Bumped version

Android split parsers

.github/workflows/python-package.yml

@@ -1,7 +1,7 @@
 # This workflow will install Python dependencies, run tests and lint with a variety of Python versions
 # For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
 
-name: Python package
+name: CI
 
 on:
   push:

.gitignore

@@ -131,3 +131,6 @@ dmypy.json
 
 # Temporal files
 *~
+
+# IDEA Dev Environment
+.idea

README.md

@@ -6,6 +6,8 @@
 
 [![](https://img.shields.io/pypi/v/mvt)](https://pypi.org/project/mvt/)
 [![Documentation Status](https://readthedocs.org/projects/mvt/badge/?version=latest)](https://docs.mvt.re/en/latest/?badge=latest)
+[![CI](https://github.com/mvt-project/mvt/actions/workflows/python-package.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/python-package.yml)
+[![Downloads](https://pepy.tech/badge/mvt)](https://pepy.tech/project/mvt)
 
 Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
 

dev/mvt-android

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

dev/mvt-ios

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

docs/docker.md

@@ -10,6 +10,11 @@ cd mvt
 docker build -t mvt .
 ```
 
+Optionally, you may need to specify your platform to Docker in order to build successfully (Apple M1)
+```bash
+docker build --platform amd64 -t mvt .
+```
+
 Test if the image was created successfully:
 
 ```bash

mvt/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/cli.py

@@ -1,10 +1,12 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import logging
 import os
+from pathlib import Path
+from zipfile import ZipFile
 
 import click
 from rich.logging import RichHandler
@@ -21,6 +23,7 @@ from .lookups.koodous import koodous_lookup
 from .lookups.virustotal import virustotal_lookup
 from .modules.adb import ADB_MODULES
 from .modules.backup import BACKUP_MODULES
+from .modules.bugreport import BUGREPORT_MODULES
 
 # Setup logging using Rich.
 LOG_FORMAT = "[%(name)s] %(message)s"
@@ -46,7 +49,7 @@ def version():
 
 
 #==============================================================================
-# Download APKs
+# Command: download-apks
 #==============================================================================
 @cli.command("download-apks", help="Download all or non-safelisted installed APKs installed on the device")
 @click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
@@ -99,7 +102,7 @@ def download_apks(ctx, all_apks, virustotal, koodous, all_checks, output, from_f
 
 
 #==============================================================================
-# Checks through ADB
+# Command: check-adb
 #==============================================================================
 @cli.command("check-adb", help="Check an Android device over adb")
 @click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
@@ -157,7 +160,81 @@ def check_adb(ctx, iocs, output, fast, list_modules, module, serial):
 
 
 #==============================================================================
-# Check ADB backup
+# Command: check-bugreport
+#==============================================================================
+@cli.command("check-bugreport", help="Check an Android Bug Report")
+@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
+              default=[], help=HELP_MSG_IOC)
+@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
+@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
+@click.option("--module", "-m", help=HELP_MSG_MODULE)
+@click.argument("BUGREPORT_PATH", type=click.Path(exists=True))
+@click.pass_context
+def check_bugreport(ctx, iocs, output, list_modules, module, bugreport_path):
+    if list_modules:
+        log.info("Following is the list of available check-bugreport modules:")
+        for adb_module in BUGREPORT_MODULES:
+            log.info(" - %s", adb_module.__name__)
+
+        return
+
+    log.info("Checking an Android Bug Report located at: %s", bugreport_path)
+
+    if output and not os.path.exists(output):
+        try:
+            os.makedirs(output)
+        except Exception as e:
+            log.critical("Unable to create output folder %s: %s", output, e)
+            ctx.exit(1)
+
+    indicators = Indicators(log=log)
+    indicators.load_indicators_files(iocs)
+
+    if os.path.isfile(bugreport_path):
+        bugreport_format = "zip"
+        zip_archive = ZipFile(bugreport_path)
+        zip_files = []
+        for file_name in zip_archive.namelist():
+            zip_files.append(file_name)
+    elif os.path.isdir(bugreport_path):
+        bugreport_format = "dir"
+        folder_files = []
+        parent_path = Path(bugreport_path).absolute().as_posix()
+        for root, subdirs, subfiles in os.walk(os.path.abspath(bugreport_path)):
+            for file_name in subfiles:
+                folder_files.append(os.path.relpath(os.path.join(root, file_name), parent_path))
+
+    timeline = []
+    timeline_detected = []
+    for bugreport_module in BUGREPORT_MODULES:
+        if module and bugreport_module.__name__ != module:
+            continue
+
+        m = bugreport_module(base_folder=bugreport_path, output_folder=output,
+                             log=logging.getLogger(bugreport_module.__module__))
+
+        if bugreport_format == "zip":
+            m.from_zip(zip_archive, zip_files)
+        else:
+            m.from_folder(bugreport_path, folder_files)
+
+        if indicators.total_ioc_count:
+            m.indicators = indicators
+            m.indicators.log = m.log
+
+        run_module(m)
+        timeline.extend(m.timeline)
+        timeline_detected.extend(m.timeline_detected)
+
+    if output:
+        if len(timeline) > 0:
+            save_timeline(timeline, os.path.join(output, "timeline.csv"))
+        if len(timeline_detected) > 0:
+            save_timeline(timeline_detected, os.path.join(output, "timeline_detected.csv"))
+
+
+#==============================================================================
+# Command: check-backup
 #==============================================================================
 @cli.command("check-backup", help="Check an Android Backup")
 @click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)

mvt/android/download_apks.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -57,7 +57,7 @@ class DownloadAPKs(AndroidExtraction):
         :param json_path: Path to the apks.json file to parse.
 
         """
-        with open(json_path, "r") as handle:
+        with open(json_path, "r", encoding="utf-8") as handle:
             packages = json.load(handle)
             return cls(packages=packages)
 
@@ -173,7 +173,7 @@ class DownloadAPKs(AndroidExtraction):
     def save_json(self):
         """Save the results to the package.json file."""
         json_path = os.path.join(self.output_folder, "apks.json")
-        with open(json_path, "w") as handle:
+        with open(json_path, "w", encoding="utf-8") as handle:
             json.dump(self.packages, handle, indent=4)
 
     def run(self):

mvt/android/lookups/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/lookups/koodous.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/lookups/virustotal.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/modules/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/modules/adb/__init__.py

@@ -1,14 +1,15 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 from .chrome_history import ChromeHistory
 from .dumpsys_accessibility import DumpsysAccessibility
-from .dumpsys_batterystats import DumpsysBatterystats
+from .dumpsys_activities import DumpsysActivities
+from .dumpsys_battery_daily import DumpsysBatteryDaily
+from .dumpsys_battery_history import DumpsysBatteryHistory
+from .dumpsys_dbinfo import DumpsysDBInfo
 from .dumpsys_full import DumpsysFull
-from .dumpsys_packages import DumpsysPackages
-from .dumpsys_procstats import DumpsysProcstats
 from .dumpsys_receivers import DumpsysReceivers
 from .files import Files
 from .getprop import Getprop
@@ -16,11 +17,13 @@ from .logcat import Logcat
 from .packages import Packages
 from .processes import Processes
 from .root_binaries import RootBinaries
+from .selinux_status import SELinuxStatus
 from .settings import Settings
 from .sms import SMS
 from .whatsapp import Whatsapp
 
 ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes, Getprop, Settings,
-               DumpsysAccessibility, DumpsysBatterystats, DumpsysProcstats,
-               DumpsysPackages, DumpsysReceivers, DumpsysFull,
-               Packages, RootBinaries, Logcat, Files]
+               SELinuxStatus, DumpsysBatteryHistory, DumpsysBatteryDaily,
+               DumpsysReceivers, DumpsysActivities, DumpsysAccessibility,
+               DumpsysDBInfo, DumpsysFull, Packages, Logcat, RootBinaries,
+               Files]

mvt/android/modules/adb/base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/modules/adb/chrome_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -68,7 +68,7 @@ class ChromeHistory(AndroidExtraction):
                 "url": item[1],
                 "visit_id": item[2],
                 "timestamp": item[3],
-                "isodate": convert_timestamp_to_iso(convert_chrometime_to_unix[item[3]]),
+                "isodate": convert_timestamp_to_iso(convert_chrometime_to_unix(item[3])),
                 "redirect_source": item[4],
             })
 
