Correct version.py

* Add iOS sysdiagnose checking

* Clarify documentation navigation

.github/dependabot.yml

@@ -0,0 +1,13 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "uv" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/black.yml

@@ -1,11 +0,0 @@
-name: Black
-on: [push]
-
-jobs:
-  black:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: psf/black@stable
-        with:
-          options: "--check"

.github/workflows/mypy.yml

@@ -0,0 +1,28 @@
+name: Mypy
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  mypy_py3:
+    name: Mypy check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install Dependencies
+        run: |
+          uv sync --locked --group dev
+      - name: mypy
+        run: |
+          make mypy

.github/workflows/publish-release-docker.yml

@@ -0,0 +1,79 @@
+#
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a release is published.
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+  release:
+    types: [published]
+
+# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      #
+    strategy:
+      matrix:
+        platform:
+          - dockerfile: "Dockerfile"
+            tag-suffix: ""
+          - dockerfile: "Dockerfile.ios"
+            tag-suffix: "-ios"
+          - dockerfile: "Dockerfile.android"
+            tag-suffix: "-android"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=latest,enable={{ is_default_branch }},suffix=${{ matrix.platform.tag-suffix }}
+            type=raw,enable=${{ github.event_name == 'release' || github.ref_type == 'tag' }},value=stable,suffix=${{ matrix.platform.tag-suffix }}
+            type=raw,enable=${{ github.event_name == 'release' }},value=${{ github.event.release.tag_name }},suffix=${{ matrix.platform.tag-suffix }}
+            type=raw,enable=${{ github.ref_type == 'tag' }},value=${{ github.ref_name }},suffix=${{ matrix.platform.tag-suffix }}
+            type=sha,suffix=${{ matrix.platform.tag-suffix }}
+            type=sha,format=long,suffix=${{ matrix.platform.tag-suffix }}
+      # This step sets up some additional capabilities to generate the provenance and sbom attestations
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          file: ${{ matrix.platform.dockerfile }}
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: mode=max
+          sbom: true
+

.github/workflows/python-package.yml

@@ -1,52 +0,0 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
-
-name: CI
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.8', '3.9', '3.10']  # , '3.11']
-
-    steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade setuptools
-        python -m pip install --upgrade pip
-        python -m pip install flake8 pytest safety stix2 pytest-mock pytest-cov
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-        python -m pip install .
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Safety checks
-      run: safety check
-    - name: Test with pytest and coverage
-      run: |
-        set -o pipefail
-        pytest --junitxml=pytest.xml --cov-report=term-missing:skip-covered --cov=mvt tests/ | tee pytest-coverage.txt
-    - name: Pytest coverage comment
-      continue-on-error: true # Workflows running on a fork can't post comments
-      uses: MishaKav/pytest-coverage-comment@main
-      if: github.event_name == 'pull_request'
-      with:
-        pytest-coverage-path: ./pytest-coverage.txt
-        junitxml-path: ./pytest.xml

.github/workflows/ruff.yml

@@ -4,16 +4,26 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+
 jobs:
   ruff_py3:
     name: Ruff syntax check
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v6
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
       - name: Install Dependencies
         run: |
-          pip install --user ruff
+          uv sync --locked --group dev
       - name: ruff
         run: |
-          ruff check --output-format github .
+          make ruff

.github/workflows/scripts/update-ios-releases.py

@@ -54,7 +54,7 @@ def parse_latest_ios_versions(rss_feed_text):
 
 
 def update_mvt(mvt_checkout_path, latest_ios_versions):
-    version_path = os.path.join(mvt_checkout_path, "mvt/ios/data/ios_versions.json")
+    version_path = os.path.join(mvt_checkout_path, "src/mvt/ios/data/ios_versions.json")
     with open(version_path, "r") as version_file:
         current_versions = json.load(version_file)
 

.github/workflows/tests.yml

@@ -0,0 +1,41 @@
+name: Tests
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+    name: Run Python Tests
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --locked --group dev --python ${{ matrix.python-version }}
+      - name: Test with pytest
+        run: |
+          set -o pipefail
+          make test-ci | tee pytest-coverage.txt
+
+      - name: Pytest coverage comment
+        continue-on-error: true # Workflows running on a fork can't post comments
+        uses: MishaKav/pytest-coverage-comment@main
+        if: github.event_name == 'pull_request'
+        with:
+          pytest-coverage-path: ./pytest-coverage.txt
+          junitxml-path: ./pytest.xml

.github/workflows/update-ios-data.yml

@@ -16,14 +16,15 @@ jobs:
       - name: Run script to fetch latest iOS releases from Apple RSS feed.
         run: python3 .github/workflows/scripts/update-ios-releases.py
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@v8
         with:
           title: '[auto] Update iOS releases and versions'
           commit-message: Add new iOS versions and build numbers
           branch: auto/add-new-ios-releases
+          draft: true
           body: |
             This is an automated pull request to update the iOS releases and version numbers.
           add-paths: |
             *.json
           labels: |
-            automated pr
+            automated pr

.gitignore

@@ -86,6 +86,9 @@ ipython_config.py
 # pyenv
 .python-version
 
+# uv project Python version
+!.python-version
+
 # pipenv
 #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
@@ -138,4 +141,4 @@ dmypy.json
 .idea
 
 # Sublime Text project files
-*.sublime*
+*.sublime*

.python-version

@@ -0,0 +1 @@
+3.10

.readthedocs.yaml

@@ -6,14 +6,16 @@
 version: 2
 
 build:
-  os: "ubuntu-22.04"
+  os: "ubuntu-24.04"
   tools:
     python: "3.11"
 
 mkdocs:
   configuration: mkdocs.yml
 
-# Optionally set the version of Python and requirements required to build your docs
 python:
-   install:
-   - requirements: docs/requirements.txt
+  install:
+    - method: uv
+      command: sync
+      groups:
+        - docs

.safety-policy.yml

@@ -6,4 +6,6 @@
 security: # configuration for the `safety check` command
     ignore-vulnerabilities: # Here you can list multiple specific vulnerabilities you want to ignore (optionally for a time period)
         67599: # Example vulnerability ID
+            reason: disputed, inapplicable
+        70612:
             reason: disputed, inapplicable

CONTRIBUTING.md

@@ -1,19 +1,65 @@
-# Contributing
+# Contributing to Mobile Verification Toolkit (MVT)
 
-Thank you for your interest in contributing to Mobile Verification Toolkit (MVT)! Your help is very much appreciated.
+We greatly appreciate contributions to MVT!
+
+Your involvement, whether through identifying issues, improving functionality, or enhancing documentation, is very much appreciated. To ensure smooth collaboration and a welcoming environment, we've outlined some key guidelines for contributing below.
+
+## Getting started
+
+Contributing to an open-source project like MVT might seem overwhelming at first, but we're here to support you!
+
+ Whether you're a technologist, a frontline human rights defender, a field researcher, or someone new to consensual spyware forensics, there are many ways to make meaningful contributions.
+
+ Here's how you can get started:
+
+1. **Explore the codebase:**
+    - Browse the repository to get familar with MVT. Many MVT modules are simple in functionality and easy to understand.
+    - Look for `TODO:` or `FIXME:` comments in the code for areas that need attention.
+
+2. **Check Github issues:**
+    - Look for issues tagged with ["help wanted"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) or ["good first issue"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) to find tasks that are beginner-friendly or where input from the community would be helpful.
+
+3. **Ask for guidance:**
+
+    - If you're unsure where to start, feel free to open a [discussion](https://github.com/mvt-project/mvt/discussions) or comment on an issue.
+
+## How to contribute:
+
+1. **Report issues:**
+
+ - Found a bug? Please check existing issues to see if it's already reported. If not, open a new issue. Mobile operating systems and databases are constantly evolving, an new errors may appear spontaniously in new app versions.
+
+ **Please provide as much information as possible about the prodblem including: any error messages, steps to reproduce the problem, and any logs or screenshots that can help.**
 
 
-## Where to start
+2. **Suggest features:**
+    - If you have an idea for new functionality, create a feature request issue and describe your proposal.
 
-Starting to contribute to a somewhat complex project like MVT might seem intimidating. Unless you have specific ideas of new functionality you would like to submit, some good starting points are searching for `TODO:` and `FIXME:` comments throughout the code. Alternatively you can check if any GitHub issues existed marked with the ["help wanted"](https://github.com/mvt-project/mvt/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) tag.
+3. **Submit code:**
+    - Fork the repository and create a new branch for your changes.
+    - Ensure your changes align with the code style guidelines (see below).
+    - Open a pull request (PR) with a clear description of your changes and link it to any relevant issues.
 
+4. **Documentation contributions:**
+    - Improving documentation is just as valuable as contributing code! If you notice gaps or inaccuracies in the documentation, feel free to submit changes or suggest updates.
 
 ## Code style
+Please follow these code style guidelines for consistency and readability:
 
-When contributing code to 
+- **Indentation**: use 4 spaces per tab.
+- **Quotes**: Use double quotes (`"`) by default. Use single quotes (`'`) for nested strings instead of escaping (`\"`), or when using f-formatting.
+- **Maximum line length**:
+    - Aim for lines no longer than 80 characters.
+    - Exceptions are allowed for long log lines or strings, which may extend up to 100 characters.
+    - Wrap lines that exceed 100 characters.
 
-- **Indentation**: we use 4-spaces tabs.
+Follow [PEP 8 guidelines](https://peps.python.org/pep-0008/) for indentation and overall Python code style. All MVT code is automatically linted with [Ruff](https://github.com/astral-sh/ruff) before merging.
 
-- **Quotes**: we use double quotes (`"`) as a default. Single quotes (`'`) can be favored with nested strings instead of escaping (`\"`), or when using f-formatting.
+Please check your code before opening a pull request by running `make ruff`
 
-- **Maximum line length**: we strongly encourage to respect a 80 characters long lines and to follow [PEP8 indentation guidelines](https://peps.python.org/pep-0008/#indentation) when having to wrap. However, if breaking at 80 is not possible or is detrimental to the readability of the code, exceptions are tolerated. For example, long log lines, or long strings can be extended to 100 characters long. Please hard wrap anything beyond 100 characters.
+
+## Community and support
+
+We aim to create a supportive and collaborative environment for all contributors. If you run into any challenges, feel free to reach out through the discussions or issues section of the repository.
+
+Your contributions, big or small, help improve MVT and are always appreciated.

Dockerfile

@@ -1,79 +1,155 @@
-FROM ubuntu:22.04
+# Base image for building libraries
+# ---------------------------------
+FROM ubuntu:22.04 AS build-base
 
-# Ref. https://github.com/mvt-project/mvt
+ARG DEBIAN_FRONTEND=noninteractive
 
-LABEL url="https://mvt.re"
-LABEL vcs-url="https://github.com/mvt-project/mvt"
-LABEL description="MVT is a forensic tool to look for signs of infection in smartphone devices."
-
-ENV PIP_NO_CACHE_DIR=1
-ENV DEBIAN_FRONTEND=noninteractive
-
-# Fixing major OS dependencies
-# ----------------------------
-RUN apt update \
-  && apt install -y python3 python3-pip libusb-1.0-0-dev wget unzip default-jre-headless adb \
-
-# Install build tools for libimobiledevice
-# ----------------------------------------
+# Install build tools and dependencies
+RUN apt-get update \
+  && apt-get install -y \
   build-essential \
-  checkinstall \
   git \
   autoconf \
   automake \
   libtool-bin \
-  libplist-dev \
-  libusbmuxd-dev \
-  libssl-dev \
-  sqlite3 \
   pkg-config \
+  libcurl4-openssl-dev \
+  libusb-1.0-0-dev \
+  libssl-dev \
+  udev \
+  && rm -rf /var/lib/apt/lists/*
 
-# Clean up
+
+# libplist
 # --------
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/* /var/cache/apt
+FROM build-base AS build-libplist
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libplist
 
 
-# Build libimobiledevice
-# ----------------------
-RUN git clone https://github.com/libimobiledevice/libplist \
-  && git clone https://github.com/libimobiledevice/libimobiledevice-glue \
-  && git clone https://github.com/libimobiledevice/libusbmuxd \
-  && git clone https://github.com/libimobiledevice/libimobiledevice \
-  && git clone https://github.com/libimobiledevice/usbmuxd \
+# libimobiledevice-glue
+# ---------------------
+FROM build-base AS build-libimobiledevice-glue
 
-  && cd libplist && ./autogen.sh && make && make install && ldconfig \
+# Install dependencies
+COPY --from=build-libplist /build /
 
-  && cd ../libimobiledevice-glue && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr && make && make install && ldconfig \
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice-glue
 
-  && cd ../libusbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh && make && make install && ldconfig \
 
-  && cd ../libimobiledevice && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --enable-debug && make && make install && ldconfig \
+# libtatsu
+# --------
+FROM build-base AS build-libtatsu
 
-  && cd ../usbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make && make install \
+# Install dependencies
+COPY --from=build-libplist /build /
 
-  # Clean up.
-  && cd .. && rm -rf libplist libimobiledevice-glue libusbmuxd libimobiledevice usbmuxd
+# Build
+RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libtatsu
 
-# Installing MVT
-# --------------
-RUN pip3 install git+https://github.com/mvt-project/mvt.git@main
+
+# libusbmuxd
+# ----------
+FROM build-base AS build-libusbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libusbmuxd
+
+
+# libimobiledevice
+# ----------------
+FROM build-base AS build-libimobiledevice
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
+  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice
+
+
+# usbmuxd
+# -------
+FROM build-base AS build-usbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
+  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
+
+
+# Create main image
+FROM ubuntu:24.04 AS main
+COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/ubuntu:22.04
+
+# Install runtime dependencies
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+  && apt-get install -y \
+  adb \
+  default-jre-headless \
+  libcurl4 \
+  libssl3 \
+  libusb-1.0-0 \
+  python3 \
+  sqlite3
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+COPY --from=build-usbmuxd /build /
+
+# Install mvt using the locally checked out source
+COPY . mvt/
+RUN uv pip install --system --break-system-packages --no-cache ./mvt \
+  && rm -rf mvt
 
 # Installing ABE
-# --------------
-RUN mkdir /opt/abe \
-  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar -O /opt/abe/abe.jar \
+ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
+  https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar /opt/abe/abe.jar
 # Create alias for abe
-  && echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 
-# Generate adb key folder 
-# ------------------------------ 
-RUN mkdir /root/.android && adb keygen /root/.android/adbkey
+# Generate adb key folder
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
+RUN mkdir /root/.android
 
