules through an entry point.
-The modules then load automatically in every command they support, see
-[Installed module packages](#installed-module-packages). `mvt plugins list`
-shows the installed packages and where each one was installed from.
-
-MVT can also load module files by path, with `--load-module` and
-`MVT_CUSTOM_MODULES`, see
-[Developing modules locally](#developing-modules-locally). This can be used
-while writing a module. Use a Python package to distribute one.
-
-A custom module declares in `supported_commands` the platform and command
-pairs it runs in. A module with empty `supported_commands` does not run and
-MVT logs a warning. The nine pairs are:
-
-```python
-("ios", "check-backup")
-("ios", "check-fs")
-("ios", "check-iocs")
-("ios", "check-sysdiagnose")
-("android", "check-backup")
-("android", "check-bugreport")
-("android", "check-androidqf")
-("android", "check-intrusion-logs")
-("android", "check-iocs")
-```
-
-`check-iocs` re-checks stored results rather than an acquisition. It matches
-every `<slug>.json` file in the results folder to the module with that slug.
-It then runs that module's `check_indicators()` again. A module which
-implements `check_indicators()` is included in `check-iocs` for its platform.
-It does not need to declare the `check-iocs` pair.
-
-### Writing a module
-
-A module subclasses `MVTModule` or one of the base classes below and
-implements `run()`. `check_indicators()` and `serialize()` are optional. The
-first matches results against IOCs or detections. The second returns timeline
-records.
-
-```python
-from mvt.plugin import IOSExtraction, convert_unix_to_iso
-
-
-class ExampleCustomModule(IOSExtraction):
-    supported_commands = (
-        ("ios", "check-backup"),
-        ("ios", "check-fs"),
-    )
-    slug = "example_custom_module"
-
-    def run(self):
-        self.results = [{"checked_at": convert_unix_to_iso(0)}]
-
-    def check_indicators(self):
-        pass
-
-    def serialize(self, result):
-        return None
-```
-
-The base classes are:
-
-- `MVTModule`: the base of every module. It provides `self.results`,
-  `self.alertstore`, `self.log`, `self.indicators` and
-  `get_dependency_results()`. Subclass it directly for a module which reads
-  only the results of other modules.
-- `IOSExtraction`: `("ios", "check-backup")` and `("ios", "check-fs")`. Adds
-  `_find_ios_database()`, which locates a module's database in a backup or in
-  a filesystem dump and repairs it if it is malformed. Adds
-  `_get_backup_files_from_manifest()`, `_get_backup_file_from_id()` and
-  `_get_fs_files_from_patterns()`. Adds `_open_sqlite_db()`, which opens a
-  database read-only.
-- `SysdiagnoseExtraction`: `("ios", "check-sysdiagnose")`. MVT extracts the
-  archive and calls `from_sysdiagnose_folder()` before `run()`. The module
-  reads files with `_get_files_by_pattern()` and `_get_file_content()`.
-  `ips_files` lists the crash reports. See
-  [Check an iOS Sysdiagnose](../ios/sysdiagnose.md).
-- `AndroidQFModule`: `("android", "check-androidqf")`. MVT calls `from_dir()`
-  or `from_zip()` with the file list of the acquisition. The module reads
-  files with `_get_files_by_pattern()` and `_get_file_content()`.
-  `_get_device_timezone()` returns the device timezone.
-- `AndroidBackupModule`: `("android", "check-backup")`. MVT calls `from_dir()`
-  or `from_ab()`. The module reads files with `_get_files_by_pattern()` and
-  `_get_file_content()`.
-- `BugReportModule`: `("android", "check-bugreport")`. MVT calls `from_dir()`
-  or `from_zip()`. The module reads files with `_get_files_by_pattern()`,
-  `_get_files_by_patterns()` and `_get_file_content()`.
-  `_get_dumpstate_file()` returns the dumpstate file, and
-  `_get_file_modification_time()` the modification time of a file.
-
-The underscore-named helpers are internal to the base classes. Plugin modules
-can call them. Their names and signatures can change between releases. Read
-the base class in `src/mvt/ios/modules` or `src/mvt/android/modules` before
-relying on one.
-
-### Depending on a built-in module
-
-A module which post-processes records generated by one or more built-in MVT
-modules must declare the source modules in `dependencies`. It reads their
-results with `get_dependency_results()`. Import the class from its family
-package: `mvt.ios.modules.backup`, `mvt.ios.modules.fs`,
-`mvt.ios.modules.mixed`, `mvt.android.modules.androidqf`,
-`mvt.android.modules.backup`, `mvt.android.modules.bugreport` or
-`mvt.android.modules.intrusion_logs`.
-
-```python
-from mvt.ios.modules.backup import Manifest
-from mvt.plugin import MVTModule
-
-
-class DependentCustomModule(MVTModule):
-    supported_commands = (("ios", "check-backup"),)
-    dependencies = (Manifest,)
-
-    def run(self):
-        manifest_results = self.get_dependency_results(Manifest)
-        self.results = [{"manifest_entries": len(manifest_results)}]
-```
-
-Dependencies are ordered as for the built-in modules, with custom modules
-appended after the built-ins, see [Module dependencies](#module-dependencies).
-A dependency has to run in every command the module supports. Where it does
-not, MVT skips the module with a warning.
-
-`get_dependency_results()` returns the plain dictionaries the module produced.
-They are the same records it writes to `<slug>.json`. Typed results per module
-are planned.
-
-### Replacing a built-in module
-
-A custom module which extends a built-in one runs alongside it, and when the
-two share a slug they write to the same results file. MVT warns about that
-collision, naming both modules, where each came from and the file the later one
-overwrites, but it runs them both. Set `replaces` to the class the module
-supersedes to take that module's place instead: when both are available to a
-command, the named module is dropped from the run.
-
-```python
-from mvt.ios.modules.backup import Manifest as BuiltinManifest
-
-
-class Manifest(BuiltinManifest):
-    supported_commands = (("ios", "check-backup"),)
-    replaces = BuiltinManifest
-```
-
-Keeping the class name of the replaced module, as above, keeps the name
-`--module` selects the module by and the slug its results file is named after.
-A replacement with a different class name writes to a file named after its own
-slug, unless it sets `slug` to the slug of the module it replaces, and
-`--module` still selects it by the name of the replaced module, which MVT logs.
-Taking over the slug of a replaced module is not a collision and is not warned
-about, because that module is no longer part of the run.
-
-Modules which depend on the replaced module receive the replacement instead, so
-`get_dependency_results(BuiltinManifest)` returns the replacement's results. A
-module must not depend on the module it replaces: that module does not run, so
-the replacement has to produce the data itself, and MVT logs a warning when a
-module declares both.
-
-A replacement takes on the obligations of the module it replaces. If it
-declares a dependency the command does not provide, it is skipped like any
-other module with an unavailable dependency, and the module it replaced stays
-out of the run: neither of them produces results, and the modules depending on
-the replaced module are skipped as well.
-
-Subclassing the replaced module is not required, but a replacement which is not
-a subclass is logged with a warning, because its results may not be what the
-modules depending on the replaced module expect. Naming a module the command
-does not run has no effect, and modules which replace each other in a cycle all
-keep running and replace nothing. Every applied substitution is logged, so it
-is recorded in `command.log` when the command runs with an `--output` folder.
-
-Every command resolves replacements on its own. `check-iocs` matches stored
-results files against the slugs of the modules available for that command. A
-replacement which subclasses the module it replaces inherits its
-`check_indicators()`. It is then part of `check-iocs` for its platform and
-re-checks the results file named after its slug. A replacement with no
-`check_indicators()` is not part of `check-iocs`. The built-in module it
-replaced re-checks the file. `check-iocs` matches `--module` on the class name
-only. Pass a differently named replacement's own name there, not the name of
-the module it replaces.
-
-### Importing from MVT
-
-Import from `mvt.plugin` if it has what you need. The names it exports are
-kept working on a best-effort basis. A change to one of them is announced in
-the release notes. Anything else in `mvt` can be imported too, but may change
-between releases without notice. The plugin interface is best effort.
-
-`mvt.plugin` exports the base classes above and `Command`, `Alert` and
-`AlertLevel`, the result types, `DatabaseNotFoundError` and
-`DatabaseCorruptedError`, the timestamp converters, the settings API of
-[Plugin Configuration](plugin_configuration.md), MVT's own `settings`,
-`get_plugin_logger()` and `MVT_VERSION`. `src/mvt/plugin.py` holds the list.
-Read MVT's `settings` for values such as `NETWORK_ACCESS_ALLOWED` and
-`NETWORK_TIMEOUT`. Plugin values go in the plugin's own settings file.
-
-## Installed module packages
-
-Python packages can register modules so they load automatically in every
-module-running `check-*` command, without `--load-module` or
-`MVT_CUSTOM_MODULES`. Register an entry point in the `mvt.modules` group in
-the package's `pyproject.toml`:
-
-```toml
-[project.entry-points."mvt.modules"]
-mvt-plugin-example-org = "mvt_plugin_example_org:get_modules"
-```
-
-The entry point must resolve to an iterable of `MVTModule` subclasses, or to
-a callable returning one:
-
-```python
-from mvt.plugin import MVTModule
-
-
-class PackagedModule(MVTModule):
-    supported_commands = (("ios", "check-backup"),)
-
-    def run(self):
-        self.results = [{"message": "packaged module ran"}]
-
-
-def get_modules() -> list[type[MVTModule]]:
-    return [PackagedModule]
-```
-
-`get_modules()` is the package's module list, written by hand. A package which
-keeps its modules in separate files imports each class there and lists it. A
-module missing from the list does not load.
-
-Installed modules follow the same rules as other custom modules: each module
-must declare `supported_commands`, and dependencies are resolved with the
-standard ordering logic. A broken entry point is skipped with a warning and
-does not prevent MVT from running. As with custom commands, installed module
-packages run as trusted code inside the MVT process, so install only packages
-from sources you trust.
-
-For a `pipx` installation of MVT, inject the package into MVT's environment:
-
-```bash
-pipx inject mvt mvt-plugin-example-org
-```
-
-Module packages that need their own settings, such as an API key, should store
-them in a namespaced [plugin configuration file](plugin_configuration.md)
-rather than in MVT's own `config.yaml`.
-
-### Naming module packages
-
-Name module packages `mvt-plugin-<name>` (import package `mvt_plugin_<name>`),
-and include the name of the publishing organization or author so packages from
-different groups do not collide: for example, an organisation's custom modules
-would be distributed as `mvt-plugin-example-org` with the import package
-`mvt_plugin_example_org`.
-
-The prefix makes module packages easy to find on PyPI and keeps their import
-names from clashing with unrelated Python packages. It is a convention, not a
-technical requirement: modules load through the `mvt.modules` entry point
-regardless of what the package is called, and existing packages with other
-names keep working. Note that the prefix is also not a mark of authenticity —
-anyone can publish a package with any available name, so vet a module package
-and its publisher before installing it, whatever it is called.
-
-### Module logging
-
-Modules log through `self.log`, and MVT names the logger for where the module
-came from. MVT's own modules log under their dotted path (for example
-`mvt.ios.modules.mixed.whatsapp`). Everything external is namespaced under
-`mvt.ext` to keep it visually distinct from built-in modules and isolated from
-MVT's internal logger tree:
-
-- Installed packages log under `mvt.ext.<package>`, with the `mvt_plugin_`
-  prefix stripped: modules in `mvt_plugin_example_org` log as
-  `mvt.ext.example_org.*`.
-- Files loaded with `--load-module` or `MVT_CUSTOM_MODULES` log as
-  `mvt.ext.<file name>`.
-
-Outside a module class, for example in a custom command line handler, log
-through `get_plugin_logger(__name__)`. It returns a logger in the same
-namespace.
-
-## Developing modules locally
-
-While a module is being written, load it from its file. `--load-module` takes a
-Python file, or a folder of them, on every module-running command, and can be
-repeated:
-
-```bash
-mvt-ios check-backup --load-module ./example_module.py --output ./out ./backup
-```
-
-For a folder, MVT loads its non-hidden top-level `*.py` files in sorted order
-and skips `__init__.py`. `MVT_CUSTOM_MODULES` names a folder to load on every
-module-running command, before any `--load-module` path:
-
-```bash
-MVT_CUSTOM_MODULES=./custom_modules mvt-android check-bugreport ./bugreport.zip
-```
-
-Files loaded this way follow the same rules as packaged modules.
-`--list-modules` reports them with the SHA-256 hash of the file in place of a
-version. An editable install of the package (`pip install -e .`) also works:
-the modules load through the entry point, and `mvt plugins list` shows the
-package with the `local` origin.
-
-Loading by path is for development. Move a module into a package once it
-works.
-
-## Auditing loaded modules
-
-Because installed module packages load automatically, MVT records where every
-module came from:
-
-- `--list-modules` groups the available modules by source: MVT itself
-  (with its version), each installed package (with its version and, when
-  installed directly from a repository, the commit), and each file loaded
-  with `--load-module` or `MVT_CUSTOM_MODULES` (with the SHA-256 hash of the
-  file).
-- When a command runs with an `--output` folder, the `command.log` file
-  records one line per module source with the source's version or hash and
-  the list of modules loaded from it.
-- `mvt plugins list` lists the installed packages, where each of them
-  was installed from and how many modules it contributes, see
-  [Managing Plugins](plugins.md).
-
-## Profiling
-
-Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
-take to avoid inefficient code paths as we add new modules.
-
-MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
-
-```bash
-MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
-```
-
-Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/development/plugin_configuration.md

@@ -1,157 +0,0 @@
-# Plugin Configuration
-
-Plugin packages that add [custom CLI commands](custom_commands.md) or
-[modules](index.md#installed-module-packages) often need to store their
-own settings, such as an API key, a server URL or the timestamp of the last
-synchronization. MVT provides a namespaced settings base class so each plugin
-keeps its configuration in its own file, and a data folder for anything else a
-plugin needs to keep on disk.
-
-!!! warning
-
-    Do not write plugin settings to MVT's own `config.yaml`. MVT rewrites that
-    file with the settings it knows about every time it starts, so any other
-    section is deleted.
-
-## Where Settings Are Stored
-
-Each plugin gets one YAML file in a `plugins` folder next to MVT's own
-configuration:
-
-```
-~/.config/mvt/plugins/<plugin name>.yaml
-```
-
-The exact parent folder follows the platform convention used for MVT's
-`config.yaml` (for example `~/Library/Application Support/mvt` on macOS). Use
-`plugin_config_path()` from `mvt.plugin` instead of building the path by hand.
-
-Plugin names must be lowercase and may only contain letters, digits and dashes,
-matching the `mvt-plugin-<name>` package naming convention. MVT creates the
-`plugins` folder with `0700` permissions and writes the settings files with
-`0600` permissions, because they commonly hold credentials. Files are written
-through a temporary file and moved into place, so an interrupted save never
-leaves a partially written settings file behind.
-
-## Plugin Data Folder
-
-Everything else a plugin keeps on disk, such as a cache, a downloaded artifact
-or synchronization state, belongs in the folder returned by the `data_folder()`
-class method of the plugin's settings class, or by `plugin_data_folder()` from
-`mvt.plugin`, called with the plugin name if the plugin has no settings class:
-
-```
-~/.local/share/mvt/plugin-data/<plugin name>/                # Linux
-~/Library/Application Support/mvt/plugin-data/<plugin name>/ # macOS
-```
-
-The folder sits beside MVT's own data, such as the downloaded indicators. It is
-created if it is missing, with `0700` permissions. Asking for it again returns
-the same path and leaves the contents alone, so a plugin can ask for it every
-time it needs the folder. `ExamplePluginSettings` below is the settings class
-defined in the next section:
-
-```python
-import os
-
-
-def cache_path() -> str:
-    folder = ExamplePluginSettings.data_folder()
-    return os.path.join(folder, "virustotal_lookups_cache.json")
-```
-
-A plugin which has no settings class calls
-`plugin_data_folder("example-plugin")` instead.
-
-Do not fall back on a path of your own such as `~/.cache/example-plugin`: it
-is a Linux-only convention, and MVT will not create it for you.
-
-## Defining Plugin Settings
-
-Subclass `MVTPluginSettings`, set `plugin_name` and declare typed fields with
-defaults:
-
-```python
-from typing import Optional
-
-from mvt.plugin import MVTPluginSettings
-
-
-class ExamplePluginSettings(MVTPluginSettings):
-    plugin_name = "example-plugin"
-
-    API_KEY: Optional[str] = None
-    MAX_RESULTS: int = 25
-    LAST_SYNC: Optional[str] = None
-```
-
-`load()` returns the current settings and `save()` writes them back:
-
-```python
-from datetime import datetime, timezone
-
-import click
-
-from mvt.plugin import plugin_env_prefix
-
-
-def sync():
-    settings = ExamplePluginSettings.load()
-    if not settings.API_KEY:
-        prefix = plugin_env_prefix(settings.plugin_name)
-        raise click.ClickException(
-            f"No API key configured. Set {prefix}API_KEY or "
-            "run 'example-plugin configure'."
-        )
-
-    settings.LAST_SYNC = datetime.now(timezone.utc).isoformat()
-    settings.save()
-```
-
-The message builds the variable name with `plugin_env_prefix()`, see
-[Environment Variables](#environment-variables).
-
-A missing settings file is not an error: the plugin then runs on the field
-defaults and on whatever the environment provides. `save()` only persists the
-values that differ from the defaults, and it never touches MVT's `config.yaml`.
-A settings file that cannot be parsed, or that does not hold a mapping of
-setting names to values, raises a `PluginConfigLoadError` naming the file.
-
-Every subclass that sets its own `plugin_name` gets its own file and its own
-environment namespace. A subclass that does not redefine `plugin_name` inherits
-it, and therefore shares the file and the environment variables of its parent
-class.
-
-## Environment Variables
-
-Every field can also be set with an environment variable. The prefix is
-`MVT_PLUGIN_`, followed by the plugin name upper-cased with dashes replaced by
-underscores, followed by the field name. For the example above:
-
-```bash
-export MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY=...
-export MVT_PLUGIN_EXAMPLE_PLUGIN_MAX_RESULTS=50
-```
-
-Do not repeat the plugin name in a field name: a plugin named `example-scanner`
-with a `SCANNER_API_KEY` field asks the user for
-`MVT_PLUGIN_EXAMPLE_SCANNER_SCANNER_API_KEY`. Name the field `API_KEY`.
-
-Settings resolve in this order, from highest to lowest priority:
-
-1. Arguments passed to the settings class directly, such as
-   `ExamplePluginSettings(API_KEY="...")`
-2. Environment variables
-3. The plugin's YAML file
-4. The field defaults declared on the settings class
-
-!!! tip
-
-    On shared or multi-user machines, prefer passing API keys through
-    environment variables rather than saving them to the plugin file. `save()`
-    skips every value that the environment currently supplies, so a credential
-    provided that way is not copied into the settings file when a plugin saves
-    an unrelated setting.
-
-Unknown keys in a plugin's YAML file are ignored, so a settings file written by
-a newer version of a plugin does not break an older one.

docs/development/plugins.md

@@ -1,116 +0,0 @@
-# Managing Plugins
-
-Plugin packages extend MVT with additional
-[forensic modules](index.md#custom-modules) and
-[CLI commands](custom_commands.md). Because installed packages load
-automatically, `mvt plugins` audits what is installed and checks whether
-updates are available. The command lives on `mvt` only, although the packages
-it lists extend `mvt-ios` and `mvt-android` too.
-
-## List Installed Plugins
-
-```bash
-mvt plugins list
-```
-
-```
-                        Installed MVT plugins
-┏━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━┓
-┃ Name                ┃ Version ┃ Origin       ┃ Modules ┃ Commands  ┃
-┡━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━┩
-│ mvt-plugin-example  │ 1.2.0   │ pypi         │       4 │ summarize │
-│ mvt-plugin-research │ 0.1.0   │ git+3f9a1c7d │       2 │ -         │
-│ mvt-plugin-local    │ 0.0.1   │ local        │       1 │ triage    │
-└─────────────────────┴─────────┴──────────────┴─────────┴───────────┘
-```
-
-The origin records where each package was installed from: `pypi` for a package
-installed from a package index, `git+<commit>` for a package installed directly
-from a repository, and `local` for a package installed from a local folder or
-archive rather than from an index, including an editable development install.
-The last two columns show how many forensic modules the package contributes and
-which CLI commands it adds.
-
-A plugin whose modules cannot be imported is listed with `error` in the
-`Modules` column rather than breaking the listing.
-
-## Check for Updates
-
-```bash
-mvt plugins check-updates
-```
-
-```
-Plugin updates available:
-  mvt-plugin-example  1.2.0 → 1.3.0
-    Upgrade with: pip install -U mvt-plugin-example
-
-MVT does not install plugin updates. Run the command above when you decide to
-upgrade.
-```
-
-Packages installed from a package index are compared against the latest release
-published for them. A package which was never published, for example a plugin
-distributed only within an organization, is skipped silently.
-
-!!! note
-
-    Packages shown with the `pypi` origin are compared against
-    [PyPI](https://pypi.org), whichever index they were installed from. A
-    plugin installed from a private index under a name which also exists on
-    PyPI is therefore compared against the unrelated public package of that
-    name. Give plugins published to a private index a name which is not taken
-    on PyPI, and treat an unexpected update suggestion as a reason to check
-    where the package would come from.
-
-!!! warning
-
-    MVT never installs or upgrades a plugin itself, it only prints the command
-    which does. Upgrading a plugin in the middle of an investigation changes
-    the modules producing the results, and a plugin runs as trusted code inside
-    the MVT process, so pulling in a new version is a decision for the analyst
-    to make deliberately and not a side effect of running a check.
-
-## Automatic Update Checks
-
-MVT also reports available plugin updates in the banner printed when a command
-starts:
-
-```
-        MVT - Mobile Verification Toolkit
-
-        https://mvt.re
-        Version: 2026.7.29
-
-        Plugin updates available:
-          mvt-plugin-example  1.2.0 → 1.3.0   (pip install -U mvt-plugin-example)
-```
-
-This check runs at most once every 12 hours. In between checks MVT prints the
-findings of the latest check without contacting anything, so a plugin update
-stays visible without a lookup on every command. The
-`mvt plugins check-updates` command checks immediately, regardless of when the
-last check happened.
-
-The automatic check is skipped when the `--disable-update-check` option is
-used, when `NETWORK_ACCESS_ALLOWED` is disabled in the MVT configuration, and
-when no plugins are installed.
-
-## Plugins Installed From a Repository
-
-A plugin installed with `pip install "mvt-plugin-example @ git+<url>"` is
-checked by asking the remote repository which commit the installed revision
-points at now. MVT runs git and ssh in batch mode, so a repository which needs
-credentials MVT does not already have fails the check instead of prompting for
-them. The check is skipped silently when git is not available, when the
-repository cannot be reached, and when access to it is denied.
-
-How the plugin was installed decides what an update means:
-
-- A plugin installed from a branch is reported as outdated when the branch has
-  moved past the installed commit.
-- A plugin installed from a specific commit or a tag is pinned. It is never
-  reported as outdated, however far the branch it came from moves on.
-
-Pinning a plugin to a commit or a tag is therefore the way to keep the modules
-used across an investigation stable.

docs/docker.md

@@ -31,18 +31,4 @@ Test if the image was created successfully:
 docker run -it mvt
 ```
 
-If a prompt is spawned successfully, you can close it with `exit`.
-
-## Access an iOS device from Docker
-
-On the Linux host, install and start [usbmuxd](https://github.com/libimobiledevice/usbmuxd), then connect and unlock the iOS device. The daemon exposes the device through the `/var/run/usbmuxd` socket.
-
-Bind that socket into the container to let MVT communicate with the device:
-
-```bash
-docker run -it \
-    --mount type=bind,source=/var/run/usbmuxd,target=/var/run/usbmuxd \
-    ghcr.io/mvt-project/mvt
-```
-
-If you built the image from source, replace `ghcr.io/mvt-project/mvt` with `mvt`. 
+If a prompt is spawned successfully, you can close it with `exit`.