@@ -78,5 +78,8 @@ class ChromeHistory(AndroidExtraction):
         log.info("Extracted a total of %d history items", len(self.results))
 
     def run(self):
-        self._adb_process_file(os.path.join("/", CHROME_HISTORY_PATH),
-                               self._parse_db)
+        try:
+            self._adb_process_file(os.path.join("/", CHROME_HISTORY_PATH),
+                                   self._parse_db)
+        except Exception as e:
+            self.log.error(e)

mvt/android/modules/adb/dumpsys_accessibility.py

@@ -1,11 +1,11 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import io
 import logging
-import os
+
+from mvt.android.parsers import parse_dumpsys_accessibility
 
 from .base import AndroidExtraction
 
@@ -21,33 +21,25 @@ class DumpsysAccessibility(AndroidExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
     def run(self):
         self._adb_connect()
-
-        stats = self._adb_command("dumpsys accessibility")
-
-        in_services = False
-        for line in stats.split("\n"):
-            if line.strip().startswith("installed services:"):
-                in_services = True
-                continue
-
-            if not in_services:
-                continue
-
-            if line.strip() == "}":
-                break
-
-            service = line.split(":")[1].strip()
-            log.info("Found installed accessibility service \"%s\"", service)
-
-        if self.output_folder:
-            acc_path = os.path.join(self.output_folder,
-                                      "dumpsys_accessibility.txt")
-            with io.open(acc_path, "w", encoding="utf-8") as handle:
-                handle.write(stats)
-
-            log.info("Records from dumpsys accessibility stored at %s",
-                     acc_path)
-
+        output = self._adb_command("dumpsys accessibility")
         self._adb_disconnect()
+
+        self.results = parse_dumpsys_accessibility(output)
+
+        for result in self.results:
+            log.info("Found installed accessibility service \"%s\"", result.get("service"))
+
+        self.log.info("Identified a total of %d accessibility services", len(self.results))

mvt/android/modules/adb/dumpsys_activities.py

@@ -0,0 +1,45 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_activity_resolver_table
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysActivities(AndroidExtraction):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = results if results else {}
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for intent, activities in self.results.items():
+            for activity in activities:
+                ioc = self.indicators.check_app_id(activity["package_name"])
+                if ioc:
+                    activity["matched_indicator"] = ioc
+                    self.detected.append({intent: activity})
+                    continue
+
+    def run(self):
+        self._adb_connect()
+        output = self._adb_command("dumpsys package")
+        self._adb_disconnect()
+
+        self.results = parse_dumpsys_activity_resolver_table(output)
+
+        self.log.info("Extracted activities for %d intents", len(self.results))

mvt/android/modules/adb/dumpsys_battery_daily.py

@@ -0,0 +1,50 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_battery_daily
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysBatteryDaily(AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["from"],
+            "module": self.__class__.__name__,
+            "event": "battery_daily",
+            "data": f"Recorded update of package {record['package_name']} with vers {record['vers']}"
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def run(self):
+        self._adb_connect()
+        output = self._adb_command("dumpsys batterystats --daily")
+        self._adb_disconnect()
+
+        self.results = parse_dumpsys_battery_daily(output)
+
+        self.log.info("Extracted %d records from battery daily stats", len(self.results))

mvt/android/modules/adb/dumpsys_battery_history.py

@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_battery_history
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysBatteryHistory(AndroidExtraction):
+    """This module extracts records from battery history events."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def run(self):
+        self._adb_connect()
+        output = self._adb_command("dumpsys batterystats --history")
+        self._adb_disconnect()
+
+        self.results = parse_dumpsys_battery_history(output)
+
+        self.log.info("Extracted %d records from battery history", len(self.results))

mvt/android/modules/adb/dumpsys_batterystats.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysBatterystats(AndroidExtraction):
-    """This module extracts stats on battery consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        stats = self._adb_command("dumpsys batterystats")
-        if self.output_folder:
-            stats_path = os.path.join(self.output_folder,
-                                      "dumpsys_batterystats.txt")
-            with open(stats_path, "w") as handle:
-                handle.write(stats)
-
-            log.info("Records from dumpsys batterystats stored at %s",
-                     stats_path)
-
-        history = self._adb_command("dumpsys batterystats --history")
-        if self.output_folder:
-            history_path = os.path.join(self.output_folder,
-                                        "dumpsys_batterystats_history.txt")
-            with open(history_path, "w") as handle:
-                handle.write(history)
-
-            log.info("History records from dumpsys batterystats stored at %s",
-                     history_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_dbinfo.py

@@ -0,0 +1,48 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import re
+
+from mvt.android.parsers import parse_dumpsys_dbinfo
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysDBInfo(AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    slug = "dumpsys_dbinfo"
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            path = result.get("path", "")
+            for part in path.split("/"):
+                ioc = self.indicators.check_app_id(part)
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+    def run(self):
+        self._adb_connect()
+        output = self._adb_command("dumpsys dbinfo")
+        self._adb_disconnect()
+
+        self.results = parse_dumpsys_dbinfo(output)
+
+        self.log.info("Extracted a total of %d records from database information",
+                      len(self.results))

mvt/android/modules/adb/dumpsys_full.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -23,14 +23,12 @@ class DumpsysFull(AndroidExtraction):
     def run(self):
         self._adb_connect()
 
-        stats = self._adb_command("dumpsys")
+        output = self._adb_command("dumpsys")
         if self.output_folder:
-            stats_path = os.path.join(self.output_folder,
-                                      "dumpsys.txt")
-            with open(stats_path, "w") as handle:
-                handle.write(stats)
+            output_path = os.path.join(self.output_folder, "dumpsys.txt")
+            with open(output_path, "w", encoding="utf-8") as handle:
+                handle.write(output)
 
-            log.info("Full dumpsys output stored at %s",
-                     stats_path)
+            log.info("Full dumpsys output stored at %s", output_path)
 
         self._adb_disconnect()

mvt/android/modules/adb/dumpsys_procstats.py

@@ -1,36 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-from .base import AndroidExtraction
-
-log = logging.getLogger(__name__)
-
-
-class DumpsysProcstats(AndroidExtraction):
-    """This module extracts stats on memory consumption by processes."""
-
-    def __init__(self, file_path=None, base_folder=None, output_folder=None,
-                 serial=None, fast_mode=False, log=None, results=[]):
-        super().__init__(file_path=file_path, base_folder=base_folder,
-                         output_folder=output_folder, fast_mode=fast_mode,
-                         log=log, results=results)
-
-    def run(self):
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys procstats")
-        if self.output_folder:
-            procstats_path = os.path.join(self.output_folder,
-                                          "dumpsys_procstats.txt")
-            with open(procstats_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Records from dumpsys procstats stored at %s",
-                     procstats_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_receivers.py

@@ -1,10 +1,12 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import logging
 
+from mvt.android.parsers import parse_dumpsys_receiver_resolver_table
+
 from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
@@ -25,72 +27,40 @@ class DumpsysReceivers(AndroidExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
+        self.results = results if results else {}
+
     def check_indicators(self):
-        for result in self.results:
-            if result["activity"] == INTENT_NEW_OUTGOING_SMS:
-                self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
-                              result["receiver"])
-            elif result["activity"] == INTENT_SMS_RECEIVED:
-                self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
-                              result["receiver"])
-            elif result["activity"] == INTENT_DATA_SMS_RECEIVED:
-                self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
-                              result["receiver"])
-            elif result["activity"] == INTENT_PHONE_STATE:
-                self.log.info("Found a receiver monitoring telephony state/incoming calls: \"%s\"",
-                              result["receiver"])
-            elif result["activity"] == INTENT_NEW_OUTGOING_CALL:
-                self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
-                              result["receiver"])
+        if not self.indicators:
+            return
+
+        for intent, receivers in self.results.items():
+            for receiver in receivers:
+                if intent == INTENT_NEW_OUTGOING_SMS:
+                    self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_SMS_RECEIVED:
+                    self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_DATA_SMS_RECEIVED:
+                    self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_PHONE_STATE:
+                    self.log.info("Found a receiver monitoring telephony state/incoming calls: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_NEW_OUTGOING_CALL:
+                    self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
+                                  receiver["receiver"])
+
+            ioc = self.indicators.check_app_id(receiver["package_name"])
+            if ioc:
+                receiver["matched_indicator"] = ioc
+                self.detected.append({intent: receiver})
+                continue
 