 # Setup investigations environment
-# --------------------------------
 RUN mkdir /home/cases
-WORKDIR /home/cases 
+WORKDIR /home/cases
 RUN echo 'echo "Mobile Verification Toolkit @ Docker\n------------------------------------\n\nYou can find information about how to use this image for Android (https://github.com/mvt-project/mvt/tree/master/docs/android) and iOS (https://github.com/mvt-project/mvt/tree/master/docs/ios) in the official docs of the project.\n"' >> ~/.bashrc \
   && echo 'echo "Note that to perform the debug via USB you might need to give the Docker image access to the USB using \"docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt\" or, preferably, the \"--device=\" parameter.\n"' >> ~/.bashrc
 

Dockerfile.android

@@ -0,0 +1,37 @@
+# Create main image
+FROM python:3.10.14-alpine3.20 AS main
+COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit (Android)"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+
+# Install runtime dependencies
+RUN apk add --no-cache \
+  android-tools \
+  git \
+  libusb \
+  openjdk11-jre-headless \
+  sqlite
+
+# Install mvt
+COPY ./ mvt
+RUN apk add --no-cache --virtual .build-deps gcc musl-dev \
+  && uv pip install --system --no-cache ./mvt \
+  && apk del .build-deps gcc musl-dev && rm -rf ./mvt
+
+# Installing ABE
+ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \
+  https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar /opt/abe/abe.jar
+# Create alias for abe
+RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+
+# Generate adb key folder
+RUN echo 'if [ ! -f /root/.android/adbkey ]; then adb keygen /root/.android/adbkey 2&>1 > /dev/null; fi' >> ~/.bashrc
+RUN mkdir /root/.android
+
+ENTRYPOINT [ "/usr/local/bin/mvt-android" ]

Dockerfile.ios

@@ -0,0 +1,138 @@
+# Base image for building libraries
+# ---------------------------------
+FROM ubuntu:22.04 AS build-base
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+# Install build tools and dependencies
+RUN apt-get update \
+  && apt-get install -y \
+  build-essential \
+  git \
+  autoconf \
+  automake \
+  libtool-bin \
+  pkg-config \
+  libcurl4-openssl-dev \
+  libusb-1.0-0-dev \
+  libssl-dev \
+  udev \
+  && rm -rf /var/lib/apt/lists/*
+
+
+# libplist
+# --------
+FROM build-base AS build-libplist
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libplist
+
+
+# libimobiledevice-glue
+# ---------------------
+FROM build-base AS build-libimobiledevice-glue
+
+# Install dependencies
+COPY --from=build-libplist /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice-glue
+
+
+# libtatsu
+# --------
+FROM build-base AS build-libtatsu
+
+# Install dependencies
+COPY --from=build-libplist /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libtatsu
+
+
+# libusbmuxd
+# ----------
+FROM build-base AS build-libusbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
+  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libusbmuxd
+
+
+# libimobiledevice
+# ----------------
+FROM build-base AS build-libimobiledevice
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
+  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf libimobiledevice
+
+
+# usbmuxd
+# -------
+FROM build-base AS build-usbmuxd
+
+# Install dependencies
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+
+# Build
+RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
+  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
+  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
+
+
+# Main image
+# ----------
+FROM python:3.10.14-alpine3.20 AS main
+COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+
+LABEL org.opencontainers.image.url="https://mvt.re"
+LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
+LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
+LABEL org.opencontainers.image.title="Mobile Verification Toolkit (iOS)"
+LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+LABEL org.opencontainers.image.licenses="MVT License 1.1"
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+
+# Install runtime dependencies
+RUN apk add --no-cache \
+  gcompat \
+  libcurl \
+  libssl3 \
+  libusb \
+  sqlite
+COPY --from=build-libplist /build /
+COPY --from=build-libimobiledevice-glue /build /
+COPY --from=build-libtatsu /build /
+COPY --from=build-libusbmuxd /build /
+COPY --from=build-libimobiledevice /build /
+COPY --from=build-usbmuxd /build /
+
+# Install mvt using the locally checked out source
+COPY ./ mvt
+RUN apk add --no-cache --virtual .build-deps git gcc musl-dev \
+  && uv pip install --system --no-cache ./mvt \
+  && apk del .build-deps git gcc musl-dev && rm -rf ./mvt
+
+ENTRYPOINT [ "/usr/local/bin/mvt-ios" ]

Makefile

@@ -1,23 +1,39 @@
 PWD = $(shell pwd)
+UV ?= uv
 
-check:
-	flake8
-	ruff check -q .
-	black --check .
-	pytest -q
+check: ruff mypy
 
+ruff:
+	$(UV) run ruff check .
+
+mypy:
+	$(UV) run mypy
+
+test:
+	$(UV) run pytest
+
+test-ci:
+	$(UV) run pytest -v
+
+install:
+	$(UV) sync
+
+test-requirements:
+	$(UV) sync --group dev
+
+generate-proto-parsers:
+	# Generate python parsers for protobuf files
+	PROTO_FILES=$$(find src/mvt/android/parsers/proto/ -iname "*.proto"); \
+	$(UV) run protoc -Isrc/mvt/android/parsers/proto/ --python_betterproto2_out=src/mvt/android/parsers/proto/ $$PROTO_FILES
 
 clean:
-	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/mvt.egg-info
+	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/src/mvt.egg-info
 
 dist:
-	python3 setup.py sdist bdist_wheel
+	$(UV) build
 
 upload:
-	python3 -m twine upload dist/*
+	$(UV) tool run twine upload dist/*
 
 test-upload:
-	python3 -m twine upload --repository testpypi dist/*
-
-pylint:
-	pylint --rcfile=setup.cfg mvt
+	$(UV) tool run twine upload --repository testpypi dist/*

README.md

@@ -4,9 +4,12 @@
 
 # Mobile Verification Toolkit
 
+> [!IMPORTANT]
+> We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757
+
 [![](https://img.shields.io/pypi/v/mvt)](https://pypi.org/project/mvt/)
 [![Documentation Status](https://readthedocs.org/projects/mvt/badge/?version=latest)](https://docs.mvt.re/en/latest/?badge=latest)
-[![CI](https://github.com/mvt-project/mvt/actions/workflows/python-package.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/python-package.yml)
+[![CI](https://github.com/mvt-project/mvt/actions/workflows/tests.yml/badge.svg)](https://github.com/mvt-project/mvt/actions/workflows/tests.yml)
 [![Downloads](https://pepy.tech/badge/mvt)](https://pepy.tech/project/mvt)
 
 Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
@@ -38,6 +41,18 @@ MVT can be installed from sources or from [PyPI](https://pypi.org/project/mvt/)
 pip3 install mvt
 ```
 
+You can also install MVT from PyPI with [uv](https://docs.astral.sh/uv/). First, install uv:
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh
+```
+
+Then install MVT as a command-line tool:
+
+```bash
+uv tool install mvt
+```
+
 For alternative installation options and known issues, please refer to the [documentation](https://docs.mvt.re/en/latest/install/) as well as [GitHub Issues](https://github.com/mvt-project/mvt/issues).
 
 
@@ -45,6 +60,28 @@ For alternative installation options and known issues, please refer to the [docu
 
 MVT provides two commands `mvt-ios` and `mvt-android`. [Check out the documentation to learn how to use them!](https://docs.mvt.re/)
 
+### Shell completion
+
+MVT can generate shell completion scripts for Bash, Zsh, and Fish:
+
+```bash
+mvt-ios completion
+mvt-android completion
+```
+
+The commands print setup instructions by default. To generate a completion script directly, pass the shell name:
+
+```bash
+mvt-ios completion bash
+mvt-android completion zsh
+```
+
+MVT only writes completion files or shell configuration when `--install` is passed. See the [command completion documentation](https://docs.mvt.re/en/latest/command_completion/) for details.
+Module-running `check-*` commands can load custom Python modules with
+`--load-module PATH` or from a folder set in `MVT_CUSTOM_MODULES`. See the
+[development documentation](https://docs.mvt.re/en/latest/development/) for
+details.
+
 
 ## License
 

SECURITY.md

@@ -2,4 +2,61 @@
 
 Thank you for your interest in reporting security issues and vulnerabilities! Security research is of utmost importance and we take all reports seriously. If you discover an issue please report it to us right away!
 
-Please DO NOT file a public issue, instead send your report privately to *nex [at] nex [dot] sx*. You can also write PGP-encrypted emails to [this key](https://keybase.io/nex/pgp_keys.asc?fingerprint=05216f3b86848a303c2fe37dd166f1667359d880).
+Please DO NOT file a public issue, instead send your report privately to the MVT maintainers at Amnesty International via `security [at] amnesty [dot] tech`.
+
+You can also write PGP-encrypted emails to key `CFBF9698DCA8EB2A80F48ADEA035A030FA04ED13`. The corresponding PGP public key is lited below.
+
+```
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGlFPwsBEADQ+d7SeHrFPYv3wPOjWs2oMpp0DPdfIyGbg+iYWOC36FegZhKY
++WeK96GqJWt8wD6kwFUVwQI795WZrjSd1q4a7wR+kj/h7xlRB6ZfVICA6O5DOOm6
+GNMvqy7ESm8g1XZDpb2u1BXmSS9X8f6rjB0e86kYsF1mB5/2USTM63jgDs0GGTkZ
+Q1z4Mq4gYyqH32b3gvXkbb68LeQmONUIM3cgmec9q8/pNc1l7fcoLWhOVADRj17Q
+plisa/EUf/SYqdtk9w7EHGggNenKNwVM235mkPcMqmE72bTpjT6XCxvZY3ByG5yi
+7L+tHJU45ZuXtt62EvX03azxThVfSmH/WbRk8lH8+CW8XMmiWZphG4ydPWqgVKCB
+2UOXm+6CQnKA+7Dt1AeK2t5ciATrv9LvwgSxk5WKc3288XFLA6eGMrTdQygYlLjJ
++42RSdK/7fCt/qk4q13oUw8ZTVcCia98uZFi704XuuYTH6NrntIB7j/0oucIS4Y9
+cTWNO5LBerez4v8VI4YHcYESPeIWGFkXhvJzo0VMg1zidBLtiPoGF2JKZGwaK7/p
+yY1xALskLp4H+5OY4eB1kf8kl4vGsEK8xA/NNzOiapVmwBXpvVvmXIQJE2k+olNf
+sAuyB8+aO1Ws7tFYt3D+olC7iaprOdK7uA4GCgmYYhq6QQPg+cxfczgHfwARAQAB
+tD1TZWN1cml0eSBMYWIgYXQgQW1uZXN0eSBJbnRlcm5hdGlvbmFsIDxzZWN1cml0
+eUBhbW5lc3R5LnRlY2g+iQJRBBMBCAA7FiEEz7+WmNyo6yqA9IreoDWgMPoE7RMF
+AmlFPwsCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQoDWgMPoE7RNr
+2w//a88uP90uSN6lgeIwKsHr1ri27QIBbzCV6hLN/gZBFR2uaiOn/xfFDbnR0Cjo
+5nMCJCT1k4nrPbMTlfmWLCD+YKELBzVqWlw4J2SOg3nznPl2JrL8QBKjwts0sF+h
+QbRWDsT54wBZnl6ZJJ79eLShNTokBbKnQ7071dMrENr5e2P2sClQXyiIc51ga4FM
+fHyhsx+GsrdiZNd2AH8912ljW1GuEi3epTO7KMZprmr37mjpZSUToiV59Yhl1Gbo
+2pixkYJqi62DG02/gTpCjq9NH3cEMxcxjh4E7yCA8ggLG6+IN6woIvPIdOsnQ+Yj
+d3H4rMNBjPSKoL+bdHILkCnp5HokcbVjNY3QAyOAF4qWhk4GtgpTshwxUmb4Tbay
+tWLJC2bzjuUBxLkGzMVFfU3B96sVS4Fi0sBaEMBtHskl2f45X8LJhSq//Lw/2L/8
+34uP/RxDSn+DPvj/yqMpekdCcmeFSTX1A19xkPcc0rVhMRde4VL338R86vzh0gMI
+1LySDAhXZyVWzrQ5s3n6N3EvCaHCn3qu7ieyFJifCSR7gZqevCEznMQRVpkMTzUt
+rk13Z6NOOb4IlTW7HFoY3omJG8Z5jV4kMIE7n6nb0qpNYQiG+YvjenQ3VrMoISyh
+lpS2De8+oOtwrxBVX3+qKWvQqzufeE3416kw2Z+5mxH7bx25Ag0EaUU/CwEQALyZ
+b+kwLN1yHObTm2yDBEn5HbCT3H1GremvPNmbAaTnfrjUngoKa8MuWWzbX5ptgmZR
+UpYY/ylOYcgGydz58vUNrPlhIZT9UhmiifPgZLEXyd0uFpr/NsbRajHMkK10iEZf
+h5bHNobiB7pGCu4Uj9e1cMiIZ4yEaYeyXYUoNHf6ISP39mJhHy6ov5yIpm9q0wzm
+tGUQPupxGXmEZlOPr3lxqXQ3Ekdv6cWDY5r/oOq71QJ/HUQ13QUuGFIbhnMbT8zd
+zaS6f/v772YKsWPc4NNUhtlf25VnQ4FuUtjCe3p6iYP4OVD8gJm0GvXyvyTuiQbL
+CSk/378JiNT7nZzYXxrWchMwvEoMIU55+/UaBc50HI5xvDQ858CX7PYGiimcdsO1
+EkQzhVxRfjlILfWrC2lgt+H5qhTn4Fah250Xe1PnLjXGHVUQnY/f3MFeiWQgf92b
+02+MfvOeC5OKttP1z5lcx6RFWCIa1E/u8Nj7YrH9hk0ZBRAnBaeAncDFY8dfX2zX
+VMoc0dV16gM7RrZ6i7D3CG3eLLkQlX0jbW9dzTuG/3f098EWB1p8vOfS/RbNCBRX
+jqGiqacL/aFF3Ci3nQ4O5tSv1XipbgrUhvXnwm9pxrLPS/45iaO59WN4RRGWLLQ7
+LHmeBxoa9avv0SdBYUL+eBxY46GXb/j5VLzHYhSnABEBAAGJAjYEGAEIACAWIQTP
+v5aY3KjrKoD0it6gNaAw+gTtEwUCaUU/CwIbDAAKCRCgNaAw+gTtEyvsEACnyFFD
+alOZTrrJTXNnUejuiExLh+qTO3T91p5bte597jpwCZnYGwkxEfffsqqhlY6ftEOf
+d5tNWE5isai4v8XCbplWomz4KBpepxcn2b+9o5dSyr1vohEFuCJziZDsta1J2DX5
+IE9U48kTgLDfdIBhuOyHNRkvXRHP2OVLCaiw4d9q+hlrraR8pehHt2BJSxh+QZoe
+n0iHvIZCBIUA45zLEGmXFpNTGeEf2dKPp3xOkAXOhAMPptE0V1itkF3R7kEW4aFO
+SZo8L3C1aWSz/gQ4/vvW5t1IJxirNMUgTMQFvqEkAwX3fm6GCxlgRSvTTRXdcrS8
+6qyFdH1nkCNsavPahN3N2RGGIlWtODEMTO1Hjy0kZtTYdW+JH9sendliCoJES+yN
+DjM125SgdAgrqlSYm/g8n9knWpxZv1QM6jU/sVz1J+l6/ixugL2i+CAL2d6uv4tT
+QmXnu7Ei4/2kHBUu3Lf59MNgmLHm6F7AhOWErszSeoJKsp+3yA1oTT/npz67sRzY
+VVyxz4NBIollna59a1lz0RhlWzNKqNB27jhylyM4ltdzHB7r4VMAVJyttozmIIOC
+35ucYxl5BHLuapaRSaYHdUId1LOccYyaOOFF/PSyCu9dKzXk7zEz2HNcIboWSkAE
+8ZDExMYM4WVpVCOj+frdsaBvzItHacRWuijtkw==
+=JAXX
+-----END PGP PUBLIC KEY BLOCK-----
+```

dev/mvt-android

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2022 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from mvt import android
-
-android.cli()

dev/mvt-ios

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2022 Claudio Guarnieri.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from mvt import ios
-
-ios.cli()

docs/android/adb.md

@@ -1,42 +1,29 @@
-# Check over ADB
+# ADB Analysis Removed
 
-In order to check an Android device over the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb) you will first need to install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you have installed [Android Studio](https://developer.android.com/studio/) you should already have access to `adb` and other utilities.
+The ability to analyze Android devices directly over the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb) has been removed from MVT.
 
-While many Linux distributions already package Android Platform Tools (for example `android-platform-tools-base` on Debian), it is preferable to install the most recent version from the official website. Packaged versions might be outdated and incompatible with most recent Android handsets.
-
-Next you will need to enable debugging on the Android device you are testing. [Please follow the official instructions on how to do so.](https://developer.android.com/studio/command-line/adb)
-
-## Connecting over USB
-
-The easiest way to check the device is over a USB transport. You will need to have USB debugging enabled and the device plugged into your computer. If everything is configured appropriately you should see your device when launching the command `adb devices`.
-
-Now you can try launching MVT with:
+Use [AndroidQF](https://github.com/mvt-project/androidqf) to collect forensic artifacts from an Android device, then analyze the collected output with:
 