docs/index.md

@@ -9,7 +9,7 @@ Mobile Verification Toolkit (MVT) is a tool to facilitate the [consensual forens
 It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
 
 
-In this documentation you will find instructions on how to install and run the `mvt-ios`, `mvt-android` and `mvt` commands, and guidance on how to interpret the extracted results.
+In this documentation you will find instructions on how to install and run the `mvt-ios` and `mvt-android` commands, and guidance on how to interpret the extracted results.
 
 ## Resources
 

docs/install.md

@@ -64,7 +64,7 @@ It is recommended to try installing and running MVT from [Windows Subsystem Linu
    pipx install mvt
    ```
 
-You now should have the `mvt`, `mvt-ios` and `mvt-android` utilities installed. If you run into problems with these commands not being found, ensure you have run `pipx ensurepath` and opened a new terminal window.
+You now should have the `mvt-ios` and `mvt-android` utilities installed. If you run into problems with these commands not being found, ensure you have run `pipx ensurepath` and opened a new terminal window.
 
 ### Installing from PyPI directly into a virtual environment
 You can use `pipenv`, `poetry` etc. for your virtual environment, but the provided example is with the built-in `venv` tool:
@@ -84,7 +84,7 @@ source env/bin/activate
 pip install mvt
 ```
 
-The `mvt`, `mvt-ios` and `mvt-android` utilities should now be available as commands whenever the virtual environment is active.
+The `mvt-ios` and `mvt-android` utilities should now be available as commands whenever the virtual environment is active.
 
 ### Installing from git source with pipx
 If you want to have the latest features in development, you can install MVT directly from the source code in git.
@@ -93,7 +93,7 @@ If you want to have the latest features in development, you can install MVT dire
 pipx install --force git+https://github.com/mvt-project/mvt.git
 ```
 
-You now should have the `mvt`, `mvt-ios` and `mvt-android` utilities installed.
+You now should have the `mvt-ios` and `mvt-android` utilities installed.
 
 **Notes:**
 1. The `--force` flag is necessary to force the reinstallation of the package.

docs/iocs.md

@@ -34,27 +34,6 @@ It is also possible to load STIX2 files automatically from the environment varia
 export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 ```
 
-## Network Access
-
-When checking URL indicators, MVT follows recognized shortened URLs with an
-HTTP `HEAD` request. URL checks are deduplicated and run concurrently, with at
-most 20 requests in progress at a time. Redirects within an individual URL
-chain are still followed sequentially. The following environment variables
-control these requests:
-
-- `MVT_NETWORK_ACCESS_ALLOWED` enables or disables network requests. It defaults
-  to `true`. Set it to `false` to prevent MVT from attempting to resolve
-  shortened URLs.
-- `MVT_NETWORK_TIMEOUT` sets the request timeout in seconds. It defaults to
-  `15`.
-
-For example, to run IOC checks without resolving shortened URLs:
-
-```bash
-MVT_NETWORK_ACCESS_ALLOWED=false mvt-ios check-iocs \
-    --iocs ~/iocs/malware.stix2 /path/to/iphone/output/
-```
-
 ## STIX2 Support
 
 So far MVT implements only a subset of [STIX2 specifications](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html):
@@ -71,7 +50,9 @@ So far MVT implements only a subset of [STIX2 specifications](https://docs.oasis
 - [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/generated/stalkerware.stix2).
 - We are also maintaining [a list of IOCs](https://github.com/mvt-project/mvt-indicators) in STIX format from public spyware campaigns.
 
-You can automatically download the latest public indicator files with the command `mvt download-iocs`. The per-platform forms `mvt-ios download-iocs` and `mvt-android download-iocs` do the same thing. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
+You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.
 
+
+

docs/ios/records.md

@@ -312,15 +312,6 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
-### `urls.json`
-
-This JSON file collects URLs extracted from SMS, iMessage, and WhatsApp
-messages. Each entry contains the original URL, its expanded destination when
-MVT resolved a shortened URL during indicator checking, the message timestamp,
-and its `sms` or `whatsapp` source.
-
----
-
 ### `sms_attachments.json`
 
 !!! info "Availability"
@@ -417,21 +408,7 @@ If indicators are provided through the command-line, they are checked against th
     Backup: :material-check:
     Full filesystem dump: :material-check:
 
-This JSON file is created by mvt-ios' `WhatsApp` module. The module extracts a list of WhatsApp messages from the SQLite database located at *private/var/mobile/Containers/Shared/AppGroup/\*/ChatStorage.sqlite*, along with one record per chat session (marked with `"record_type": "chat_session"`) containing the first and last interaction dates of each conversation. Chat sessions produce `chat_first_message` and `chat_last_message` timeline events, and group chats additionally produce a `group_created` event. A chat session's last-message date can postdate its newest stored message when the most recent messages in the chat were deleted.
-
-Recent WhatsApp versions key 1:1 chat sessions by an opaque LID identifier rather than the contact's phone number. The module resolves these using the `ZWAPHONENUMBERLIDPAIR` table from the *LID.sqlite* database in the same app group (or from *ChatStorage.sqlite* itself in versions that store it there), populating `partner_resolved_phone_number` on chat session records and using the phone number in timeline events. Each LID-phone number pair is also extracted as a record (`"record_type": "lid_phone_number_pair"`) and produces a `lid_pair_recorded` timeline event marking when WhatsApp learned the association.
+This JSON file is created by mvt-ios' `WhatsApp` module. The module extracts a list of WhatsApp messages from the SQLite database located at *private/var/mobile/Containers/Shared/AppGroup/\*/ChatStorage.sqlite*.
 
 If indicators are provided through the command-line, they are checked against the extracted HTTP links. Any matches are stored in *whatsapp_detected.json*.
 
----
-
-### `whatsapp_contacts.json`
-
-!!! info "Availability"
-    Backup: :material-check:
-    Full filesystem dump: :material-check:
-
-This JSON file is created by mvt-ios' `WhatsappContacts` module. The module extracts WhatsApp contact records from the SQLite database located at *private/var/mobile/Containers/Shared/AppGroup/\*/ContactsV2.sqlite*, including each contact's phone number, WhatsApp and LID identifiers, and the per-contact disappearing messages timer, which is not recorded in *ChatStorage.sqlite*. Each timestamp stored on a contact record produces a timeline event: `disappearing_mode_set` (when the disappearing messages timer was last changed), `about_changed` (when the contact last changed their "about" text), `about_expiration` (when a timed "about" is scheduled to expire) and `contact_last_updated` (when the contact record was last updated).
-
-This database is often missing from incremental backups. When it cannot be found, the module logs a warning and produces no results, in which case the disappearing messages state of chats cannot be determined from the backup.
-

docs/ios/sysdiagnose.md

@@ -1,54 +0,0 @@
-# Check an iOS Sysdiagnose
-
-`mvt-ios check-sysdiagnose` prepares an iOS sysdiagnose archive for analysis by
-custom MVT modules. MVT does not include built-in sysdiagnose modules. The
-command runs the modules of the installed
-[plugin packages](../development/index.md#installed-module-packages) which
-declare support for it. Install at least one such package first.
-
-The command accepts either an extracted sysdiagnose directory or the original
-gzip-compressed tar archive.
-
-```bash
-mvt-ios check-sysdiagnose --output ./results \
-    ./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz
-```
-
-Use `--hashes` to include hashes for analyzed files in `info.json`, and
-`--list-modules` to display the eligible modules without running them.
-
-## Writing a custom module
-
-Extend `SysdiagnoseExtraction` from `mvt.plugin`, see
-[Writing a module](../development/index.md#writing-a-module). The module reads
-the archive the same way whether MVT was given a folder or a tar archive. It
-declares the command in `supported_commands`. While writing one,
-[load it from its file](../development/index.md#developing-modules-locally).
-
-```python
-from mvt.plugin import SysdiagnoseExtraction
-
-
-class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
-    supported_commands = (("ios", "check-sysdiagnose"),)
-    slug = "example_sysdiagnose"
-
-    def run(self):
-        paths = self._get_files_by_pattern("*/example.log")
-        if paths:
-            content = self._get_file_content(paths[0]).decode("utf-8", "replace")
-            self.results = [{"content": content}]
-
-    def check_indicators(self):
-        pass
-
-    def serialize(self, result):
-        return None
-```
-
-MVT extracts a tar archive first. It calls `from_sysdiagnose_folder()` on each
-module before `run()`. `ips_files` lists the IPS crash reports.
-
-`_get_files_by_pattern()` and `_get_file_content()` are internal helpers of the
-base class. Use them to read the archive. Their names and signatures can change
-between releases. See `src/mvt/ios/modules/sysdiagnose/base.py`.

docs/requirements.txt

@@ -0,0 +1,5 @@
+mkdocs==1.6.1
+mkdocs-autorefs==1.4.3
+mkdocs-material==9.6.20
+mkdocs-material-extensions==1.3.1
+mkdocstrings==1.0.0

mkdocs.yml

@@ -3,8 +3,6 @@ repo_url: https://github.com/mvt-project/mvt
 edit_uri: edit/main/docs/
 copyright: Copyright © 2021-2023 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
-not_in_nav: |
-    android/adb.md
 markdown_extensions:
     - attr_list
     - admonition
@@ -30,7 +28,6 @@ nav:
     - Welcome: "index.md"
     - Introduction: "introduction.md"
     - Installation: "install.md"
-    - Command Completion: "command_completion.md"
     - Using Docker: "docker.md"
     - MVT for iOS:
         - iOS Forensic Methodology: "ios/methodology.md"
@@ -42,16 +39,12 @@ nav:
         - Check a Filesystem Dump:
             - Dumping the filesystem: "ios/filesystem/dump.md"
             - Check a Filesystem Dump with mvt-ios: "ios/filesystem/check.md"
-        - Check a Sysdiagnose: "ios/sysdiagnose.md"
         - Records extracted by mvt-ios: "ios/records.md"
     - MVT for Android:
         - Android Forensic Methodology: "android/methodology.md"
+        - Check over ADB: "android/adb.md"
         - Check an Android Backup (SMS messages): "android/backup.md"
-        - Check Android Intrusion Logs: "android/intrusion_logs.md"
+        - Download APKs: "android/download_apks.md"
     - Indicators of Compromise: "iocs.md"
-    - Development:
-        - Development Instructions: "development/index.md"
-        - Custom CLI Commands: "development/custom_commands.md"
-        - Plugin Configuration: "development/plugin_configuration.md"
-        - Managing Plugins: "development/plugins.md"
+    - Development: "development.md"
     - License: "license.md"

pyproject.toml

@@ -17,25 +17,25 @@ classifiers = [
     "Programming Language :: Python",
 ]
 dependencies = [
-    "click==8.4.2",
-    "rich==15.0.0",
-    "tld==0.13.2",
-    "requests==2.34.2",
-    "simplejson==4.1.1",
-    "packaging==26.3",
+    "click==8.3.1",
+    "rich==14.1.0",
+    "tld==0.13.1",
+    "requests==2.33.0",
+    "simplejson==3.20.2",
+    "packaging==25.0",
     "appdirs==1.4.4",
     "iOSbackup==0.9.925",
     "adb-shell[usb]==0.4.4",
-    "libusb1==3.4.0",
-    "cryptography==50.0.0",
+    "libusb1==3.3.1",
+    "cryptography==46.0.6",
     "PyYAML>=6.0.2",
-    "pyahocorasick==2.3.1",
-    "betterproto2==0.10.0",
-    "pydantic==2.13.4",
-    "pydantic-settings==2.15.0",
+    "pyahocorasick==2.2.0",
+    "betterproto==1.2.5",
+    "pydantic==2.12.5",
+    "pydantic-settings==2.10.1",
     "NSKeyedUnArchiver==1.5.2",
     "python-dateutil==2.9.0.post0",
-    "tzdata==2026.3",
+    "tzdata==2025.2",
 ]
 requires-python = ">= 3.10"
 
@@ -44,9 +44,8 @@ homepage = "https://docs.mvt.re/en/latest/"
 repository = "https://github.com/mvt-project/mvt"
 
 [project.scripts]
-mvt = "mvt.cli:main"
-mvt-ios = "mvt.ios:main"
-mvt-android = "mvt.android:main"
+mvt-ios = "mvt.ios:cli"
+mvt-android = "mvt.android:cli"
 
 [dependency-groups]
 dev = [
@@ -58,17 +57,7 @@ dev = [
     "stix2>=3.0.1",
     "ruff>=0.1.6",
     "mypy>=1.7.1",
-    "betterproto2-compiler",
-    "types-PyYAML>=6.0.12.20250516",
-    "types-python-dateutil>=2.9.0.20250822",
-    "types-requests>=2.32.4.20250913",
-]
-docs = [
-    "mkdocs==1.6.1",
-    "mkdocs-autorefs==1.4.4",
-    "mkdocs-material==9.7.7",
-    "mkdocs-material-extensions==1.3.1",
-    "mkdocstrings==1.0.6",
+    "betterproto[compiler]",
 ]
 
 [build-system]
@@ -82,7 +71,8 @@ omit = ["tests/*"]
 directory = "htmlcov"
 
 [tool.mypy]
-install_types = false
+install_types = true
+non_interactive = true
 ignore_missing_imports = true
 packages = "src"
 

src/mvt/android/__init__.py

@@ -3,4 +3,4 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-from .cli import cli, main
+from .cli import cli

src/mvt/android/artifacts/dumpsys_accessibility.py

@@ -4,27 +4,22 @@
 #   https://license.mvt.re/1.1/
 
 import re
-from typing import Any
 
 from .artifact import AndroidArtifact
 
 
 class DumpsysAccessibilityArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                ioc_match = self.indicators.check_app_id(result["package_name"])
-                if ioc_match:
-                    self.alertstore.critical(
-                        ioc_match.message, "", result, matched_indicator=ioc_match.ioc
-                    )
-                    continue
+        if not self.indicators:
+            return
 
-            self.alertstore.medium(
-                f'Found accessibility service: "{result["component"]}"',
-                "",
-                result,
-            )
+        for result in self.results:
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+                continue
 
     def parse(self, content: str) -> None:
         """
@@ -34,69 +29,41 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
         :param content: content of the accessibility section (string)
         """
 
-        self.results: list[dict[str, Any]] = []
-        services: dict[tuple[int | None, str], dict] = {}
-        user_id: int | None = None
-        state: str | None = None
+        # "Old" syntax
+        in_services = False
+        for line in content.splitlines():
+            if line.strip().startswith("installed services:"):
+                in_services = True
+                continue
+
+            if not in_services:
+                continue
+
+            if line.strip() == "}":
+                # At end of installed services
+                break
+
+            service = line.split(":")[1].strip()
+
+            self.results.append(
+                {
+                    "package_name": service.split("/")[0],
+                    "service": service,
+                }
+            )
+
+        # "New" syntax - AOSP >= 14 (?)
+        # Looks like:
+        # Enabled services:{{com.azure.authenticator/com.microsoft.brooklyn.module.accessibility.BrooklynAccessibilityService}, {com.agilebits.onepassword/com.agilebits.onepassword.filling.accessibility.FillingAccessibilityService}}
 
         for line in content.splitlines():
-            user_match = re.search(r"attributes:\{id=(\d+)", line)
-            if user_match:
-                user_id = int(user_match.group(1))
+            if line.strip().startswith("Enabled services:"):
+                matches = re.finditer(r"{([^{]+?)}", line)
 
-            stripped = line.strip()
-            state_match = re.match(
-                r"(?i)(installed|enabled|binding|bound|crashed) services\s*:\s*\{(.*)",
-                stripped,
-            )
-            if state_match:
-                state = state_match.group(1).lower()
-                inline = state_match.group(2)
-                for component in re.findall(
-                    r"\{?([\w.$-]+/[\w.$-]+)(?:\s+\(A11yTool\))?\}?", inline
-                ):
-                    service = services.setdefault(
-                        (user_id, component), self._new_service(component, user_id)
+                for match in matches:
+                    # Each match is in format: <package_name>/<service>
+                    package_name, _, service = match.group(1).partition("/")
+
+                    self.results.append(
+                        {"package_name": package_name, "service": service}
                     )
-                    service[self._state_field(state)] = True
-                    service["accessibility_tool"] = "(A11yTool)" in inline
-                continue
-
-            if not state:
-                continue
-            if stripped == "}" or stripped.startswith("AccessibilityInputFilter"):
-                state = None
-                continue
-            component_match = re.search(
-                r"(?:\d+\s*:\s*)?([\w.$-]+/[\w.$-]+)(?:\s+\(A11yTool\))?",
-                stripped,
-            )
-            if component_match:
-                component = component_match.group(1)
-                service = services.setdefault(
-                    (user_id, component), self._new_service(component, user_id)
-                )
-                service[self._state_field(state)] = True
-                service["accessibility_tool"] = "(A11yTool)" in stripped
-
-        self.results.extend(services.values())
-
-    @staticmethod
-    def _state_field(state: str) -> str:
-        return {"binding": "binding", "bound": "bound"}.get(state, state)
-
-    @staticmethod
-    def _new_service(component: str, user_id: int | None) -> dict:
-        package_name, service_name = component.split("/", 1)
-        return {
-            "user_id": user_id,
-            "component": component,
-            "package_name": package_name,
-            "service_name": service_name,
-            "installed": False,
-            "enabled": False,
-            "binding": False,
-            "bound": False,
-            "crashed": False,
-            "accessibility_tool": False,
-        }

src/mvt/android/artifacts/dumpsys_adb.py

@@ -6,7 +6,6 @@
 import base64
 import binascii
 import hashlib
-import re
 
 from .artifact import AndroidArtifact
 
@@ -14,13 +13,6 @@ from .artifact import AndroidArtifact
 class DumpsysADBArtifact(AndroidArtifact):
     multiline_fields = ["user_keys", "keystore"]
 
-    @staticmethod
-    def is_structural_line(key: str, vals: list) -> bool:
-        if key == "}":
-            return True
-        # XML keystore continuations also split on "=", but never into an identifier.
-        return len(vals) == 2 and key.isidentifier()
-
     def indented_dump_parser(self, dump_data):
         """
         Parse the indented dumpsys output, generated by DualDumpOutputStream in Android.
@@ -49,18 +41,10 @@ class DumpsysADBArtifact(AndroidArtifact):
                 if key == "":
                     # If the line is empty, it's the terminator for the multiline value
                     in_multiline = False
-                    if isinstance(stack[-1], list):
-                        stack.pop()
-                    continue
-
-                if not self.is_structural_line(key, vals):
-                    current_dict.append(line.lstrip())
-                    continue
-
-                in_multiline = False
-                if isinstance(stack[-1], list):
                     stack.pop()
-                current_dict = stack[-1]
+                else:
+                    current_dict.append(line.lstrip())
+                continue
 
             if key == "}":
                 stack.pop()
@@ -99,34 +83,6 @@ class DumpsysADBArtifact(AndroidArtifact):
 
         return keystore
 
-    def parse_binary_xml(self, data: bytes) -> list[dict]:
-        """Recover ADB key records from Android binary XML (ABX).
-
-        Some dumpstate implementations embed ABX in a text stream and replace
-        binary token bytes. The public key remains intact, while unavailable
-        numeric metadata is represented as ``None`` rather than corrupt text.
-        """
-        keystore = []
-        seen = set()
-        for match in re.finditer(
-            rb"(?<![A-Za-z0-9+/])([A-Za-z0-9+/]{300,}={0,2})"
-            rb"(?: ([A-Za-z0-9_.@-]+))?",
-            data,
-        ):
-            key = match.group(1)
-            try:
-                base64.b64decode(key, validate=True)
-            except (binascii.Error, ValueError):
-                continue
-            if key in seen:
-                continue
-            seen.add(key)
-            full_key = key + (b" " + match.group(2) if match.group(2) else b"")
-            key_info = self.calculate_key_info(full_key)
-            key_info["last_connected"] = None
-            keystore.append(key_info)
-        return keystore
-
     @staticmethod
     def calculate_key_info(user_key: bytes) -> dict:
         if b" " in user_key:
@@ -147,7 +103,7 @@ class DumpsysADBArtifact(AndroidArtifact):
         return {
             "user": user.decode("utf-8"),
             "fingerprint": key_fingerprint_colon,
-            "key": key_base64.decode("ascii", errors="replace"),
+            "key": key_base64,
         }
 
     def check_indicators(self) -> None:
@@ -175,17 +131,10 @@ class DumpsysADBArtifact(AndroidArtifact):
             )
             return
 
-        start_of_json = content.find(b"\n{")
-        if start_of_json == -1:
-            self.log.error("Unable to find ADB manager state in dumpsys output")
-            return
-
-        end_of_json = content.rfind(b"}\n")
-        if end_of_json == -1 or end_of_json <= start_of_json:
-            self.log.error("Unable to find complete ADB manager state in dumpsys output")
-            return
-
-        json_content = content[start_of_json + 2 : end_of_json - 2].rstrip()
+        # TODO: Parse AdbDebuggingManager line in output.