     def run(self):
         self._adb_connect()
 
         output = self._adb_command("dumpsys package")
-        if not output:
-            return
-
-        activity = None
-        for line in output.split("\n"):
-            # Find activity block markers.
-            if line.strip().startswith(INTENT_NEW_OUTGOING_SMS):
-                activity = INTENT_NEW_OUTGOING_SMS
-                continue
-            elif line.strip().startswith(INTENT_SMS_RECEIVED):
-                activity = INTENT_SMS_RECEIVED
-                continue
-            elif line.strip().startswith(INTENT_PHONE_STATE):
-                activity = INTENT_PHONE_STATE
-                continue
-            elif line.strip().startswith(INTENT_DATA_SMS_RECEIVED):
-                activity = INTENT_DATA_SMS_RECEIVED
-                continue
-            elif line.strip().startswith(INTENT_NEW_OUTGOING_CALL):
-                activity = INTENT_NEW_OUTGOING_CALL
-                continue
-
-            # If we are not in an activity block yet, skip.
-            if not activity:
-                continue
-
-            # If we are in a block but the line does not start with 8 spaces
-            # it means the block ended a new one started, so we reset and
-            # continue.
-            if not line.startswith(" " * 8):
-                activity = None
-                continue
-
-            # If we got this far, we are processing receivers for the
-            # activities we are interested in.
-            receiver = line.strip().split(" ")[1]
-            package_name = receiver.split("/")[0]
-            if package_name == "com.google.android.gms":
-                continue
-
-            self.results.append({
-                "activity": activity,
-                "package_name": package_name,
-                "receiver": receiver,
-            })
+        self.results = parse_dumpsys_receiver_resolver_table(output)
 
         self._adb_disconnect()

mvt/android/modules/adb/files.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -24,9 +24,9 @@ class Files(AndroidExtraction):
                          log=log, results=results)
         self.full_find = False
 
-    def find_files(self, file_path):
+    def find_files(self, folder):
         if self.full_find:
-            output = self._adb_command(f"find '{file_path}' -printf '%T@ %m %s %u %g %p\n' 2> /dev/null")
+            output = self._adb_command(f"find '{folder}' -printf '%T@ %m %s %u %g %p\n' 2> /dev/null")
 
             for file_line in output.splitlines():
                 [unix_timestamp, mode, size, owner, group, full_path] = file_line.rstrip().split(" ", 5)
@@ -42,7 +42,7 @@ class Files(AndroidExtraction):
                     "group": group,
                 })
         else:
-            output = self._adb_command(f"find '{file_path}' 2> /dev/null")
+            output = self._adb_command(f"find '{folder}' 2> /dev/null")
             for file_line in output.splitlines():
                 self.results.append({"path": file_line.rstrip()})
 

mvt/android/modules/adb/getprop.py

@@ -1,12 +1,13 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import logging
-import os
 import re
 
+from mvt.android.parsers import parse_getprop
+
 from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
@@ -25,22 +26,9 @@ class Getprop(AndroidExtraction):
 
     def run(self):
         self._adb_connect()
-
-        rxp = re.compile("\\[(.+?)\\]: \\[(.+?)\\]")
-        out = self._adb_command("getprop")
-        for line in out.splitlines():
-            line = line.strip()
-            if line == "":
-                continue
-
-            matches = re.findall(rxp, line)
-            if not matches or len(matches[0]) != 2:
-                continue
-
-            key = matches[0][0]
-            value = matches[0][1]
-            self.results[key] = value
-
+        output = self._adb_command("getprop")
         self._adb_disconnect()
 
+        self.results = parse_getprop(output)
+
         self.log.info("Extracted %d Android system properties", len(self.results))

mvt/android/modules/adb/logcat.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -31,7 +31,7 @@ class Logcat(AndroidExtraction):
         if self.output_folder:
             logcat_path = os.path.join(self.output_folder,
                                        "logcat.txt")
-            with open(logcat_path, "w") as handle:
+            with open(logcat_path, "w", encoding="utf-8") as handle:
                 handle.write(output)
 
             log.info("Current logcat logs stored at %s",
@@ -39,7 +39,7 @@ class Logcat(AndroidExtraction):
 
             logcat_last_path = os.path.join(self.output_folder,
                                             "logcat_last.txt")
-            with open(logcat_last_path, "w") as handle:
+            with open(logcat_last_path, "w", encoding="utf-8") as handle:
                 handle.write(last_output)
 
             log.info("Logcat logs prior to last reboot stored at %s",

mvt/android/modules/adb/packages.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -15,6 +15,30 @@ from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
+DANGEROUS_PERMISSIONS_THRESHOLD = 10
+DANGEROUS_PERMISSIONS = [
+    "android.permission.ACCESS_COARSE_LOCATION",
+    "android.permission.ACCESS_FINE_LOCATION",
+    "android.permission.AUTHENTICATE_ACCOUNTS",
+    "android.permission.CAMERA",
+    "android.permission.DISABLE_KEYGUARD",
+    "android.permission.PROCESS_OUTGOING_CALLS",
+    "android.permission.READ_CALENDAR",
+    "android.permission.READ_CALL_LOG",
+    "android.permission.READ_CONTACTS",
+    "android.permission.READ_PHONE_STATE",
+    "android.permission.READ_SMS",
+    "android.permission.RECEIVE_MMS",
+    "android.permission.RECEIVE_SMS",
+    "android.permission.RECEIVE_WAP_PUSH",
+    "android.permission.RECORD_AUDIO",
+    "android.permission.SEND_SMS",
+    "android.permission.SYSTEM_ALERT_WINDOW",
+    "android.permission.USE_CREDENTIALS",
+    "android.permission.USE_SIP",
+    "com.android.browser.permission.READ_HISTORY_BOOKMARKS",
+]
+
 
 class Packages(AndroidExtraction):
     """This module extracts the list of installed packages."""
@@ -47,7 +71,7 @@ class Packages(AndroidExtraction):
     def check_indicators(self):
         root_packages_path = os.path.join("..", "..", "data", "root_packages.txt")
         root_packages_string = pkg_resources.resource_string(__name__, root_packages_path)
-        root_packages = root_packages_string.decode("utf-8").split("\n")
+        root_packages = root_packages_string.decode("utf-8").splitlines()
         root_packages = [rp.strip() for rp in root_packages]
 
         for result in self.results:
@@ -57,18 +81,61 @@ class Packages(AndroidExtraction):
                 self.detected.append(result)
                 continue
 
+            if not self.indicators:
+                continue
+
             ioc = self.indicators.check_app_id(result.get("package_name"))
             if ioc:
-                result["matched_indicators"] = ioc
+                result["matched_indicator"] = ioc
                 self.detected.append(result)
                 continue
 
             for package_file in result["files"]:
                 ioc = self.indicators.check_file_hash(package_file["sha256"])
                 if ioc:
-                    result["matched_indicators"] = ioc
+                    result["matched_indicator"] = ioc
                     self.detected.append(result)
 
+    @staticmethod
+    def parse_package_for_details(output):
+        details = {
+            "uid": "",
+            "version_name": "",
+            "version_code": "",
+            "timestamp": "",
+            "first_install_time": "",
+            "last_update_time": "",
+            "requested_permissions": [],
+        }
+
+        in_permissions = False
+        for line in output.splitlines():
+            if in_permissions:
+                if line.startswith(" " * 4) and not line.startswith(" " * 6):
+                    in_permissions = False
+                    continue
+
+                permission = line.strip().split(":")[0]
+                details["requested_permissions"].append(permission)
+
+            if line.strip().startswith("userId="):
+                details["uid"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionName="):
+                details["version_name"] = line.split("=")[1].strip()
+            elif line.strip().startswith("versionCode="):
+                details["version_code"] = line.split("=", 1)[1].strip()
+            elif line.strip().startswith("timeStamp="):
+                details["timestamp"] = line.split("=")[1].strip()
+            elif line.strip().startswith("firstInstallTime="):
+                details["first_install_time"] = line.split("=")[1].strip()
+            elif line.strip().startswith("lastUpdateTime="):
+                details["last_update_time"] = line.split("=")[1].strip()
+            elif line.strip() == "requested permissions:":
+                in_permissions = True
+                continue
+
+        return details
+
     def _get_files_for_package(self, package_name):
         output = self._adb_command(f"pm path {package_name}")
         output = output.strip().replace("package:", "")
@@ -76,7 +143,7 @@ class Packages(AndroidExtraction):
             return []
 
         package_files = []
-        for file_path in output.split("\n"):
+        for file_path in output.splitlines():
             file_path = file_path.strip()
 
             md5 = self._adb_command(f"md5sum {file_path}").split(" ")[0]
@@ -97,11 +164,9 @@ class Packages(AndroidExtraction):
     def run(self):
         self._adb_connect()
 