 ```bash
-mvt-android check-adb --output /path/to/results
+mvt-android check-androidqf /path/to/androidqf-output
 ```
 
-If you have previously started an adb daemon MVT will alert you and require you to kill it with `adb kill-server` and relaunch the command.
-
-!!! warning
-    MVT relies on the Python library [adb-shell](https://pypi.org/project/adb-shell/) to connect to an Android device, which relies on libusb for the USB transport. Because of known driver issues, Windows users [are recommended](https://github.com/JeffLIrion/adb_shell/issues/118) to install appropriate drivers using [Zadig](https://zadig.akeo.ie/). Alternatively, an easier option might be to use the TCP transport and connect over Wi-Fi as describe next.
-
-## Connecting over Wi-FI
-
-When connecting to the device over USB is not possible or not working properly, an alternative option is to connect over the network. In order to do so, first launch an adb daemon at a fixed port number:
+For a standalone Android bug report, use:
 
 ```bash
-adb tcpip 5555
+mvt-android check-bugreport /path/to/bugreport.zip
 ```
 
-Then you can specify the IP address of the phone with the adb port number to MVT like so:
+## Reasons for Removal
 
-```bash
-mvt-android check-adb --serial 192.168.1.20:5555 --output /path/to/results
-```
+1. **Inconsistent Data Collection Across Devices**
+   Android devices vary significantly in system architecture, security policy, and diagnostic log availability. This made it difficult to collect reliable forensic data across devices.
 
-Where `192.168.1.20` is the correct IP address of your device.
+2. **Incomplete Forensic Data Acquisition**
+   Direct ADB analysis did not retrieve a complete forensic snapshot. Critical artifacts such as full bug reports could be missing.
 
-## MVT modules requiring root privileges
+3. **Duplicated Analysis Paths**
+   Similar artifacts were parsed through separate ADB, AndroidQF, and bugreport modules, which made behavior harder to keep consistent.
 
-Of the currently available `mvt-android check-adb` modules a handful require root privileges to function correctly. This is because certain files, such as browser history and SMS messages databases are not accessible with user privileges through adb. These modules are to be considered OPTIONALLY available in case the device was already jailbroken. **Do NOT jailbreak your own device unless you are sure of what you are doing!** Jailbreaking your phone exposes it to considerable security risks!
+4. **Workflow Consistency**
+   MVT now focuses on analyzing acquired artifacts rather than interacting with live devices directly.

docs/android/download_apks.md

@@ -1,28 +0,0 @@
-# Downloading APKs from an Android phone
-
-MVT allows to attempt to download all available installed packages (APKs) in order to further inspect them and potentially identify any which might be malicious in nature.
-
-You can do so by launching the following command:
-
-```bash
-mvt-android download-apks --output /path/to/folder
-```
-
-It might take several minutes to complete.
-
-!!! info
-    MVT will likely warn you it was unable to download certain installed packages. There is no reason to be alarmed: this is typically expected behavior when MVT attempts to download a system package it has no privileges to access.
-
-Optionally, you can decide to enable lookups of the SHA256 hash of all the extracted APKs on [VirusTotal](https://www.virustotal.com). While these lookups do not provide any conclusive assessment on all of the extracted APKs, they might highlight any known malicious ones:
-
-```bash
-MVT_VT_API_KEY=<key> mvt-android download-apks --output /path/to/folder --virustotal
-```
-
-Please note that in order to use VirusTotal lookups you are required to provide your own API key through the `MVT_VT_API_KEY` environment variable. You should also note that VirusTotal enforces strict API usage. Be mindful that MVT might consume your hourly search quota.
-
-In case you have a previous extraction of APKs you want to later check against VirusTotal, you can do so with the following arguments:
-
-```bash
-MVT_VT_API_KEY=<key> mvt-android download-apks --from-file /path/to/folder/apks.json --virustotal
-```

docs/android/intrusion_logs.md

@@ -0,0 +1,82 @@
+# Check Android Intrusion Logs
+
+Recent versions of Android can produce structured *Intrusion Logs* — newline-delimited JSON records derived from the platform's [SecurityLog API](https://developer.android.com/reference/android/app/admin/SecurityLog). Intrusion Logging is offered as a new option under Android's **Advanced Protection Mode**, which users can opt into on their device; no MDM or device-policy configuration is required. When enabled, these logs provide a high-fidelity record of process starts, DNS queries, outbound network connections, ADB activity, keyguard events, and other security-relevant operations. The initial Intrusion Logging feature was released for Android 16 in May 2026. The feature and supported events is likely to be expanded over time.
+
+For background on how this data source was introduced and why it is forensically valuable, see the Amnesty International Security Lab announcement: [Android Intrusion Logging as a new source of data for consensual forensic analysis](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/).
+
+## Recommended workflow: collect with AndroidQF
+
+[AndroidQF](https://github.com/mvt-project/androidqf) is the recommended way to acquire data from an Android device for analysis with MVT. During acquisition AndroidQF will prompt the user to also collect intrusion logs from the device, and writes them into an `intrusion-logs/` subdirectory of the acquisition output.
+
+When you analyse such an acquisition with `mvt-android check-androidqf`, MVT automatically detects the `intrusion-logs/` directory and runs the same intrusion-log checks described below — there is no need to invoke a separate command:
+
+```bash
+mvt-android check-androidqf --output /path/to/results/ /path/to/androidqf-output/
+```
+
+The device timezone is read from the AndroidQF acquisition (`getprop.txt`) and applied to event timestamps automatically.
+
+## Standalone command: `check-intrusion-logs`
+
+The `mvt-android check-intrusion-logs` command runs the intrusion-log analysis directly against a set of log files. Prefer the AndroidQF workflow above; use the standalone command when the intrusion logs were collected outside of an AndroidQF acquisition, or when re-analysing only a set of intrusion logs.
+
+## Expected input
+
+`check-intrusion-logs` accepts either:
+
+- a **directory** containing one or more `.txt` files (recursively), or
+- a **`.zip` archive** containing such `.txt` files (nested `.zip` archives are also walked).
+
+Each `.txt` file is expected to contain newline-delimited JSON, with one JSON object per line. Each object wraps a single event under a top-level key indicating its type, for example:
+
+```json
+{"dns_event": {"event_time": 1746979200000, "hostname": "example.com", "ip_addresses": ["93.184.216.34"], "package_name": "com.example.app"}}
+{"connect_event": {"event_time": 1746979201000, "ip_address": "93.184.216.34", "port": 443, "package_name": "com.example.app"}}
+{"security_event": {"event_time": 1746979202000, "tag": 210005, "data": ["..."]}}
+```
+
+Identical events that appear across multiple overlapping log files (e.g. daily rotations) are de-duplicated on a first-seen basis.
+
+## Running the analysis
+
+```bash
+mvt-android check-intrusion-logs --output /path/to/results/ /path/to/intrusion-logs/
+```
+
+A `.zip` archive can be passed directly in place of the directory:
+
+```bash
+mvt-android check-intrusion-logs --output /path/to/results/ /path/to/intrusion-logs.zip
+```
+
+### Options
+
+| Option | Description |
+| --- | --- |
+| `-i, --iocs PATH` | Path to a STIX2 indicator file. May be passed multiple times. |
+| `-o, --output PATH` | Directory where JSON results and the timeline CSV will be written. |
+| `-l, --list-modules` | List the available intrusion-log modules and exit. |
+| `-m, --module NAME` | Run a single module (e.g. `DnsEvent`) instead of all of them. |
+| `-t, --timezone TZ` | IANA timezone name for the device (e.g. `Europe/Paris`). When set, event timestamps are converted to the device's local time instead of UTC. |
+| `-v, --verbose` | Verbose logging. |
+
+## Modules
+
+The command runs the following modules over the parsed events:
+
+- **`DnsEvent`** — DNS resolution events. Hostnames and resolved IP addresses are checked against domain indicators, and the requesting `package_name` is checked against app-identifier indicators.
+- **`ConnectEvent`** — Outbound network connection events. Destination IPs (with localhost addresses skipped) are checked against domain indicators, and `package_name` is checked against app-identifier indicators.
+- **`SecurityEvent`** — Security log events keyed by Android `SecurityLog` tag IDs (e.g. `app_process_start`, `adb_shell_cmd`, `keyguard_dismissed`, `os_startup`, `cert_*` events). These are surfaced in the timeline to help reconstruct device activity around suspected events.
+
+All three modules share a single pre-parsing pass over the input, so adding more modules in the future does not multiply I/O cost. Additional modules will be added in the future to support new event types which are generated by the Intrusion Logging feature.
+
+## Interpreting results
+
+A successful IOC match raises a `CRITICAL` alert that includes the matched indicator, the offending event, and the event timestamp. Alerts are summarised at the end of the run and persisted alongside the per-module JSON results.
+
+When `--timezone` is provided, timestamps in the timeline and JSON output reflect the device's local wall-clock time. Otherwise timestamps are in UTC, consistent with the rest of MVT.
+
+## Limitations
+
+- This page assumes the intrusion logs have already been collected from the device. The recommended collection path is via AndroidQF (see above); intrusion logging itself must have been enabled on the device beforehand by opting into Android's Advanced Protection mode and also enabling the optional Intrusion Logging feature (see the [Amnesty blog post](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/) for details).
+- As with all IOC-based analysis, public indicators alone are not sufficient to conclude that a device is uncompromised. See the [Indicators of Compromise](../iocs.md) page for context.

docs/android/methodology.md

@@ -1,23 +1,75 @@
 # Methodology for Android forensic
 
-Unfortunately Android devices provide much less observability than their iOS cousins. Android stores very little diagnostic information useful to triage potential compromises, and because of this `mvt-android` capabilities are limited as well.
+Unfortunately Android devices provide fewer complete forensically useful datasources than their iOS cousins. Unlike iOS, the Android backup feature only provides a limited about of relevant data.
+
+Android diagnostic logs such as *bugreport files* can be inconsistent in format and structure across different Android versions and device  vendors. The limited diagnostic information available makes it difficult to triage potential compromises, and because of this `mvt-android` capabilities are limited as well.
 
 However, not all is lost.
 
-## Check installed Apps
+## Check Android devices with AndroidQF and MVT
 
-Because malware attacks over Android typically take the form of malicious or backdoored apps, the very first thing you might want to do is to extract and verify all installed Android packages and triage quickly if there are any which stand out as malicious or which might be atypical.
+The [AndroidQF](https://github.com/mvt-project/androidqf) tool can be used to collect a wide range of forensic artifacts from an Android device including an Android backup, a bugreport file, and a range of system logs. MVT natively supports analyzing the generated AndroidQF output for signs of device compromise.
 
-While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly look them up on services such as [VirusTotal](https://www.virustotal.com).
+### Why Use AndroidQF?
 
-!!! info "Using VirusTotal"
-	Please note that in order to use VirusTotal lookups you are required to provide your own API key through the `MVT_VT_API_KEY` environment variable. You should also note that VirusTotal enforces strict API usage. Be mindful that MVT might consume your hourly search quota.
+- **Complete and raw data extraction**
+  AndroidQF collects full forensic artifacts using an on-device forensic collection agent, ensuring that no crucial data is overlooked. The data collection does not depended on the shell environment or utilities available on the device.
 
-## Check the device over Android Debug Bridge
+- **Consistent and standardized output**
+  By collecting a predefined and complete set of forensic files, AndroidQF ensures consistency in data acquisition across different Android devices.
 
-Some additional diagnostic information can be extracted from the phone using the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb). `mvt-android` allows to automatically extract information including [dumpsys](https://developer.android.com/studio/command-line/dumpsys) results, details on installed packages (without download), running processes, presence of root binaries and packages, and more.
+- **Future-proof analysis**
+  Since the full forensic artifacts are preserved, analysts can extract new evidence or apply updated analysis techniques without requiring access to the original device.
 
+- **Cross-platform tool without dependencies**
+  AndroidQF is a standalone Go binary which can be used to remotely collect data from an Android device without the device owner needing to install MVT or a Python environment.
+
+### Workflow for Android Forensic Analysis with AndroidQF
+
+With AndroidQF the analysis process is split into a separate data collection and data analysis stages.
+
+1. **Extract Data Using AndroidQF**
+  Deploy the AndroidQF forensic collector to acquire all relevant forensic artifacts from the Android device.
+
+2. **Analyze Extracted Data with MVT**
+  Use the `mvt-android check-androidqf` command to perform forensic analysis on the extracted artifacts.
+
+By separating artifact collection from forensic analysis, this approach ensures a more reliable and scalable methodology for Android forensic investigations.
+
+For more information, refer to the [AndroidQF project documentation](https://github.com/mvt-project/androidqf).
+
+### VirusTotal package lookups
+
+AndroidQF records APK file hashes in `packages.json`. MVT can optionally look up non-system APK hashes on VirusTotal while checking an AndroidQF acquisition:
+
+```bash
+MVT_VT_API_KEY=<key> mvt-android check-androidqf --virustotal /path/to/androidqf-output
+```
+
+The `--virustotal` option is disabled by default because it sends APK hashes to VirusTotal and requires network access. It uses the `VT_API_KEY` MVT configuration value, which can also be provided through the `MVT_VT_API_KEY` environment variable.
+
+To avoid exhausting free VirusTotal API quotas, MVT waits 16 seconds between package hash requests by default. Use `--delay` to change the delay, or `--delay 0` to disable throttling:
+
+```bash
+mvt-android check-androidqf --virustotal --delay 30 /path/to/androidqf-output
+```
+
+## Android Intrusion Logs
+
+On devices where the user has opted into Android's [**Advanced Protection Mode**](https://support.google.com/android/answer/16339980) and turned on the optional Intrusion Logging featrue, Android can create and archive structured *Intrusion Logs* in an encrypted format. These logs record DNS queries, outbound network connections, process starts, ADB activity and other security-relevant events, and are a high-fidelity complement to the rest of an AndroidQF acquisition. The logs are generated on-device and encrypted before being stored in the Google account associated with the device. The encryption key is protected by the user device PIN. The intrusion log data is not accessible to Google.
+
+AndroidQF will prompt the user to download, decrypt and collect device intrusion logs as part of an acquisition. When they are present, `mvt-android check-androidqf` will automatically run the intrusion-log checks alongside the other AndroidQF modules — no extra command is required. This is the recommended workflow for Android forensic analysis with MVT.
+
+For cases where intrusion logs were collected outside of an AndroidQF acquisition, the standalone `mvt-android check-intrusion-logs` command can analyse them directly. See [Check Android Intrusion Logs](intrusion_logs.md) for details, and the [feature announcment from Amnesty International's Security Lab](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/) for background on the data source.
+
+## Android Debug Bridge analysis removed
+
+The ability to analyze Android devices directly over ADB has been removed from MVT. Direct extraction of data from ADB was error-prone and frequently resulted in inconsistent data collection between ADB and AndroidQF acquisitions. Use AndroidQF for device acquisition and `mvt-android check-androidqf` for analysis.
 
 ## Check an Android Backup (SMS messages)
 
-Although Android backups are becoming deprecated, it is still possible to generate one. Unfortunately, because apps these days typically favor backup over the cloud, the amount of data available is limited. Currently, `mvt-android check-backup` only supports checking SMS messages containing links.
+Although Android backups are becoming deprecated, it is still possible to generate one. Unfortunately, because apps these days typically favor backup over the cloud, the amount of data available is limited.
+
+The `mvt-android check-androidqf` command will automatically check an Android backup and SMS messages if an SMS backup is included in the AndroidQF extraction.
+
+The  `mvt-android check-backup` command can also be used directly with an Android backup file.

docs/command_completion.md

@@ -0,0 +1,66 @@
+# Command Completion
+
+MVT utilizes the [Click](https://click.palletsprojects.com/en/stable/) library for creating its command line interface.
+
+Click provides tab completion support for Bash (version 4.4 and up), Zsh, and Fish.
+
+To enable it, you need to register a completion script with your shell, which varies depending on the shell you are using.
+
+The following describes how to generate the command completion scripts and add them to your shell configuration.
+
+> **Note: You will need to start a new shell for the changes to take effect.**
+
+### For Bash
+
+```bash
+# Generate bash completion scripts
+mvt-ios completion bash > ~/.mvt-ios-complete.bash
+mvt-android completion bash > ~/.mvt-android-complete.bash
+```
+
+Add the following to `~/.bashrc`:
+```bash
+# source mvt completion scripts
+[ -f ~/.mvt-ios-complete.bash ] && . ~/.mvt-ios-complete.bash
+[ -f ~/.mvt-android-complete.bash ] && . ~/.mvt-android-complete.bash
+```
+
+### For Zsh
+
+```bash
+# Generate zsh completion scripts
+mvt-ios completion zsh > ~/.mvt-ios-complete.zsh
+mvt-android completion zsh > ~/.mvt-android-complete.zsh
+```
+
+Add the following to `~/.zshrc`:
+```bash
+# source mvt completion scripts
+[ -f ~/.mvt-ios-complete.zsh ] && . ~/.mvt-ios-complete.zsh
+[ -f ~/.mvt-android-complete.zsh ] && . ~/.mvt-android-complete.zsh
+```
+
+### For Fish
+
+```bash
+# Generate fish completion scripts
+mkdir -p ~/.config/fish/completions
+mvt-ios completion fish > ~/.config/fish/completions/mvt-ios.fish
+mvt-android completion fish > ~/.config/fish/completions/mvt-android.fish
+```
+
+Fish loads completion files from `~/.config/fish/completions` automatically.
+
+### Automatic Installation
+
+MVT can write the completion file and update the relevant shell configuration for Bash and Zsh when you pass `--install`:
+
+```bash
+mvt-ios completion bash --install
+mvt-android completion bash --install
+```
+
+Replace `bash` with `zsh` or `fish` as needed. For Fish, `--install` writes the completion file into `~/.config/fish/completions`.
+
+For more information, visit the official [Click Docs](https://click.palletsprojects.com/en/stable/shell-completion/#enabling-completion).
+

docs/development.md

@@ -2,9 +2,17 @@
 
 The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
 
+## Local environment
+
+MVT uses `uv` for dependency management. To install the project and development dependencies from the locked environment, run:
+
+```bash
+make install
+```
+
 ## Testing
 
-MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `flake8`, `ruff` and `black`. All can
+MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `ruff` and `mypy`. All can
 be run automatically with:
 