+        start_of_json = content.find(b"\n{") + 2
+        end_of_json = content.rfind(b"}\n") - 2
+        json_content = content[start_of_json:end_of_json].rstrip()
 
         parsed = self.indented_dump_parser(json_content)
         if parsed.get("debugging_manager") is None:
@@ -204,23 +153,12 @@ class DumpsysADBArtifact(AndroidArtifact):
         # Keystore is in XML format on some devices and we need to parse it
         if keystore_data and keystore_data.startswith(b"<?xml"):
             parsed["debugging_manager"]["keystore"] = self.parse_xml(keystore_data)
-        elif keystore_data and keystore_data.startswith(b"ABX\x00"):
-            parsed["debugging_manager"]["keystore"] = self.parse_binary_xml(
-                keystore_data
-            )
         else:
             # Keystore is not XML format
             parsed["debugging_manager"]["keystore"] = keystore_data
 
         parsed = parsed["debugging_manager"]
 
-        for key, value in list(parsed.items()):
-            if isinstance(value, bytes):
-                decoded = value.decode("utf-8", errors="replace")
-                parsed[key] = (
-                    decoded == "true" if decoded in ("true", "false") else decoded
-                )
-
         # Calculate key fingerprints for better readability
         key_info = []
         for user_key in parsed.get("user_keys", []):

src/mvt/android/artifacts/dumpsys_appops.py

@@ -4,7 +4,6 @@
 #   https://license.mvt.re/1.1/
 
 from datetime import datetime
-import re
 from typing import Any
 
 from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
@@ -28,14 +27,14 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                 continue
 
             for entry in perm["entries"]:
-                if entry.get("timestamp"):
+                if "timestamp" in entry:
                     records.append(
                         {
                             "timestamp": entry["timestamp"],
                             "module": self.__class__.__name__,
-                            "event": entry["event"],
+                            "event": entry["access"],
                             "data": f"{result['package_name']} access to "
-                            f"{perm['name']}: {entry['event']}",
+                            f"{perm['name']}: {entry['access']}",
                         }
                     )
 
@@ -52,7 +51,7 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                     continue
 
             # We use a placeholder entry to create a basic alert even without permission entries.
-            placeholder_entry = {"event": "unknown", "timestamp": ""}
+            placeholder_entry = {"access": "Unknown", "timestamp": ""}
 
             for perm in result["permissions"]:
                 if (
@@ -61,12 +60,12 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                 ):
                     for entry in sorted(
                         perm["entries"] or [placeholder_entry],
-                        key=lambda x: x.get("timestamp") or "",
+                        key=lambda x: x["timestamp"],
                     ):
                         cleaned_result = result.copy()
                         cleaned_result["permissions"] = [perm]
                         self.alertstore.medium(
-                            f"Package '{result['package_name']}' had risky permission '{perm['name']}' set to '{entry['event']}' at {entry['timestamp']}",
+                            f"Package '{result['package_name']}' had risky permission '{perm['name']}' set to '{entry['access']}' at {entry['timestamp']}",
                             entry["timestamp"],
                             cleaned_result,
                         )
@@ -74,151 +73,111 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                 elif result["package_name"] in RISKY_PACKAGES:
                     for entry in sorted(
                         perm["entries"] or [placeholder_entry],
-                        key=lambda x: x.get("timestamp") or "",
+                        key=lambda x: x["timestamp"],
                     ):
                         cleaned_result = result.copy()
                         cleaned_result["permissions"] = [perm]
                         self.alertstore.medium(
-                            f"Risky package '{result['package_name']}' had '{perm['name']}' permission set to '{entry['event']}' at {entry['timestamp']}",
+                            f"Risky package '{result['package_name']}' had '{perm['name']}' permission set to '{entry['access']}' at {entry['timestamp']}",
                             entry["timestamp"],
                             cleaned_result,
                         )
 
     def parse(self, output: str) -> None:
-        self.results: list[dict[str, Any]] = []
-        permission: dict[str, Any] | None = None
-        package: dict[str, Any] | None = None
-        uid: str | None = None
-        uid_details: dict[str, Any] = {}
-        attribution: str | None = None
+        # self.results: List[Dict[str, Any]] = []
+        perm: dict[str, Any] = {}
+        package: dict[str, Any] = {}
+        entry: dict[str, Any] = {}
+        uid = None
         in_packages = False
 
-        def finish_permission() -> None:
-            nonlocal permission
-            if package is not None and permission is not None:
-                package["permissions"].append(permission)
-            permission = None
-
-        def finish_package() -> None:
-            nonlocal package
-            finish_permission()
-            if package is not None:
-                self.results.append(package)
-            package = None
-
         for line in output.splitlines():
-            uid_match = re.match(r"^  Uid ([^:]+):$", line)
-            if uid_match:
+            if line.startswith("  Uid 0:"):
                 in_packages = True
-                finish_package()
-                uid = uid_match.group(1)
-                uid_details = {
-                    "uid_state": None,
-                    "capability": None,
-                    "app_widget_visible": None,
-                    "default_modes": {},
-                }
-                continue
 
             if not in_packages:
                 continue
 
-            uid_property = re.match(
-                r"^    (state|capability|appWidgetVisible)=(.*)$", line
-            )
-            if uid_property:
-                key = {
-                    "state": "uid_state",
-                    "appWidgetVisible": "app_widget_visible",
-                }.get(uid_property.group(1), uid_property.group(1))
-                value: Any = uid_property.group(2)
-                if value in ("true", "false"):
-                    value = value == "true"
-                uid_details[key] = value
-                continue
+            if line.startswith("  Uid "):
+                uid = line[6:-1]
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+                if package:
+                    if perm:
+                        package["permissions"].append(perm)
 
-            default_mode = re.match(r"^      ([A-Z0-9_]+): mode=([^\s]+)", line)
-            if default_mode and package is None:
-                uid_details["default_modes"][default_mode.group(1)] = (
-                    default_mode.group(2)
-                )
+                    perm = {}
+                    self.results.append(package)
+                package = {}
                 continue
 
             if line.startswith("    Package "):
-                finish_package()
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+
+                if package:
+                    if perm:
+                        package["permissions"].append(perm)
+
+                    perm = {}
+                    self.results.append(package)
+
                 package = {
                     "package_name": line[12:-1],
                     "permissions": [],
                     "uid": uid,
-                    **uid_details,
                 }
                 continue
 
-            operation_match = re.match(
-                r"^      ([A-Z0-9_]+)(?: \(([^)]+)\))?:\s*$", line
-            )
-            if package is not None and operation_match:
-                finish_permission()
-                permission = {
-                    "name": operation_match.group(1),
-                    "mode": operation_match.group(2),
-                    "entries": [],
-                }
-                attribution = None
+            if package and line.startswith("      ") and line[6] != " ":
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+                if perm:
+                    package["permissions"].append(perm)
+                    perm = {}
+
+                perm["name"] = line.split()[0]
+                perm["entries"] = []
+                if len(line.split()) > 1:
+                    perm["access"] = line.split()[1][1:-2]
+
                 continue
 
-            attribution_match = re.match(r"^\s{8,}([^=]+)=\[$", line)
-            if attribution_match:
-                attribution = attribution_match.group(1).strip()
-                continue
-            if line.strip() == "]":
-                attribution = None
-                continue
+            if line.startswith("          "):
+                # Permission entry like:
+                # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
+                access_type = line.split(":")[0].strip()
+                if access_type not in ["Access", "Reject"]:
+                    # Skipping invalid access type. Some entries are not in the format we expect
+                    continue
 
-            if permission is None:
-                continue
-            event_match = re.match(
-                r"^\s*(Access|Reject):\s*\[([^]]+)\]\s*"
-                r"(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d+)\s*"
-                r"(\([^)]*\))?(?:\s+duration=([^\s]+))?",
-                line,
-            )
-            running_match = re.match(
-                r"^\s*Running start at:\s*(\S+(?: \S+)?)",
-                line,
-            )
-            if event_match:
-                entry = {
-                    "event": event_match.group(1).lower(),
-                    "access": event_match.group(1),
-                    "uid_state": event_match.group(2),
-                    "timestamp": convert_datetime_to_iso(
-                        datetime.strptime(event_match.group(3), "%Y-%m-%d %H:%M:%S.%f")
-                    ),
-                    "relative_time": event_match.group(4),
-                    "duration": event_match.group(5),
-                    "attribution": attribution,
-                }
-                permission["entries"].append(entry)
-            elif running_match:
-                raw_start = running_match.group(1)
-                timestamp = None
-                if re.fullmatch(r"\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d+", raw_start):
-                    timestamp = convert_datetime_to_iso(
-                        datetime.strptime(raw_start, "%Y-%m-%d %H:%M:%S.%f")
+                if entry:
+                    perm["entries"].append(entry)
+                    entry = {}
+
+                entry["access"] = access_type
+                entry["type"] = line[line.find("[") + 1 : line.find("]")]
+
+                try:
+                    entry["timestamp"] = convert_datetime_to_iso(
+                        datetime.strptime(
+                            line[line.find("]") + 1 : line.find("(")].strip(),
+                            "%Y-%m-%d %H:%M:%S.%f",
+                        )
                     )
-                permission["entries"].append(
-                    {
-                        "event": "running",
-                        "access": "Running",
-                        "uid_state": None,
-                        "timestamp": timestamp,
-                        "relative_time": raw_start
-                        if raw_start.startswith("+")
-                        else None,
-                        "duration": None,
-                        "attribution": attribution,
-                    }
-                )
+                except ValueError:
+                    # Invalid date format
+                    pass
 
-        finish_package()
+            if line.strip() == "":
+                break
+
+        if entry:
+            perm["entries"].append(entry)
+        if perm:
+            package["permissions"].append(perm)
+        if package:
+            self.results.append(package)

src/mvt/android/artifacts/dumpsys_battery_daily.py

@@ -18,18 +18,18 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
     def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         action = record.get("action", "update")
         package_name = record["package_name"]
-        vers = record["version_code"]
+        vers = record["vers"]
 
-        if vers == 0:
+        if vers == "0":
             data = f"Recorded uninstall of package {package_name} (vers 0)"
         elif action == "downgrade":
-            prev_vers = record.get("previous_version_code", "unknown")
+            prev_vers = record.get("previous_vers", "unknown")
             data = f"Recorded downgrade of package {package_name} from vers {prev_vers} to vers {vers}"
         else:
             data = f"Recorded update of package {package_name} with vers {vers}"
 
         return {
-            "timestamp": record["period_start"],
+            "timestamp": record["from"],
             "module": self.__class__.__name__,
             "event": "battery_daily",
             "data": data,
@@ -48,22 +48,20 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
                 continue
 
     def parse(self, output: str) -> None:
-        self.results = []
         daily = None
         daily_updates: list[dict[str, Any]] = []
-        records: list[dict[str, Any]] = []
+        package_versions: dict[
+            str, str
+        ] = {}  # Track package versions to detect downgrades
         for line in output.splitlines():
             if line.startswith("  Daily from "):
                 if len(daily_updates) > 0:
-                    records.extend(daily_updates)
+                    self.results.extend(daily_updates)
                     daily_updates = []
 
                 timeframe = line[13:].strip()
                 date_from, date_to = timeframe.strip(":").split(" to ", 1)
-                daily = {
-                    "period_start": self._format_daily_timestamp(date_from),
-                    "period_end": self._format_daily_timestamp(date_to),
-                }
+                daily = {"from": date_from[0:10], "to": date_to[0:10]}
                 continue
 
             if not daily:
@@ -74,84 +72,53 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
 
             line = line.strip().replace("Update ", "")
             package_name, vers = line.split(" ", 1)
-            vers_raw = vers.split("=", 1)[1]
-            try:
-                version_code: int | str = int(vers_raw)
-            except ValueError:
-                version_code = vers_raw
+            vers_nr = vers.split("=", 1)[1]
 
             already_seen = False
             for update in daily_updates:
-                if (
-                    package_name == update["package_name"]
-                    and version_code == update["version_code"]
-                ):
-                    update["occurrences"] += 1
+                if package_name == update["package_name"] and vers_nr == update["vers"]:
                     already_seen = True
                     break
 
             if not already_seen:
                 update_record: dict[str, Any] = {
                     "action": "update",
-                    "period_start": daily["period_start"],
-                    "period_end": daily["period_end"],
+                    "from": daily["from"],
+                    "to": daily["to"],
                     "package_name": package_name,
-                    "version_code": version_code,
-                    "occurrences": 1,
+                    "vers": vers_nr,
                 }
 
+                # Check for uninstall (version 0)
+                if vers_nr == "0":
+                    self.log.warning(
+                        "Detected uninstall of package %s (vers 0) on %s",
+                        package_name,
+                        daily["from"],
+                    )
+                # Check for downgrade
+                elif package_name in package_versions:
+                    try:
+                        current_vers = int(vers_nr)
+                        previous_vers = int(package_versions[package_name])
+                        if current_vers < previous_vers:
+                            update_record["action"] = "downgrade"
+                            update_record["previous_vers"] = str(previous_vers)
+                            self.log.warning(
+                                "Detected downgrade of package %s from vers %d to vers %d on %s",
+                                package_name,
+                                previous_vers,
+                                current_vers,
+                                daily["from"],
+                            )
+                    except ValueError:
+                        # If version numbers aren't integers, skip comparison
+                        pass
+
+                # Update tracking dictionary
+                package_versions[package_name] = vers_nr
+
                 daily_updates.append(update_record)
 
         if len(daily_updates) > 0:
-            records.extend(daily_updates)
-
-        self._detect_uninstalls_and_downgrades(records)
-        self.results.extend(records)
-
-    @staticmethod
-    def _format_daily_timestamp(value: str) -> str:
-        if len(value) >= 19 and value[10] == "-":
-            return f"{value[:10]} {value[11:].replace('-', ':')}"
-        return value
-
-    def _detect_uninstalls_and_downgrades(self, records: list[dict[str, Any]]) -> None:
-        package_versions: dict[str, int] = {}
-
-        for record in sorted(
-            records,
-            key=lambda record: (
-                record["period_start"],
-                record["period_end"],
-                record["package_name"],
-            ),
-        ):
-            package_name = record["package_name"]
-            vers_nr = record["version_code"]
-
-            if vers_nr == 0:
-                record["action"] = "uninstall"
-                self.alertstore.medium(
-                    f"Detected uninstall of package {package_name} (vers 0)",
-                    record["period_start"],
-                    record,
-                )
-                package_versions.pop(package_name, None)
-                continue
-
-            try:
-                current_vers = int(vers_nr)
-            except ValueError:
-                continue
-
-            previous_vers = package_versions.get(package_name)
-            if previous_vers is not None and current_vers < previous_vers:
-                record["action"] = "downgrade"
-                record["previous_version_code"] = previous_vers
-                self.alertstore.medium(
-                    f"Detected downgrade of package {package_name} "
-                    f"from vers {previous_vers} to vers {current_vers}",
-                    record["period_start"],
-                    record,
-                )
-
-            package_versions[package_name] = current_vers
+            self.results.extend(daily_updates)

src/mvt/android/artifacts/dumpsys_battery_history.py

@@ -1,177 +1,79 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import datetime
-import re
-
-from mvt.common.utils import convert_datetime_to_iso
-
 from .artifact import AndroidArtifact
 
 
 class DumpsysBatteryHistoryArtifact(AndroidArtifact):
-    """Parser for package-related events in dumpsys batterystats history."""
+    """
+    Parser for dumpsys dattery history events.
+    """
 
     def check_indicators(self) -> None:
         if not self.indicators:
             return
+
         for result in self.results:
-            package_name = result.get("package_name")
-            if not package_name:
-                continue
-            ioc_match = self.indicators.check_app_id(package_name)
+            ioc_match = self.indicators.check_app_id(result["package_name"])
             if ioc_match:
                 self.alertstore.critical(
                     ioc_match.message, "", result, matched_indicator=ioc_match.ioc
                 )
-
-    @staticmethod
-    def _parse_wall_time(value: str) -> datetime.datetime | None:
-        if re.fullmatch(r"\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d+", value):
-            value = f"1900-{value}"
-        for date_format in (
-            "%Y-%m-%d-%H-%M-%S-%f",
-            "%Y-%m-%d-%H-%M-%S",
-            "%Y-%m-%d %H:%M:%S.%f",
-        ):
-            try:
-                return datetime.datetime.strptime(value, date_format)
-            except ValueError:
-                pass
-        return None
-
-    @staticmethod
-    def _elapsed_seconds(value: str) -> float | None:
-        if not value.startswith("+"):
-            return None
-        units = {"d": 86400, "h": 3600, "m": 60, "s": 1, "ms": 0.001}
-        total = 0.0
-        for number, unit in re.findall(r"(\d+)(ms|d|h|m|s)", value):
-            total += int(number) * units[unit]
-        return total
-
-    @staticmethod
-    def _package_from_name(name: str) -> str | None:
-        clean = name.removeprefix("*walarm*:").removeprefix("*alarm*:")
-        slash_parts = clean.split("/")
-        if len(slash_parts) > 1:
-            first = slash_parts[0].lstrip("@")
-            if first.startswith(("com.", "org.", "net.")):
-                return first
-            for part in reversed(slash_parts[1:]):
-                candidate = part.lstrip("@").split(":", 1)[0]
-                if candidate.startswith(("com.", "org.", "net.")):
-                    return candidate
-        parts = clean.split(".")
-        package_parts = []
-        for part in parts:
-            if part and part[0].islower():
-                package_parts.append(part)
-            else:
-                break
-        return ".".join(package_parts) if len(package_parts) >= 2 else None
-
-    @staticmethod
-    def _normalize_service(service: str) -> str:
-        # WorkManager decorates jobs with one or more scheduler prefixes.
-        if "@" in service:
-            candidates = [part for part in service.split("@") if "/" in part]
-            if candidates:
-                return candidates[-1]
-        return service
+                continue
 
     def parse(self, data: str) -> None:
-        self.results: list[dict[str, str | None]] = []
-        anchor_time: datetime.datetime | None = None
-        anchor_elapsed = 0.0
-        has_history_heading = any(
-            line.startswith("Battery History") for line in data.splitlines()
-        )
-        in_history = not has_history_heading
-
         for line in data.splitlines():
-            stripped = line.strip()
-            if line.startswith("Battery History"):
-                if in_history:
-                    break
-                in_history = True
+            if line.startswith("Battery History "):
                 continue
-            if not in_history:
-                continue
-            if has_history_heading and not stripped:
+
+            if line.strip() == "":
                 break
-            reset_match = re.search(r"(?:RESET:)?TIME:\s*(\S+)", stripped)
-            if reset_match:
-                parsed_time = self._parse_wall_time(reset_match.group(1))
-                if parsed_time is not None:
-                    elapsed_token = stripped.split()[0]
-                    anchor_elapsed = self._elapsed_seconds(elapsed_token) or 0.0
-                    anchor_time = parsed_time
-                continue
 
-            fields = stripped.split()
-            if not fields:
-                continue
-            if len(fields) > 1 and re.fullmatch(r"\d{2}-\d{2}", fields[0]):
-                time_elapsed = " ".join(fields[:2])
-                line_time = self._parse_wall_time(time_elapsed)
-                elapsed = None
+            time_elapsed = line.strip().split(" ", 1)[0]
+
+            event = ""
+            if line.find("+job") > 0:
+                event = "start_job"
+                uid = line[line.find("+job") + 5 : line.find(":")]
+                service = line[line.find(":") + 1 :].strip('"')
+                package_name = service.split("/")[0]
+            elif line.find("-job") > 0:
+                event = "end_job"
+                uid = line[line.find("-job") + 5 : line.find(":")]
+                service = line[line.find(":") + 1 :].strip('"')
+                package_name = service.split("/")[0]
+            elif line.find("+running +wake_lock=") > 0:
+                uid = line[line.find("+running +wake_lock=") + 21 : line.find(":")]
+                event = "wake"
+                service = (
+                    line[line.find("*walarm*:") + 9 :].split(" ")[0].strip('"').strip()
+                )
+                if service == "" or "/" not in service:
+                    continue
+
+                package_name = service.split("/")[0]
+            elif (line.find("+top=") > 0) or (line.find("-top") > 0):
+                if line.find("+top=") > 0:
+                    event = "start_top"
+                    top_pos = line.find("+top=")
+                else:
+                    event = "end_top"
+                    top_pos = line.find("-top=")
+                colon_pos = top_pos + line[top_pos:].find(":")
+                uid = line[top_pos + 5 : colon_pos]
+                service = ""
+                package_name = line[colon_pos + 1 :].strip('"')
             else:
-                time_elapsed = fields[0]
-                elapsed = self._elapsed_seconds(time_elapsed)
-                line_time = None
+                continue
 
-            timestamp = line_time
-            if timestamp is None and anchor_time is not None and elapsed is not None:
-                timestamp = anchor_time + datetime.timedelta(
-                    seconds=elapsed - anchor_elapsed
-                )
-
-            def add(
-                event: str, uid: str, service: str, package_name: str | None
-            ) -> None:
-                self.results.append(
-                    {
-                        "time_elapsed": time_elapsed,
-                        "timestamp": convert_datetime_to_iso(timestamp)
-                        if timestamp
-                        else None,
-                        "event": event,
-                        "uid": uid,
-                        "package_name": package_name,
-                        "service": service,
-                    }
-                )
-
-            for sign, uid, raw_service in re.findall(
-                r"([+-])job=([^:\s]+):\"([^\"]+)\"", line
-            ):
-                service = self._normalize_service(raw_service)
-                add(
-                    "start_job" if sign == "+" else "end_job",
-                    uid,
-                    service,
-                    self._package_from_name(service) or service.split("/", 1)[0],
-                )
-
-            for sign, uid, package_name in re.findall(
-                r"([+-])top=([^:\s]+):\"([^\"]+)\"", line
-            ):
-                add(
-                    "start_top" if sign == "+" else "end_top",
-                    uid,
-                    "",
-                    package_name,
-                )
-
-            wake_match = re.search(r"\+wake_lock=([^:\s]+):\"([^\"]+)\"", line)
-            if wake_match:
-                wake_name = wake_match.group(2)
-                add(
-                    "wake",
-                    wake_match.group(1),
-                    wake_name,
-                    self._package_from_name(wake_name),
-                )
+            self.results.append(
+                {
+                    "time_elapsed": time_elapsed,
+                    "event": event,
+                    "uid": uid,
+                    "package_name": package_name,
+                    "service": service,
+                }
+            )

src/mvt/android/artifacts/dumpsys_dbinfo.py

@@ -29,27 +29,17 @@ class DumpsysDBInfoArtifact(AndroidArtifact):
 
     def parse(self, output: str) -> None:
         rxp = re.compile(
-            r"^\s*\d+:\s*\[((?:\d{4}-)?\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3})\]\s*"
-            r"(?:\[Pid:\((\d+)\)\])?\s*([\w-]+) took (\d+)ms - ([^,]+),"
-            r"\s*sql=\"(.*)\"(?:, path=(.*))?$"
-        )
+            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\""
+        )  # pylint: disable=line-too-long
+        rxp_no_pid = re.compile(
+            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\""
+        )  # pylint: disable=line-too-long
 
-        pool: str | None = None
-        connection_number: int | None = None
-        is_primary: bool | None = None
+        pool = None
         in_operations = False
         for line in output.splitlines():
             if line.startswith("Connection pool for "):
                 pool = line.replace("Connection pool for ", "").rstrip(":")
-                in_operations = False
-
-            connection_match = re.match(r"\s+Connection #(\d+):", line)
-            if connection_match:
-                connection_number = int(connection_match.group(1))
-                is_primary = None
-
-            if line.strip().startswith("isPrimaryConnection:"):
-                is_primary = line.strip().split(":", 1)[1].strip() == "true"
 
             if not pool:
                 continue
@@ -63,22 +53,32 @@ class DumpsysDBInfoArtifact(AndroidArtifact):
 
             if not line.startswith("        "):
                 in_operations = False
+                pool = None
                 continue
 
-            match = rxp.match(line)
-            if not match:
-                continue
+            matches = rxp.findall(line)
+            if not matches:
+                matches = rxp_no_pid.findall(line)
+                if not matches:
+                    continue
 
-            result = {
-                "timestamp": match.group(1),
-                "pid": int(match.group(2)) if match.group(2) else None,
-                "action": match.group(3),
-                "duration_ms": int(match.group(4)),
-                "status": match.group(5),
-                "sql": match.group(6),
-                "path": match.group(7) or pool,
-                "pool_path": pool,
-                "connection_number": connection_number,
-                "is_primary": is_primary,
-            }
-            self.results.append(result)
+                match = matches[0]
+                self.results.append(
+                    {
+                        "isodate": match[0],
+                        "action": match[1],
+                        "sql": match[2],
+                        "path": pool,
+                    }
+                )
+            else:
+                match = matches[0]
+                self.results.append(
+                    {
+                        "isodate": match[0],
+                        "pid": match[1],
+                        "action": match[2],
+                        "sql": match[3],
+                        "path": pool,
+                    }
+                )

src/mvt/android/artifacts/dumpsys_package_activities.py

@@ -4,7 +4,6 @@
 #   https://license.mvt.re/1.1/
 
 from .artifact import AndroidArtifact
-from .package_resolvers import parse_resolver_table
 
 
 class DumpsysPackageActivitiesArtifact(AndroidArtifact):
@@ -20,11 +19,67 @@ class DumpsysPackageActivitiesArtifact(AndroidArtifact):
                 )
                 continue
 
-    def parse(self, content: str) -> None:
+    def parse(self, content: str):
         """
         Parse the Dumpsys Package section for activities
         Adds results to self.results
 
         :param content: content of the package section (string)
         """
-        self.results = parse_resolver_table(content, "Activity")
+        self.results = []
+
+        in_activity_resolver_table = False
+        in_non_data_actions = False
+        intent = None
+        for line in content.splitlines():
+            if line.startswith("Activity Resolver Table:"):
+                in_activity_resolver_table = True
+                continue
+
+            if not in_activity_resolver_table:
+                continue
+
+            if line.startswith("  Non-Data Actions:"):
+                in_non_data_actions = True
+                continue
+
+            if not in_non_data_actions:
+                continue
+
+            # If we hit an empty line, the Non-Data Actions section should be
+            # finished.
+            if line.strip() == "":
+                break
+
+            # We detect the action name.
+            if (
+                line.startswith(" " * 6)
+                and not line.startswith(" " * 8)
+                and ":" in line
+            ):
+                intent = line.strip().replace(":", "")
+                continue
+
+            # If we are not in an intent block yet, skip.
+            if not intent:
+                continue
+
+            # If we are in a block but the line does not start with 8 spaces
+            # it means the block ended a new one started, so we reset and
+            # continue.
+            if not line.startswith(" " * 8):
+                intent = None
+                continue
+
+            # If we got this far, we are processing receivers for the
+            # activities we are interested in.