-        packages = self._adb_command("pm list packages -U -u -i -f")
-        if packages.strip() == "Error: Unknown option: -U":
-            packages = self._adb_command("pm list packages -u -i -f")
+        packages = self._adb_command("pm list packages -u -i -f")
 
-        for line in packages.split("\n"):
+        for line in packages.splitlines():
             line = line.strip()
             if not line.startswith("package:"):
                 continue
@@ -117,31 +182,22 @@ class Packages(AndroidExtraction):
                 if installer == "null":
                     installer = None
 
-            try:
-                uid = fields[2].split(":")[1].strip()
-            except IndexError:
-                uid = None
-
-            dumpsys = self._adb_command(f"dumpsys package {package_name} | grep -A2 timeStamp").split("\n")
-            timestamp = dumpsys[0].split("=")[1].strip()
-            first_install = dumpsys[1].split("=")[1].strip()
-            last_update = dumpsys[2].split("=")[1].strip()
-
             package_files = self._get_files_for_package(package_name)
-
-            self.results.append({
+            new_package = {
                 "package_name": package_name,
                 "file_name": file_name,
                 "installer": installer,
-                "timestamp": timestamp,
-                "first_install_time": first_install,
-                "last_update_time": last_update,
-                "uid": uid,
                 "disabled": False,
                 "system": False,
                 "third_party": False,
                 "files": package_files,
-            })
+            }
+
+            dumpsys_package = self._adb_command(f"dumpsys package {package_name}")
+            package_details = self.parse_package_for_details(dumpsys_package)
+            new_package.update(package_details)
+
+            self.results.append(new_package)
 
         cmds = [
             {"field": "disabled", "arg": "-d"},
@@ -150,7 +206,7 @@ class Packages(AndroidExtraction):
         ]
         for cmd in cmds:
             output = self._adb_command(f"pm list packages {cmd['arg']}")
-            for line in output.split("\n"):
+            for line in output.splitlines():
                 line = line.strip()
                 if not line.startswith("package:"):
                     continue
@@ -160,6 +216,19 @@ class Packages(AndroidExtraction):
                     if result["package_name"] == package_name:
                         self.results[i][cmd["field"]] = True
 
+        for result in self.results:
+            if not result["third_party"]:
+                continue
+
+            dangerous_permissions_count = 0
+            for perm in result["requested_permissions"]:
+                if perm in DANGEROUS_PERMISSIONS:
+                    dangerous_permissions_count += 1
+
+            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
+                self.log.info("Third-party package \"%s\" requested %d potentially dangerous permissions",
+                              result["package_name"], dangerous_permissions_count)
+
         packages_to_lookup = []
         for result in self.results:
             if result["system"]:

mvt/android/modules/adb/processes.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -19,12 +19,22 @@ class Processes(AndroidExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result.get("name", ""))
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+
     def run(self):
         self._adb_connect()
 
         output = self._adb_command("ps -e")
 
-        for line in output.split("\n")[1:]:
+        for line in output.splitlines()[1:]:
             line = line.strip()
             if line == "":
                 continue

mvt/android/modules/adb/root_binaries.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -25,7 +25,7 @@ class RootBinaries(AndroidExtraction):
     def run(self):
         root_binaries_path = os.path.join("..", "..", "data", "root_binaries.txt")
         root_binaries_string = pkg_resources.resource_string(__name__, root_binaries_path)
-        root_binaries = root_binaries_string.decode("utf-8").split("\n")
+        root_binaries = root_binaries_string.decode("utf-8").splitlines()
 
         self._adb_connect()
 

mvt/android/modules/adb/selinux_status.py

@@ -1,18 +1,22 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import logging
 import os
 
+import pkg_resources
+
 from .base import AndroidExtraction
 
 log = logging.getLogger(__name__)
 
 
-class DumpsysPackages(AndroidExtraction):
-    """This module extracts details on installed packages."""
+class SELinuxStatus(AndroidExtraction):
+    """This module checks if SELinux is being enforced."""
+
+    slug = "selinux_status"
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  serial=None, fast_mode=False, log=None, results=[]):
@@ -20,18 +24,17 @@ class DumpsysPackages(AndroidExtraction):
                          output_folder=output_folder, fast_mode=fast_mode,
                          log=log, results=results)
 
+        self.results = {} if not results else results
+
     def run(self):
         self._adb_connect()
-
-        output = self._adb_command("dumpsys package")
-
-        if self.output_folder:
-            packages_path = os.path.join(self.output_folder,
-                                         "dumpsys_packages.txt")
-            with open(packages_path, "w") as handle:
-                handle.write(output)
-
-            log.info("Records from dumpsys package stored at %s",
-                     packages_path)
-
+        output = self._adb_command("getenforce")
         self._adb_disconnect()
+
+        status = output.lower().strip()
+        self.results["status"] = status
+
+        if status == "enforcing":
+            self.log.info("SELinux is being regularly enforced")
+        else:
+            self.log.warning("SELinux status is \"%s\"!", status)

mvt/android/modules/adb/settings.py

@@ -1,11 +1,9 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import logging
-import os
-import re
 
 from .base import AndroidExtraction
 
@@ -60,6 +58,7 @@ ANDROID_DANGEROUS_SETTINGS = [
     },
 ]
 
+
 class Settings(AndroidExtraction):
     """This module extracts Android system settings."""
 

mvt/android/modules/adb/sms.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/modules/adb/whatsapp.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -85,4 +85,7 @@ class Whatsapp(AndroidExtraction):
         self.results = messages
 
     def run(self):
-        self._adb_process_file(os.path.join("/", WHATSAPP_PATH), self._parse_db)
+        try:
+            self._adb_process_file(os.path.join("/", WHATSAPP_PATH), self._parse_db)
+        except Exception as e:
+            self.log.error(e)

mvt/android/modules/backup/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/modules/backup/sms.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/modules/bugreport/__init__.py

@@ -0,0 +1,16 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .accessibility import Accessibility
+from .activities import Activities
+from .battery_daily import BatteryDaily
+from .battery_history import BatteryHistory
+from .dbinfo import DBInfo
+from .getprop import Getprop
+from .packages import Packages
+from .receivers import Receivers
+
+BUGREPORT_MODULES = [Accessibility, Activities, BatteryDaily, BatteryHistory,
+                     DBInfo, Getprop, Packages, Receivers]

mvt/android/modules/bugreport/accessibility.py

@@ -0,0 +1,60 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_accessibility
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class Accessibility(BugReportModule):
+    """This module extracts stats on accessibility."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        lines = []
+        in_accessibility = False
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "DUMP OF SERVICE accessibility:":
+                in_accessibility = True
+                continue
+
+            if not in_accessibility:
+                continue
+
+            if line.strip().startswith("------------------------------------------------------------------------------"):
+                break
+
+            lines.append(line)
+
+        self.results = parse_dumpsys_accessibility("\n".join(lines))
+        for result in self.results:
+            log.info("Found installed accessibility service \"%s\"", result.get("service"))
+
+        self.log.info("Identified a total of %d accessibility services", len(self.results))