 ```bash
@@ -13,6 +21,102 @@ make check
 
 Run these tests before making new commits or opening pull requests.
 
+## Module dependencies
+
+Modules can require other modules to run first by declaring their classes in
+`dependencies`. The command runner uses a stable topological ordering, so the
+existing module list order is preserved wherever dependency constraints allow.
+
+```python
+class DependentModule(MVTModule):
+    dependencies = (PrerequisiteModule,)
+
+    def run(self):
+        prerequisite_results = self.get_dependency_results(PrerequisiteModule)
+```
+
+Selecting a single module also runs its transitive dependencies. If a dependency
+is unavailable or the dependency graph contains a cycle, the command logs a
+warning and does not run any modules.
+
+## Custom modules
+
+Module-running `check-*` commands can load custom modules from Python files that
+are not installed as part of MVT. Load one file with:
+
+```bash
+mvt-ios check-backup --load-module ./example_module.py --output ./out ./backup
+```
+
+You can also load a folder. MVT loads non-hidden top-level `*.py` files in
+sorted order and skips `__init__.py`:
+
+```bash
+mvt-ios check-fs --load-module ./custom_modules ./filesystem-dump
+```
+
+Set `MVT_CUSTOM_MODULES` to load a folder for every module-running command. This
+folder is loaded before any `--load-module` path:
+
+```bash
+MVT_CUSTOM_MODULES=./custom_modules mvt-android check-bugreport ./bugreport.zip
+```
+
+Custom modules are normal `MVTModule` subclasses:
+
+```python
+from mvt.common.module import MVTModule
+
+
+class ExampleCustomModule(MVTModule):
+    supported_commands = (("ios", "check-backup"), ("ios", "check-fs"))
+    slug = "example_custom_module"
+
+    def run(self):
+        self.results = [{"message": "custom module ran"}]
+
+    def check_indicators(self):
+        pass
+
+    def serialize(self, result):
+        return None
+```
+
+Use `supported_commands` to declare the platform/command pairs a module
+supports. Empty `supported_commands` means the module will not run and MVT logs
+a warning. This explicit declaration is required for every command. Supported
+pairs are:
+
+```python
+("ios", "check-backup")
+("ios", "check-fs")
+("ios", "check-iocs")
+("ios", "check-sysdiagnose")
+("android", "check-backup")
+("android", "check-bugreport")
+("android", "check-androidqf")
+("android", "check-intrusion-logs")
+("android", "check-iocs")
+```
+
+Custom modules can depend on existing MVT module classes. Dependencies are
+resolved with the same ordering logic as built-in modules, and custom modules
+are appended after built-ins before ordering:
+
+```python
+from mvt.common.module import MVTModule
+from mvt.ios.modules.backup.manifest import Manifest
+
+
+class DependentCustomModule(MVTModule):
+    supported_commands = (("ios", "check-backup"),)
+    dependencies = (Manifest,)
+
+    def run(self):
+        manifest_results = self.get_dependency_results(Manifest)
+        self.results = [{"manifest_entries": len(manifest_results)}]
+```
+
 ## Profiling
 
 Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
@@ -24,4 +128,4 @@ MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_
 MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
 ```
 
-Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.
+Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/docker.md

@@ -2,7 +2,22 @@ Using Docker simplifies having all the required dependencies and tools (includin
 
 Install Docker following the [official documentation](https://docs.docker.com/get-docker/).
 
-Once installed, you can clone MVT's repository and build its Docker image:
+Once Docker is installed, you can run MVT by downloading a prebuilt MVT Docker image, or by building a Docker image yourself from the MVT source repo.
+
+### Using the prebuilt Docker image
+
+```bash
+docker pull ghcr.io/mvt-project/mvt
+```
+
+You can then run the Docker container with:
+
+```
+docker run -it ghcr.io/mvt-project/mvt
+```
+
+
+### Build and run Docker image from source
 