+            activity = line.strip().split(" ")[1]
+            package_name = activity.split("/")[0]
+
+            self.results.append(
+                {
+                    "intent": intent,
+                    "package_name": package_name,
+                    "activity": activity,
+                }
+            )

src/mvt/android/artifacts/dumpsys_packages.py

@@ -1,10 +1,10 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import re
-from typing import Any
+from typing import Any, Dict, List
 
 from mvt.android.utils import ROOT_PACKAGES
 from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
@@ -12,244 +12,195 @@ from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 from .artifact import AndroidArtifact
 
 
-def _value(raw: str) -> Any:
-    if raw == "null":
-        return None
-    if raw in ("true", "false"):
-        return raw == "true"
-    try:
-        return int(raw)
-    except ValueError:
-        return raw
-
-
 class DumpsysPackagesArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
-        alerted_root_packages = set()
         for result in self.results:
-            package_name = result["package_name"]
-            if (
-                package_name in ROOT_PACKAGES
-                and package_name not in alerted_root_packages
-            ):
-                alerted_root_packages.add(package_name)
+            # XXX: De-duplication Package detections
+            if result["package_name"] in ROOT_PACKAGES:
                 self.alertstore.medium(
-                    f'Found an installed package related to rooting/jailbreaking: "{package_name}"',
+                    f'Found an installed package related to rooting/jailbreaking: "{result["package_name"]}"',
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
+                continue
+
             if not self.indicators:
                 continue
-            ioc_match = self.indicators.check_app_id(package_name)
+
+            ioc_match = self.indicators.check_app_id(result.get("package_name", ""))
             if ioc_match:
                 self.alertstore.critical(
                     ioc_match.message, "", result, matched_indicator=ioc_match.ioc
                 )
+                self.alertstore.log_latest()
 
     def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        records = []
         timestamps = [
-            ("package_install", record.get("timestamp")),
-            ("package_last_update", record.get("last_update_time")),
-        ]
-        timestamps.extend(
-            ("package_first_install", user.get("first_install_time"))
-            for user in record.get("users", [])
-        )
-        return [
+            {"event": "package_install", "timestamp": record["timestamp"]},
             {
-                "timestamp": timestamp,
-                "module": self.__class__.__name__,
-                "event": event,
-                "data": f"Install or update of package {record['package_name']}",
-            }
-            for event, timestamp in timestamps
-            if timestamp
+                "event": "package_first_install",
+                "timestamp": record["first_install_time"],
+            },
+            {"event": "package_last_update", "timestamp": record["last_update_time"]},
         ]
 
+        for timestamp in timestamps:
+            records.append(
+                {
+                    "timestamp": timestamp["timestamp"],
+                    "module": self.__class__.__name__,
+                    "event": timestamp["event"],
+                    "data": f"Install or update of package {record['package_name']}",
+                }
+            )
+
+        return records
+
     @staticmethod
-    def _permission(line: str, permission_type: str) -> dict:
-        name, _, details = line.strip().partition(":")
-        granted_match = re.search(r"granted=(true|false)", details)
-        flags_match = re.search(r"flags=\[\s*([^]]*)\]", details)
-        return {
-            "name": name,
-            "type": permission_type,
-            "granted": granted_match.group(1) == "true" if granted_match else None,
-            "flags": [
-                flag.strip()
-                for flag in (flags_match.group(1).split("|") if flags_match else [])
-                if flag.strip()
-            ],
+    def parse_dumpsys_package_for_details(output: str) -> Dict[str, Any]:
+        """
+        Parse one entry of a dumpsys package information
+        """
+        details: Dict[str, Any] = {
+            "uid": "",
+            "version_name": "",
+            "version_code": "",
+            "timestamp": "",
+            "first_install_time": "",
+            "last_update_time": "",
+            "permissions": list(),
+            "requested_permissions": list(),
         }
-
-    @classmethod
-    def parse_dumpsys_package_for_details(cls, output: str) -> dict[str, Any]:
-        details: dict[str, Any] = {
-            "app_id": None,
-            "version_name": None,
-            "version_code": None,
-            "min_sdk": None,
-            "target_sdk": None,
-            "timestamp": None,
-            "last_update_time": None,
-            "installer": None,
-            "system": False,
-            "permissions": [],
-            "requested_permissions": [],
-            "users": [],
-        }
-        permission_section: str | None = None
-        current_user: dict[str, Any] | None = None
-        legacy_first_install: str | None = None
-
+        in_install_permissions = False
+        in_runtime_permissions = False
+        in_declared_permissions = False
+        in_requested_permissions = True
         for line in output.splitlines():
-            stripped = line.strip()
-            user_match = re.match(r"User (\d+):\s*(.*)", stripped)
-            if user_match:
-                current_user = {"user_id": int(user_match.group(1)), "permissions": []}
-                for key, raw in re.findall(r"(\w+)=([^\s]+)", user_match.group(2)):
-                    clean_key = {
-                        "notLaunched": "not_launched",
-                        "installReason": "install_reason",
-                        "uninstallReason": "uninstall_reason",
-                        "dataDir": "data_dir",
-                    }.get(key, re.sub(r"(?<!^)(?=[A-Z])", "_", key).lower())
-                    current_user[clean_key] = _value(raw)
-                details["users"].append(current_user)
-                permission_section = None
-                continue
+            if in_install_permissions:
+                if line.startswith(" " * 4) and not line.startswith(" " * 6):
+                    in_install_permissions = False
+                else:
+                    lineinfo = line.strip().split(":")
+                    permission = lineinfo[0]
+                    granted = None
+                    if "granted=" in lineinfo[1]:
+                        granted = "granted=true" in lineinfo[1]
 
-            header = stripped.lower()
-            if header in {
-                "declared permissions:",
-                "install permissions:",
-                "requested permissions:",
-                "runtime permissions:",
-            }:
-                permission_section = header.split()[0]
-                continue
+                    details["permissions"].append(
+                        {"name": permission, "granted": granted, "type": "install"}
+                    )
+            if in_runtime_permissions:
+                if not line.startswith(" " * 8):
+                    in_runtime_permissions = False
+                else:
+                    lineinfo = line.strip().split(":")
+                    permission = lineinfo[0]
+                    granted = None
+                    if "granted=" in lineinfo[1]:
+                        granted = "granted=true" in lineinfo[1]
 
-            if current_user is not None:
-                user_property = re.match(
-                    r"(installReason|uninstallReason|dataDir|firstInstallTime)=(.*)",
-                    stripped,
-                )
-                if user_property:
-                    key = {
-                        "installReason": "install_reason",
-                        "uninstallReason": "uninstall_reason",
-                        "dataDir": "data_dir",
-                        "firstInstallTime": "first_install_time",
-                    }[user_property.group(1)]
-                    current_user[key] = _value(user_property.group(2))
-                    continue
+                    details["permissions"].append(
+                        {"name": permission, "granted": granted, "type": "runtime"}
+                    )
+            if in_declared_permissions:
+                if not line.startswith(" " * 6):
+                    in_declared_permissions = False
+                else:
+                    permission = line.strip().split(":")[0]
+                    details["permissions"].append(
+                        {"name": permission, "type": "declared"}
+                    )
+            if in_requested_permissions:
+                if not line.startswith(" " * 6):
+                    in_requested_permissions = False
+                else:
+                    details["requested_permissions"].append(line.strip())
+            if line.strip().startswith("userId="):
+                details["uid"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionName="):
+                details["version_name"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionCode="):
+                details["version_code"] = line.split("=", 1)[1].strip()
+            elif line.strip().startswith("timeStamp="):
+                details["timestamp"] = line.split("=")[1].strip()
+            elif line.strip().startswith("firstInstallTime="):
+                details["first_install_time"] = line.split("=")[1].strip()
+            elif line.strip().startswith("lastUpdateTime="):
+                details["last_update_time"] = line.split("=")[1].strip()
+            elif line.strip() == "install permissions:":
+                in_install_permissions = True
+            elif line.strip() == "runtime permissions:":
+                in_runtime_permissions = True
+            elif line.strip() == "declared permissions:":
+                in_declared_permissions = True
+            elif line.strip() == "requested permissions:":
+                in_requested_permissions = True
 
-            if permission_section == "requested" and line.startswith("      "):
-                details["requested_permissions"].append(stripped)
-                continue
-            if permission_section in ("declared", "install") and line.startswith(
-                "      "
-            ):
-                details["permissions"].append(
-                    cls._permission(stripped, permission_section)
-                )
-                continue
-            if (
-                permission_section == "runtime"
-                and line.startswith("        ")
-                and current_user is not None
-            ):
-                current_user["permissions"].append(cls._permission(stripped, "runtime"))
-                continue
-
-            simple_match = re.match(
-                r"(appId|userId|versionName|timeStamp|lastUpdateTime|installerPackageName)=(.*)",
-                stripped,
-            )
-            if simple_match:
-                key = {
-                    "appId": "app_id",
-                    "userId": "app_id",
-                    "versionName": "version_name",
-                    "timeStamp": "timestamp",
-                    "lastUpdateTime": "last_update_time",
-                    "installerPackageName": "installer",
-                }[simple_match.group(1)]
-                raw_value = simple_match.group(2)
-                details[key] = (
-                    _value(raw_value)
-                    if key == "app_id" or raw_value == "null"
-                    else raw_value
-                )
-                continue
-            if stripped.startswith("pkgFlags="):
-                details["system"] = "SYSTEM" in stripped.split("=", 1)[1].split()
-                continue
-            version_match = re.match(
-                r"versionCode=([^\s]+)(?:\s+minSdk=([^\s]+))?(?:\s+targetSdk=([^\s]+))?",
-                stripped,
-            )
-            if version_match:
-                details["version_code"] = _value(version_match.group(1))
-                details["min_sdk"] = (
-                    _value(version_match.group(2)) if version_match.group(2) else None
-                )
-                details["target_sdk"] = (
-                    _value(version_match.group(3)) if version_match.group(3) else None
-                )
-            elif stripped.startswith("firstInstallTime="):
-                legacy_first_install = stripped.split("=", 1)[1]
-
-        if legacy_first_install:
-            user_zero = next(
-                (user for user in details["users"] if user["user_id"] == 0), None
-            )
-            if user_zero is None:
-                user_zero = {"user_id": 0, "permissions": []}
-                details["users"].append(user_zero)
-            user_zero.setdefault("first_install_time", legacy_first_install)
         return details
 
-    def parse(self, content: str) -> None:
-        self.results: list[dict[str, Any]] = []
-        category: str | None = None
-        package: dict[str, Any] | None = None
-        block: list[str] = []
+    def parse_dumpsys_packages(self, output: str) -> List[Dict[str, Any]]:
+        """
+        Parse the dumpsys package service data
+        """
+        pkg_rxp = re.compile(r"  Package \[(.+?)\].*")
 
-        def finish() -> None:
-            nonlocal package, block
-            if package is not None:
-                package.update(self.parse_dumpsys_package_for_details("\n".join(block)))
-                self.results.append(package)
-            package = None
-            block = []
+        results = []
+        package_name = None
+        package = {}
+        lines: list[str] = []
+        for line in output.splitlines():
+            if line.startswith("  Package ["):
+                if len(lines) > 0:
+                    details = self.parse_dumpsys_package_for_details("\n".join(lines))
+                    package.update(details)
+                    results.append(package)
+                    lines = []
+                    package = {}
 
-        for line in content.splitlines():
-            if line == "Packages:":
-                finish()
-                category = "active"
+                matches = pkg_rxp.findall(line)
+                if not matches:
+                    continue
+
+                package_name = matches[0]
+                package["package_name"] = package_name
                 continue
-            if line == "Hidden system packages:":
-                finish()
-                category = "hidden_system"
+
+            if not package_name:
                 continue
-            package_match = re.match(r"^  Package \[([^]]+)\]", line)
-            if package_match and category:
-                finish()
-                package = {
-                    "package_name": package_match.group(1),
-                    "package_type": category,
-                }
+
+            lines.append(line)
+
+        if len(lines) > 0:
+            details = self.parse_dumpsys_package_for_details("\n".join(lines))
+            package.update(details)
+            results.append(package)
+
+        return results
+
+    def parse(self, content: str):
+        """
+        Parse the Dumpsys Package section for activities
+        Adds results to self.results
+
+        :param content: content of the package section (string)
+        """
+        self.results = []
+        package = []
+
+        in_package_list = False
+        for line in content.split("\n"):
+            if line.startswith("Packages:"):
+                in_package_list = True
                 continue
-            if (
-                category
-                and line
-                and not line.startswith(" ")
-                and not line.endswith(" overlay paths:")
-            ):
-                finish()
-                category = None
+
+            if not in_package_list:
                 continue
-            if package is not None:
-                block.append(line)
-        finish()
+
+            if line.strip() == "":
+                break
+
+            package.append(line)
+
+        self.results = self.parse_dumpsys_packages("\n".join(package))

src/mvt/android/artifacts/dumpsys_platform_compat.py

@@ -3,8 +3,6 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import re
-
 from .artifact import AndroidArtifact
 
 
@@ -27,37 +25,19 @@ class DumpsysPlatformCompatArtifact(AndroidArtifact):
 
     def parse(self, data: str) -> None:
         for line in data.splitlines():
-            match = re.match(r"ChangeId\((\d+);\s*(.*)\)$", line.strip())
-            if not match or "rawOverrides={" not in line:
+            if not line.startswith("ChangeId(168419799; name=DOWNSCALED;"):
                 continue
-            body = match.group(2)
-            name_match = re.search(r"(?:^|;\s*)name=([^;]+)", body)
-            state = (
-                "enabled"
-                if re.search(r"(?:^|;\s*)enabled(?:;|$)", body)
-                else "disabled"
-            )
-            overridable = bool(re.search(r"(?:^|;\s*)overridable(?:;|$)", body))
-            overrides_field = body.split("rawOverrides={", 1)[1].split("}", 1)[0]
-            for entry in overrides_field.split(","):
-                package_name, separator, raw_value = entry.strip().partition("=")
-                if not separator:
-                    continue
-                value: bool | int | str
-                if raw_value in ("true", "false"):
-                    value = raw_value == "true"
-                else:
-                    try:
-                        value = int(raw_value)
-                    except ValueError:
-                        value = raw_value
-                self.results.append(
-                    {
-                        "change_id": int(match.group(1)),
-                        "change_name": name_match.group(1) if name_match else None,
-                        "change_state": state,
-                        "overridable": overridable,
-                        "package_name": package_name,
-                        "override_value": value,
-                    }
-                )
+
+            if line.strip() == "":
+                break
+
+            # Look for rawOverrides field
+            if "rawOverrides={" in line:
+                # Extract the content inside the braces for rawOverrides
+                overrides_field = line.split("rawOverrides={", 1)[1].split("};", 1)[0]
+
+                for entry in overrides_field.split(", "):
+                    # Extract app name
+                    uninstall_app = entry.split("=")[0].strip()
+
+                    self.results.append({"package_name": uninstall_app})

src/mvt/android/artifacts/dumpsys_receivers.py

@@ -4,7 +4,6 @@
 #   https://license.mvt.re/1.1/
 
 from .artifact import AndroidArtifact
-from .package_resolvers import parse_resolver_table
 
 INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
 INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
@@ -19,45 +18,103 @@ class DumpsysReceiversArtifact(AndroidArtifact):
     """
 
     def check_indicators(self) -> None:
-        for receiver in self.results:
-            intent = receiver["key"]
-            if intent == INTENT_NEW_OUTGOING_SMS:
-                self.log.info(
-                    'Found a receiver to intercept outgoing SMS messages: "%s"',
-                    receiver["component"],
-                )
-            elif intent == INTENT_SMS_RECEIVED:
-                self.log.info(
-                    'Found a receiver to intercept incoming SMS messages: "%s"',
-                    receiver["component"],
-                )
-            elif intent == INTENT_DATA_SMS_RECEIVED:
-                self.log.info(
-                    'Found a receiver to intercept incoming data SMS message: "%s"',
-                    receiver["component"],
-                )
-            elif intent == INTENT_PHONE_STATE:
-                self.log.info(
-                    'Found a receiver monitoring telephony state/incoming calls: "%s"',
-                    receiver["component"],
-                )
-            elif intent == INTENT_NEW_OUTGOING_CALL:
-                self.log.info(
-                    'Found a receiver monitoring outgoing calls: "%s"',
-                    receiver["component"],
-                )
+        for intent, receivers in self.results.items():
+            for receiver in receivers:
+                if intent == INTENT_NEW_OUTGOING_SMS:
+                    self.log.info(
+                        'Found a receiver to intercept outgoing SMS messages: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_SMS_RECEIVED:
+                    self.log.info(
+                        'Found a receiver to intercept incoming SMS messages: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_DATA_SMS_RECEIVED:
+                    self.log.info(
+                        'Found a receiver to intercept incoming data SMS message: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_PHONE_STATE:
+                    self.log.info(
+                        "Found a receiver monitoring "
+                        'telephony state/incoming calls: "%s"',
+                        receiver["receiver"],
+                    )
+                elif intent == INTENT_NEW_OUTGOING_CALL:
+                    self.log.info(
+                        'Found a receiver monitoring outgoing calls: "%s"',
+                        receiver["receiver"],
+                    )
 
-            if not self.indicators:
-                continue
+                if not self.indicators:
+                    continue
 
-            ioc_match = self.indicators.check_app_id(receiver["package_name"])
-            if ioc_match:
-                self.alertstore.critical(
-                    ioc_match.message,
-                    "",
-                    receiver,
-                    matched_indicator=ioc_match.ioc,
-                )
+                ioc_match = self.indicators.check_app_id(receiver["package_name"])
+                if ioc_match:
+                    self.alertstore.critical(
+                        ioc_match.message,
+                        "",
+                        {intent: receiver},
+                        matched_indicator=ioc_match.ioc,
+                    )
+                    continue
 
     def parse(self, output: str) -> None:
-        self.results = parse_resolver_table(output, "Receiver")
+        self.results: dict[str, list[dict[str, str]]] = {}
+
+        in_receiver_resolver_table = False
+        in_non_data_actions = False
+        intent = None
+        for line in output.splitlines():
+            if line.startswith("Receiver Resolver Table:"):
+                in_receiver_resolver_table = True
+                continue
+
+            if not in_receiver_resolver_table:
+                continue
+
+            if line.startswith("  Non-Data Actions:"):
+                in_non_data_actions = True
+                continue
+
+            if not in_non_data_actions:
+                continue
+
+            # If we hit an empty line, the Non-Data Actions section should be
+            # finished.
+            if line.strip() == "":
+                break
+
+            # We detect the action name.
+            if (
+                line.startswith(" " * 6)
+                and not line.startswith(" " * 8)
+                and ":" in line
+            ):
+                intent = line.strip().replace(":", "")
+                self.results[intent] = []
+                continue
+
+            # If we are not in an intent block yet, skip.
+            if not intent:
+                continue
+
+            # If we are in a block but the line does not start with 8 spaces
+            # it means the block ended a new one started, so we reset and
+            # continue.
+            if not line.startswith(" " * 8):
+                intent = None
+                continue
+
+            # If we got this far, we are processing receivers for the
+            # activities we are interested in.
+            receiver = line.strip().split(" ")[1]
+            package_name = receiver.split("/")[0]
+
+            self.results[intent].append(
+                {
+                    "package_name": package_name,
+                    "receiver": receiver,
+                }
+            )

src/mvt/android/artifacts/getprop.py

@@ -28,16 +28,19 @@ INTERESTING_PROPERTIES = [
 class GetProp(AndroidArtifact):
     def parse(self, entry: str) -> None:
         self.results: List[Dict[str, str]] = []
-        # A property value may span several lines: persist.sys.boot.reason.history
-        # prints one boot per line. Matching the whole section instead of line by
-        # line lets a value run to the first closing bracket that ends a line.
-        rxp = re.compile(
-            r"^[ \t]*\[([^]]+)\]: \[(.*?)\][ \t\r]*$",
-            re.MULTILINE | re.DOTALL,
-        )
+        rxp = re.compile(r"\[(.+?)\]: \[(.+?)\]")
 
-        for name, value in rxp.findall(entry):
-            self.results.append({"name": name, "value": value})
+        for line in entry.splitlines():
+            line = line.strip()
+            if line == "":
+                continue
+
+            matches = re.findall(rxp, line)
+            if not matches or len(matches[0]) != 2:
+                continue
+
+            prop_entry = {"name": matches[0][0], "value": matches[0][1]}
+            self.results.append(prop_entry)
 
     def get_device_timezone(self) -> str | None:
         """

src/mvt/android/artifacts/mounts.py

@@ -117,51 +117,6 @@ class Mounts(AndroidArtifact):
                 # Skip lines that don't match expected format
                 continue
 
-    @staticmethod
-    def parse_mountinfo(entry: str, process_id: int) -> list[dict[str, Any]]:
-        """Parse Linux /proc/PID/mountinfo records."""
-        results = []
-        for line in entry.splitlines():
-            fields = line.split()
-            if "-" not in fields:
-                continue
-            separator = fields.index("-")
-            if separator < 6 or len(fields) < separator + 4:
-                continue
-            try:
-                mount_id = int(fields[0])
-                parent_id = int(fields[1])
-            except ValueError:
-                continue
-            mount_options = fields[5].split(",")
-            super_options = fields[separator + 3].split(",")
-            options = list(dict.fromkeys(mount_options + super_options))
-            mount_point = fields[4].replace("\\040", " ")
-            device = fields[separator + 2].replace("\\040", " ")
-            filesystem_type = fields[separator + 1]
-            is_system = mount_point in SUSPICIOUS_MOUNT_POINTS or any(
-                mount_point.startswith(f"{prefix}/")
-                for prefix in SUSPICIOUS_MOUNT_POINTS
-            )
-            results.append(
-                {
-                    "mount_id": mount_id,
-                    "parent_id": parent_id,
-                    "major_minor": fields[2],
-                    "root": fields[3].replace("\\040", " "),
-                    "mount_point": mount_point,
-                    "device": device,
-                    "filesystem_type": filesystem_type,
-                    "mount_options": ",".join(options),
-                    "options_list": options,
-                    "optional_fields": fields[6:separator],
-                    "is_system_partition": is_system,
-                    "is_read_write": "rw" in options,
-                    "process_ids": [process_id],
-                }
-            )
-        return results
-
     def check_indicators(self) -> None:
         """
         Check for suspicious mount configurations that may indicate root access
@@ -199,7 +154,7 @@ class Mounts(AndroidArtifact):
                 ):
                     continue
                 suspicious_mounts.append(mount)
-                self.alertstore.medium(
+                self.alertstore.high(
                     f"Suspicious mount options found for {mount_point}: {', '.join(suspicious_opts)}",
                     "",
                     mount,
@@ -225,18 +180,18 @@ class Mounts(AndroidArtifact):
             ioc = self.indicators.check_file_path(mount.get("mount_point", ""))
             if ioc:
                 self.alertstore.critical(
-                    ioc.message,
+                    f"Mount point matches indicator: {mount.get('mount_point', '')}",
                     "",
                     mount,
-                    matched_indicator=ioc.ioc,
+                    matched_indicator=ioc,
                 )
 
             # Check device paths for indicators
             ioc = self.indicators.check_file_path(mount.get("device", ""))
             if ioc:
                 self.alertstore.critical(
-                    ioc.message,
+                    f"Device path matches indicator: {mount.get('device', '')}",
                     "",
                     mount,
-                    matched_indicator=ioc.ioc,
+                    matched_indicator=ioc,
                 )

src/mvt/android/artifacts/package_resolvers.py

@@ -1,70 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-
-
-RESOLVER_TYPES = {
-    "Full MIME Types": "full_mime_type",
-    "Base MIME Types": "base_mime_type",
-    "Wild MIME Types": "wild_mime_type",
-    "Schemes": "scheme",
-    "Non-Data Actions": "non_data_action",
-    "MIME Typed Actions": "mime_typed_action",
-}
-
-ENTRY_RE = re.compile(
-    r"^\s{8,}[0-9a-fA-F]+\s+(?P<component>\S+)"
-    r"(?:\s+\((?P<filters>\d+)\s+filters?\))?\s*$"
-)
-
-
-def parse_resolver_table(content: str, table_name: str) -> list[dict]:
-    """Parse every resolver category from a dumpsys package table."""