mvt/android/modules/bugreport/activities.py

@@ -0,0 +1,61 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_activity_resolver_table
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class Activities(BugReportModule):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = results if results else {}
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for intent, activities in self.results.items():
+            for activity in activities:
+                ioc = self.indicators.check_app_id(activity["package_name"])
+                if ioc:
+                    activity["matched_indicator"] = ioc
+                    self.detected.append({intent: activity})
+                    continue
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        lines = []
+        in_package = False
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "DUMP OF SERVICE package:":
+                in_package = True
+                continue
+
+            if not in_package:
+                continue
+
+            if line.strip().startswith("------------------------------------------------------------------------------"):
+                break
+
+            lines.append(line)
+
+        self.results = parse_dumpsys_activity_resolver_table("\n".join(lines))
+
+        self.log.info("Extracted activities for %d intents", len(self.results))

mvt/android/modules/bugreport/base.py

@@ -0,0 +1,70 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 Claudio Guarnieri.
+# See the file 'LICENSE' for usage and copying permissions, or find a copy at
+#   https://github.com/mvt-project/mvt/blob/main/LICENSE
+
+import fnmatch
+import logging
+import os
+
+from mvt.common.module import MVTModule
+
+log = logging.getLogger(__name__)
+
+
+class BugReportModule(MVTModule):
+    """This class provides a base for all Android Bug Report modules."""
+
+    zip_archive = None
+
+    def from_folder(self, extract_path, extract_files):
+        self.extract_path = extract_path
+        self.extract_files = extract_files
+
+    def from_zip(self, zip_archive, zip_files):
+        self.zip_archive = zip_archive
+        self.zip_files = zip_files
+
+    def _get_files_by_pattern(self, pattern):
+        file_names = []
+        if self.zip_archive:
+            for zip_file in self.zip_files:
+                file_names.append(zip_file)
+        else:
+            file_names = self.extract_files
+
+        return fnmatch.filter(file_names, pattern)
+
+    def _get_files_by_patterns(self, patterns):
+        for pattern in patterns:
+            matches = self._get_files_by_pattern(pattern)
+            if matches:
+                return matches
+
+    def _get_file_content(self, file_path):
+        if self.zip_archive:
+            handle = self.zip_archive.open(file_path)
+        else:
+            handle = open(os.path.join(self.extract_path, file_path), "rb")
+
+        data = handle.read()
+        handle.close()
+
+        return data
+
+    def _get_dumpstate_file(self):
+        main = self._get_files_by_pattern("main_entry.txt")
+        if main:
+            main_content = self._get_file_content(main[0])
+            try:
+                return self._get_file_content(main_content.decode().strip())
+            except KeyError:
+                return None
+        else:
+            dumpstate_logs = self._get_files_by_pattern("dumpState_*.log")
+            if not dumpstate_logs:
+                return None
+
+            return self._get_file_content(dumpstate_logs[0])
+
+        return None

mvt/android/modules/bugreport/battery_daily.py

@@ -0,0 +1,76 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_battery_daily
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class BatteryDaily(BugReportModule):
+    """This module extracts records from battery daily updates."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["from"],
+            "module": self.__class__.__name__,
+            "event": "battery_daily",
+            "data": f"Recorded update of package {record['package_name']} with vers {record['vers']}"
+        }
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        lines = []
+        in_batterystats = False
+        in_daily = False
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "DUMP OF SERVICE batterystats:":
+                in_batterystats = True
+                continue
+
+            if not in_batterystats:
+                continue
+
+            if line.strip() == "Daily stats:":
+                lines.append(line)
+                in_daily = True
+                continue
+
+            if not in_daily:
+                continue
+
+            if line.strip() == "":
+                break
+
+            lines.append(line)
+
+        self.results = parse_dumpsys_battery_daily("\n".join(lines))
+
+        self.log.info("Extracted a total of %d battery daily stats",
+                      len(self.results))

mvt/android/modules/bugreport/battery_history.py

@@ -0,0 +1,60 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_battery_history
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class BatteryHistory(BugReportModule):
+    """This module extracts records from battery daily updates."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        lines = []
+        in_history = False
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip().startswith("Battery History "):
+                lines.append(line)
+                in_history = True
+                continue
+
+            if not in_history:
+                continue
+
+            if line.strip() == "":
+                break
+
+            lines.append(line)
+
+        self.results = parse_dumpsys_battery_history("\n".join(lines))
+
+        self.log.info("Extracted a total of %d battery history records",
+                      len(self.results))

mvt/android/modules/bugreport/dbinfo.py

@@ -0,0 +1,63 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_dbinfo
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class DBInfo(BugReportModule):
+    """This module extracts records from battery daily updates."""
+
+    slug = "dbinfo"
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            path = result.get("path", "")
+            for part in path.split("/"):
+                ioc = self.indicators.check_app_id(part)
+                if ioc:
+                    result["matched_indicator"] = ioc
+                    self.detected.append(result)
+                    continue
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        in_dbinfo = False
+        lines = []
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "DUMP OF SERVICE dbinfo:":
+                in_dbinfo = True
+                continue
+
+            if not in_dbinfo:
+                continue
+
+            if line.strip().startswith("------------------------------------------------------------------------------"):
+                break
+
+            lines.append(line)
+
+        self.results = parse_dumpsys_dbinfo("\n".join(lines))
+
+        self.log.info("Extracted a total of %d database connection pool records",
+                      len(self.results))

mvt/android/modules/bugreport/getprop.py

@@ -0,0 +1,50 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import re
+
+from mvt.android.parsers import parse_getprop
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class Getprop(BugReportModule):
+    """This module extracts device properties from getprop command."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = {} if not results else results
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        lines = []
+        in_getprop = False
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "------ SYSTEM PROPERTIES (getprop) ------":
+                in_getprop = True
+                continue
+
+            if not in_getprop:
+                continue
+
+            if line.strip() == "------":
+                break
+
+            lines.append(line)
+
+        self.results = parse_getprop("\n".join(lines))
+
+        self.log.info("Extracted %d Android system properties", len(self.results))

mvt/android/modules/bugreport/packages.py

@@ -0,0 +1,117 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import re
+
+from mvt.android.modules.adb.packages import Packages as PCK
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+
+class Packages(BugReportModule):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        records = []
+
+        timestamps = [
+            {"event": "package_install", "timestamp": record["timestamp"]},
+            {"event": "package_first_install", "timestamp": record["first_install_time"]},
+            {"event": "package_last_update", "timestamp": record["last_update_time"]},
+        ]
+
+        for ts in timestamps:
+            records.append({
+                "timestamp": ts["timestamp"],
+                "module": self.__class__.__name__,
+                "event": ts["event"],
+                "data": f"Install or update of package {record['package_name']}",
+            })
+
+        return records
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package_name"])
+            if ioc:
+                result["matched_indicator"] = ioc
+                self.detected.append(result)
+                continue
+
+    @staticmethod
+    def parse_packages_list(output):
+        pkg_rxp = re.compile(r"  Package \[(.+?)\].*")
+
+        results = []
+        package_name = None
+        package = {}
+        lines = []
+        for line in output.splitlines():
+            if line.startswith("  Package ["):
+                if len(lines) > 0:
+                    details = PCK.parse_package_for_details("\n".join(lines))
+                    package.update(details)
+                    results.append(package)
+                    package = {}
+
+                matches = pkg_rxp.findall(line)
+                if not matches:
+                    continue
+
+                package_name = matches[0]
+                package["package_name"] = package_name
+                continue
+
+            if not package_name:
+                continue
+
+            lines.append(line)
+
+        return results
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        in_package = False
+        in_packages_list = False
+        lines = []
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "DUMP OF SERVICE package:":
+                in_package = True
+                continue
+
+            if not in_package:
+                continue
+
+            if line.strip() == "Packages:":
+                in_packages_list = True
+                continue
+
+            if not in_packages_list:
+                continue
+
+            if line.strip() == "":
+                break
+
+            lines.append(line)
+
+        self.results = self.parse_packages_list("\n".join(lines))
+
+        self.log.info("Extracted details on %d packages", len(self.results))