 ```bash
 git clone https://github.com/mvt-project/mvt.git
@@ -16,18 +31,4 @@ Test if the image was created successfully:
 docker run -it mvt
 ```
 
-If a prompt is spawned successfully, you can close it with `exit`.
-
-If you wish to use MVT to test an Android device you will need to enable the container's access to the host's USB devices. You can do so by enabling the `--privileged` flag and mounting the USB bus device as a volume:
-
-```bash
-docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt
-```
-
-**Please note:** the `--privileged` parameter is generally regarded as a security risk. If you want to learn more about this check out [this explainer on container escapes](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/) as it gives access to the whole system.
-
-Recent versions of Docker provide a `--device` parameter allowing to specify a precise USB device without enabling `--privileged`:
-
-```bash
-docker run -it --device=/dev/<your_usb_port> mvt
-```
+If a prompt is spawned successfully, you can close it with `exit`.

docs/install.md

@@ -98,3 +98,7 @@ You now should have the `mvt-ios` and `mvt-android` utilities installed.
 **Notes:**
 1. The `--force` flag is necessary to force the reinstallation of the package.
 2. To revert to using a PyPI version, it will be necessary to `pipx uninstall mvt` first.
+
+## Setting up command completions
+
+See ["Command completions"](command_completion.md)

docs/iocs.md

@@ -34,6 +34,34 @@ It is also possible to load STIX2 files automatically from the environment varia
 export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 ```
 
+## Network Access
+
+When checking URL indicators, MVT follows recognized shortened URLs with an
+HTTP `HEAD` request. URL checks are deduplicated and run concurrently, with at
+most 20 requests in progress at a time. Redirects within an individual URL
+chain are still followed sequentially. The following environment variables
+control these requests:
+
+- `MVT_NETWORK_ACCESS_ALLOWED` enables or disables network requests. It defaults
+  to `true`. Set it to `false` to prevent MVT from attempting to resolve
+  shortened URLs.
+- `MVT_NETWORK_TIMEOUT` sets the request timeout in seconds. It defaults to
+  `15`.
+
+For example, to run IOC checks without resolving shortened URLs:
+
+```bash
+MVT_NETWORK_ACCESS_ALLOWED=false mvt-ios check-iocs \
+    --iocs ~/iocs/malware.stix2 /path/to/iphone/output/
+```
+
+## STIX2 Support
+
+So far MVT implements only a subset of [STIX2 specifications](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html):
+
+* It only supports checks for one value (such as `[domain-name:value='DOMAIN']`) and not boolean expressions over multiple comparisons
+* It only supports the following types: `domain-name:value`, `process:name`, `email-addr:value`, `file:name`, `file:path`, `file:hashes.md5`, `file:hashes.sha1`, `file:hashes.sha256`, `app:id`, `configuration-profile:id`, `android-property:name`, `url:value` (but each type will only be checked by a module if it is relevant to the type of data obtained)
+
 ## Known repositories of STIX2 IOCs
 
 - The [Amnesty International investigations repository](https://github.com/AmnestyTech/investigations) contains STIX-formatted IOCs for:
@@ -46,3 +74,4 @@ export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.
+

docs/ios/sysdiagnose.md

@@ -0,0 +1,50 @@
+# Check an iOS Sysdiagnose
+
+`mvt-ios check-sysdiagnose` prepares an iOS sysdiagnose archive for analysis by
+custom MVT modules. MVT does not include built-in sysdiagnose modules. You must
+load at least one custom module that explicitly supports this command.
+
+The command accepts either an extracted sysdiagnose directory or the original
+gzip-compressed tar archive.
+
+```bash
+mvt-ios check-sysdiagnose \
+    --load-module ./sysdiagnose_modules.py \
+    --output ./results \
+    ./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz
+```
+
+Use `--hashes` to include hashes for analyzed files in `info.json`, and
+`--list-modules` to display the eligible custom modules without running them.
+
+## Writing a custom module
+
+Extend `SysdiagnoseExtraction` to access the archive contents consistently for
+both directory and tar inputs. Each module must declare the command explicitly
+in `supported_commands`.
+
+```python
+from mvt.ios.modules.sysdiagnose import SysdiagnoseExtraction
+
+
+class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
+    supported_commands = (("ios", "check-sysdiagnose"),)
+    slug = "example_sysdiagnose"
+
+    def run(self):
+        paths = self._get_files_by_pattern("*/example.log")
+        if paths:
+            content = self._get_file_content(paths[0]).decode("utf-8", "replace")
+            self.results = [{"content": content}]
+
+    def check_indicators(self):
+        pass
+
+    def serialize(self, result):
+        return None
+```
+
+The base class provides `from_sysdiagnose_folder()` and
+`from_sysdiagnose_tar()` setup hooks, as well as protected file lookup, file
+reading, and timezone extraction helpers. IPS crash-report metadata is exposed
+on `ips_files`.

docs/requirements.txt

@@ -1,5 +0,0 @@
-mkdocs==1.2.3
-mkdocs-autorefs
-mkdocs-material
-mkdocs-material-extensions
-mkdocstrings

mkdocs.yml

@@ -3,12 +3,14 @@ repo_url: https://github.com/mvt-project/mvt
 edit_uri: edit/main/docs/
 copyright: Copyright © 2021-2023 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
+not_in_nav: |
+    android/adb.md
 markdown_extensions:
     - attr_list
     - admonition
     - pymdownx.emoji:
-        emoji_index: !!python/name:materialx.emoji.twemoji
-        emoji_generator: !!python/name:materialx.emoji.to_svg
+        emoji_index: !!python/name:material.extensions.emoji.twemoji
+        emoji_generator: !!python/name:material.extensions.emoji.to_svg
     - pymdownx.superfences
     - pymdownx.inlinehilite
     - pymdownx.highlight:
@@ -28,6 +30,7 @@ nav:
     - Welcome: "index.md"
     - Introduction: "introduction.md"
     - Installation: "install.md"
+    - Command Completion: "command_completion.md"
     - Using Docker: "docker.md"
     - MVT for iOS:
         - iOS Forensic Methodology: "ios/methodology.md"
@@ -39,12 +42,12 @@ nav:
         - Check a Filesystem Dump:
             - Dumping the filesystem: "ios/filesystem/dump.md"
             - Check a Filesystem Dump with mvt-ios: "ios/filesystem/check.md"
+        - Check a Sysdiagnose: "ios/sysdiagnose.md"
         - Records extracted by mvt-ios: "ios/records.md"
     - MVT for Android:
         - Android Forensic Methodology: "android/methodology.md"
-        - Check over ADB: "android/adb.md"
         - Check an Android Backup (SMS messages): "android/backup.md"
-        - Download APKs: "android/download_apks.md"
+        - Check Android Intrusion Logs: "android/intrusion_logs.md"
     - Indicators of Compromise: "iocs.md"
     - Development: "development.md"
     - License: "license.md"

mvt/android/artifacts/artifact.py

@@ -1,36 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from mvt.common.artifact import Artifact
-
-
-class AndroidArtifact(Artifact):
-    @staticmethod
-    def extract_dumpsys_section(dumpsys: str, separator: str) -> str:
-        """
-        Extract a section from a full dumpsys file.
-
-        :param dumpsys: content of the full dumpsys file (string)
-        :param separator: content of the first line separator (string)
-        :return: section extracted (string)
-        """
-        lines = []
-        in_section = False
-        for line in dumpsys.splitlines():
-            if line.strip() == separator:
-                in_section = True
-                continue
-
-            if not in_section:
-                continue
-
-            if line.strip().startswith(
-                "------------------------------------------------------------------------------"
-            ):
-                break
-
-            lines.append(line)
-
-        return "\n".join(lines)

mvt/android/artifacts/dumpsys_battery_daily.py

@@ -1,78 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from typing import Union
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysBatteryDailyArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys dattery daily updates.
-    """
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["from"],
-            "module": self.__class__.__name__,
-            "event": "battery_daily",
-            "data": f"Recorded update of package {record['package_name']} "
-            f"with vers {record['vers']}",
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, output: str) -> None:
-        daily = None
-        daily_updates = []
-        for line in output.splitlines():
-            if line.startswith("  Daily from "):
-                if len(daily_updates) > 0:
-                    self.results.extend(daily_updates)
-                    daily_updates = []
-
-                timeframe = line[13:].strip()
-                date_from, date_to = timeframe.strip(":").split(" to ", 1)
-                daily = {"from": date_from[0:10], "to": date_to[0:10]}
-                continue
-
-            if not daily:
-                continue
-
-            if not line.strip().startswith("Update "):
-                continue
-
-            line = line.strip().replace("Update ", "")
-            package_name, vers = line.split(" ", 1)
-            vers_nr = vers.split("=", 1)[1]
-
-            already_seen = False
-            for update in daily_updates:
-                if package_name == update["package_name"] and vers_nr == update["vers"]:
-                    already_seen = True
-                    break
-
-            if not already_seen:
-                daily_updates.append(
-                    {
-                        "action": "update",
-                        "from": daily["from"],
-                        "to": daily["to"],
-                        "package_name": package_name,
-                        "vers": vers_nr,
-                    }
-                )
-
-        if len(daily_updates) > 0:
-            self.results.extend(daily_updates)

mvt/android/artifacts/dumpsys_dbinfo.py

@@ -1,83 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysDBInfoArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys DBInfo service
-    """
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            path = result.get("path", "")
-            for part in path.split("/"):
-                ioc = self.indicators.check_app_id(part)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-    def parse(self, output: str) -> None:
-        rxp = re.compile(
-            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\""
-        )  # pylint: disable=line-too-long
-        rxp_no_pid = re.compile(
-            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\""
-        )  # pylint: disable=line-too-long
-
-        pool = None
-        in_operations = False
-        for line in output.splitlines():
-            if line.startswith("Connection pool for "):
-                pool = line.replace("Connection pool for ", "").rstrip(":")
-
-            if not pool:
-                continue
-
-            if line.strip() == "Most recently executed operations:":
-                in_operations = True
-                continue
-
-            if not in_operations:
-                continue
-
-            if not line.startswith("        "):
-                in_operations = False
-                pool = None
-                continue
-
-            matches = rxp.findall(line)
-            if not matches:
-                matches = rxp_no_pid.findall(line)
-                if not matches:
-                    continue
-
-                match = matches[0]
-                self.results.append(
-                    {
-                        "isodate": match[0],
-                        "action": match[1],
-                        "sql": match[2],
-                        "path": pool,
-                    }
-                )
-            else:
-                match = matches[0]
-                self.results.append(
-                    {
-                        "isodate": match[0],
-                        "pid": match[1],
-                        "action": match[2],
-                        "sql": match[3],
-                        "path": pool,
-                    }
-                )

mvt/android/cmd_check_adb.py

@@ -1,37 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.common.command import Command
-
-from .modules.adb import ADB_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckADB(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            log=log,
-        )
-
-        self.name = "check-adb"
-        self.modules = ADB_MODULES

mvt/android/cmd_check_androidqf.py

@@ -1,67 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import zipfile
-from pathlib import Path
-from typing import List, Optional
-
-from mvt.common.command import Command
-
-from .modules.androidqf import ANDROIDQF_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckAndroidQF(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: bool = False,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            hashes=hashes,
-            log=log,
-        )
-
-        self.name = "check-androidqf"
-        self.modules = ANDROIDQF_MODULES
-
-        self.format: Optional[str] = None
-        self.archive: Optional[zipfile.ZipFile] = None
-        self.files: List[str] = []
-
-    def init(self):
-        if os.path.isdir(self.target_path):
-            self.format = "dir"
-            parent_path = Path(self.target_path).absolute().parent.as_posix()
-            target_abs_path = os.path.abspath(self.target_path)
-            for root, subdirs, subfiles in os.walk(target_abs_path):
-                for fname in subfiles:
-                    file_path = os.path.relpath(os.path.join(root, fname), parent_path)
-                    self.files.append(file_path)
-        elif os.path.isfile(self.target_path):
-            self.format = "zip"
-            self.archive = zipfile.ZipFile(self.target_path)
-            self.files = self.archive.namelist()
-
-    def module_init(self, module):
-        if self.format == "zip":
-            module.from_zip_file(self.archive, self.files)
-        else:
-            parent_path = Path(self.target_path).absolute().parent.as_posix()
-            module.from_folder(parent_path, self.files)

mvt/android/cmd_check_backup.py

@@ -1,114 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import io
-import logging
-import os
-import sys
-import tarfile
-from pathlib import Path
-from typing import List, Optional
-
-from mvt.android.modules.backup.base import BackupExtraction
-from mvt.android.modules.backup.helpers import prompt_or_load_android_backup_password
-from mvt.android.parsers.backup import (
-    AndroidBackupParsingError,
-    InvalidBackupPassword,
-    parse_ab_header,
-    parse_backup_file,
-)
-from mvt.common.command import Command
-
-from .modules.backup import BACKUP_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckBackup(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: bool = False,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            hashes=hashes,
-            log=log,
-        )
-
-        self.name = "check-backup"
-        self.modules = BACKUP_MODULES
-
-        self.backup_type: str = ""
-        self.backup_archive: Optional[tarfile.TarFile] = None
-        self.backup_files: List[str] = []
-
-    def init(self) -> None:
-        if not self.target_path:
-            return
-
-        if os.path.isfile(self.target_path):
-            self.backup_type = "ab"
-            with open(self.target_path, "rb") as handle:
-                data = handle.read()
-
-            header = parse_ab_header(data)
-            if not header["backup"]:
-                log.critical("Invalid backup format, file should be in .ab format")
-                sys.exit(1)
-
-            password = None
-            if header["encryption"] != "none":
-                password = prompt_or_load_android_backup_password(
-                    log, self.module_options
-                )
-                if not password:
-                    log.critical("No backup password provided.")
-                    sys.exit(1)
-            try:
-                tardata = parse_backup_file(data, password=password)
-            except InvalidBackupPassword:
-                log.critical("Invalid backup password")
-                sys.exit(1)
-            except AndroidBackupParsingError as exc:
-                log.critical("Impossible to parse this backup file: %s", exc)
-                log.critical("Please use Android Backup Extractor (ABE) instead")
-                sys.exit(1)
-
-            dbytes = io.BytesIO(tardata)
-            self.backup_archive = tarfile.open(fileobj=dbytes)
-            for member in self.backup_archive:
-                self.backup_files.append(member.name)
-
-        elif os.path.isdir(self.target_path):
-            self.backup_type = "folder"
-            self.target_path = Path(self.target_path).absolute().as_posix()
-            for root, subdirs, subfiles in os.walk(os.path.abspath(self.target_path)):
-                for fname in subfiles:
-                    self.backup_files.append(
-                        os.path.relpath(os.path.join(root, fname), self.target_path)
-                    )
-        else:
-            log.critical(
-                "Invalid backup path, path should be a folder or an "
-                "Android Backup (.ab) file"
-            )
-            sys.exit(1)
-
-    def module_init(self, module: BackupExtraction) -> None:  # type: ignore[override]
-        if self.backup_type == "folder":
-            module.from_folder(self.target_path, self.backup_files)
-        else:
-            module.from_ab(self.target_path, self.backup_archive, self.backup_files)

mvt/android/cmd_check_bugreport.py

@@ -1,76 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-from pathlib import Path
-from typing import List, Optional
-from zipfile import ZipFile
-
-from mvt.android.modules.bugreport.base import BugReportModule
-from mvt.common.command import Command