-    results: list[dict] = []
-    in_table = False
-    resolver_type: str | None = None
-    key: str | None = None
-
-    for line in content.splitlines():
-        if line.startswith(f"{table_name} Resolver Table:"):
-            in_table = True
-            continue
-        if not in_table:
-            continue
-
-        if line and not line.startswith(" "):
-            break
-
-        section_match = re.match(r"^ {2}([^ ].*):\s*$", line)
-        if section_match:
-            resolver_type = RESOLVER_TYPES.get(section_match.group(1))
-            key = None
-            continue
-        if resolver_type is None:
-            continue
-
-        key_match = re.match(r"^ {6,}([^ ].*):\s*$", line)
-        if key_match:
-            key = key_match.group(1)
-            continue
-        if key is None:
-            continue
-
-        entry_match = ENTRY_RE.match(line)
-        if not entry_match:
-            continue
-        component = entry_match.group("component")
-        results.append(
-            {
-                "resolver_type": resolver_type,
-                "key": key,
-                "package_name": component.split("/", 1)[0],
-                "component": component,
-                "filter_count": int(entry_match.group("filters") or 1),
-            }
-        )
-
-    return results

src/mvt/android/artifacts/processes.py

@@ -1,91 +1,72 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
+# Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 from .artifact import AndroidArtifact
 
 
-FIELD_NAMES = {
-    "LABEL": "label",
-    "USER": "user",
-    "PID": "pid",
-    "TID": "tid",
-    "PPID": "ppid",
-    "VSZ": "virtual_memory_size",
-    "RSS": "resident_set_size",
-    "WCHAN": "wchan",
-    "ADDR": "address",
-    "S": "state",
-    "PRI": "priority",
-    "NI": "nice",
-    "RTPRIO": "realtime_priority",
-    "SCH": "scheduler",
-    "PCY": "policy",
-    "TIME": "cpu_time",
-    "CMD": "command",
-    "NAME": "command",
-}
-INTEGER_FIELDS = {
-    "pid",
-    "tid",
-    "ppid",
-    "virtual_memory_size",
-    "resident_set_size",
-    "priority",
-    "nice",
-}
-
-
 class Processes(AndroidArtifact):
     def parse(self, entry: str) -> None:
-        self.results = []
-        lines = [line for line in entry.splitlines() if line.strip()]
-        if not lines:
-            return
-        headers = lines[0].split()
-        if not all(header in FIELD_NAMES for header in headers):
-            return
+        for line in entry.split("\n")[1:]:
+            proc = line.split()
 
-        for line in lines[1:]:
-            values = line.split(None, len(headers) - 1)
-            if len(values) != len(headers):
+            # Skip empty lines
+            if len(proc) == 0:
                 continue
-            result = {}
-            valid = True
-            for header, raw in zip(headers, values):
-                key = FIELD_NAMES[header]
-                value: str | int = raw.strip("[]") if key == "command" else raw
-                if key in INTEGER_FIELDS:
-                    try:
-                        value = int(value)
-                    except ValueError:
-                        valid = False
-                        break
-                result[key] = value
-            if valid:
-                self.results.append(result)
+
+            # Sometimes WCHAN is empty.
+            if len(proc) == 8:
+                proc = proc[:5] + [""] + proc[5:]
+
+            # Sometimes there is the security label.
+            if proc[0].startswith("u:r"):
+                label = proc[0]
+                proc = proc[1:]
+            else:
+                label = ""
+
+            # Sometimes there is no WCHAN.
+            if len(proc) < 9:
+                proc = proc[:5] + [""] + proc[5:]
+
+            self.results.append(
+                {
+                    "user": proc[0],
+                    "pid": int(proc[1]),
+                    "ppid": int(proc[2]),
+                    "virtual_memory_size": int(proc[3]),
+                    "resident_set_size": int(proc[4]),
+                    "wchan": proc[5],
+                    "aprocress": proc[6],
+                    "stat": proc[7],
+                    "proc_name": proc[8].strip("[]"),
+                    "label": label,
+                }
+            )
 
     def check_indicators(self) -> None:
         if not self.indicators:
             return
+
         for result in self.results:
-            command = result.get("command", "")
-            if not isinstance(command, str):
+            proc_name = result.get("proc_name", "")
+            if not proc_name:
                 continue
-            process_name = command.rsplit("/", 1)[-1]
-            if not process_name or process_name == "gatekeeperd":
+
+            # Skipping this process because of false positives.
+            if result["proc_name"] == "gatekeeperd":
                 continue
-            for checker in (
-                self.indicators.check_app_id,
-                self.indicators.check_process,
-            ):
-                ioc_match = checker(process_name)
-                if ioc_match:
-                    self.alertstore.critical(
-                        ioc_match.message,
-                        "",
-                        result,
-                        matched_indicator=ioc_match.ioc,
-                    )
-                    break
+
+            ioc_match = self.indicators.check_app_id(proc_name)
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+                continue
+
+            ioc_match = self.indicators.check_process(proc_name)
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )

src/mvt/android/artifacts/settings.py

@@ -3,8 +3,6 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import re
-
 from .artifact import AndroidArtifact
 
 ANDROID_DANGEROUS_SETTINGS = [
@@ -62,28 +60,6 @@ ANDROID_DANGEROUS_SETTINGS = [
 
 
 class Settings(AndroidArtifact):
-    def parse(self, content: str) -> None:
-        self.results: dict[str, dict[str, str]] = {}
-        namespace: str | None = None
-        for line in content.splitlines():
-            heading = re.match(
-                r"^(CONFIG|GLOBAL|SECURE|SYSTEM) SETTINGS \(user (\d+)\)$",
-                line.strip(),
-            )
-            if heading:
-                namespace = f"{heading.group(1).lower()}:user_{heading.group(2)}"
-                self.results[namespace] = {}
-                continue
-            if namespace is None or not line.startswith("_id:"):
-                continue
-            setting = re.match(
-                r"^_id:\S+\s+name:(.*?)\s+pkg:.*?\s+value:(.*?)"
-                r"(?:\s+default:.*\s+defaultSystemSet:(?:true|false))?$",
-                line,
-            )
-            if setting:
-                self.results[namespace][setting.group(1)] = setting.group(2)
-
     def check_indicators(self) -> None:
         for namespace, settings in self.results.items():
             for key, value in settings.items():
@@ -91,14 +67,11 @@ class Settings(AndroidArtifact):
                     # Check if one of the dangerous settings is using an unsafe
                     # value (different than the one specified).
                     if danger["key"] == key and danger["safe_value"] != value:
-                        self.alertstore.medium(
-                            f'Found suspicious "{namespace}" setting "{key} = {value}" ({danger["description"]})',
-                            "",
-                            {
-                                "namespace": namespace,
-                                "key": key,
-                                "value": value,
-                                "description": danger["description"],
-                            },
+                        self.log.warning(
+                            'Found suspicious "%s" setting "%s = %s" (%s)',
+                            namespace,
+                            key,
+                            value,
+                            danger["description"],
                         )
                         break

src/mvt/android/artifacts/tombstone_crashes.py

@@ -6,8 +6,8 @@
 import datetime
 from typing import List, Optional
 
+import betterproto
 import pydantic
-import betterproto2
 from dateutil import parser
 
 from mvt.android.parsers.proto.tombstone import Tombstone
@@ -34,7 +34,6 @@ TOMBSTONE_TEXT_KEY_MAPPINGS = {
     "signal": "signal_info",
     "code": "code",
     "Cause": "cause",
-    "Abort message": "abort_message",
 }
 
 
@@ -68,8 +67,6 @@ class TombstoneCrashResult(pydantic.BaseModel):
     uid: int
     signal_info: SignalInfo
     cause: Optional[str] = None
-    causes: Optional[List[dict]] = None
-    abort_message: Optional[str] = None
     extra: Optional[str] = None
 
 
@@ -104,7 +101,8 @@ class TombstoneCrashArtifact(AndroidArtifact):
                 continue
 
             if result.get("command_line", []):
-                command_name = result["command_line"][0].split("/")[-1]
+                command_name = result.get("command_line")[0].split("/")[-1]
+                command_name = result["command_line"][0]
                 ioc_match = self.indicators.check_process(command_name)
                 if ioc_match:
                     self.alertstore.critical(
@@ -131,16 +129,9 @@ class TombstoneCrashArtifact(AndroidArtifact):
         self, file_name: str, file_timestamp: datetime.datetime, data: bytes
     ) -> None:
         """Parse Android tombstone crash files from a protobuf object."""
-        self.results.append(self.parse_protobuf_record(file_name, file_timestamp, data))
-
-    def parse_protobuf_record(
-        self, file_name: str, file_timestamp: datetime.datetime, data: bytes
-    ) -> dict:
-        if not data:
-            raise ValueError("empty protobuf tombstone")
         tombstone_pb = Tombstone().parse(data)
         tombstone_dict = tombstone_pb.to_dict(
-            casing=betterproto2.Casing.SNAKE, include_default_values=True
+            betterproto.Casing.SNAKE, include_default_values=True
         )
 
         # Add some extra metadata
@@ -150,31 +141,20 @@ class TombstoneCrashArtifact(AndroidArtifact):
         tombstone_dict["file_name"] = file_name
         tombstone_dict["file_timestamp"] = convert_datetime_to_iso(file_timestamp)
         tombstone_dict["process_name"] = self._proccess_name_from_thread(tombstone_dict)
-        if isinstance(tombstone_dict.get("selinux_label"), str):
-            tombstone_dict["selinux_label"] = tombstone_dict["selinux_label"].rstrip(
-                "\x00"
-            )
 
         # Confirm the tombstone is valid, and matches the output model
         tombstone = TombstoneCrashResult.model_validate(tombstone_dict)
-        return tombstone.model_dump()
+        self.results.append(tombstone.model_dump())
 
     def parse(
         self, file_name: str, file_timestamp: datetime.datetime, content: bytes
     ) -> None:
         """Parse text Android tombstone crash files."""
-        self.results.append(self.parse_text_record(file_name, file_timestamp, content))
-
-    def parse_text_record(
-        self, file_name: str, file_timestamp: datetime.datetime, content: bytes
-    ) -> dict:
-        if not content:
-            raise ValueError("empty plaintext tombstone")
         tombstone_dict = {
             "file_name": file_name,
             "file_timestamp": convert_datetime_to_iso(file_timestamp),
         }
-        lines = content.decode("utf-8", errors="replace").splitlines()
+        lines = content.decode("utf-8").splitlines()
         for line_num, line in enumerate(lines, 1):
             if not line.strip() or TOMBSTONE_DELIMITER in line:
                 continue
@@ -189,7 +169,7 @@ class TombstoneCrashArtifact(AndroidArtifact):
 
         # Validate the tombstone and add it to the results
         tombstone = TombstoneCrashResult.model_validate(tombstone_dict)
-        return tombstone.model_dump()
+        self.results.append(tombstone.model_dump())
 
     def _parse_tombstone_line(
         self, line: str, key: str, destination_key: str, tombstone: dict
@@ -209,36 +189,24 @@ class TombstoneCrashArtifact(AndroidArtifact):
     def _load_key_value_line(
         self, line: str, key: str, destination_key: str, tombstone: dict
     ) -> bool:
-        # The caller matched the key as a bare prefix, so a longer word starting
-        # with it arrives here: `Caused by: …` inside an abort message reaches
-        # the `Cause` key. That is a different line, not a broken file — say so
-        # by declining it, and let the remaining keys have their turn. Raising
-        # here discarded the whole tombstone, crash and stack trace included.
-        line_key, separator, value = line.partition(":")
-        if not separator or line_key != key:
-            return False
+        line_key, value = line.split(":", 1)
+        if line_key != key:
+            raise ValueError(f"Expected key {key}, got {line_key}")
 
-        value_clean = value.strip()
-        if len(value_clean) >= 2 and value_clean[0] == value_clean[-1] == "'":
-            value_clean = value_clean[1:-1]
+        value_clean = value.strip().strip("'")
         if destination_key == "uid":
             tombstone[destination_key] = int(value_clean)
         elif destination_key == "process_uptime":
             # eg. "Process uptime: 40s"
             tombstone[destination_key] = int(value_clean.rstrip("s"))
         elif destination_key == "command_line":
-            # Wrap in list for consistency with protobuf format (repeated string).
+            # XXX: Check if command line should be a single string in a list, or a list of strings.
             tombstone[destination_key] = [value_clean]
         else:
             tombstone[destination_key] = value_clean
         return True
 
     def _load_pid_line(self, line: str, tombstone: dict) -> bool:
-        # The first pid line identifies the crashing thread. Full text tombstones
-        # contain additional pid lines for the other threads in the process.
-        if "pid" in tombstone:
-            return True
-
         try:
             parts = line.split(" >>> ") if " >>> " in line else line.split(">>>")
             process_info = parts[0]
@@ -294,7 +262,9 @@ class TombstoneCrashArtifact(AndroidArtifact):
     @staticmethod
     def _parse_timestamp_string(timestamp: str) -> str:
         timestamp_parsed = parser.parse(timestamp)
-        return convert_datetime_to_iso(timestamp_parsed)
+        # HACK: Swap the local timestamp to UTC, so keep the original time and avoid timezone conversion.
+        local_timestamp = timestamp_parsed.replace(tzinfo=datetime.timezone.utc)
+        return convert_datetime_to_iso(local_timestamp)
 
     @staticmethod
     def _proccess_name_from_thread(tombstone_dict: dict) -> str:

src/mvt/android/cli.py

@@ -4,16 +4,10 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from zipfile import BadZipFile
 
 import click
 
-from mvt.common.cli_plugins import (
-    ANDROID_CLI_PLUGIN_GROUP,
-    MVT_ANDROID_CUSTOM_COMMANDS_ENV,
-    load_cli_commands_option,
-    register_cli_plugins,
-)
+from mvt.common.cmd_check_iocs import CmdCheckIOCS
 from mvt.common.help import (
     HELP_MSG_ANDROID_BACKUP_PASSWORD,
     HELP_MSG_CHECK_ADB_REMOVED,
@@ -22,29 +16,29 @@ from mvt.common.help import (
     HELP_MSG_CHECK_ANDROIDQF,
     HELP_MSG_CHECK_BUGREPORT,
     HELP_MSG_CHECK_IOCS,
-    HELP_MSG_CHECK_INTRUSION_LOGS,
-    HELP_MSG_DELAY_CHECKS,
     HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
     HELP_MSG_DISABLE_UPDATE_CHECK,
     HELP_MSG_HASHES,
     HELP_MSG_IOC,
     HELP_MSG_LIST_MODULES,
-    HELP_MSG_LOAD_MODULE,
     HELP_MSG_MODULE,
     HELP_MSG_NONINTERACTIVE,
     HELP_MSG_OUTPUT,
     HELP_MSG_STIX2,
     HELP_MSG_VERBOSE,
-    HELP_MSG_VERBOSE_COMMAND,
     HELP_MSG_VERSION,
-    HELP_MSG_VIRUS_TOTAL,
 )
+from mvt.common.logo import logo
+from mvt.common.updates import IndicatorsUpdates
 from mvt.common.utils import init_logging, set_verbose_logging
 
-# The commands import what they run only when they are invoked. This module is
-# imported at every start of mvt-android, including by shell completion on
-# every keystroke, so importing it must do no more than build the command tree:
-# the forensic modules, the backup parsers and the update checks stay out of it.
+from .cmd_check_androidqf import CmdAndroidCheckAndroidQF
+from .cmd_check_backup import CmdAndroidCheckBackup
+from .cmd_check_bugreport import CmdAndroidCheckBugreport
+from .modules.androidqf import ANDROIDQF_MODULES
+from .modules.backup import BACKUP_MODULES
+from .modules.backup.helpers import cli_load_android_backup_password
+from .modules.bugreport import BUGREPORT_MODULES
 
 init_logging()
 log = logging.getLogger("mvt")
@@ -62,25 +56,10 @@ def _get_disable_flags(ctx):
     )
 
 
-def _get_verbose(ctx):
-    """Return whether --verbose was passed to the CLI itself."""
-    return bool(ctx.obj and ctx.obj.get("verbose", False))
-
-
-def _load_custom_modules(load_module):
-    from mvt.common.module_loader import CustomModuleLoadError, load_custom_modules
-
-    try:
-        return load_custom_modules(load_module)
-    except CustomModuleLoadError as exc:
-        raise click.ClickException(str(exc)) from exc
-
-
 # ==============================================================================
 # Main
 # ==============================================================================
 @click.group(invoke_without_command=False)
-@load_cli_commands_option
 @click.option(
     "--disable-update-check", is_flag=True, help=HELP_MSG_DISABLE_UPDATE_CHECK
 )
@@ -89,17 +68,11 @@ def _load_custom_modules(load_module):
     is_flag=True,
     help=HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
 )
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
 @click.pass_context
-def cli(ctx, disable_update_check, disable_indicator_update_check, verbose):
+def cli(ctx, disable_update_check, disable_indicator_update_check):
     ctx.ensure_object(dict)
     ctx.obj["disable_version_check"] = disable_update_check
     ctx.obj["disable_indicator_check"] = disable_indicator_update_check
-    ctx.obj["verbose"] = verbose
-    set_verbose_logging(verbose)
-
-    from mvt.common.logo import logo
-
     logo(
         disable_version_check=disable_update_check,
         disable_indicator_check=disable_indicator_update_check,
@@ -109,7 +82,7 @@ def cli(ctx, disable_update_check, disable_indicator_update_check, verbose):
 # ==============================================================================
 # Command: version
 # ==============================================================================
-@cli.command("version", context_settings=CONTEXT_SETTINGS, help=HELP_MSG_VERSION)
+@cli.command("version", help=HELP_MSG_VERSION)
 def version():
     return
 
@@ -123,7 +96,6 @@ def version():
 @click.pass_context
 def check_adb(ctx):
     log.error(HELP_MSG_CHECK_ADB_REMOVED_DESCRIPTION)
-    ctx.exit(1)
 
 
 # ==============================================================================
@@ -143,30 +115,11 @@ def check_adb(ctx):
 @click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
 @click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
 @click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option(
-    "--load-module",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_LOAD_MODULE,
-)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
 @click.argument("BUGREPORT_PATH", type=click.Path(exists=True))
 @click.pass_context
-def check_bugreport(
-    ctx,
-    iocs,
-    output,
-    list_modules,
-    module,
-    load_module,
-    verbose,
-    bugreport_path,
-):
-    from .cmd_check_bugreport import CmdAndroidCheckBugreport
-
-    set_verbose_logging(verbose or _get_verbose(ctx))
-    custom_modules = _load_custom_modules(load_module)
+def check_bugreport(ctx, iocs, output, list_modules, module, verbose, bugreport_path):
+    set_verbose_logging(verbose)
     # Always generate hashes as bug reports are small.
     cmd = CmdAndroidCheckBugreport(
         target_path=bugreport_path,
@@ -176,7 +129,6 @@ def check_bugreport(
         hashes=True,
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
-        custom_modules=custom_modules,
     )
 
     if list_modules:
@@ -185,10 +137,7 @@ def check_bugreport(
 
     log.info("Checking Android bug report at path: %s", bugreport_path)
 
-    try:
-        cmd.run()
-    except BadZipFile as exc:
-        raise click.ClickException(f"Invalid bugreport archive: {exc}") from exc
+    cmd.run()
     cmd.show_alerts_brief()
     cmd.show_support_message()
 
@@ -211,16 +160,9 @@ def check_bugreport(
 )
 @click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
 @click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option(
-    "--load-module",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_LOAD_MODULE,
-)
 @click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
 @click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
 @click.argument("BACKUP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_backup(
@@ -228,17 +170,12 @@ def check_backup(
     iocs,
     output,
     list_modules,
-    load_module,
     non_interactive,
     backup_password,
     verbose,
     backup_path,
 ):
-    from .cmd_check_backup import CmdAndroidCheckBackup
-    from .modules.backup.helpers import cli_load_android_backup_password
-
-    set_verbose_logging(verbose or _get_verbose(ctx))
-    custom_modules = _load_custom_modules(load_module)
+    set_verbose_logging(verbose)
 
     # Always generate hashes as backups are generally small.
     cmd = CmdAndroidCheckBackup(
@@ -252,7 +189,6 @@ def check_backup(
         },
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
-        custom_modules=custom_modules,
     )
 
     if list_modules:
@@ -283,21 +219,10 @@ def check_backup(
 @click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
 @click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
 @click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option(
-    "--load-module",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_LOAD_MODULE,
-)
 @click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--virustotal", "-V", is_flag=True, help=HELP_MSG_VIRUS_TOTAL)
-@click.option(
-    "--delay", "-d", type=click.IntRange(min=0), default=16, help=HELP_MSG_DELAY_CHECKS
-)
 @click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
 @click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
 @click.argument("ANDROIDQF_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_androidqf(
@@ -306,20 +231,13 @@ def check_androidqf(
     output,
     list_modules,
     module,
-    load_module,
     hashes,
-    virustotal,
-    delay,
     non_interactive,
     backup_password,
     verbose,
     androidqf_path,
 ):
-    from .cmd_check_androidqf import CmdAndroidCheckAndroidQF
-    from .modules.backup.helpers import cli_load_android_backup_password
-
-    set_verbose_logging(verbose or _get_verbose(ctx))
-    custom_modules = _load_custom_modules(load_module)
+    set_verbose_logging(verbose)
 
     cmd = CmdAndroidCheckAndroidQF(
         target_path=androidqf_path,
@@ -330,12 +248,9 @@ def check_androidqf(
         module_options={
             "interactive": not non_interactive,
             "backup_password": cli_load_android_backup_password(log, backup_password),
-            "virustotal": virustotal,
-            "virustotal_delay": delay,
         },
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
-        custom_modules=custom_modules,
     )
 
     if list_modules:
@@ -350,87 +265,6 @@ def check_androidqf(
     cmd.show_support_message()
 
 
-# ==============================================================================
-# Command: check-intrusion-logs
-# ==============================================================================
-@cli.command(
-    "check-intrusion-logs",
-    context_settings=CONTEXT_SETTINGS,
-    help=HELP_MSG_CHECK_INTRUSION_LOGS,
-)
-@click.option(
-    "--iocs",
-    "-i",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_IOC,
-)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option(
-    "--load-module",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_LOAD_MODULE,
-)
-@click.option(
-    "--timezone",
-    "-t",
-    default=None,
-    help=(
-        "IANA timezone name for the device, for example 'Europe/Paris'. "
-        "When provided, event timestamps are expressed in the device's local "
-        "time instead of UTC."
-    ),
-)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
-@click.argument("LOGS_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_intrusion_logs(
-    ctx,
-    iocs,
-    output,
-    list_modules,
-    module,
-    load_module,
-    timezone,
-    verbose,
-    logs_path,
-):
-    from .cmd_check_intrusion_logs import CmdAndroidCheckIntrusionLogs
-
-    set_verbose_logging(verbose or _get_verbose(ctx))
-    custom_modules = _load_custom_modules(load_module)
-
-    module_options = {}
-    if timezone:
-        module_options["device_timezone"] = timezone
-
-    cmd = CmdAndroidCheckIntrusionLogs(
-        target_path=logs_path,
-        results_path=output,
-        ioc_files=iocs,
-        module_name=module,
-        module_options=module_options if module_options else None,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-        custom_modules=custom_modules,
-    )
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking intrusion logs at path: %s", logs_path)
-
-    cmd.run()
-    cmd.show_alerts_brief()
-    cmd.show_support_message()
-
-
 # ==============================================================================
 # Command: check-iocs
 # ==============================================================================
@@ -445,31 +279,11 @@ def check_intrusion_logs(
 )
 @click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
 @click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option(
-    "--load-module",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_LOAD_MODULE,
-)
 @click.argument("FOLDER", type=click.Path(exists=True))
 @click.pass_context
-def check_iocs(ctx, iocs, list_modules, module, load_module, folder):
-    from mvt.common.cmd_check_iocs import CmdCheckIOCS
-
-    from .command_modules import ANDROID_CHECK_IOCS_MODULES
-
-    custom_modules = _load_custom_modules(load_module)
-    cmd = CmdCheckIOCS(
-        target_path=folder,
-        ioc_files=iocs,
-        module_name=module,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-        custom_modules=custom_modules,
-        platform="android",
-    )
-    cmd.modules = ANDROID_CHECK_IOCS_MODULES
+def check_iocs(ctx, iocs, list_modules, module, folder):
+    cmd = CmdCheckIOCS(target_path=folder, ioc_files=iocs, module_name=module)
+    cmd.modules = BACKUP_MODULES + BUGREPORT_MODULES + ANDROIDQF_MODULES
 
     if list_modules:
         cmd.list_modules()
@@ -485,25 +299,5 @@ def check_iocs(ctx, iocs, list_modules, module, load_module, folder):
 # ==============================================================================
 @cli.command("download-iocs", context_settings=CONTEXT_SETTINGS, help=HELP_MSG_STIX2)
 def download_indicators():
-    from mvt.common.updates import IndicatorsUpdates
-
     ioc_updates = IndicatorsUpdates()
     ioc_updates.update()
-
-
-# ==============================================================================
-# Entry point of the mvt-android console script
-# ==============================================================================
-def main() -> None:
-    """Register the external commands and run the mvt-android CLI.