mvt/android/modules/bugreport/receivers.py

@@ -0,0 +1,83 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.android.parsers import parse_dumpsys_receiver_resolver_table
+
+from .base import BugReportModule
+
+log = logging.getLogger(__name__)
+
+INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
+INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
+INTENT_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
+INTENT_PHONE_STATE = "android.intent.action.PHONE_STATE"
+INTENT_NEW_OUTGOING_CALL = "android.intent.action.NEW_OUTGOING_CALL"
+
+
+class Receivers(BugReportModule):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+        self.results = results if results else {}
+
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for intent, receivers in self.results.items():
+            for receiver in receivers:
+                if intent == INTENT_NEW_OUTGOING_SMS:
+                    self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_SMS_RECEIVED:
+                    self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_DATA_SMS_RECEIVED:
+                    self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_PHONE_STATE:
+                    self.log.info("Found a receiver monitoring telephony state/incoming calls: \"%s\"",
+                                  receiver["receiver"])
+                elif intent == INTENT_NEW_OUTGOING_CALL:
+                    self.log.info("Found a receiver monitoring outgoing calls: \"%s\"",
+                                  receiver["receiver"])
+
+            ioc = self.indicators.check_app_id(receiver["package_name"])
+            if ioc:
+                receiver["matched_indicator"] = ioc
+                self.detected.append({intent: receiver})
+                continue
+
+    def run(self):
+        content = self._get_dumpstate_file()
+        if not content:
+            self.log.error("Unable to find dumpstate file. Did you provide a valid bug report archive?")
+            return
+
+        in_receivers = False
+        lines = []
+        for line in content.decode(errors="ignore").splitlines():
+            if line.strip() == "DUMP OF SERVICE package:":
+                in_receivers = True
+                continue
+
+            if not in_receivers:
+                continue
+
+            if line.strip().startswith("------------------------------------------------------------------------------"):
+                break
+
+            lines.append(line)
+
+        self.results = parse_dumpsys_receiver_resolver_table("\n".join(lines))
+
+        self.log.info("Extracted receivers for %d intents", len(self.results))

mvt/android/parsers/__init__.py

@@ -0,0 +1,11 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .dumpsys import (parse_dumpsys_accessibility,
+                      parse_dumpsys_activity_resolver_table,
+                      parse_dumpsys_battery_daily,
+                      parse_dumpsys_battery_history, parse_dumpsys_dbinfo,
+                      parse_dumpsys_receiver_resolver_table)
+from .getprop import parse_getprop

mvt/android/parsers/dumpsys.py

@@ -0,0 +1,287 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+
+
+def parse_dumpsys_accessibility(output):
+    results = []
+
+    in_services = False
+    for line in output.splitlines():
+        if line.strip().startswith("installed services:"):
+            in_services = True
+            continue
+
+        if not in_services:
+            continue
+
+        if line.strip() == "}":
+            break
+
+        service = line.split(":")[1].strip()
+
+        results.append({
+            "package_name": service.split("/")[0],
+            "service": service,
+        })
+
+    return results
+
+
+def parse_dumpsys_activity_resolver_table(output):
+    results = {}
+
+    in_activity_resolver_table = False
+    in_non_data_actions = False
+    intent = None
+    for line in output.splitlines():
+        if line.startswith("Activity Resolver Table:"):
+            in_activity_resolver_table = True
+            continue
+
+        if not in_activity_resolver_table:
+            continue
+
+        if line.startswith("  Non-Data Actions:"):
+            in_non_data_actions = True
+            continue
+
+        if not in_non_data_actions:
+            continue
+
+        # If we hit an empty line, the Non-Data Actions section should be
+        # finished.
+        if line.strip() == "":
+            break
+
+        # We detect the action name.
+        if line.startswith(" " * 6) and not line.startswith(" " * 8) and ":" in line:
+            intent = line.strip().replace(":", "")
+            results[intent] = []
+            continue
+
+        # If we are not in an intent block yet, skip.
+        if not intent:
+            continue
+
+        # If we are in a block but the line does not start with 8 spaces
+        # it means the block ended a new one started, so we reset and
+        # continue.
+        if not line.startswith(" " * 8):
+            intent = None
+            continue
+
+        # If we got this far, we are processing receivers for the
+        # activities we are interested in.
+        activity = line.strip().split(" ")[1]
+        package_name = activity.split("/")[0]
+
+        results[intent].append({
+            "package_name": package_name,
+            "activity": activity,
+        })
+
+    return results
+
+
+def parse_dumpsys_battery_daily(output):
+    results = []
+    daily = None
+    daily_updates = []
+    for line in output.splitlines():
+        if line.startswith("  Daily from "):
+            if len(daily_updates) > 0:
+                results.extend(daily_updates)
+                daily_updates = []
+
+            timeframe = line[13:].strip()
+            date_from, date_to = timeframe.strip(":").split(" to ", 1)
+            daily = {"from": date_from[0:10], "to": date_to[0:10]}
+            continue
+
+        if not daily:
+            continue
+
+        if not line.strip().startswith("Update "):
+            continue
+
+        line = line.strip().replace("Update ", "")
+        package_name, vers = line.split(" ", 1)
+        vers_nr = vers.split("=", 1)[1]
+
+        already_seen = False
+        for update in daily_updates:
+            if package_name == update["package_name"] and vers_nr == update["vers"]:
+                already_seen = True
+                break
+
+        if not already_seen:
+            daily_updates.append({
+                "action": "update",
+                "from": daily["from"],
+                "to": daily["to"],
+                "package_name": package_name,
+                "vers": vers_nr,
+            })
+
+    if len(daily_updates) > 0:
+        results.extend(daily_updates)
+
+    return results
+
+
+def parse_dumpsys_battery_history(output):
+    results = []
+
+    for line in output.splitlines():
+        if line.startswith("Battery History "):
+            continue
+
+        if line.strip() == "":
+            break
+
+        time_elapsed = line.strip().split(" ", 1)[0]
+
+        event = ""
+        if line.find("+job") > 0:
+            event = "start_job"
+            uid = line[line.find("+job")+5:line.find(":")]
+            service = line[line.find(":")+1:].strip('"')
+            package_name = service.split("/")[0]
+        elif line.find("-job") > 0:
+            event = "end_job"
+            uid = line[line.find("-job")+5:line.find(":")]
+            service = line[line.find(":")+1:].strip('"')
+            package_name = service.split("/")[0]
+        elif line.find("+running +wake_lock=") > 0:
+            uid = line[line.find("+running +wake_lock=")+21:line.find(":")]
+            event = "wake"
+            service = line[line.find("*walarm*:")+9:].split(" ")[0].strip('"').strip()
+            if service == "" or "/" not in service:
+                continue
+
+            package_name = service.split("/")[0]
+        else:
+            continue
+
+        results.append({
+            "time_elapsed": time_elapsed,
+            "event": event,
+            "uid": uid,
+            "package_name": package_name,
+            "service": service,
+        })
+
+    return results
+
+
+def parse_dumpsys_dbinfo(output):
+    results = []
+
+    rxp = re.compile(r'.*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\"')
+    rxp_no_pid = re.compile(r'.*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\"')
+
+    pool = None
+    in_operations = False
+    for line in output.splitlines():
+        if line.startswith("Connection pool for "):
+            pool = line.replace("Connection pool for ", "").rstrip(":")
+
+        if not pool:
+            continue
+
+        if line.strip() == "Most recently executed operations:":
+            in_operations = True
+            continue
+
+        if not in_operations:
+            continue
+
+        if not line.startswith("        "):
+            in_operations = False
+            pool = None
+            continue
+
+        matches = rxp.findall(line)
+        if not matches:
+            matches = rxp_no_pid.findall(line)
+            if not matches:
+                continue
+            else:
+                match = matches[0]
+                results.append({
+                    "isodate": match[0],
+                    "action": match[1],
+                    "sql": match[2],
+                    "path": pool,
+                })
+        else:
+            match = matches[0]
+            results.append({
+                "isodate": match[0],
+                "pid": match[1],
+                "action": match[2],
+                "sql": match[3],
+                "path": pool,
+            })
+
+    return results
+
+
+def parse_dumpsys_receiver_resolver_table(output):
+    results = {}
+
+    in_receiver_resolver_table = False
+    in_non_data_actions = False
+    intent = None
+    for line in output.splitlines():
+        if line.startswith("Receiver Resolver Table:"):
+            in_receiver_resolver_table = True
+            continue
+
+        if not in_receiver_resolver_table:
+            continue
+
+        if line.startswith("  Non-Data Actions:"):
+            in_non_data_actions = True
+            continue
+
+        if not in_non_data_actions:
+            continue
+
+        # If we hit an empty line, the Non-Data Actions section should be
+        # finished.
+        if line.strip() == "":
+            break
+
+        # We detect the action name.
+        if line.startswith(" " * 6) and not line.startswith(" " * 8) and ":" in line:
+            intent = line.strip().replace(":", "")
+            results[intent] = []
+            continue
+
+        # If we are not in an intent block yet, skip.
+        if not intent:
+            continue
+
+        # If we are in a block but the line does not start with 8 spaces
+        # it means the block ended a new one started, so we reset and
+        # continue.
+        if not line.startswith(" " * 8):
+            intent = None
+            continue
+
+        # If we got this far, we are processing receivers for the
+        # activities we are interested in.
+        receiver = line.strip().split(" ")[1]
+        package_name = receiver.split("/")[0]
+
+        results[intent].append({
+            "package_name": package_name,
+            "receiver": receiver,
+        })
+
+    return results