-
-from .modules.bugreport import BUGREPORT_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckBugreport(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: bool = False,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            hashes=hashes,
-            log=log,
-        )
-
-        self.name = "check-bugreport"
-        self.modules = BUGREPORT_MODULES
-
-        self.bugreport_format: str = ""
-        self.bugreport_archive: Optional[ZipFile] = None
-        self.bugreport_files: List[str] = []
-
-    def init(self) -> None:
-        if not self.target_path:
-            return
-
-        if os.path.isfile(self.target_path):
-            self.bugreport_format = "zip"
-            self.bugreport_archive = ZipFile(self.target_path)
-            for file_name in self.bugreport_archive.namelist():
-                self.bugreport_files.append(file_name)
-        elif os.path.isdir(self.target_path):
-            self.bugreport_format = "dir"
-            parent_path = Path(self.target_path).absolute().as_posix()
-            for root, _, subfiles in os.walk(os.path.abspath(self.target_path)):
-                for file_name in subfiles:
-                    file_path = os.path.relpath(
-                        os.path.join(root, file_name), parent_path
-                    )
-                    self.bugreport_files.append(file_path)
-
-    def module_init(self, module: BugReportModule) -> None:  # type: ignore[override]
-        if self.bugreport_format == "zip":
-            module.from_zip(self.bugreport_archive, self.bugreport_files)
-        else:
-            module.from_folder(self.target_path, self.bugreport_files)
-
-    def finish(self) -> None:
-        if self.bugreport_archive:
-            self.bugreport_archive.close()

mvt/android/cmd_download_apks.py

@@ -1,182 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import logging
-import os
-from typing import Callable, Optional
-
-from rich.progress import track
-
-from mvt.common.module import InsufficientPrivileges
-
-from .modules.adb.base import AndroidExtraction
-from .modules.adb.packages import Packages
-
-log = logging.getLogger(__name__)
-
-
-class DownloadAPKs(AndroidExtraction):
-    """DownloadAPKs is the main class operating the download of APKs
-    from the device.
-    """
-
-    def __init__(
-        self,
-        results_path: Optional[str] = None,
-        all_apks: bool = False,
-        packages: Optional[list] = None,
-    ) -> None:
-        """Initialize module.
-        :param results_path: Path to the folder where data should be stored
-        :param all_apks: Boolean indicating whether to download all packages
-                         or filter known-goods
-        :param packages: Provided list of packages, typically for JSON checks
-        """
-        super().__init__(results_path=results_path, log=log)
-
-        self.packages = packages
-        self.all_apks = all_apks
-        self.results_path_apks = None
-
-    @classmethod
-    def from_json(cls, json_path: str) -> Callable:
-        """Initialize this class from an existing apks.json file.
-
-        :param json_path: Path to the apks.json file to parse.
-
-        """
-        with open(json_path, "r", encoding="utf-8") as handle:
-            packages = json.load(handle)
-            return cls(packages=packages)
-
-    def pull_package_file(self, package_name: str, remote_path: str) -> None:
-        """Pull files related to specific package from the device.
-
-        :param package_name: Name of the package to download
-        :param remote_path: Path to the file to download
-        :returns: Path to the local copy
-
-        """
-        log.info("Downloading %s ...", remote_path)
-
-        file_name = ""
-        if "==/" in remote_path:
-            file_name = "_" + remote_path.split("==/")[1].replace(".apk", "")
-
-        local_path = os.path.join(
-            self.results_path_apks, f"{package_name}{file_name}.apk"
-        )
-        name_counter = 0
-        while True:
-            if not os.path.exists(local_path):
-                break
-
-            name_counter += 1
-            local_path = os.path.join(
-                self.results_path_apks, f"{package_name}{file_name}_{name_counter}.apk"
-            )
-
-        try:
-            self._adb_download(remote_path, local_path)
-        except InsufficientPrivileges:
-            log.error(
-                "Unable to pull package file from %s: insufficient privileges, "
-                "it might be a system app",
-                remote_path,
-            )
-            self._adb_reconnect()
-            return None
-        except Exception as exc:
-            log.exception("Failed to pull package file from %s: %s", remote_path, exc)
-            self._adb_reconnect()
-            return None
-
-        return local_path
-
-    def get_packages(self) -> None:
-        """Use the Packages adb module to retrieve the list of packages.
-        We reuse the same extraction logic to then download the APKs.
-        """
-        self.log.info("Retrieving list of installed packages...")
-
-        m = Packages()
-        m.log = self.log
-        m.serial = self.serial
-        m.run()
-
-        self.packages = m.results
-
-    def pull_packages(self) -> None:
-        """Download all files of all selected packages from the device."""
-        log.info(
-            "Starting extraction of installed APKs at folder %s", self.results_path
-        )
-
-        # If the user provided the flag --all-apks we select all packages.
-        packages_selection = []
-        if self.all_apks:
-            log.info("Selected all %d available packages", len(self.packages))
-            packages_selection = self.packages
-        else:
-            # Otherwise we loop through the packages and get only those that
-            # are not marked as system.
-            for package in self.packages:
-                if not package.get("system", False):
-                    packages_selection.append(package)
-
-            log.info(
-                'Selected only %d packages which are not marked as "system"',
-                len(packages_selection),
-            )
-
-        if len(packages_selection) == 0:
-            log.info("No packages were selected for download")
-            return
-
-        log.info("Downloading packages from device. This might take some time ...")
-
-        self.results_path_apks = os.path.join(self.results_path, "apks")
-        if not os.path.exists(self.results_path_apks):
-            os.makedirs(self.results_path_apks, exist_ok=True)
-
-        for i in track(
-            range(len(packages_selection)),
-            description=f"Downloading {len(packages_selection)} packages...",
-        ):
-            package = packages_selection[i]
-
-            log.info(
-                "[%d/%d] Package: %s",
-                i,
-                len(packages_selection),
-                package["package_name"],
-            )
-
-            # Sometimes the package path contains multiple lines for multiple
-            # apks. We loop through each line and download each file.
-            for package_file in package["files"]:
-                device_path = package_file["path"]
-                local_path = self.pull_package_file(
-                    package["package_name"], device_path
-                )
-                if not local_path:
-                    continue
-
-                package_file["local_path"] = local_path
-
-        log.info("Download of selected packages completed")
-
-    def save_json(self) -> None:
-        json_path = os.path.join(self.results_path, "apks.json")
-        with open(json_path, "w", encoding="utf-8") as handle:
-            json.dump(self.packages, handle, indent=4)
-
-    def run(self) -> None:
-        self.get_packages()
-        self._adb_connect()
-        self.pull_packages()
-        self.save_json()
-        self._adb_disconnect()

mvt/android/modules/adb/__init__.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .chrome_history import ChromeHistory
-from .dumpsys_accessibility import DumpsysAccessibility
-from .dumpsys_activities import DumpsysActivities
-from .dumpsys_appops import DumpsysAppOps
-from .dumpsys_battery_daily import DumpsysBatteryDaily
-from .dumpsys_battery_history import DumpsysBatteryHistory
-from .dumpsys_dbinfo import DumpsysDBInfo
-from .dumpsys_full import DumpsysFull
-from .dumpsys_receivers import DumpsysReceivers
-from .files import Files
-from .getprop import Getprop
-from .logcat import Logcat
-from .packages import Packages
-from .processes import Processes
-from .root_binaries import RootBinaries
-from .selinux_status import SELinuxStatus
-from .settings import Settings
-from .sms import SMS
-from .whatsapp import Whatsapp
-
-ADB_MODULES = [
-    ChromeHistory,
-    SMS,
-    Whatsapp,
-    Processes,
-    Getprop,
-    Settings,
-    SELinuxStatus,
-    DumpsysBatteryHistory,
-    DumpsysBatteryDaily,
-    DumpsysReceivers,
-    DumpsysActivities,
-    DumpsysAccessibility,
-    DumpsysDBInfo,
-    DumpsysFull,
-    DumpsysAppOps,
-    Packages,
-    Logcat,
-    RootBinaries,
-    Files,
-]

mvt/android/modules/adb/base.py

@@ -1,356 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import base64
-import logging
-import os
-import random
-import string
-import sys
-import tempfile
-import time
-from typing import Callable, Optional
-
-from adb_shell.adb_device import AdbDeviceTcp, AdbDeviceUsb
-from adb_shell.auth.keygen import keygen, write_public_keyfile
-from adb_shell.auth.sign_pythonrsa import PythonRSASigner
-from adb_shell.exceptions import (
-    AdbCommandFailureException,
-    DeviceAuthError,
-    UsbDeviceNotFoundError,
-    UsbReadFailedError,
-)
-from usb1 import USBErrorAccess, USBErrorBusy
-
-from mvt.android.modules.backup.helpers import prompt_or_load_android_backup_password
-from mvt.android.parsers.backup import (
-    InvalidBackupPassword,
-    parse_ab_header,
-    parse_backup_file,
-)
-from mvt.common.module import InsufficientPrivileges, MVTModule
-
-ADB_KEY_PATH = os.path.expanduser("~/.android/adbkey")
-ADB_PUB_KEY_PATH = os.path.expanduser("~/.android/adbkey.pub")
-
-
-class AndroidExtraction(MVTModule):
-    """This class provides a base for all Android extraction modules."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.device = None
-        self.serial = None
-
-    @staticmethod
-    def _adb_check_keys() -> None:
-        """Make sure Android adb keys exist."""
-        if not os.path.isdir(os.path.dirname(ADB_KEY_PATH)):
-            os.makedirs(os.path.dirname(ADB_KEY_PATH))
-
-        if not os.path.exists(ADB_KEY_PATH):
-            keygen(ADB_KEY_PATH)
-
-        if not os.path.exists(ADB_PUB_KEY_PATH):
-            write_public_keyfile(ADB_KEY_PATH, ADB_PUB_KEY_PATH)
-
-    def _adb_connect(self) -> None:
-        """Connect to the device over adb."""
-        self._adb_check_keys()
-
-        with open(ADB_KEY_PATH, "rb") as handle:
-            priv_key = handle.read()
-
-        with open(ADB_PUB_KEY_PATH, "rb") as handle:
-            pub_key = handle.read()
-
-        signer = PythonRSASigner(pub_key, priv_key)
-
-        # If no serial was specified or if the serial does not seem to be
-        # a HOST:PORT definition, we use the USB transport.
-        if not self.serial or ":" not in self.serial:
-            try:
-                self.device = AdbDeviceUsb(serial=self.serial)
-            except UsbDeviceNotFoundError:
-                self.log.critical(
-                    "No device found. Make sure it is connected and unlocked."
-                )
-                sys.exit(-1)
-        # Otherwise we try to use the TCP transport.
-        else:
-            addr = self.serial.split(":")
-            if len(addr) < 2:
-                raise ValueError(
-                    "TCP serial number must follow the format: `address:port`"
-                )
-
-            self.device = AdbDeviceTcp(
-                addr[0], int(addr[1]), default_transport_timeout_s=30.0
-            )
-
-        while True:
-            try:
-                self.device.connect(rsa_keys=[signer], auth_timeout_s=5)
-            except (USBErrorBusy, USBErrorAccess):
-                self.log.critical(
-                    "Device is busy, maybe run `adb kill-server` and try again."
-                )
-                sys.exit(-1)
-            except DeviceAuthError:
-                self.log.error(
-                    "You need to authorize this computer on the Android device. "
-                    "Retrying in 5 seconds..."
-                )
-                time.sleep(5)
-            except UsbReadFailedError:
-                self.log.error(
-                    "Unable to connect to the device over USB. "
-                    "Try to unplug, plug the device and start again."
-                )
-                sys.exit(-1)
-            except OSError as exc:
-                if exc.errno == 113 and self.serial:
-                    self.log.critical(
-                        "Unable to connect to the device %s: "
-                        "did you specify the correct IP address?",
-                        self.serial,
-                    )
-                    sys.exit(-1)
-            else:
-                break
-
-    def _adb_disconnect(self) -> None:
-        """Close adb connection to the device."""
-        self.device.close()
-
-    def _adb_reconnect(self) -> None:
-        """Reconnect to device using adb."""
-        self.log.info("Reconnecting ...")
-        self._adb_disconnect()
-        self._adb_connect()
-
-    def _adb_command(self, command: str) -> str:
-        """Execute an adb shell command.
-
-        :param command: Shell command to execute
-        :returns: Output of command
-
-        """
-        return self.device.shell(command, read_timeout_s=200.0)
-
-    def _adb_check_if_root(self) -> bool:
-        """Check if we have a `su` binary on the Android device.
-
-
-        :returns: Boolean indicating whether a `su` binary is present or not
-
-        """
-        result = self._adb_command("command -v su && su -c true")
-        return bool(result) and "Permission denied" not in result
-
-    def _adb_root_or_die(self) -> None:
-        """Check if we have a `su` binary, otherwise raise an Exception."""
-        if not self._adb_check_if_root():
-            raise InsufficientPrivileges(
-                "This module is optionally available "
-                "in case the device is already rooted."
-                " Do NOT root your own device!"
-            )
-
-    def _adb_command_as_root(self, command):
-        """Execute an adb shell command.
-
-        :param command: Shell command to execute as root
-        :returns: Output of command
-
-        """
-        return self._adb_command(f"su -c {command}")
-
-    def _adb_check_file_exists(self, file: str) -> bool:
-        """Verify that a file exists.
-
-        :param file: Path of the file
-        :returns: Boolean indicating whether the file exists or not
-
-        """
-
-        # TODO: Need to support checking files without root privileges as well.
-
-        # Check if we have root, if not raise an Exception.
-        self._adb_root_or_die()
-
-        return bool(self._adb_command_as_root(f"[ ! -f {file} ] || echo 1"))
-
-    def _adb_download(
-        self,
-        remote_path: str,
-        local_path: str,
-        progress_callback: Optional[Callable] = None,
-        retry_root: Optional[bool] = True,
-    ) -> None:
-        """Download a file form the device.
-
-        :param remote_path: Path to download from the device
-        :param local_path: Path to where to locally store the copy of the file
-        :param progress_callback: Callback for download progress bar
-                                  (Default value = None)
-        :param retry_root: Default value = True)
-
-        """
-        try:
-            self.device.pull(remote_path, local_path, progress_callback)
-        except AdbCommandFailureException as exc:
-            if retry_root:
-                self._adb_download_root(remote_path, local_path, progress_callback)
-            else:
-                raise Exception(
-                    f"Unable to download file {remote_path}: {exc}"
-                ) from exc
-
-    def _adb_download_root(
-        self,
-        remote_path: str,
-        local_path: str,
-        progress_callback: Optional[Callable] = None,
-    ) -> None:
-        try:
-            # Check if we have root, if not raise an Exception.
-            self._adb_root_or_die()
-
-            # We generate a random temporary filename.
-            allowed_chars = (
-                string.ascii_uppercase + string.ascii_lowercase + string.digits
-            )
-            tmp_filename = "tmp_" + "".join(random.choices(allowed_chars, k=10))
-
-            # We create a temporary local file.
-            new_remote_path = f"/sdcard/{tmp_filename}"
-
-            # We copy the file from the data folder to /sdcard/.
-            cp_output = self._adb_command_as_root(f"cp {remote_path} {new_remote_path}")
-            if (
-                cp_output.startswith("cp: ")
-                and "No such file or directory" in cp_output
-            ):
-                raise Exception(f"Unable to process file {remote_path}: File not found")
-            if cp_output.startswith("cp: ") and "Permission denied" in cp_output:
-                raise Exception(
-                    f"Unable to process file {remote_path}: Permission denied"
-                )
-
-            # We download from /sdcard/ to the local temporary file.
-            # If it doesn't work now, don't try again (retry_root=False)
-            self._adb_download(
-                new_remote_path, local_path, progress_callback, retry_root=False
-            )
-
-            # Delete the copy on /sdcard/.
-            self._adb_command(f"rm -rf {new_remote_path}")
-
-        except AdbCommandFailureException as exc:
-            raise Exception(f"Unable to download file {remote_path}: {exc}") from exc
-