-
-    External commands are registered here rather than when this module is
-    imported, so that importing MVT never runs third-party code and a plugin
-    importing from MVT cannot re-enter a module that is still initializing.
-    """
-    register_cli_plugins(
-        cli,
-        entry_point_group=ANDROID_CLI_PLUGIN_GROUP,
-        environment_variable=MVT_ANDROID_CUSTOM_COMMANDS_ENV,
-    )
-    cli()

src/mvt/android/cmd_check_androidqf.py

@@ -3,22 +3,16 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import json
 import logging
 import os
-import shutil
-import tempfile
 import zipfile
 from pathlib import Path
 from typing import List, Optional
 
-from mvt.android.artifacts.getprop import GetProp
-from mvt.android.cmd_check_intrusion_logs import CmdAndroidCheckIntrusionLogs
-from mvt.android.cmd_check_backup import CmdAndroidCheckBackup, InvalidAndroidBackup
+from mvt.android.cmd_check_backup import CmdAndroidCheckBackup
 from mvt.android.cmd_check_bugreport import CmdAndroidCheckBugreport
 from mvt.common.command import Command
 from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule
 
 from .modules.androidqf import ANDROIDQF_MODULES
 from .modules.androidqf.base import AndroidQFModule
@@ -52,7 +46,6 @@ class CmdAndroidCheckAndroidQF(Command):
         sub_command: Optional[bool] = False,
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
-        custom_modules: Optional[list[type[MVTModule]]] = None,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -67,10 +60,8 @@ class CmdAndroidCheckAndroidQF(Command):
             log=log,
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
-            custom_modules=custom_modules,
         )
 
-        self.platform = "android"
         self.name = "check-androidqf"
         self.modules = ANDROIDQF_MODULES
 
@@ -95,47 +86,6 @@ class CmdAndroidCheckAndroidQF(Command):
             self.__zip = zipfile.ZipFile(self.target_path)
             self.__files = self.__zip.namelist()
 
-        self._load_acquisition_context()
-
-    def _load_acquisition_context(self) -> None:
-        """Pass AndroidQF acquisition metadata to nested commands and modules."""
-        context = {}
-        metadata_files = [
-            file_path
-            for file_path in self.__files
-            if file_path.replace("\\", "/").rsplit("/", 1)[-1] == "acquisition.json"
-        ]
-        for file_path in metadata_files:
-            try:
-                metadata = json.loads(self._get_file_content(file_path))
-                if isinstance(metadata, dict):
-                    context["started"] = metadata.get("started")
-                    context["adb_host_public_key"] = metadata.get("adb_host_public_key")
-                    break
-            except (json.JSONDecodeError, OSError, TypeError, UnicodeDecodeError):
-                self.log.warning(
-                    'Unable to read AndroidQF acquisition metadata "%s"', file_path
-                )
-
-        if not context.get("adb_host_public_key"):
-            key_files = [
-                file_path
-                for file_path in self.__files
-                if file_path.replace("\\", "/").rsplit("/", 1)[-1] == "adb_host_key.pub"
-            ]
-            for file_path in key_files:
-                try:
-                    context["adb_host_public_key"] = self._get_file_content(
-                        file_path
-                    ).decode("utf-8")
-                    break
-                except (OSError, UnicodeDecodeError):
-                    self.log.warning(
-                        'Unable to read AndroidQF ADB host key "%s"', file_path
-                    )
-
-        self.module_options["androidqf_acquisition"] = context
-
     def module_init(self, module: AndroidQFModule) -> None:  # type: ignore[override]
         if self.__format == "zip" and self.__zip:
             module.from_zip(self.__zip, self.__files)
@@ -189,55 +139,6 @@ class CmdAndroidCheckAndroidQF(Command):
 
         raise NoAndroidQFBackup
 
-    def _read_device_timezone(self) -> Optional[str]:
-        getprop_files = [
-            f for f in self.__files if f.replace("\\", "/").endswith("getprop.txt")
-        ]
-        if not getprop_files:
-            self.log.warning(
-                "Could not find getprop.txt; intrusion log timestamps will use UTC."
-            )
-            return None
-
-        try:
-            content = self._get_file_content(getprop_files[0]).decode(
-                "utf-8", errors="ignore"
-            )
-        except Exception as exc:
-            self.log.warning("Could not read getprop.txt: %s", exc)
-            return None
-
-        props = GetProp()
-        props.parse(content)
-        timezone = props.get_device_timezone()
-        if timezone:
-            self.log.info(
-                "Device timezone identified from getprop.txt: %s",
-                timezone,
-            )
-        else:
-            self.log.warning(
-                "persist.sys.timezone not found in getprop.txt; "
-                "intrusion log timestamps will use UTC."
-            )
-
-        return timezone
-
-    def _get_file_content(self, file_path: str) -> bytes:
-        if self.__format == "zip" and self.__zip:
-            handle = self.__zip.open(file_path)
-            try:
-                return handle.read()
-            finally:
-                handle.close()
-
-        if self.__format == "dir" and self.target_path:
-            parent_path = Path(self.target_path).absolute().parent.as_posix()
-            with open(os.path.join(parent_path, file_path), "rb") as handle:
-                return handle.read()
-
-        raise FileNotFoundError(file_path)
-
     def run_bugreport_cmd(self) -> bool:
         bugreport = None
         try:
@@ -256,13 +157,11 @@ class CmdAndroidCheckAndroidQF(Command):
                 module_options=self.module_options,
                 hashes=self.hashes,
                 sub_command=True,
-                custom_modules=self.custom_modules,
             )
             cmd.from_zip(bugreport)
             cmd.run()
 
             self.timeline.extend(cmd.timeline)
-            self.url_results.extend(cmd.url_results)
             self.alertstore.extend(cmd.alertstore.alerts)
         finally:
             if bugreport:
@@ -287,109 +186,17 @@ class CmdAndroidCheckAndroidQF(Command):
             module_options=self.module_options,
             hashes=self.hashes,
             sub_command=True,
-            custom_modules=self.custom_modules,
         )
-        try:
-            cmd.from_ab(backup)
-        except InvalidAndroidBackup as exc:
-            self.log.warning("Skipping backup modules: %s", exc)
-            return False
-
+        cmd.from_ab(backup)
         cmd.run()
 
         self.timeline.extend(cmd.timeline)
-        self.url_results.extend(cmd.url_results)
         self.alertstore.extend(cmd.alertstore.alerts)
         return True
 
-    def run_intrusion_logs_cmd(self) -> bool:
-        intrusion_log_files = [
-            f
-            for f in self.__files
-            if "/intrusion_logs/" in f.replace("\\", "/")
-            or f.replace("\\", "/").startswith("intrusion_logs/")
-        ]
-
-        if not intrusion_log_files:
-            self.log.info(
-                "No intrusion_logs folder found in AndroidQF data, "
-                "skipping intrusion logs analysis."
-            )
-            return False
-
-        self.log.info(
-            "Found intrusion_logs folder in AndroidQF data, running intrusion logs analysis."
-        )
-
-        intrusion_logs_path = None
-        temp_dir = None
-
-        try:
-            if self.__format == "dir" and self.target_path:
-                intrusion_logs_path = os.path.join(
-                    os.path.abspath(self.target_path), "intrusion_logs"
-                )
-                if not os.path.isdir(intrusion_logs_path):
-                    self.log.warning(
-                        "intrusion_logs directory not found at %s",
-                        intrusion_logs_path,
-                    )
-                    return False
-
-            elif self.__format == "zip" and self.__zip:
-                temp_dir = tempfile.mkdtemp(prefix="mvt_intrusion_logs_")
-                temp_root = Path(temp_dir).resolve()
-                for entry in intrusion_log_files:
-                    normalized = entry.replace("\\", "/")
-                    idx = normalized.find("intrusion_logs/")
-                    relative = normalized[idx + len("intrusion_logs/") :]
-                    if not relative or relative.endswith("/"):
-                        continue
-
-                    target = (temp_root / relative).resolve()
-                    if not target.is_relative_to(temp_root):
-                        self.log.warning(
-                            "Skipping unsafe intrusion log archive entry: %s", entry
-                        )
-                        continue
-
-                    target.parent.mkdir(parents=True, exist_ok=True)
-                    with self.__zip.open(entry) as src, target.open("wb") as dst:
-                        dst.write(src.read())
-
-                intrusion_logs_path = temp_dir
-            else:
-                return False
-
-            adv_module_options = dict(self.module_options or {})
-            if device_timezone := self._read_device_timezone():
-                adv_module_options["device_timezone"] = device_timezone
-
-            cmd = CmdAndroidCheckIntrusionLogs(
-                target_path=intrusion_logs_path,
-                results_path=self.results_path,
-                ioc_files=self.ioc_files,
-                iocs=self.iocs,
-                module_options=adv_module_options,
-                hashes=self.hashes,
-                sub_command=True,
-                custom_modules=self.custom_modules,
-            )
-            cmd.run()
-
-            self.timeline.extend(cmd.timeline)
-            self.url_results.extend(cmd.url_results)
-            self.alertstore.extend(cmd.alertstore.alerts)
-            return True
-
-        finally:
-            if temp_dir:
-                shutil.rmtree(temp_dir, ignore_errors=True)
-
     def finish(self) -> None:
         """
-        Run nested modules if their respective files are found in AndroidQF data.
+        Run the bugreport and backup modules if the respective files are found in the AndroidQF data.
         """
         self.run_bugreport_cmd()
         self.run_backup_cmd()
-        self.run_intrusion_logs_cmd()

src/mvt/android/cmd_check_backup.py

@@ -21,17 +21,12 @@ from mvt.android.parsers.backup import (
 )
 from mvt.common.command import Command
 from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule
 
 from .modules.backup import BACKUP_MODULES
 
 log = logging.getLogger(__name__)
 
 
-class InvalidAndroidBackup(Exception):
-    pass
-
-
 class CmdAndroidCheckBackup(Command):
     def __init__(
         self,
@@ -46,7 +41,6 @@ class CmdAndroidCheckBackup(Command):
         sub_command: Optional[bool] = False,
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
-        custom_modules: Optional[list[type[MVTModule]]] = None,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -61,10 +55,8 @@ class CmdAndroidCheckBackup(Command):
             log=log,
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
-            custom_modules=custom_modules,
         )
 
-        self.platform = "android"
         self.name = "check-backup"
         self.modules = BACKUP_MODULES
 
@@ -76,10 +68,6 @@ class CmdAndroidCheckBackup(Command):
         self.__type = "ab"
         header = parse_ab_header(ab_file_bytes)
         if not header["backup"]:
-            if self.sub_command:
-                raise InvalidAndroidBackup(
-                    "Invalid backup format, file should be in .ab format"
-                )
             log.critical("Invalid backup format, file should be in .ab format")
             sys.exit(1)
 
@@ -87,37 +75,20 @@ class CmdAndroidCheckBackup(Command):
         if header["encryption"] != "none":
             password = prompt_or_load_android_backup_password(log, self.module_options)
             if not password:
-                if self.sub_command:
-                    raise InvalidAndroidBackup("No backup password provided")
                 log.critical("No backup password provided.")
                 sys.exit(1)
         try:
             tardata = parse_backup_file(ab_file_bytes, password=password)
         except InvalidBackupPassword:
-            if self.sub_command:
-                raise InvalidAndroidBackup("Invalid backup password")
             log.critical("Invalid backup password")
             sys.exit(1)
         except AndroidBackupParsingError as exc:
-            if self.sub_command:
-                raise InvalidAndroidBackup(
-                    f"Impossible to parse this backup file: {exc}"
-                ) from exc
             log.critical("Impossible to parse this backup file: %s", exc)
             log.critical("Please use Android Backup Extractor (ABE) instead")
             sys.exit(1)
 
         dbytes = io.BytesIO(tardata)
-        try:
-            self.__tar = tarfile.open(fileobj=dbytes)
-        except tarfile.TarError as exc:
-            if self.sub_command:
-                raise InvalidAndroidBackup(
-                    f"Impossible to parse this backup file: {exc}"
-                ) from exc
-            log.critical("Impossible to parse this backup file: %s", exc)
-            log.critical("Please use Android Backup Extractor (ABE) instead")
-            sys.exit(1)
+        self.__tar = tarfile.open(fileobj=dbytes)
         for member in self.__tar:
             self.__files.append(member.name)
 

src/mvt/android/cmd_check_bugreport.py

@@ -12,7 +12,6 @@ from zipfile import ZipFile
 from mvt.android.modules.bugreport.base import BugReportModule
 from mvt.common.command import Command
 from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule
 
 from .modules.bugreport import BUGREPORT_MODULES
 
@@ -33,7 +32,6 @@ class CmdAndroidCheckBugreport(Command):
         sub_command: Optional[bool] = False,
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
-        custom_modules: Optional[list[type[MVTModule]]] = None,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -48,10 +46,8 @@ class CmdAndroidCheckBugreport(Command):
             log=log,
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
-            custom_modules=custom_modules,
         )
 
-        self.platform = "android"
         self.name = "check-bugreport"
         self.modules = BUGREPORT_MODULES
 

src/mvt/android/cmd_check_intrusion_logs.py

@@ -1,117 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-from typing import Optional
-
-from mvt.common.command import Command
-from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule
-
-from .modules.intrusion_logs import (
-    INTRUSION_LOGS_MODULES,
-    KNOWN_INTRUSION_LOG_EVENT_TYPES,
-)
-from .modules.intrusion_logs.base import IntrusionLogsModule
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckIntrusionLogs(Command):
-    """Command to check Android Intrusion Logging files."""
-
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
-        custom_modules: Optional[list[type[MVTModule]]] = None,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            iocs=iocs,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            hashes=hashes,
-            sub_command=sub_command,
-            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
-            custom_modules=custom_modules,
-        )
-
-        self.platform = "android"
-        self.name = "check-intrusion-logs"
-        self.modules = INTRUSION_LOGS_MODULES
-        self._all_events: dict[str, list[dict]] = {}
-
-    def init(self) -> None:
-        if not self.target_path:
-            raise ValueError("No target path specified")
-
-        if not os.path.isdir(self.target_path) and not (
-            os.path.isfile(self.target_path)
-            and self.target_path.lower().endswith(".zip")
-        ):
-            raise ValueError(
-                f"Target path must be a directory or a .zip file: {self.target_path}"
-            )
-
-        self.log.info("Checking intrusion logs at path: %s", self.target_path)
-        self._all_events = self._pre_load_events()
-
-    def module_init(self, module: IntrusionLogsModule) -> None:  # type: ignore[override]
-        module.il_events_by_type = self._all_events
-
-    def finish(self) -> None:
-        return
-
-    def _pre_load_events(self) -> dict[str, list[dict]]:
-        """Load and parse all advanced-log files once for reuse by all modules."""
-        self.log.info("Pre-loading intrusion log files from: %s", self.target_path)
-
-        loader = IntrusionLogsModule(
-            target_path=self.target_path,
-            log=self.log,
-        )
-
-        try:
-            all_events = loader.load_all_events(self.target_path)
-        except Exception as exc:
-            self.log.error("Failed to pre-load events: %s", exc)
-            return {}
-
-        total_events = sum(len(events) for events in all_events.values())
-        self.log.info(
-            "Pre-loaded %d events across %d type(s); modules will reuse this data",
-            total_events,
-            len(all_events),
-        )
-
-        unknown_event_types = sorted(
-            event_type
-            for event_type in all_events
-            if event_type not in KNOWN_INTRUSION_LOG_EVENT_TYPES
-        )
-        if unknown_event_types:
-            self.log.warning(
-                "Found unknown intrusion logging event type(s): %s. "
-                "Please open an issue on GitHub so MVT can add support for them.",
-                ", ".join(unknown_event_types),
-            )
-
-        return all_events

src/mvt/android/command_modules.py

@@ -1,23 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-"""Module lists an mvt-android command composes from more than one family.
-
-Commands whose modules are one family read that family directly. check-iocs
-re-checks stored results, so it has to know every module that could have
-written one, and both the CLI and any other code needing that answer share
-the list from here rather than each concatenating their own.
-"""
-
-from mvt.common.module import MVTModule
-
-from .modules.androidqf import ANDROIDQF_MODULES
-from .modules.backup import BACKUP_MODULES
-from .modules.bugreport import BUGREPORT_MODULES
-from .modules.intrusion_logs import INTRUSION_LOGS_MODULES
-
-ANDROID_CHECK_IOCS_MODULES: list[type[MVTModule]] = (
-    BACKUP_MODULES + BUGREPORT_MODULES + ANDROIDQF_MODULES + INTRUSION_LOGS_MODULES
-)

src/mvt/android/modules/adb/__init__.py

@@ -0,0 +1,32 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .chrome_history import ChromeHistory
+from .dumpsys_full import DumpsysFull
+from .files import Files
+from .getprop import Getprop
+from .logcat import Logcat
+from .packages import Packages
+from .processes import Processes
+from .root_binaries import RootBinaries
+from .selinux_status import SELinuxStatus
+from .settings import Settings
+from .sms import SMS
+from .whatsapp import Whatsapp
+
+ADB_MODULES = [
+    ChromeHistory,
+    SMS,
+    Whatsapp,
+    Processes,
+    Getprop,
+    Settings,
+    SELinuxStatus,
+    DumpsysFull,
+    Packages,
+    Logcat,
+    RootBinaries,
+    Files,
+]

src/mvt/android/modules/adb/chrome_history.py

@@ -0,0 +1,117 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+import sqlite3
+from typing import Optional
+
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
+from mvt.common.utils import convert_chrometime_to_datetime, convert_datetime_to_iso
+
+from .base import AndroidExtraction
+
+CHROME_HISTORY_PATH = "data/data/com.android.chrome/app_chrome/Default/History"
+
+
+class ChromeHistory(AndroidExtraction):
+    """This module extracts records from Android's Chrome browsing history."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+        self.results: list = []
+
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        return {
+            "timestamp": record["isodate"],
+            "module": self.__class__.__name__,
+            "event": "visit",
+            "data": f"{record['id']} - {record['url']} (visit ID: {record['visit_id']}, "
+            f"redirect source: {record['redirect_source']})",
+        }
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc_match = self.indicators.check_url(result["url"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+
+    def _parse_db(self, db_path: str) -> None:
+        """Parse a Chrome History database file.
+
+        :param db_path: Path to the History database to process.
+
+        """
+        assert isinstance(self.results, list)  # assert results type for mypy
+        conn = sqlite3.connect(db_path)
+        cur = conn.cursor()
+        cur.execute(
+            """
+            SELECT
+                urls.id,
+                urls.url,
+                visits.id,
+                visits.visit_time,
+                visits.from_visit
+            FROM urls
+            JOIN visits ON visits.url = urls.id
+            ORDER BY visits.visit_time;
+        """
+        )
+
+        for item in cur:
+            self.results.append(
+                {
+                    "id": item[0],
+                    "url": item[1],
+                    "visit_id": item[2],
+                    "timestamp": item[3],
+                    "isodate": convert_datetime_to_iso(
+                        convert_chrometime_to_datetime(item[3])
+                    ),
+                    "redirect_source": item[4],
+                }
+            )
+
+        cur.close()
+        conn.close()
+
+        self.log.info("Extracted a total of %d history items", len(self.results))
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        try:
+            self._adb_process_file(
+                os.path.join("/", CHROME_HISTORY_PATH), self._parse_db
+            )
+        except Exception as exc:
+            self.log.error(exc)
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/dumpsys_full.py

@@ -0,0 +1,46 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+from typing import Optional
+
+from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
+
+
+class DumpsysFull(AndroidExtraction):
+    """This module extracts stats on battery consumption by processes."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys")
+        if self.results_path:
+            output_path = os.path.join(self.results_path, "dumpsys.txt")
+            with open(output_path, "w", encoding="utf-8") as handle:
+                handle.write(output)
+
+            self.log.info("Full dumpsys output stored at %s", output_path)
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/files.py

@@ -0,0 +1,160 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+import stat
+from typing import Optional, Union
+
+from mvt.common.module_types import ModuleResults
+from mvt.common.utils import convert_unix_to_iso
+
+from .base import AndroidExtraction
+
+ANDROID_TMP_FOLDERS = [
+    "/tmp/",
+    "/data/local/tmp/",
+]
+ANDROID_MEDIA_FOLDERS = [
+    "/data/media/0",
+    "/sdcard/",
+]
+
+
+class Files(AndroidExtraction):
+    """This module extracts the list of files on the device."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+        self.full_find = False
+
+    def serialize(self, record: dict) -> Union[dict, list, None]:
+        if "modified_time" in record:
+            return {
+                "timestamp": record["modified_time"],
+                "module": self.__class__.__name__,
+                "event": "file_modified",
+                "data": record["path"],
+            }
+
+        return None
+
+    def check_indicators(self) -> None:
+        for result in self.results:
+            if result.get("is_suid"):
+                self.log.warning(
+                    'Found an SUID file in a non-standard directory "%s".',
+                    result["path"],
+                )
+
+            if self.indicators:
+                ioc_match = self.indicators.check_file_path(result["path"])
+                if ioc_match:
+                    self.alertstore.critical(
+                        f'Found a known suspicious file at path: "{result["path"]}"',
+                        "",
+                        result,
+                        matched_indicator=ioc_match,
+                    )
+
+    def backup_file(self, file_path: str) -> None:
+        if not self.results_path:
+            return
+
+        local_file_name = file_path.replace("/", "_").replace(" ", "-")
+        local_files_folder = os.path.join(self.results_path, "files")
+        if not os.path.exists(local_files_folder):
+            os.mkdir(local_files_folder)
+
+        local_file_path = os.path.join(local_files_folder, local_file_name)
+
+        try:
+            self._adb_download(remote_path=file_path, local_path=local_file_path)
+        except Exception:
+            pass
+        else:
+            self.log.info(
+                "Downloaded file %s to local copy at %s", file_path, local_file_path
+            )
+
+    def find_files(self, folder: str) -> None:
+        assert isinstance(self.results, list)
+        if self.full_find:
+            cmd = f"find '{folder}' -type f -printf '%T@ %m %s %u %g %p\n' 2> /dev/null"
+            output = self._adb_command(cmd)
+
+            for file_line in output.splitlines():
+                file_info = file_line.rstrip().split(" ", 5)
+                if len(file_line) < 6:
+                    self.log.info("Skipping invalid file info - %s", file_line.rstrip())
+                    continue
+                [unix_timestamp, mode, size, owner, group, full_path] = file_info
+                mod_time = convert_unix_to_iso(unix_timestamp)
+
+                self.results.append(
+                    {
+                        "path": full_path,
+                        "modified_time": mod_time,
+                        "mode": mode,
+                        "is_suid": (int(mode, 8) & stat.S_ISUID) == 2048,
+                        "is_sgid": (int(mode, 8) & stat.S_ISGID) == 1024,
+                        "size": size,
+                        "owner": owner,
+                        "group": group,
+                    }
+                )
+        else:
+            output = self._adb_command(f"find '{folder}' -type f 2> /dev/null")
+            for file_line in output.splitlines():
+                self.results.append({"path": file_line.rstrip()})
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        cmd = "find '/' -maxdepth 1 -printf '%T@ %m %s %u %g %p\n' 2> /dev/null"
+        output = self._adb_command(cmd)
+        if output or output.strip().splitlines():
+            self.full_find = True
+
+        for tmp_folder in ANDROID_TMP_FOLDERS:
+            self.find_files(tmp_folder)
+
+        for entry in self.results:
+            self.log.info("Found file in tmp folder at path %s", entry.get("path"))
+            self.backup_file(entry.get("path"))
+
+        for media_folder in ANDROID_MEDIA_FOLDERS:
+            self.find_files(media_folder)
+
+        self.log.info(
+            "Found %s files in primary Android tmp and media folders", len(self.results)
+        )
+
+        if self.module_options.get("fast_mode", None):
+            self.log.info(
+                "The `fast_mode` option was enabled: skipping full file listing"
+            )
+        else:
+            self.log.info("Processing full file listing. This may take a while...")