mvt/android/parsers/getprop.py

@@ -0,0 +1,26 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2022 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+
+
+def parse_getprop(output):
+    results = {}
+    rxp = re.compile(r"\[(.+?)\]: \[(.+?)\]")
+
+    for line in output.splitlines():
+        line = line.strip()
+        if line == "":
+            continue
+
+        matches = re.findall(rxp, line)
+        if not matches or len(matches[0]) != 2:
+            continue
+
+        key = matches[0][0]
+        value = matches[0][1]
+        results[key] = value
+
+    return results

mvt/common/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/common/help.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/common/indicators.py

@@ -1,9 +1,8 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-import io
 import json
 import os
 
@@ -21,7 +20,7 @@ class Indicators:
     def __init__(self, log=None):
         self.data_dir = user_data_dir("mvt")
         self.log = log
-        self.ioc_files = []
+        self.ioc_collections = []
         self.total_ioc_count = 0
 
     def _load_downloaded_indicators(self):
@@ -34,7 +33,7 @@ class Indicators:
 
     def _check_stix2_env_variable(self):
         """
-        Checks if a variable MVT_STIX2 contains path to STIX Files.
+        Checks if a variable MVT_STIX2 contains path to a STIX files.
         """
         if "MVT_STIX2" not in os.environ:
             return
@@ -44,14 +43,17 @@ class Indicators:
             if os.path.isfile(path):
                 self.parse_stix2(path)
             else:
-                self.log.info("Invalid STIX2 path %s in MVT_STIX2 environment variable", path)
+                self.log.error("Path specified with env MVT_STIX2 is not a valid file: %s",
+                               path)
 
-    def _generate_indicators_file(self):
+    def _new_collection(self, cid="", name="", description="", file_name="",
+                        file_path=""):
         return {
-            "name": "",
-            "description": "",
-            "file_name": "",
-            "file_path": "",
+            "id": cid,
+            "name": name,
+            "description": description,
+            "stix2_file_name": file_name,
+            "stix2_file_path": file_path,
             "domains": [],
             "processes": [],
             "emails": [],
@@ -63,10 +65,11 @@ class Indicators:
             "count": 0,
         }
 
-    def _add_indicator(self, ioc, ioc_file, iocs_list):
-        if ioc not in iocs_list:
-            iocs_list.append(ioc)
-            ioc_file["count"] += 1
+    def _add_indicator(self, ioc, ioc_coll, ioc_coll_list):
+        ioc = ioc.strip("'")
+        if ioc not in ioc_coll_list:
+            ioc_coll_list.append(ioc)
+            ioc_coll["count"] += 1
             self.total_ioc_count += 1
 
     def parse_stix2(self, file_path):
@@ -78,69 +81,102 @@ class Indicators:
         """
         self.log.info("Parsing STIX2 indicators file at path %s", file_path)
 
-        ioc_file = self._generate_indicators_file()
-        ioc_file["file_path"] = file_path
-        ioc_file["file_name"] = os.path.basename(file_path)
-
-        with open(file_path, "r") as handle:
+        with open(file_path, "r", encoding="utf-8") as handle:
             try:
                 data = json.load(handle)
             except json.decoder.JSONDecodeError:
-                self.log.critical("Unable to parse STIX2 indicator file. The file is malformed or in the wrong format.")
+                self.log.critical("Unable to parse STIX2 indicator file. "
+                                  "The file is corrupted or in the wrong format!")
                 return
 
+        malware = {}
+        indicators = []
+        relationships = []
         for entry in data.get("objects", []):
             entry_type = entry.get("type", "")
             if entry_type == "malware":
-                ioc_file["name"] = entry.get("name", "") or ioc_file["file_name"]
-                ioc_file["description"] = entry.get("description", "") or ioc_file["file_name"]
-                continue
+                malware[entry["id"]] = {
+                    "name": entry["name"],
+                    "description": entry["description"],
+                }
+            elif entry_type == "indicator":
+                indicators.append(entry)
+            elif entry_type == "relationship":
+                relationships.append(entry)
 
-            if entry_type != "indicator":
-                continue
+        collections = []
+        for mal_id, mal_values in malware.items():
+            collection = self._new_collection(mal_id, mal_values.get("name"),
+                                              mal_values.get("description"),
+                                              os.path.basename(file_path),
+                                              file_path)
+            collections.append(collection)
 
-            key, value = entry.get("pattern", "").strip("[]").split("=")
-            value = value.strip("'")
+        # We loop through all indicators.
+        for indicator in indicators:
+            malware_id = None
 
-            if key == "domain-name:value":
-                # We force domain names to lower case.
-                self._add_indicator(ioc=value.lower(),
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["domains"])
-            elif key == "process:name":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["processes"])
-            elif key == "email-addr:value":
-                # We force email addresses to lower case.
-                self._add_indicator(ioc=value.lower(),
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["emails"])
-            elif key == "file:name":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["file_names"])
-            elif key == "file:path":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["file_paths"])
-            elif key == "file:hashes.sha256":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["files_sha256"])
-            elif key == "app:id":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["app_ids"])
-            elif key == "configuration-profile:id":
-                self._add_indicator(ioc=value,
-                                    ioc_file=ioc_file,
-                                    iocs_list=ioc_file["ios_profile_ids"])
+            # We loop through all relationships and find the one pertinent to
+            # the current indicator.
+            for relationship in relationships:
+                if relationship["source_ref"] != indicator["id"]:
+                    continue
 
-        self.log.info("Loaded %d indicators from \"%s\" indicators file",
-                      ioc_file["count"], ioc_file["name"])
+                # Look for a malware definition with the correct identifier.
+                if relationship["target_ref"] in malware.keys():
+                    malware_id = relationship["target_ref"]
+                    break
 
-        self.ioc_files.append(ioc_file)
+            # Now we look for the correct collection matching the malware ID we
+            # got from the relationship.
+            for collection in collections:
+                if collection["id"] != malware_id:
+                    continue
+
+                key, value = indicator.get("pattern", "").strip("[]").split("=")
+
+                if key == "domain-name:value":
+                    # We force domain names to lower case.
+                    self._add_indicator(ioc=value.lower(),
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["domains"])
+                elif key == "process:name":
+                    self._add_indicator(ioc=value,
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["processes"])
+                elif key == "email-addr:value":
+                    # We force email addresses to lower case.
+                    self._add_indicator(ioc=value.lower(),
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["emails"])
+                elif key == "file:name":
+                    self._add_indicator(ioc=value,
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["file_names"])
+                elif key == "file:path":
+                    self._add_indicator(ioc=value,
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["file_paths"])
+                elif key == "file:hashes.sha256":
+                    self._add_indicator(ioc=value,
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["files_sha256"])
+                elif key == "app:id":
+                    self._add_indicator(ioc=value,
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["app_ids"])
+                elif key == "configuration-profile:id":
+                    self._add_indicator(ioc=value,
+                                        ioc_coll=collection,
+                                        ioc_coll_list=collection["ios_profile_ids"])
+
+                break
+
+        for coll in collections:
+            self.log.info("Extracted %d indicators for collection with name \"%s\"",
+                          coll["count"], coll["name"])
+
+        self.ioc_collections.extend(collections)
 
     def load_indicators_files(self, files, load_default=True):
         """
@@ -150,7 +186,8 @@ class Indicators:
             if os.path.isfile(file_path):
                 self.parse_stix2(file_path)
             else:
-                self.log.warning("This indicators file %s does not exist", file_path)
+                self.log.warning("No indicators file exists at path %s",
+                                 file_path)
 