-    def _adb_process_file(self, remote_path: str, process_routine: Callable) -> None:
-        """Download a local copy of a file which is only accessible as root.
-        This is a wrapper around process_routine.
-
-        :param remote_path: Path of the file on the device to process
-        :param process_routine: Function to be called on the local copy of the
-                                downloaded file
-
-        """
-        # Connect to the device over adb.
-        # Check if we have root, if not raise an Exception.
-        self._adb_root_or_die()
-
-        # We create a temporary local file.
-        tmp = tempfile.NamedTemporaryFile()
-        local_path = tmp.name
-        local_name = os.path.basename(tmp.name)
-        new_remote_path = f"/sdcard/Download/{local_name}"
-
-        # We copy the file from the data folder to /sdcard/.
-        cp_output = self._adb_command_as_root(f"cp {remote_path} {new_remote_path}")
-        if cp_output.startswith("cp: ") and "No such file or directory" in cp_output:
-            raise Exception(f"Unable to process file {remote_path}: File not found")
-        if cp_output.startswith("cp: ") and "Permission denied" in cp_output:
-            raise Exception(f"Unable to process file {remote_path}: Permission denied")
-
-        # We download from /sdcard/ to the local temporary file.
-        self._adb_download(new_remote_path, local_path)
-
-        # Launch the provided process routine!
-        process_routine(local_path)
-
-        # Delete the local copy.
-        tmp.close()
-        # Delete the copy on /sdcard/.
-        self._adb_command(f"rm -f {new_remote_path}")
-
-    def _generate_backup(self, package_name: str) -> bytes:
-        self.log.info(
-            "Please check phone and accept Android backup prompt. "
-            "You may need to set a backup password. \a"
-        )
-
-        if self.module_options.get("backup_password", None):
-            self.log.warning(
-                "Backup password already set from command line or environment "
-                "variable. You should use the same password if enabling encryption!"
-            )
-
-        # TODO: Base64 encoding as temporary fix to avoid byte-mangling over
-        #       the shell transport...
-        cmd = f"/system/bin/bu backup -nocompress '{package_name}' | base64"
-        backup_output_b64 = self._adb_command(cmd)
-        backup_output = base64.b64decode(backup_output_b64)
-        header = parse_ab_header(backup_output)
-
-        if not header["backup"]:
-            self.log.error(
-                "Extracting SMS via Android backup failed. "
-                "No valid backup data found."
-            )
-            return None
-
-        if header["encryption"] == "none":
-            return parse_backup_file(backup_output, password=None)
-
-        for _ in range(0, 3):
-            backup_password = prompt_or_load_android_backup_password(
-                self.log, self.module_options
-            )
-            if not backup_password:
-                # Fail as no backup password loaded for this encrypted backup
-                self.log.critical("No backup password provided.")
-            try:
-                decrypted_backup_tar = parse_backup_file(backup_output, backup_password)
-                return decrypted_backup_tar
-            except InvalidBackupPassword:
-                self.log.error("You provided the wrong password! Please try again...")
-
-        self.log.error("All attempts to decrypt backup with password failed!")
-
-        return None
-
-    def run(self) -> None:
-        """Run the main procedure."""
-        raise NotImplementedError

mvt/android/modules/adb/chrome_history.py

@@ -1,109 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import sqlite3
-from typing import Optional, Union
-
-from mvt.common.utils import convert_chrometime_to_datetime, convert_datetime_to_iso
-
-from .base import AndroidExtraction
-
-CHROME_HISTORY_PATH = "data/data/com.android.chrome/app_chrome/Default/History"
-
-
-class ChromeHistory(AndroidExtraction):
-    """This module extracts records from Android's Chrome browsing history."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-        self.results = []
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "visit",
-            "data": f"{record['id']} - {record['url']} (visit ID: {record['visit_id']}, "
-            f"redirect source: {record['redirect_source']})",
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if self.indicators.check_domain(result["url"]):
-                self.detected.append(result)
-
-    def _parse_db(self, db_path: str) -> None:
-        """Parse a Chrome History database file.
-
-        :param db_path: Path to the History database to process.
-
-        """
-        assert isinstance(self.results, list)  # assert results type for mypy
-        conn = sqlite3.connect(db_path)
-        cur = conn.cursor()
-        cur.execute(
-            """
-            SELECT
-                urls.id,
-                urls.url,
-                visits.id,
-                visits.visit_time,
-                visits.from_visit
-            FROM urls
-            JOIN visits ON visits.url = urls.id
-            ORDER BY visits.visit_time;
-        """
-        )
-
-        for item in cur:
-            self.results.append(
-                {
-                    "id": item[0],
-                    "url": item[1],
-                    "visit_id": item[2],
-                    "timestamp": item[3],
-                    "isodate": convert_datetime_to_iso(
-                        convert_chrometime_to_datetime(item[3])
-                    ),
-                    "redirect_source": item[4],
-                }
-            )
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d history items", len(self.results))
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        try:
-            self._adb_process_file(
-                os.path.join("/", CHROME_HISTORY_PATH), self._parse_db
-            )
-        except Exception as exc:
-            self.log.error(exc)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_accessibility.py

@@ -1,49 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
-
-from .base import AndroidExtraction
-
-
-class DumpsysAccessibility(DumpsysAccessibilityArtifact, AndroidExtraction):
-    """This module extracts stats on accessibility."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys accessibility")
-        self._adb_disconnect()
-
-        self.parse(output)
-
-        for result in self.results:
-            self.log.info(
-                'Found installed accessibility service "%s"', result.get("service")
-            )
-
-        self.log.info(
-            "Identified a total of %d accessibility services", len(self.results)
-        )

mvt/android/modules/adb/dumpsys_activities.py

@@ -1,45 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_package_activities import (
-    DumpsysPackageActivitiesArtifact,
-)
-
-from .base import AndroidExtraction
-
-
-class DumpsysActivities(DumpsysPackageActivitiesArtifact, AndroidExtraction):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = results if results else []
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys package")
-        self._adb_disconnect()
-        self.parse(output)
-
-        self.log.info("Extracted %d package activities", len(self.results))

mvt/android/modules/adb/dumpsys_appops.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_appops import DumpsysAppopsArtifact
-
-from .base import AndroidExtraction
-
-
-class DumpsysAppOps(DumpsysAppopsArtifact, AndroidExtraction):
-    """This module extracts records from App-op Manager."""
-
-    slug = "dumpsys_appops"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys appops")
-        self._adb_disconnect()
-
-        self.parse(output)
-
-        self.log.info(
-            "Extracted a total of %d records from app-ops manager", len(self.results)
-        )

mvt/android/modules/adb/dumpsys_battery_daily.py

@@ -1,44 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_battery_daily import DumpsysBatteryDailyArtifact
-
-from .base import AndroidExtraction
-
-
-class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, AndroidExtraction):
-    """This module extracts records from battery daily updates."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys batterystats --daily")
-        self._adb_disconnect()
-
-        self.parse(output)
-
-        self.log.info(
-            "Extracted %d records from battery daily stats", len(self.results)
-        )

mvt/android/modules/adb/dumpsys_battery_history.py

@@ -1,42 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_battery_history import DumpsysBatteryHistoryArtifact
-
-from .base import AndroidExtraction
-
-
-class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, AndroidExtraction):
-    """This module extracts records from battery history events."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys batterystats --history")
-        self._adb_disconnect()
-
-        self.parse(output)
-
-        self.log.info("Extracted %d records from battery history", len(self.results))

mvt/android/modules/adb/dumpsys_dbinfo.py

@@ -1,47 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfoArtifact
-
-from .base import AndroidExtraction
-
-
-class DumpsysDBInfo(DumpsysDBInfoArtifact, AndroidExtraction):
-    """This module extracts records from battery daily updates."""
-
-    slug = "dumpsys_dbinfo"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("dumpsys dbinfo")
-        self._adb_disconnect()
-
-        self.parse(output)
-
-        self.log.info(
-            "Extracted a total of %d records from database information",
-            len(self.results),
-        )

mvt/android/modules/adb/dumpsys_full.py

@@ -1,45 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-from typing import Optional
-
-from .base import AndroidExtraction
-
-
-class DumpsysFull(AndroidExtraction):
-    """This module extracts stats on battery consumption by processes."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys")
-        if self.results_path:
-            output_path = os.path.join(self.results_path, "dumpsys.txt")
-            with open(output_path, "w", encoding="utf-8") as handle:
-                handle.write(output)
-
-            self.log.info("Full dumpsys output stored at %s", output_path)
-
-        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_receivers.py

@@ -1,44 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_receivers import DumpsysReceiversArtifact
-
-from .base import AndroidExtraction
-
-
-class DumpsysReceivers(DumpsysReceiversArtifact, AndroidExtraction):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = results if results else {}
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        output = self._adb_command("dumpsys package")
-        self.parse(output)
-
-        self._adb_disconnect()
-        self.log.info("Extracted receivers for %d intents", len(self.results))

mvt/android/modules/adb/files.py

@@ -1,155 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import stat
-from typing import Optional, Union
-
-from mvt.common.utils import convert_unix_to_iso
-
-from .base import AndroidExtraction
-
-ANDROID_TMP_FOLDERS = [
-    "/tmp/",
-    "/data/local/tmp/",
-]
-ANDROID_MEDIA_FOLDERS = [
-    "/data/media/0",
-    "/sdcard/",
-]
-
-
-class Files(AndroidExtraction):
-    """This module extracts the list of files on the device."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-        self.full_find = False
-
-    def serialize(self, record: dict) -> Union[dict, list, None]:
-        if "modified_time" in record:
-            return {
-                "timestamp": record["modified_time"],
-                "module": self.__class__.__name__,
-                "event": "file_modified",
-                "data": record["path"],
-            }
-
-        return None
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if result.get("is_suid"):
-                self.log.warning(
-                    'Found an SUID file in a non-standard directory "%s".',
-                    result["path"],
-                )
-
-            if self.indicators and self.indicators.check_file_path(result["path"]):
-                self.log.warning(
-                    'Found a known suspicous file at path: "%s"', result["path"]
-                )
-                self.detected.append(result)
-
-    def backup_file(self, file_path: str) -> None:
-        if not self.results_path:
-            return
-
-        local_file_name = file_path.replace("/", "_").replace(" ", "-")
-        local_files_folder = os.path.join(self.results_path, "files")
-        if not os.path.exists(local_files_folder):
-            os.mkdir(local_files_folder)
-
-        local_file_path = os.path.join(local_files_folder, local_file_name)
-
-        try:
-            self._adb_download(remote_path=file_path, local_path=local_file_path)
-        except Exception:
-            pass
-        else:
-            self.log.info(
-                "Downloaded file %s to local copy at %s", file_path, local_file_path
-            )
-
-    def find_files(self, folder: str) -> None:
-        assert isinstance(self.results, list)
-        if self.full_find:
-            cmd = f"find '{folder}' -type f -printf '%T@ %m %s %u %g %p\n' 2> /dev/null"
-            output = self._adb_command(cmd)
-
-            for file_line in output.splitlines():
-                file_info = file_line.rstrip().split(" ", 5)
-                if len(file_line) < 6:
-                    self.log.info("Skipping invalid file info - %s", file_line.rstrip())
-                    continue
-                [unix_timestamp, mode, size, owner, group, full_path] = file_info
-                mod_time = convert_unix_to_iso(unix_timestamp)
-
-                self.results.append(
-                    {
-                        "path": full_path,
-                        "modified_time": mod_time,
-                        "mode": mode,
-                        "is_suid": (int(mode, 8) & stat.S_ISUID) == 2048,
-                        "is_sgid": (int(mode, 8) & stat.S_ISGID) == 1024,
-                        "size": size,
-                        "owner": owner,
-                        "group": group,
-                    }
-                )
-        else:
-            output = self._adb_command(f"find '{folder}' -type f 2> /dev/null")
-            for file_line in output.splitlines():
-                self.results.append({"path": file_line.rstrip()})
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        cmd = "find '/' -maxdepth 1 -printf '%T@ %m %s %u %g %p\n' 2> /dev/null"
-        output = self._adb_command(cmd)
-        if output or output.strip().splitlines():
-            self.full_find = True
-
-        for tmp_folder in ANDROID_TMP_FOLDERS:
-            self.find_files(tmp_folder)
-
-        for entry in self.results:
-            self.log.info("Found file in tmp folder at path %s", entry.get("path"))
-            self.backup_file(entry.get("path"))
-
-        for media_folder in ANDROID_MEDIA_FOLDERS:
-            self.find_files(media_folder)
-
-        self.log.info(
-            "Found %s files in primary Android tmp and media folders", len(self.results)
-        )
-
-        if self.module_options.get("fast_mode", None):
-            self.log.info(
-                "The `fast_mode` option was enabled: skipping full file listing"
-            )
-        else:
-            self.log.info("Processing full file listing. This may take a while...")
-            self.find_files("/")
-
-            self.log.info("Found %s total files", len(self.results))
-
-        self._adb_disconnect()

mvt/android/modules/adb/getprop.py

@@ -1,43 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
-
-from .base import AndroidExtraction
-
-
-class Getprop(GetPropArtifact, AndroidExtraction):
-    """This module extracts device properties from getprop command."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = {} if not results else results
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("getprop")
-        self._adb_disconnect()
-
-        self.parse(output)
-        self.log.info("Extracted %d Android system properties", len(self.results))

mvt/android/modules/adb/logcat.py

@@ -1,57 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-from typing import Optional
-
-from .base import AndroidExtraction
-
-
-class Logcat(AndroidExtraction):
-    """This module extracts details on installed packages."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        # Get the current logcat.
-        output = self._adb_command('logcat -d -b all "*:V"')
-        # Get the locat prior to last reboot.
-        last_output = self._adb_command('logcat -L -b all "*:V"')
-
-        if self.results_path:
-            logcat_path = os.path.join(self.results_path, "logcat.txt")
-            with open(logcat_path, "w", encoding="utf-8") as handle:
-                handle.write(output)
-
-            self.log.info("Current logcat logs stored at %s", logcat_path)
-
-            logcat_last_path = os.path.join(self.results_path, "logcat_last.txt")
-            with open(logcat_last_path, "w", encoding="utf-8") as handle:
-                handle.write(last_output)
-
-            self.log.info(
-                "Logcat logs prior to last reboot stored at %s", logcat_last_path
-            )
-
-        self._adb_disconnect()

mvt/android/modules/adb/packages.py

@@ -1,312 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional, Union
-
-from rich.console import Console
-from rich.progress import track
-from rich.table import Table
-from rich.text import Text
-
-from mvt.android.artifacts.dumpsys_packages import DumpsysPackagesArtifact
-from mvt.android.utils import (
-    DANGEROUS_PERMISSIONS,
-    DANGEROUS_PERMISSIONS_THRESHOLD,
-    ROOT_PACKAGES,
-    SECURITY_PACKAGES,
-    SYSTEM_UPDATE_PACKAGES,
-)
-from mvt.common.virustotal import VTNoKey, VTQuotaExceeded, virustotal_lookup
-
-from .base import AndroidExtraction
-
-
-class Packages(AndroidExtraction):