+            self.find_files("/")
+
+            self.log.info("Found %s total files", len(self.results))
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/getprop.py

@@ -0,0 +1,44 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
+
+from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
+
+
+class Getprop(GetPropArtifact, AndroidExtraction):
+    """This module extracts device properties from getprop command."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.results = {} if not results else results
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("getprop")
+        self._adb_disconnect()
+
+        self.parse(output)
+        self.log.info("Extracted %d Android system properties", len(self.results))

src/mvt/android/modules/adb/logcat.py

@@ -0,0 +1,58 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+from typing import Optional
+
+from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
+
+
+class Logcat(AndroidExtraction):
+    """This module extracts details on installed packages."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        # Get the current logcat.
+        output = self._adb_command('logcat -d -b all "*:V"')
+        # Get the locat prior to last reboot.
+        last_output = self._adb_command('logcat -L -b all "*:V"')
+
+        if self.results_path:
+            logcat_path = os.path.join(self.results_path, "logcat.txt")
+            with open(logcat_path, "w", encoding="utf-8") as handle:
+                handle.write(output)
+
+            self.log.info("Current logcat logs stored at %s", logcat_path)
+
+            logcat_last_path = os.path.join(self.results_path, "logcat_last.txt")
+            with open(logcat_last_path, "w", encoding="utf-8") as handle:
+                handle.write(last_output)
+
+            self.log.info(
+                "Logcat logs prior to last reboot stored at %s", logcat_last_path
+            )
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/packages.py

@@ -0,0 +1,311 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_packages import DumpsysPackagesArtifact
+from mvt.android.utils import (
+    DANGEROUS_PERMISSIONS,
+    DANGEROUS_PERMISSIONS_THRESHOLD,
+    ROOT_PACKAGES,
+    SECURITY_PACKAGES,
+    SYSTEM_UPDATE_PACKAGES,
+)
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
+
+from .base import AndroidExtraction
+
+
+class Packages(AndroidExtraction):
+    """This module extracts the list of installed packages."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+        self._user_needed = False
+
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        records = []
+
+        timestamps = [
+            {"event": "package_install", "timestamp": record["timestamp"]},
+            {
+                "event": "package_first_install",
+                "timestamp": record["first_install_time"],
+            },
+            {"event": "package_last_update", "timestamp": record["last_update_time"]},
+        ]
+
+        for timestamp in timestamps:
+            records.append(
+                {
+                    "timestamp": timestamp["timestamp"],
+                    "module": self.__class__.__name__,
+                    "event": timestamp["event"],
+                    "data": f"{record['package_name']} (system: {record['system']},"
+                    f" third party: {record['third_party']})",
+                }
+            )
+
+        return records
+
+    def check_indicators(self) -> None:
+        for result in self.results:
+            if result["package_name"] in ROOT_PACKAGES:
+                self.log.warning(
+                    'Found an installed package related to rooting/jailbreaking: "%s"',
+                    result["package_name"],
+                )
+                self.detected.append(result)
+                continue
+
+            if result["package_name"] in SECURITY_PACKAGES and result["disabled"]:
+                self.log.warning(
+                    'Found a security package disabled: "%s"', result["package_name"]
+                )
+
+            if result["package_name"] in SYSTEM_UPDATE_PACKAGES and result["disabled"]:
+                self.log.warning(
+                    'System OTA update package "%s" disabled on the phone',
+                    result["package_name"],
+                )
+
+            if not self.indicators:
+                continue
+
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+
+            for package_file in result.get("files", []):
+                ioc_match = self.indicators.check_file_hash(package_file["sha256"])
+                if ioc_match:
+                    self.alertstore.critical(
+                        ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                    )
+
+    # @staticmethod
+    # def check_virustotal(packages: list) -> None:
+    #     hashes = []
+    #     for package in packages:
+    #         for file in package.get("files", []):
+    #             if file["sha256"] not in hashes:
+    #                 hashes.append(file["sha256"])
+
+    #     total_hashes = len(hashes)
+    #     detections = {}
+
+    #     progress_desc = f"Looking up {total_hashes} files..."
+    #     for i in track(range(total_hashes), description=progress_desc):
+    #         try:
+    #             results = virustotal_lookup(hashes[i])
+    #         except VTNoKey:
+    #             return
+    #         except VTQuotaExceeded as exc:
+    #             print("Unable to continue: %s", exc)
+    #             break
+
+    #         if not results:
+    #             continue
+
+    #         positives = results["attributes"]["last_analysis_stats"]["malicious"]
+    #         total = len(results["attributes"]["last_analysis_results"])
+
+    #         detections[hashes[i]] = f"{positives}/{total}"
+
+    #     table = Table(title="VirusTotal Packages Detections")
+    #     table.add_column("Package name")
+    #     table.add_column("File path")
+    #     table.add_column("Detections")
+
+    #     for package in packages:
+    #         for file in package.get("files", []):
+    #             row = [package["package_name"], file["path"]]
+
+    #             if file["sha256"] in detections:
+    #                 detection = detections[file["sha256"]]
+    #                 positives = detection.split("/")[0]
+    #                 if int(positives) > 0:
+    #                     row.append(Text(detection, "red bold"))
+    #                 else:
+    #                     row.append(detection)
+    #             else:
+    #                 row.append("not found")
+
+    #             table.add_row(*row)
+
+    #     console = Console()
+    #     console.print(table)
+
+    @staticmethod
+    def parse_package_for_details(output: str) -> dict:
+        lines = []
+        in_packages = False
+        for line in output.splitlines():
+            if in_packages:
+                if line.strip() == "":
+                    break
+                lines.append(line)
+            if line.strip() == "Packages:":
+                in_packages = True
+
+        return DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
+            "\n".join(lines)
+        )
+
+    def _get_files_for_package(self, package_name: str) -> list:
+        command = f"pm path {package_name}"
+        if self._user_needed:
+            command += " --user 0"
+        output = self._adb_command(command)
+        output = output.strip().replace("package:", "")
+        if not output:
+            return []
+
+        package_files = []
+        for file_path in output.splitlines():
+            file_path = file_path.strip()
+
+            md5 = self._adb_command(f"md5sum {file_path}").split(" ", maxsplit=1)[0]
+            sha1 = self._adb_command(f"sha1sum {file_path}").split(" ", maxsplit=1)[0]
+            sha256 = self._adb_command(f"sha256sum {file_path}").split(" ", maxsplit=1)[
+                0
+            ]
+            sha512 = self._adb_command(f"sha512sum {file_path}").split(" ", maxsplit=1)[
+                0
+            ]
+
+            package_files.append(
+                {
+                    "path": file_path,
+                    "md5": md5,
+                    "sha1": sha1,
+                    "sha256": sha256,
+                    "sha512": sha512,
+                }
+            )
+
+        return package_files
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        packages = self._adb_command("pm list packages -u -i -f")
+        if "java.lang.SecurityException" in packages or packages.strip() == "":
+            self._user_needed = True
+            packages = self._adb_command("pm list packages -u -i -f --user 0")
+
+        for line in packages.splitlines():
+            line = line.strip()
+            if not line.startswith("package:"):
+                continue
+
+            fields = line.split()
+            file_name, package_name = fields[0].split(":")[1].rsplit("=", 1)
+
+            try:
+                installer = fields[1].split("=")[1].strip()
+            except IndexError:
+                installer = None
+            else:
+                if installer == "null":
+                    installer = None
+
+            package_files = self._get_files_for_package(package_name)
+            new_package = {
+                "package_name": package_name,
+                "file_name": file_name,
+                "installer": installer,
+                "disabled": False,
+                "system": False,
+                "third_party": False,
+                "files": package_files,
+            }
+
+            dumpsys_package = self._adb_command(f"dumpsys package {package_name}")
+            package_details = self.parse_package_for_details(dumpsys_package)
+            new_package.update(package_details)
+
+            self.results.append(new_package)
+
+        cmds = [
+            {"field": "disabled", "arg": "-d"},
+            {"field": "system", "arg": "-s"},
+            {"field": "third_party", "arg": "-3"},
+        ]
+        for cmd in cmds:
+            command = f"pm list packages {cmd['arg']}"
+            if self._user_needed:
+                command += " --user 0"
+            output = self._adb_command(command)
+            for line in output.splitlines():
+                line = line.strip()
+                if not line.startswith("package:"):
+                    continue
+
+                package_name = line.split(":", 1)[1]
+                for i, result in enumerate(self.results):
+                    if result["package_name"] == package_name:
+                        self.results[i][cmd["field"]] = True
+
+        for result in self.results:
+            if not result["third_party"]:
+                continue
+
+            dangerous_permissions_count = 0
+            for perm in result["requested_permissions"]:
+                if perm in DANGEROUS_PERMISSIONS:
+                    dangerous_permissions_count += 1
+
+            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
+                self.log.info(
+                    'Third-party package "%s" requested %d '
+                    "potentially dangerous permissions",
+                    result["package_name"],
+                    dangerous_permissions_count,
+                )
+
+        packages_to_lookup = []
+        for result in self.results:
+            if result["system"]:
+                continue
+
+            packages_to_lookup.append(result)
+            self.log.info(
+                'Found non-system package with name "%s" installed by "%s" on %s',
+                result["package_name"],
+                result["installer"],
+                result["timestamp"],
+            )
+
+        if not self.module_options.get("fast_mode", None):
+            self.check_virustotal(packages_to_lookup)
+
+        self.log.info(
+            "Extracted at total of %d installed package names", len(self.results)
+        )
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/processes.py

@@ -0,0 +1,43 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.processes import Processes as ProcessesArtifact
+
+from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
+
+
+class Processes(ProcessesArtifact, AndroidExtraction):
+    """This module extracts details on running processes."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        output = self._adb_command("ps -A")
+        self.parse(output)
+        self._adb_disconnect()
+
+        self.log.info("Extracted records on a total of %d processes", len(self.results))

src/mvt/android/modules/adb/root_binaries.py

@@ -0,0 +1,75 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.common.module_types import ModuleResults
+
+from .base import AndroidExtraction
+
+
+class RootBinaries(AndroidExtraction):
+    """This module extracts the list of installed packages."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def check_indicators(self) -> None:
+        for root_binary in self.results:
+            self.alertstore.high(
+                f'Found root binary "{root_binary}"',
+                "",
+                root_binary,
+            )
+
+    def run(self) -> None:
+        root_binaries = [
+            "su",
+            "busybox",
+            "supersu",
+            "Superuser.apk",
+            "KingoUser.apk",
+            "SuperSu.apk",
+            "magisk",
+            "magiskhide",
+            "magiskinit",
+            "magiskpolicy",
+        ]
+
+        self._adb_connect()
+
+        for root_binary in root_binaries:
+            root_binary = root_binary.strip()
+            if not root_binary:
+                continue
+
+            output = self._adb_command(f"which -a {root_binary}")
+            output = output.strip()
+
+            if not output:
+                continue
+
+            if "which: not found" in output:
+                continue
+
+            self.results.append(root_binary)
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/selinux_status.py

@@ -0,0 +1,50 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.common.module_types import ModuleResults
+
+from .base import AndroidExtraction
+
+
+class SELinuxStatus(AndroidExtraction):
+    """This module checks if SELinux is being enforced."""
+
+    slug = "selinux_status"
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.results: dict = {}
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("getenforce")
+        self._adb_disconnect()
+
+        status = output.lower().strip()
+        self.results["status"] = status
+
+        if status == "enforcing":
+            self.log.info("SELinux is being regularly enforced")
+        else:
+            self.log.warning('SELinux status is "%s"!', status)

src/mvt/android/modules/adb/settings.py

@@ -0,0 +1,59 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.settings import Settings as SettingsArtifact
+from mvt.common.module_types import ModuleResults
+
+from .base import AndroidExtraction
+
+
+class Settings(SettingsArtifact, AndroidExtraction):
+    """This module extracts Android system settings."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.results = {} if not results else results
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        for namespace in ["system", "secure", "global"]:
+            out = self._adb_command(f"cmd settings list {namespace}")
+            if not out:
+                continue
+
+            self.results[namespace] = {}
+
+            for line in out.splitlines():
+                line = line.strip()
+                if line == "":
+                    continue
+
+                fields = line.split("=", 1)
+                try:
+                    self.results[namespace][fields[0]] = fields[1]
+                except IndexError:
+                    continue
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/sms.py

@@ -0,0 +1,186 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+import sqlite3
+from typing import Optional
+
+from mvt.android.parsers.backup import AndroidBackupParsingError, parse_tar_for_sms
+from mvt.common.module import InsufficientPrivileges
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
+from mvt.common.utils import check_for_links, convert_unix_to_iso
+
+from .base import AndroidExtraction
+
+SMS_BUGLE_PATH = "data/data/com.google.android.apps.messaging/databases/bugle_db"
+SMS_BUGLE_QUERY = """
+SELECT
+    ppl.normalized_destination AS address,
+    p.timestamp AS timestamp,
+CASE WHEN m.sender_id IN
+(SELECT _id FROM participants WHERE contact_id=-1)
+THEN 2 ELSE 1 END incoming, p.text AS body
+FROM messages m, conversations c, parts p,
+        participants ppl, conversation_participants cp
+WHERE (m.conversation_id = c._id)
+    AND (m._id = p.message_id)
+    AND (cp.conversation_id = c._id)
+    AND (cp.participant_id = ppl._id);
+"""
+
+SMS_MMSSMS_PATH = "data/data/com.android.providers.telephony/databases/mmssms.db"
+SMS_MMSMS_QUERY = """
+SELECT
+    address AS address,
+    date_sent AS timestamp,
+    type as incoming,
+    body AS body
+FROM sms;
+"""
+
+
+class SMS(AndroidExtraction):
+    """This module extracts all SMS messages."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.sms_db_type = 0
+
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        body = record["body"].replace("\n", "\\n")
+        return {
+            "timestamp": record["isodate"],
+            "module": self.__class__.__name__,
+            "event": f"sms_{record['direction']}",
+            "data": f'{record.get("address", "unknown source")}: "{body}"',
+        }
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for message in self.results:
+            if "body" not in message:
+                continue
+
+            message_links = message.get("links", [])
+            if message_links == []:
+                message_links = check_for_links(message["body"])
+
+            ioc_match = self.indicators.check_urls(message_links)
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", message, matched_indicator=ioc_match.ioc
+                )
+
+    def _parse_db(self, db_path: str) -> None:
+        """Parse an Android bugle_db SMS database file.
+
+        :param db_path: Path to the Android SMS database file to process
+
+        """
+        conn = sqlite3.connect(db_path)
+        cur = conn.cursor()
+
+        if self.sms_db_type == 1:
+            cur.execute(SMS_BUGLE_QUERY)
+        elif self.sms_db_type == 2:
+            cur.execute(SMS_MMSMS_QUERY)
+
+        names = [description[0] for description in cur.description]
+
+        for item in cur:
+            message = {}
+            for index, value in enumerate(item):
+                message[names[index]] = value
+
+            message["direction"] = "received" if message["incoming"] == 1 else "sent"
+            message["isodate"] = convert_unix_to_iso(message["timestamp"])
+
+            # Extract links in the message body
+            body = message.get("body", None)
+            if body:
+                links = check_for_links(message["body"])
+                message["links"] = links
+
+            self.results.append(message)
+
+        cur.close()
+        conn.close()
+
+        self.log.info("Extracted a total of %d SMS messages", len(self.results))
+
+    def _extract_sms_adb(self) -> None:
+        """Use the Android backup command to extract SMS data from the native
+        SMS app.
+
+        It is crucial to use the under-documented "-nocompress" flag to disable
+        the non-standard Java compression algorithm. This module only supports
+        an unencrypted ADB backup.
+        """
+        backup_tar = self._generate_backup("com.android.providers.telephony")
+        if not backup_tar:
+            return
+
+        try:
+            self.results = parse_tar_for_sms(backup_tar)
+        except AndroidBackupParsingError:
+            self.log.info(
+                "Impossible to read SMS from the Android Backup, "
+                "please extract the SMS and try extracting it with "
+                "Android Backup Extractor"
+            )
+            return
+
+        self.log.info("Extracted a total of %d SMS messages", len(self.results))
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        try:
+            if self._adb_check_file_exists(os.path.join("/", SMS_BUGLE_PATH)):
+                self.sms_db_type = 1
+                self._adb_process_file(
+                    os.path.join("/", SMS_BUGLE_PATH), self._parse_db
+                )
+            elif self._adb_check_file_exists(os.path.join("/", SMS_MMSSMS_PATH)):
+                self.sms_db_type = 2
+                self._adb_process_file(
+                    os.path.join("/", SMS_MMSSMS_PATH), self._parse_db
+                )
+
+            self._adb_disconnect()
+            return
+        except InsufficientPrivileges:
+            pass
+
+        self.log.info(
+            "No SMS database found. Trying extraction of SMS data "
+            "using Android backup feature."
+        )
+        self._extract_sms_adb()
+
+        self._adb_disconnect()

src/mvt/android/modules/adb/whatsapp.py

@@ -0,0 +1,121 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import base64
+import logging
+import os
+import sqlite3
+from typing import Optional
+
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
+from mvt.common.utils import check_for_links, convert_unix_to_iso
+
+from .base import AndroidExtraction
+
+WHATSAPP_PATH = "data/data/com.whatsapp/databases/msgstore.db"
+
+
+class Whatsapp(AndroidExtraction):
+    """This module extracts all WhatsApp messages containing links."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: ModuleResults = [],
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        text = record["data"].replace("\n", "\\n")
+        return {
+            "timestamp": record["isodate"],
+            "module": self.__class__.__name__,
+            "event": f"whatsapp_msg_{record['direction']}",
+            "data": f'"{text}"',
+        }
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for message in self.results:
+            if "data" not in message:
+                continue
+
+            message_links = check_for_links(message["data"])
+            ioc_match = self.indicators.check_urls(message_links)
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", message, matched_indicator=ioc_match.ioc
+                )
+                continue
+
+    def _parse_db(self, db_path: str) -> None:
+        """Parse an Android msgstore.db WhatsApp database file.
+
+        :param db_path: Path to the Android WhatsApp database file to process
+
+        """
+        conn = sqlite3.connect(db_path)
+        cur = conn.cursor()
+        cur.execute(
+            """
+            SELECT * FROM messages;
+        """
+        )
+        names = [description[0] for description in cur.description]
+
+        messages = []
+        for item in cur:
+            message = {}
+            for index, value in enumerate(item):
+                message[names[index]] = value
+
+            if not message["data"]:
+                continue
+
+            message["direction"] = "send" if message["key_from_me"] == 1 else "received"
+            message["isodate"] = convert_unix_to_iso(message["timestamp"])
+
+            # If we find links in the messages or if they are empty we add them
+            # to the list.
+            if check_for_links(message["data"]) or message["data"].strip() == "":
+                if message.get("thumb_image"):
+                    message["thumb_image"] = base64.b64encode(message["thumb_image"])
+
+                messages.append(message)
+
+        cur.close()
+        conn.close()
+
+        self.log.info(
+            "Extracted a total of %d WhatsApp messages containing links", len(messages)
+        )
+        self.results = messages
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        try:
+            self._adb_process_file(os.path.join("/", WHATSAPP_PATH), self._parse_db)
+        except Exception as exc:
+            self.log.error(exc)
+
+        self._adb_disconnect()

src/mvt/android/modules/androidqf/__init__.py

@@ -3,24 +3,22 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-from mvt.common.module import MVTModule
-
 from .aqf_files import AQFFiles
 from .aqf_getprop import AQFGetProp
-from .aqf_log_timestamps import AQFLogTimestamps
 from .aqf_packages import AQFPackages
 from .aqf_processes import AQFProcesses
 from .aqf_settings import AQFSettings
 from .mounts import Mounts
 from .root_binaries import RootBinaries
+from .sms import SMS
 
-ANDROIDQF_MODULES: list[type[MVTModule]] = [
+ANDROIDQF_MODULES = [
     AQFPackages,
     AQFProcesses,
     AQFGetProp,
     AQFSettings,
     AQFFiles,
-    AQFLogTimestamps,
+    SMS,
     RootBinaries,
     Mounts,
 ]

src/mvt/android/modules/androidqf/aqf_files.py

@@ -41,7 +41,7 @@ class AQFFiles(AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -92,6 +92,7 @@ class AQFFiles(AndroidQFModule):
                 self.alertstore.critical(
                     ioc_match.message, "", result, matched_indicator=ioc_match.ioc
                 )
+                self.alertstore.log_latest()
                 continue
 
             # NOTE: Update with final path used for Android collector.
@@ -106,17 +107,18 @@ class AQFFiles(AndroidQFModule):
 
                     msg = f'Found {file_type}file at suspicious path "{result["path"]}"'
                     self.alertstore.high(msg, "", result)
+                    self.alertstore.log_latest()
 
-            for hash_key in ("sha256", "sha1", "md5"):
-                file_hash = result.get(hash_key, "")
-                if not file_hash:
-                    continue
-                ioc_match = self.indicators.check_file_hash(file_hash)
-                if ioc_match:
-                    self.alertstore.critical(
-                        ioc_match.message, "", result, matched_indicator=ioc_match.ioc
-                    )
-                    break
+            if result.get("sha256", "") == "":
+                continue
+
+            ioc_match = self.indicators.check_file_hash(result.get("sha256") or "")
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+
+            # TODO: adds SHA1 and MD5 when available in MVT
 
     def run(self) -> None:
         if timezone := self._get_device_timezone():
@@ -131,7 +133,7 @@ class AQFFiles(AndroidQFModule):
                 data = json.loads(rawdata)
             except json.decoder.JSONDecodeError:
                 data = []
-                for line in rawdata.splitlines():
+                for line in rawdata.split("\n"):
                     if line.strip() == "":
                         continue
                     data.append(json.loads(line))
@@ -142,11 +144,11 @@ class AQFFiles(AndroidQFModule):
                         utc_timestamp = datetime.datetime.fromtimestamp(
                             file_data[ts], tz=datetime.timezone.utc
                         )
-                        # Convert the UTC timestamp to local time on Android device's local timezone
+                        # Convert the UTC timestamp to local tiem on Android device's local timezone
                         local_timestamp = utc_timestamp.astimezone(device_timezone)
 
-                        # Preserve the device-local wall-clock time while using
-                        # the project-wide ISO conversion helper.
+                        # HACK: We only output the UTC timestamp in convert_datetime_to_iso, we
+                        # set the timestamp timezone to UTC, to avoid the timezone conversion again.
