Scope package fields to the primary user

Dockerfile

@@ -119,23 +119,12 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
   && apt-get install -y \
   adb \
-  binutils \
   default-jre-headless \
-  file \
-  jq \
-  less \
   libcurl4 \
-  libimage-exiftool-perl \
   libssl3 \
   libusb-1.0-0 \
-  moreutils \
-  p7zip-full \
   python3 \
-  ripgrep \
-  sqlite3 \
-  tree \
-  unzip \
-  xxd
+  sqlite3
 COPY --from=build-libplist /build /
 COPY --from=build-libimobiledevice-glue /build /
 COPY --from=build-libtatsu /build /
@@ -155,7 +144,7 @@ ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2
 RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
 # Generate adb key folder
-RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey > /dev/null 2>&1; fi' >> ~/.bashrc
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
 RUN mkdir /root/.android
 
 # Setup investigations environment

Dockerfile.android

@@ -31,7 +31,7 @@ ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2
 RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
 # Generate adb key folder
-RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey > /dev/null 2>&1; fi' >> ~/.bashrc
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
 RUN mkdir /root/.android
 
 ENTRYPOINT [ "/usr/local/bin/mvt-android" ]

docs/docker.md

@@ -31,18 +31,4 @@ Test if the image was created successfully:
 docker run -it mvt
 ```
 
-If a prompt is spawned successfully, you can close it with `exit`.
-
-## Access an iOS device from Docker
-
-On the Linux host, install and start [usbmuxd](https://github.com/libimobiledevice/usbmuxd), then connect and unlock the iOS device. The daemon exposes the device through the `/var/run/usbmuxd` socket.
-
-Bind that socket into the container to let MVT communicate with the device:
-
-```bash
-docker run -it \
-    --mount type=bind,source=/var/run/usbmuxd,target=/var/run/usbmuxd \
-    ghcr.io/mvt-project/mvt
-```
-
-If you built the image from source, replace `ghcr.io/mvt-project/mvt` with `mvt`. 
+If a prompt is spawned successfully, you can close it with `exit`.

src/mvt/android/artifacts/dumpsys_packages.py

@@ -72,7 +72,6 @@ class DumpsysPackagesArtifact(AndroidArtifact):
             "first_install_time": "",
             "last_update_time": "",
             "installer": "",
-            "system": False,
             "permissions": list(),
             "requested_permissions": list(),
         }
@@ -137,8 +136,6 @@ class DumpsysPackagesArtifact(AndroidArtifact):
                 details["timestamp"] = line.split("=")[1].strip()
             elif line.strip().startswith("installerPackageName="):
                 details["installer"] = line.split("=", 1)[1].strip()
-            elif line.strip().startswith("pkgFlags="):
-                details["system"] = "SYSTEM" in line.split("=", 1)[1].split()
             elif line.strip().startswith("firstInstallTime="):
                 first_install_times[current_user] = line.split("=", 1)[1].strip()
             elif line.strip().startswith("lastUpdateTime="):

src/mvt/ios/data/ios_versions.json

@@ -1220,10 +1220,6 @@
         "version": "18.7.10",
         "build": "22H373"
     },
-    {
-        "version": "18.7.10",
-        "build": "22H374"
-    },
     {
         "version": "26",
         "build": "23A341"
@@ -1267,9 +1263,5 @@
     {
         "version": "26.6.1",
         "build": "23G82"
-    },
-    {
-        "version": "26.6.1",
-        "build": "23G83"
     }
 ]

tests/android/test_artifact_dumpsys_packages.py

@@ -26,24 +26,6 @@ class TestDumpsysPackagesArtifact:
         )
         assert dpa.results[0]["version_name"] == "5.0.07"
         assert dpa.results[0]["first_install_time"] == "2008-12-31 16:00:00"
-        assert dpa.results[0]["system"] is True
-
-    def test_parsing_system_flag(self):
-        system_details = DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
-            "    pkgFlags=[ SYSTEM HAS_CODE ALLOW_CLEAR_USER_DATA ]"
-        )
-        third_party_details = DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
-            "    pkgFlags=[ HAS_CODE ALLOW_BACKUP ]"
-        )
-        missing_flag_details = (
-            DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
-                "    versionName=1.0"
-            )
-        )
-
-        assert system_details["system"] is True
-        assert third_party_details["system"] is False
-        assert missing_flag_details["system"] is False
 
     def test_ioc_check(self, indicator_file):
         dpa = DumpsysPackagesArtifact()