         # Load downloaded indicators and any indicators from env variable.
         if load_default:
@@ -160,12 +197,13 @@ class Indicators:
         self.log.info("Loaded a total of %d unique indicators", self.total_ioc_count)
 
     def get_iocs(self, ioc_type):
-        for ioc_file in self.ioc_files:
-            for ioc in ioc_file.get(ioc_type, []):
+        for ioc_collection in self.ioc_collections:
+            for ioc in ioc_collection.get(ioc_type, []):
                 yield {
                     "value": ioc,
                     "type": ioc_type,
-                    "name": ioc_file["name"]
+                    "name": ioc_collection["name"],
+                    "stix2_file_name": ioc_collection["stix2_file_name"],
                 }
 
     def check_domain(self, url):
@@ -425,18 +463,18 @@ def download_indicators_files(log):
 
     for ioc_entry in res.json():
         ioc_url = ioc_entry["stix2_url"]
-        log.info("Downloading indicator file '%s' from '%s'", ioc_entry["name"], ioc_url)
+        log.info("Downloading indicator file %s from %s", ioc_entry["name"], ioc_url)
 
         res = requests.get(ioc_url)
         if res.status_code != 200:
-            log.warning("Could not find indicator file '%s'", ioc_url)
+            log.warning("Could not find indicator file %s", ioc_url)
             continue
 
         clean_file_name = ioc_url.lstrip("https://").replace("/", "_")
         ioc_path = os.path.join(data_dir, clean_file_name)
 
         # Write file to disk. This will overwrite any older version of the STIX2 file.
-        with io.open(ioc_path, "w") as f:
-            f.write(res.text)
+        with open(ioc_path, "w", encoding="utf-8") as handle:
+            handle.write(res.text)
 
-        log.info("Saved indicator file to '%s'", os.path.basename(ioc_path))
+        log.info("Saved indicator file to %s", os.path.basename(ioc_path))

mvt/common/logo.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/common/module.py

@@ -1,10 +1,9 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import csv
-import io
 import os
 import re
 
@@ -58,7 +57,7 @@ class MVTModule(object):
 
     @classmethod
     def from_json(cls, json_path, log=None):
-        with open(json_path, "r") as handle:
+        with open(json_path, "r", encoding="utf-8") as handle:
             results = json.load(handle)
             if log:
                 log.info("Loaded %d results from \"%s\"",
@@ -91,7 +90,7 @@ class MVTModule(object):
         if self.results:
             results_file_name = f"{name}.json"
             results_json_path = os.path.join(self.output_folder, results_file_name)
-            with io.open(results_json_path, "w", encoding="utf-8") as handle:
+            with open(results_json_path, "w", encoding="utf-8") as handle:
                 try:
                     json.dump(self.results, handle, indent=4, default=str)
                 except Exception as e:
@@ -101,7 +100,7 @@ class MVTModule(object):
         if self.detected:
             detected_file_name = f"{name}_detected.json"
             detected_json_path = os.path.join(self.output_folder, detected_file_name)
-            with io.open(detected_json_path, "w", encoding="utf-8") as handle:
+            with open(detected_json_path, "w", encoding="utf-8") as handle:
                 json.dump(self.detected, handle, indent=4, default=str)
 
     def serialize(self, record):
@@ -192,7 +191,7 @@ def save_timeline(timeline, timeline_path):
     :param timeline_path: Path to the csv file to store the timeline to
 
     """
-    with io.open(timeline_path, "a+", encoding="utf-8") as handle:
+    with open(timeline_path, "a+", encoding="utf-8") as handle:
         csvoutput = csv.writer(handle, delimiter=",", quotechar="\"")
         csvoutput.writerow(["UTC Timestamp", "Plugin", "Event", "Description"])
         for event in sorted(timeline, key=lambda x: x["timestamp"] if x["timestamp"] is not None else ""):

mvt/common/options.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/common/url.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/common/utils.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -73,7 +73,7 @@ def check_for_links(text):
     :returns: Search results.
 
     """
-    return re.findall("(?P<url>https?://[^\s]+)", text, re.IGNORECASE)
+    return re.findall(r"(?P<url>https?://[^\s]+)", text, re.IGNORECASE)
 
 
 def get_sha256_from_file_path(file_path):

mvt/common/version.py

@@ -1,12 +1,12 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
 import requests
 from packaging import version
 
-MVT_VERSION = "1.4.9"
+MVT_VERSION = "1.5.1"
 
 
 def check_for_updates():

mvt/ios/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/cli.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -184,7 +184,7 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
 
     if len(timeline_detected) > 0:
         log.warning("The analysis of the backup produced %d detections!",
-                len(timeline_detected))
+                    len(timeline_detected))
 
 
 #==============================================================================
@@ -247,6 +247,7 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
         log.warning("The analysis of the filesystem produced %d detections!",
                     len(timeline_detected))
 
+
 #==============================================================================
 # Command: check-iocs
 #==============================================================================

mvt/ios/decrypt.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -185,7 +185,7 @@ class DecryptBackup:
             return
 
         try:
-            with open(key_path, 'w') as handle:
+            with open(key_path, 'w', encoding="utf-8") as handle:
                 handle.write(self._decryption_key)
         except Exception as e:
             log.exception(e)

mvt/ios/modules/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/ios/modules/backup/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/backup/backup_info.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/backup/configuration_profiles.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/backup/manifest.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/backup/profile_events.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/analytics.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/cache_files.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/filesystem.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/net_netusage.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/safari_favicon.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/shutdownlog.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -86,5 +86,5 @@ class ShutdownLog(IOSExtraction):
     def run(self):
         self._find_ios_database(root_paths=SHUTDOWN_LOG_PATH)
         self.log.info("Found shutdown log at path: %s", self.file_path)
-        with open(self.file_path, "r") as handle:
+        with open(self.file_path, "r", encoding="utf-8") as handle:
             self.process_shutdownlog(handle.read())

mvt/ios/modules/fs/version_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -34,7 +34,7 @@ class IOSVersionHistory(IOSExtraction):
 
     def run(self):
         for found_path in self._get_fs_files_from_patterns(IOS_ANALYTICS_JOURNAL_PATHS):
-            with open(found_path, "r") as analytics_log:
+            with open(found_path, "r", encoding="utf-8") as analytics_log:
                 log_line = json.loads(analytics_log.readline().strip())
 
                 timestamp = datetime.datetime.strptime(log_line["timestamp"],

mvt/ios/modules/fs/webkit_base.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/webkit_indexeddb.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/webkit_localstorage.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/fs/webkit_safariviewservice.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/calls.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/chrome_favicon.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/chrome_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/contacts.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/firefox_favicon.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/firefox_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/idstatuscache.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/interactionc.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/locationd.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/net_datausage.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/osanalytics_addaily.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/safari_browserstate.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/safari_history.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/shortcuts.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/sms.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/sms_attachments.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/ios/modules/mixed/tcc.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021 The MVT Project Authors.
+# Copyright (c) 2021-2022 The MVT Project Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
@@ -97,7 +97,6 @@ class TCC(IOSExtraction):
                     FROM access;""")
                 db_version = "v1"
 
-
         for row in cur:
             service = row[0]
             client = row[1]
@@ -113,7 +112,7 @@ class TCC(IOSExtraction):
                 if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
                     device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
                     self.log.info("Found client \"%s\" with access %s to %s on %s by %s",
-                                client, auth_value_desc, device, last_modified, auth_reason_desc)
+                                  client, auth_value_desc, device, last_modified, auth_reason_desc)
 
                 self.results.append({
                     "service": service,
@@ -132,7 +131,7 @@ class TCC(IOSExtraction):
                     if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
                         device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
                         self.log.info("Found client \"%s\" with access %s to %s at %s",
-                                    client, allowed_desc, device, last_modified)
+                                      client, allowed_desc, device, last_modified)
                     self.results.append({
                         "service": service,
                         "client": client,
@@ -145,7 +144,7 @@ class TCC(IOSExtraction):
                     if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
                         device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
                         self.log.info("Found client \"%s\" with access %s to %s",
-                                    client, allowed_desc, device)
+                                      client, allowed_desc, device)
                     self.results.append({
                         "service": service,
                         "client": client,