                         local_timestamp = local_timestamp.replace(
                             tzinfo=datetime.timezone.utc
                         )

src/mvt/android/modules/androidqf/aqf_getprop.py

@@ -22,7 +22,7 @@ class AQFGetProp(GetPropArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -32,7 +32,7 @@ class AQFGetProp(GetPropArtifact, AndroidQFModule):
             log=log,
             results=results,
         )
-        self.results: list = [] if results is None else results
+        self.results: list = []
 
     def run(self) -> None:
         getprop_files = self._get_files_by_pattern("*/getprop.txt")

src/mvt/android/modules/androidqf/aqf_log_timestamps.py

@@ -27,7 +27,7 @@ class AQFLogTimestamps(FileTimestampsArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/aqf_packages.py

@@ -5,11 +5,8 @@
 
 import json
 import logging
-import time
 from typing import Optional
 
-from rich.progress import track
-
 from mvt.android.utils import (
     BROWSER_INSTALLERS,
     PLAY_STORE_INSTALLERS,
@@ -18,8 +15,7 @@ from mvt.android.utils import (
     SYSTEM_UPDATE_PACKAGES,
     THIRD_PARTY_STORE_INSTALLERS,
 )
-from mvt.common.module_types import ModuleAtomicResult, ModuleResults
-from mvt.common.virustotal import VTNoKey, VTQuotaExceeded, virustotal_lookup
+from mvt.common.module_types import ModuleResults
 
 from .base import AndroidQFModule
 
@@ -34,7 +30,7 @@ class AQFPackages(AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -53,6 +49,7 @@ class AQFPackages(AndroidQFModule):
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
                 continue
 
             # Detections for apps installed via unusual methods.
@@ -62,36 +59,41 @@ class AQFPackages(AndroidQFModule):
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
             elif result["installer"] in BROWSER_INSTALLERS:
                 self.alertstore.medium(
                     f'Found a package installed via a browser (installer="{result["installer"]}"): "{result["name"]}"',
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
             elif result["installer"] == "null" and result["system"] is False:
-                self.alertstore.medium(
+                self.alertstore.high(
                     f'Found a non-system package installed via adb or another method: "{result["name"]}"',
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
             elif result["installer"] in PLAY_STORE_INSTALLERS:
                 pass
 
             # Check for disabled security or software update packages.
             package_disabled = result.get("disabled", None)
             if result["name"] in SECURITY_PACKAGES and package_disabled:
-                self.alertstore.medium(
+                self.alertstore.high(
                     f'Security package "{result["name"]}" disabled on the phone',
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
 
             if result["name"] in SYSTEM_UPDATE_PACKAGES and package_disabled:
-                self.alertstore.medium(
+                self.alertstore.high(
                     f'System OTA update package "{result["name"]}" disabled on the phone',
                     "",
                     result,
                 )
+                self.alertstore.log_latest()
 
             if not self.indicators:
                 continue
@@ -101,6 +103,7 @@ class AQFPackages(AndroidQFModule):
                 self.alertstore.critical(
                     ioc_match.message, "", result, matched_indicator=ioc_match.ioc
                 )
+                self.alertstore.log_latest()
 
             for package_file in result.get("files", []):
                 ioc_match = self.indicators.check_file_hash(
@@ -110,6 +113,7 @@ class AQFPackages(AndroidQFModule):
                     self.alertstore.critical(
                         ioc_match.message, "", result, matched_indicator=ioc_match.ioc
                     )
+                    self.alertstore.log_latest()
 
                 if "certificate" not in package_file:
                     continue
@@ -127,67 +131,9 @@ class AQFPackages(AndroidQFModule):
                             result,
                             matched_indicator=ioc_match.ioc,
                         )
+                        self.alertstore.log_latest()
                         break
 
-        if self.module_options.get("virustotal", False):
-            self.check_virustotal(
-                delay=self.module_options.get("virustotal_delay", 0)
-            )
-
-    def check_virustotal(self, delay: int = 0) -> None:
-        files_by_hash: dict[
-            str, list[tuple[ModuleAtomicResult, ModuleAtomicResult]]
-        ] = {}
-        for package in self.results:
-            if package.get("system", False):
-                continue
-
-            for package_file in package.get("files", []):
-                file_hash = package_file.get("sha256")
-                if not file_hash:
-                    continue
-
-                files_by_hash.setdefault(file_hash, []).append((package, package_file))
-
-        total_hashes = len(files_by_hash)
-        if total_hashes == 0:
-            return
-
-        progress_desc = f"Looking up {total_hashes} package files on VirusTotal..."
-        for index, file_hash in enumerate(
-            track(files_by_hash, description=progress_desc)
-        ):
-            try:
-                results = virustotal_lookup(file_hash)
-            except VTNoKey as exc:
-                self.log.warning("%s", exc)
-                return
-            except VTQuotaExceeded as exc:
-                self.log.warning("Unable to continue VirusTotal lookups: %s", exc)
-                break
-
-            if index < total_hashes - 1 and delay > 0:
-                time.sleep(delay)
-
-            if not results:
-                continue
-
-            attributes = results.get("attributes", {})
-            stats = attributes.get("last_analysis_stats", {})
-            positives = stats.get("malicious", 0)
-            total = len(attributes.get("last_analysis_results", {}))
-            detection = f"{positives}/{total}"
-
-            for package, package_file in files_by_hash[file_hash]:
-                package_file["virustotal"] = detection
-                if positives > 0:
-                    self.alertstore.high(
-                        f'VirusTotal flagged package "{package["name"]}" file '
-                        f'"{package_file["path"]}" with {detection} detections',
-                        "",
-                        package,
-                    )
-
     def run(self) -> None:
         packages = self._get_files_by_pattern("*/packages.json")
         if not packages:

src/mvt/android/modules/androidqf/aqf_processes.py

@@ -22,7 +22,7 @@ class AQFProcesses(ProcessesArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/aqf_settings.py

@@ -22,7 +22,7 @@ class AQFSettings(SettingsArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -32,7 +32,7 @@ class AQFSettings(SettingsArtifact, AndroidQFModule):
             log=log,
             results=results,
         )
-        self.results: dict = results if results is not None else {}
+        self.results: dict = {}
 
     def run(self) -> None:
         for setting_file in self._get_files_by_pattern("*/settings_*.txt"):
@@ -40,7 +40,7 @@ class AQFSettings(SettingsArtifact, AndroidQFModule):
 
             self.results[namespace] = {}
             data = self._get_file_content(setting_file)
-            for line in data.decode("utf-8").splitlines():
+            for line in data.decode("utf-8").split("\n"):
                 line = line.strip()
                 try:
                     key, value = line.split("=", 1)

src/mvt/android/modules/androidqf/base.py

@@ -23,7 +23,7 @@ class AndroidQFModule(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/mounts.py

@@ -32,7 +32,7 @@ class Mounts(MountsArtifact, AndroidQFModule):
             log=log,
             results=results,
         )
-        self.results: list = [] if results is None else results
+        self.results: list = []
 
     def run(self) -> None:
         """
@@ -66,9 +66,6 @@ class Mounts(MountsArtifact, AndroidQFModule):
                 # AndroidQF format: array of strings like
                 # "/dev/block/dm-12 on / type ext4 (ro,seclabel,noatime)"
                 mount_content = "\n".join(json_data)
-            else:
-                self.log.error("Expected mounts.json to contain a list of mount lines")
-                return
             self.parse(mount_content)
         except Exception as exc:
             self.log.error("Failed to parse mount information: %s", exc)

src/mvt/android/modules/androidqf/root_binaries.py

@@ -51,6 +51,7 @@ class RootBinaries(AndroidQFModule):
                 "",
                 result,
             )
+            self.alertstore.log_latest()
 
         if self.results:
             self.log.warning(

src/mvt/android/modules/androidqf/sms.py

@@ -0,0 +1,109 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1
+
+import logging
+from typing import Optional
+
+from mvt.android.modules.backup.helpers import prompt_or_load_android_backup_password
+from mvt.android.parsers.backup import (
+    AndroidBackupParsingError,
+    InvalidBackupPassword,
+    parse_ab_header,
+    parse_backup_file,
+    parse_tar_for_sms,
+)
+
+from .base import AndroidQFModule
+
+
+class SMS(AndroidQFModule):
+    """
+    This module analyse SMS file in backup
+
+    XXX: We should also de-duplicate this AQF module, but first we
+    need to add tests for loading encrypted SMS backups through the backup
+    sub-module.
+    """
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for message in self.results:
+            if "body" not in message:
+                continue
+
+            ioc_match = self.indicators.check_domains(message.get("links", []))
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", message, matched_indicator=ioc_match.ioc
+                )
+
+    def parse_backup(self, data):
+        header = parse_ab_header(data)
+        if not header["backup"]:
+            self.log.critical("Invalid backup format, backup.ab was not analysed")
+            return
+
+        password = None
+        if header["encryption"] != "none":
+            password = prompt_or_load_android_backup_password(
+                self.log, self.module_options
+            )
+            if not password:
+                self.log.critical("No backup password provided.")
+                return
+
+        try:
+            tardata = parse_backup_file(data, password=password)
+        except InvalidBackupPassword:
+            self.log.critical("Invalid backup password")
+            return
+        except AndroidBackupParsingError:
+            self.log.critical(
+                "Impossible to parse this backup file, please use"
+                " Android Backup Extractor instead"
+            )
+            return
+
+        if not tardata:
+            return
+
+        try:
+            self.results = parse_tar_for_sms(tardata)
+        except AndroidBackupParsingError:
+            self.log.info(
+                "Impossible to read SMS from the Android Backup, "
+                "please extract the SMS and try extracting it with "
+                "Android Backup Extractor"
+            )
+            return
+
+    def run(self) -> None:
+        files = self._get_files_by_pattern("*/backup.ab")
+        if not files:
+            self.log.info("No backup data found")
+            return
+
+        self.parse_backup(self._get_file_content(files[0]))
+        self.log.info("Identified %d SMS in backup data", len(self.results))

src/mvt/android/modules/backup/__init__.py

@@ -3,8 +3,6 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-from mvt.common.module import MVTModule
-
 from .sms import SMS
 
-BACKUP_MODULES: list[type[MVTModule]] = [SMS]
+BACKUP_MODULES = [SMS]

src/mvt/android/modules/backup/base.py

@@ -22,7 +22,7 @@ class BackupModule(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/backup/helpers.py

@@ -4,8 +4,9 @@
 #   https://license.mvt.re/1.1/
 
 
+from rich.prompt import Prompt
+
 from mvt.common.config import settings
-from mvt.common.password import prompt_password
 
 MVT_ANDROID_BACKUP_PASSWORD = "MVT_ANDROID_BACKUP_PASSWORD"
 
@@ -48,7 +49,7 @@ def prompt_or_load_android_backup_password(log, module_options):
 
     # The default is to allow interactivity
     elif module_options.get("interactive", True):
-        backup_password = prompt_password("Enter backup password: ")
+        backup_password = Prompt.ask(prompt="Enter backup password", password=True)
     else:
         log.critical(
             "Cannot decrypt backup because interactivity"

src/mvt/android/modules/backup/sms.py

@@ -20,7 +20,7 @@ class SMS(BackupModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -36,8 +36,6 @@ class SMS(BackupModule):
         if not self.indicators:
             return
 
-        messages = []
-        url_batches = []
         for message in self.results:
             if "body" not in message:
                 continue
@@ -46,21 +44,12 @@ class SMS(BackupModule):
             if message_links == []:
                 message_links = check_for_links(message.get("text", ""))
 
-            messages.append(message)
-            url_batches.append(message_links)
-
-        for message, ioc_match in zip(
-            messages, self.indicators.check_url_batches(url_batches)
-        ):
+            ioc_match = self.indicators.check_urls(message_links)
             if ioc_match:
                 self.alertstore.critical(
                     ioc_match.message, "", message, matched_indicator=ioc_match.ioc
                 )
-
-    def collect_url_results(self) -> None:
-        for message in self.results:
-            for url in message.get("links", []):
-                self.add_url_result(url, message.get("isodate"), "sms")
+                continue
 
     def run(self) -> None:
         sms_path = "apps/com.android.providers.telephony/d_f/*_sms_backup"

src/mvt/android/modules/bugreport/__init__.py

@@ -3,8 +3,6 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-from mvt.common.module import MVTModule
-
 from .dumpsys_accessibility import DumpsysAccessibility
 from .dumpsys_activities import DumpsysActivities
 from .dumpsys_appops import DumpsysAppops
@@ -18,11 +16,8 @@ from .dumpsys_receivers import DumpsysReceivers
 from .dumpsys_adb_state import DumpsysADBState
 from .fs_timestamps import BugReportTimestamps
 from .tombstones import Tombstones
-from .mounts import Mounts
-from .processes import Processes
-from .settings import Settings
 
-BUGREPORT_MODULES: list[type[MVTModule]] = [
+BUGREPORT_MODULES = [
     DumpsysAccessibility,
     DumpsysActivities,
     DumpsysAppops,
@@ -36,7 +31,4 @@ BUGREPORT_MODULES: list[type[MVTModule]] = [
     DumpsysADBState,
     BugReportTimestamps,
     Tombstones,
-    Processes,
-    Settings,
-    Mounts,
 ]

src/mvt/android/modules/bugreport/base.py

@@ -6,7 +6,6 @@ import datetime
 import fnmatch
 import logging
 import os
-from pathlib import Path
 from typing import List, Optional
 from zipfile import ZipFile
 
@@ -23,7 +22,7 @@ class BugReportModule(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -71,14 +70,7 @@ class BugReportModule(MVTModule):
         else:
             if not self.extract_path:
                 raise ValueError("extract_path is not set")
-            joined = os.path.join(self.extract_path, file_path)
-            if (
-                not Path(joined)
-                .resolve()
-                .is_relative_to(Path(self.extract_path).resolve())
-            ):
-                raise ValueError("unsafe file_path")
-            handle = open(joined, "rb")
+            handle = open(os.path.join(self.extract_path, file_path), "rb")
 
         data = handle.read()
         handle.close()
@@ -104,27 +96,6 @@ class BugReportModule(MVTModule):
 
         return None
 
-    @staticmethod
-    def extract_command_section(content: str, heading: str) -> str:
-        """Return a bugreport command section without consuming the next one.
-
-        Bugreport separators include timing text, so looking for a line equal to
-        ``------`` is not sufficient and can accidentally feed the remainder of
-        dumpstate to a parser.
-        """
-        lines: list[str] = []
-        in_section = False
-        for line in content.splitlines():
-            stripped = line.strip()
-            if not in_section:
-                if stripped.startswith(heading):
-                    in_section = True
-                continue
-            if stripped.startswith("------"):
-                break
-            lines.append(line)
-        return "\n".join(lines)
-
     def _get_file_modification_time(self, file_path: str) -> datetime.datetime:
         if self.zip_archive:
             file_timetuple = self.zip_archive.getinfo(file_path).date_time

src/mvt/android/modules/bugreport/dumpsys_accessibility.py

@@ -22,7 +22,7 @@ class DumpsysAccessibility(DumpsysAccessibilityArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -49,7 +49,9 @@ class DumpsysAccessibility(DumpsysAccessibilityArtifact, BugReportModule):
         self.parse(content)
 
         for result in self.results:
-            self.log.info('Found accessibility service "%s"', result.get("component"))
+            self.log.info(
+                'Found installed accessibility service "%s"', result.get("service")
+            )
 
         self.log.info(
             "Identified a total of %d accessibility services", len(self.results)

src/mvt/android/modules/bugreport/dumpsys_activities.py

@@ -24,7 +24,7 @@ class DumpsysActivities(DumpsysPackageActivitiesArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_adb_state.py

@@ -3,15 +3,11 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import base64
-import binascii
-import datetime
 import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_adb import DumpsysADBArtifact
 from mvt.common.module_types import ModuleResults
-from mvt.common.utils import convert_datetime_to_iso
 
 from .base import BugReportModule
 
@@ -26,7 +22,7 @@ class DumpsysADBState(DumpsysADBArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -57,122 +53,3 @@ class DumpsysADBState(DumpsysADBArtifact, BugReportModule):
                 "Identified a total of %d trusted ADB keys",
                 len(self.results[0].get("user_keys", [])),
             )
-
-    @staticmethod
-    def _key_material(public_key: object) -> str:
-        if isinstance(public_key, bytes):
-            public_key = public_key.decode("utf-8", errors="replace")
-        if not isinstance(public_key, str):
-            return ""
-        return public_key.strip().split(" ", 1)[0]
-
-    @staticmethod
-    def _is_valid_key(public_key: str) -> bool:
-        if not public_key:
-            return False
-        try:
-            return bool(base64.b64decode(public_key, validate=True))
-        except (binascii.Error, ValueError):
-            return False
-
-    @staticmethod
-    def _parse_acquisition_time(value: object) -> Optional[datetime.datetime]:
-        if not isinstance(value, str):
-            return None
-        try:
-            timestamp = datetime.datetime.fromisoformat(value.replace("Z", "+00:00"))
-        except ValueError:
-            return None
-        if not timestamp.tzinfo:
-            timestamp = timestamp.replace(tzinfo=datetime.timezone.utc)
-        return timestamp.astimezone(datetime.timezone.utc)
-
-    @staticmethod
-    def _parse_last_connected(value: object) -> Optional[datetime.datetime]:
-        try:
-            return datetime.datetime.fromtimestamp(
-                int(str(value)) / 1000,
-                tz=datetime.timezone.utc,
-            )
-        except (OSError, OverflowError, TypeError, ValueError):
-            return None
-
-    def _trusted_keys(self) -> list[dict]:
-        """Return unique trusted keys, preferring keystore connection metadata."""
-        trusted_keys = []
-        seen = set()
-        for result in self.results:
-            keystore = result.get("keystore", [])
-            candidates = keystore if isinstance(keystore, list) else []
-            candidates = [*candidates, *result.get("user_keys", [])]
-            for candidate in candidates:
-                if not isinstance(candidate, dict):
-                    continue
-                key = self._key_material(candidate.get("key"))
-                identity = key or repr(candidate)
-                if identity in seen:
-                    continue
-                seen.add(identity)
-                trusted_keys.append(candidate)
-        return trusted_keys
-
-    def check_indicators(self) -> None:
-        if "androidqf_acquisition" not in self.module_options:
-            return super().check_indicators()
-
-        context = self.module_options.get("androidqf_acquisition")
-        if not isinstance(context, dict):
-            context = {}
-        acquisition_key = self._key_material(context.get("adb_host_public_key"))
-        if acquisition_key and not self._is_valid_key(acquisition_key):
-            acquisition_key = ""
-        acquisition_time = self._parse_acquisition_time(context.get("started"))
-        cutoff = (
-            acquisition_time - datetime.timedelta(days=1) if acquisition_time else None
-        )
-
-        for trusted_key in self._trusted_keys():
-            key = self._key_material(trusted_key.get("key"))
-            fingerprint = trusted_key.get("fingerprint") or "<unknown key>"
-            user = trusted_key.get("user") or "unknown user"
-            description = f"{fingerprint} ({user})"
-            last_connected = self._parse_last_connected(
-                trusted_key.get("last_connected")
-            )
-            event_time = (
-                convert_datetime_to_iso(last_connected) if last_connected else ""
-            )
-
-            if not self._is_valid_key(key):
-                self.alertstore.low(
-                    f"Found an invalid trusted ADB host key: {description}",
-                    event_time,
-                    trusted_key,
-                )
-                continue
-
-            if not acquisition_key:
-                self.alertstore.low(
-                    "Found a trusted ADB host key, but the AndroidQF acquisition "
-                    f"does not include its host key: {description}",
-                    event_time,
-                    trusted_key,
-                )
-                continue
-
-            if key != acquisition_key:
-                self.alertstore.low(
-                    "Found a trusted ADB host key different from the AndroidQF "
-                    f"acquisition host: {description}",
-                    event_time,
-                    trusted_key,
-                )
-                continue
-
-            if cutoff and last_connected and last_connected <= cutoff:
-                self.alertstore.info(
-                    "Found a trusted ADB host key last connected at least one day "
-                    f"before the AndroidQF acquisition: {description}",
-                    event_time,
-                    trusted_key,
-                )

src/mvt/android/modules/bugreport/dumpsys_appops.py

@@ -22,7 +22,7 @@ class DumpsysAppops(DumpsysAppopsArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_battery_daily.py

@@ -22,7 +22,7 @@ class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_battery_history.py

@@ -22,7 +22,7 @@ class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_dbinfo.py

@@ -24,7 +24,7 @@ class DumpsysDBInfo(DumpsysDBInfoArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_getprop.py

@@ -22,7 +22,7 @@ class DumpsysGetProp(GetPropArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -44,8 +44,21 @@ class DumpsysGetProp(GetPropArtifact, BugReportModule):
             )
             return
 
-        section = self.extract_command_section(
-            content.decode(errors="ignore"), "------ SYSTEM PROPERTIES"
-        )
-        self.parse(section)
+        lines = []
+        in_getprop = False
+
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip().startswith("------ SYSTEM PROPERTIES"):
+                in_getprop = True
+                continue
+
+            if not in_getprop:
+                continue
+
+            if line.strip() == "------":
+                break
+
+            lines.append(line)
+
+        self.parse("\n".join(lines))
         self.log.info("Extracted %d Android system properties", len(self.results))

src/mvt/android/modules/bugreport/dumpsys_packages.py

@@ -23,7 +23,7 @@ class DumpsysPackages(DumpsysPackagesArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -50,10 +50,7 @@ class DumpsysPackages(DumpsysPackagesArtifact, BugReportModule):
 
         for result in self.results:
             dangerous_permissions_count = 0
-            permissions = list(result["permissions"])
-            for user in result.get("users", []):
-                permissions.extend(user.get("permissions", []))
-            for perm in permissions:
+            for perm in result["permissions"]:
                 if perm["name"] in DANGEROUS_PERMISSIONS:
                     dangerous_permissions_count += 1
 

src/mvt/android/modules/bugreport/dumpsys_platform_compat.py

@@ -13,7 +13,7 @@ from mvt.common.module_types import ModuleResults
 
 
 class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
-    """This module extracts raw per-package compatibility overrides."""
+    """This module extracts details on uninstalled apps."""
 
     def __init__(
         self,
@@ -22,7 +22,7 @@ class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -42,10 +42,8 @@ class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
             )
             return
 
-        decoded_data = data.decode("utf-8", errors="replace")
-        content = self.extract_dumpsys_section(
-            decoded_data, "DUMP OF SERVICE platform_compat:"
-        )
+        data = data.decode("utf-8", errors="replace")
+        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE platform_compat:")
         self.parse(content)
 
-        self.log.info("Found %d package compatibility overrides", len(self.results))
+        self.log.info("Found %d uninstalled apps", len(self.results))

src/mvt/android/modules/bugreport/dumpsys_receivers.py

@@ -22,7 +22,7 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -33,7 +33,21 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
             results=results,
         )
 
-        self.results = results if results else []
+        self.results = results if results else {}
+
+    def check_indicators(self) -> None:
+        for result in self.results:
+            if self.indicators:
+                receiver_name = self.results[result][0]["receiver"]
+
+                # return IoC if the stix2 process name a substring of the receiver name
+                ioc = self.indicators.check_receiver_prefix(receiver_name)
+                if ioc:
+                    self.results[result][0]["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+
 
     def run(self) -> None:
         content = self._get_dumpstate_file()
@@ -49,4 +63,4 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
         )
 
         self.parse(dumpsys_section)
-        self.log.info("Extracted %d package receivers", len(self.results))
+        self.log.info("Extracted receivers for %d intents", len(self.results))

src/mvt/android/modules/bugreport/fs_timestamps.py

@@ -4,15 +4,12 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-import datetime
 from typing import Optional
-from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from mvt.common.utils import convert_datetime_to_iso
 from .base import BugReportModule
 from mvt.common.module_types import ModuleResults
 from mvt.android.artifacts.file_timestamps import FileTimestampsArtifact
-from mvt.android.artifacts.getprop import GetProp
 
 
 class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
@@ -27,7 +24,7 @@ class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -41,44 +38,15 @@ class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
     def run(self) -> None:
         filesystem_files = self._get_files_by_pattern("FS/*")
 
-        timezone_name = None
-        dumpstate = self._get_dumpstate_file()
-        if dumpstate:
-            section = self.extract_command_section(
-                dumpstate.decode("utf-8", errors="replace"),
-                "------ SYSTEM PROPERTIES",
-            )
-            properties = GetProp()
-            properties.parse(section)
-            timezone_name = properties.get_device_timezone()
-        timezone = None
-        if timezone_name:
-            try:
-                timezone = ZoneInfo(timezone_name)
-            except ZoneInfoNotFoundError:
-                self.log.warning("Unknown device timezone %s", timezone_name)
-
         self.results = []
         for file in filesystem_files:
             # Only the modification time is available in the zip file metadata.
             # The timezone is the local timezone of the machine the phone.
             modification_time = self._get_file_modification_time(file)
-            utc_time = None
-            if timezone is not None:
-                utc_time = convert_datetime_to_iso(
-                    modification_time.replace(tzinfo=timezone).astimezone(
-                        datetime.timezone.utc
-                    )
-                )
             self.results.append(
                 {
                     "path": file,
                     "modified_time": convert_datetime_to_iso(modification_time),
-                    "modified_time_utc": utc_time,
-                    "timezone": timezone_name,
-                    "timestamp_source": (
-                        "zip_metadata" if self.zip_archive else "filesystem_metadata"
-                    ),
                 }
             )