-    """This module extracts the list of installed packages."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-        self._user_needed = False
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-
-        timestamps = [
-            {"event": "package_install", "timestamp": record["timestamp"]},
-            {
-                "event": "package_first_install",
-                "timestamp": record["first_install_time"],
-            },
-            {"event": "package_last_update", "timestamp": record["last_update_time"]},
-        ]
-
-        for timestamp in timestamps:
-            records.append(
-                {
-                    "timestamp": timestamp["timestamp"],
-                    "module": self.__class__.__name__,
-                    "event": timestamp["event"],
-                    "data": f"{record['package_name']} (system: {record['system']},"
-                    f" third party: {record['third_party']})",
-                }
-            )
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if result["package_name"] in ROOT_PACKAGES:
-                self.log.warning(
-                    "Found an installed package related to "
-                    'rooting/jailbreaking: "%s"',
-                    result["package_name"],
-                )
-                self.detected.append(result)
-                continue
-
-            if result["package_name"] in SECURITY_PACKAGES and result["disabled"]:
-                self.log.warning(
-                    'Found a security package disabled: "%s"', result["package_name"]
-                )
-
-            if result["package_name"] in SYSTEM_UPDATE_PACKAGES and result["disabled"]:
-                self.log.warning(
-                    'System OTA update package "%s" disabled on the phone',
-                    result["package_name"],
-                )
-
-            if not self.indicators:
-                continue
-
-            ioc = self.indicators.check_app_id(result.get("package_name"))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-            for package_file in result.get("files", []):
-                ioc = self.indicators.check_file_hash(package_file["sha256"])
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-
-    @staticmethod
-    def check_virustotal(packages: list) -> None:
-        hashes = []
-        for package in packages:
-            for file in package.get("files", []):
-                if file["sha256"] not in hashes:
-                    hashes.append(file["sha256"])
-
-        total_hashes = len(hashes)
-        detections = {}
-
-        progress_desc = f"Looking up {total_hashes} files..."
-        for i in track(range(total_hashes), description=progress_desc):
-            try:
-                results = virustotal_lookup(hashes[i])
-            except VTNoKey:
-                return
-            except VTQuotaExceeded as exc:
-                print("Unable to continue: %s", exc)
-                break
-
-            if not results:
-                continue
-
-            positives = results["attributes"]["last_analysis_stats"]["malicious"]
-            total = len(results["attributes"]["last_analysis_results"])
-
-            detections[hashes[i]] = f"{positives}/{total}"
-
-        table = Table(title="VirusTotal Packages Detections")
-        table.add_column("Package name")
-        table.add_column("File path")
-        table.add_column("Detections")
-
-        for package in packages:
-            for file in package.get("files", []):
-                row = [package["package_name"], file["path"]]
-
-                if file["sha256"] in detections:
-                    detection = detections[file["sha256"]]
-                    positives = detection.split("/")[0]
-                    if int(positives) > 0:
-                        row.append(Text(detection, "red bold"))
-                    else:
-                        row.append(detection)
-                else:
-                    row.append("not found")
-
-                table.add_row(*row)
-
-        console = Console()
-        console.print(table)
-
-    @staticmethod
-    def parse_package_for_details(output: str) -> dict:
-        lines = []
-        in_packages = False
-        for line in output.splitlines():
-            if in_packages:
-                if line.strip() == "":
-                    break
-                lines.append(line)
-            if line.strip() == "Packages:":
-                in_packages = True
-
-        return DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
-            "\n".join(lines)
-        )
-
-    def _get_files_for_package(self, package_name: str) -> list:
-        command = f"pm path {package_name}"
-        if self._user_needed:
-            command += " --user 0"
-        output = self._adb_command(command)
-        output = output.strip().replace("package:", "")
-        if not output:
-            return []
-
-        package_files = []
-        for file_path in output.splitlines():
-            file_path = file_path.strip()
-
-            md5 = self._adb_command(f"md5sum {file_path}").split(" ", maxsplit=1)[0]
-            sha1 = self._adb_command(f"sha1sum {file_path}").split(" ", maxsplit=1)[0]
-            sha256 = self._adb_command(f"sha256sum {file_path}").split(" ", maxsplit=1)[
-                0
-            ]
-            sha512 = self._adb_command(f"sha512sum {file_path}").split(" ", maxsplit=1)[
-                0
-            ]
-
-            package_files.append(
-                {
-                    "path": file_path,
-                    "md5": md5,
-                    "sha1": sha1,
-                    "sha256": sha256,
-                    "sha512": sha512,
-                }
-            )
-
-        return package_files
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        packages = self._adb_command("pm list packages -u -i -f")
-        if "java.lang.SecurityException" in packages or packages.strip() == "":
-            self._user_needed = True
-            packages = self._adb_command("pm list packages -u -i -f --user 0")
-
-        for line in packages.splitlines():
-            line = line.strip()
-            if not line.startswith("package:"):
-                continue
-
-            fields = line.split()
-            file_name, package_name = fields[0].split(":")[1].rsplit("=", 1)
-
-            try:
-                installer = fields[1].split("=")[1].strip()
-            except IndexError:
-                installer = None
-            else:
-                if installer == "null":
-                    installer = None
-
-            package_files = self._get_files_for_package(package_name)
-            new_package = {
-                "package_name": package_name,
-                "file_name": file_name,
-                "installer": installer,
-                "disabled": False,
-                "system": False,
-                "third_party": False,
-                "files": package_files,
-            }
-
-            dumpsys_package = self._adb_command(f"dumpsys package {package_name}")
-            package_details = self.parse_package_for_details(dumpsys_package)
-            new_package.update(package_details)
-
-            self.results.append(new_package)
-
-        cmds = [
-            {"field": "disabled", "arg": "-d"},
-            {"field": "system", "arg": "-s"},
-            {"field": "third_party", "arg": "-3"},
-        ]
-        for cmd in cmds:
-            command = f"pm list packages {cmd['arg']}"
-            if self._user_needed:
-                command += " --user 0"
-            output = self._adb_command(command)
-            for line in output.splitlines():
-                line = line.strip()
-                if not line.startswith("package:"):
-                    continue
-
-                package_name = line.split(":", 1)[1]
-                for i, result in enumerate(self.results):
-                    if result["package_name"] == package_name:
-                        self.results[i][cmd["field"]] = True
-
-        for result in self.results:
-            if not result["third_party"]:
-                continue
-
-            dangerous_permissions_count = 0
-            for perm in result["requested_permissions"]:
-                if perm in DANGEROUS_PERMISSIONS:
-                    dangerous_permissions_count += 1
-
-            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
-                self.log.info(
-                    'Third-party package "%s" requested %d '
-                    "potentially dangerous permissions",
-                    result["package_name"],
-                    dangerous_permissions_count,
-                )
-
-        packages_to_lookup = []
-        for result in self.results:
-            if result["system"]:
-                continue
-
-            packages_to_lookup.append(result)
-            self.log.info(
-                'Found non-system package with name "%s" installed by "%s" on %s',
-                result["package_name"],
-                result["installer"],
-                result["timestamp"],
-            )
-
-        if not self.module_options.get("fast_mode", None):
-            self.check_virustotal(packages_to_lookup)
-
-        self.log.info(
-            "Extracted at total of %d installed package names", len(self.results)
-        )
-
-        self._adb_disconnect()

mvt/android/modules/adb/processes.py

@@ -1,42 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.processes import Processes as ProcessesArtifact
-
-from .base import AndroidExtraction
-
-
-class Processes(ProcessesArtifact, AndroidExtraction):
-    """This module extracts details on running processes."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        output = self._adb_command("ps -A")
-        self.parse(output)
-        self._adb_disconnect()
-
-        self.log.info("Extracted records on a total of %d processes", len(self.results))

mvt/android/modules/adb/root_binaries.py

@@ -1,70 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from .base import AndroidExtraction
-
-
-class RootBinaries(AndroidExtraction):
-    """This module extracts the list of installed packages."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def check_indicators(self) -> None:
-        for root_binary in self.results:
-            self.detected.append(root_binary)
-            self.log.warning('Found root binary "%s"', root_binary)
-
-    def run(self) -> None:
-        root_binaries = [
-            "su",
-            "busybox",
-            "supersu",
-            "Superuser.apk",
-            "KingoUser.apk",
-            "SuperSu.apk",
-            "magisk",
-            "magiskhide",
-            "magiskinit",
-            "magiskpolicy",
-        ]
-
-        self._adb_connect()
-
-        for root_binary in root_binaries:
-            root_binary = root_binary.strip()
-            if not root_binary:
-                continue
-
-            output = self._adb_command(f"which -a {root_binary}")
-            output = output.strip()
-
-            if not output:
-                continue
-
-            if "which: not found" in output:
-                continue
-
-            self.results.append(root_binary)
-
-        self._adb_disconnect()

mvt/android/modules/adb/selinux_status.py

@@ -1,48 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from .base import AndroidExtraction
-
-
-class SELinuxStatus(AndroidExtraction):
-    """This module checks if SELinux is being enforced."""
-
-    slug = "selinux_status"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = {} if not results else results
-
-    def run(self) -> None:
-        self._adb_connect()
-        output = self._adb_command("getenforce")
-        self._adb_disconnect()
-
-        status = output.lower().strip()
-        self.results["status"] = status
-
-        if status == "enforcing":
-            self.log.info("SELinux is being regularly enforced")
-        else:
-            self.log.warning('SELinux status is "%s"!', status)

mvt/android/modules/adb/settings.py

@@ -1,58 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.settings import Settings as SettingsArtifact
-
-from .base import AndroidExtraction
-
-
-class Settings(SettingsArtifact, AndroidExtraction):
-    """This module extracts Android system settings."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = {} if not results else results
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        for namespace in ["system", "secure", "global"]:
-            out = self._adb_command(f"cmd settings list {namespace}")
-            if not out:
-                continue
-
-            self.results[namespace] = {}
-
-            for line in out.splitlines():
-                line = line.strip()
-                if line == "":
-                    continue
-
-                fields = line.split("=", 1)
-                try:
-                    self.results[namespace][fields[0]] = fields[1]
-                except IndexError:
-                    continue
-
-        self._adb_disconnect()

mvt/android/modules/adb/sms.py

@@ -1,176 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-import sqlite3
-from typing import Optional, Union
-
-from mvt.android.parsers.backup import AndroidBackupParsingError, parse_tar_for_sms
-from mvt.common.module import InsufficientPrivileges
-from mvt.common.utils import check_for_links, convert_unix_to_iso
-
-from .base import AndroidExtraction
-
-SMS_BUGLE_PATH = "data/data/com.google.android.apps.messaging/databases/bugle_db"
-SMS_BUGLE_QUERY = """
-SELECT
-    ppl.normalized_destination AS address,
-    p.timestamp AS timestamp,
-CASE WHEN m.sender_id IN
-(SELECT _id FROM participants WHERE contact_id=-1)
-THEN 2 ELSE 1 END incoming, p.text AS body
-FROM messages m, conversations c, parts p,
-        participants ppl, conversation_participants cp
-WHERE (m.conversation_id = c._id)
-    AND (m._id = p.message_id)
-    AND (cp.conversation_id = c._id)
-    AND (cp.participant_id = ppl._id);
-"""
-
-SMS_MMSSMS_PATH = "data/data/com.android.providers.telephony/databases/mmssms.db"
-SMS_MMSMS_QUERY = """
-SELECT
-    address AS address,
-    date_sent AS timestamp,
-    type as incoming,
-    body AS body
-FROM sms;
-"""
-
-
-class SMS(AndroidExtraction):
-    """This module extracts all SMS messages."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.sms_db_type = 0
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        body = record["body"].replace("\n", "\\n")
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": f"sms_{record['direction']}",
-            "data": f"{record.get('address', 'unknown source')}: \"{body}\"",
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for message in self.results:
-            if "body" not in message:
-                continue
-
-            message_links = message.get("links", [])
-            if message_links == []:
-                message_links = check_for_links(message["body"])
-
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
-
-    def _parse_db(self, db_path: str) -> None:
-        """Parse an Android bugle_db SMS database file.
-
-        :param db_path: Path to the Android SMS database file to process
-
-        """
-        conn = sqlite3.connect(db_path)
-        cur = conn.cursor()
-
-        if self.sms_db_type == 1:
-            cur.execute(SMS_BUGLE_QUERY)
-        elif self.sms_db_type == 2:
-            cur.execute(SMS_MMSMS_QUERY)
-
-        names = [description[0] for description in cur.description]
-
-        for item in cur:
-            message = {}
-            for index, value in enumerate(item):
-                message[names[index]] = value
-
-            message["direction"] = "received" if message["incoming"] == 1 else "sent"
-            message["isodate"] = convert_unix_to_iso(message["timestamp"])
-
-            # Extract links in the message body
-            links = check_for_links(message["body"])
-            message["links"] = links
-
-            self.results.append(message)
-
-        cur.close()
-        conn.close()
-
-        self.log.info("Extracted a total of %d SMS messages", len(self.results))
-
-    def _extract_sms_adb(self) -> None:
-        """Use the Android backup command to extract SMS data from the native
-        SMS app.
-
-        It is crucial to use the under-documented "-nocompress" flag to disable
-        the non-standard Java compression algorithm. This module only supports
-        an unencrypted ADB backup.
-        """
-        backup_tar = self._generate_backup("com.android.providers.telephony")
-        if not backup_tar:
-            return
-
-        try:
-            self.results = parse_tar_for_sms(backup_tar)
-        except AndroidBackupParsingError:
-            self.log.info(
-                "Impossible to read SMS from the Android Backup, "
-                "please extract the SMS and try extracting it with "
-                "Android Backup Extractor"
-            )
-            return
-
-        self.log.info("Extracted a total of %d SMS messages", len(self.results))
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        try:
-            if self._adb_check_file_exists(os.path.join("/", SMS_BUGLE_PATH)):
-                self.sms_db_type = 1
-                self._adb_process_file(
-                    os.path.join("/", SMS_BUGLE_PATH), self._parse_db
-                )
-            elif self._adb_check_file_exists(os.path.join("/", SMS_MMSSMS_PATH)):
-                self.sms_db_type = 2
-                self._adb_process_file(
-                    os.path.join("/", SMS_MMSSMS_PATH), self._parse_db
-                )
-
-            self._adb_disconnect()
-            return
-        except InsufficientPrivileges:
-            pass
-
-        self.log.info(
-            "No SMS database found. Trying extraction of SMS data "
-            "using Android backup feature."
-        )
-        self._extract_sms_adb()
-
-        self._adb_disconnect()

mvt/android/modules/adb/whatsapp.py

@@ -1,112 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import base64
-import logging
-import os
-import sqlite3
-from typing import Optional, Union
-
-from mvt.common.utils import check_for_links, convert_unix_to_iso
-
-from .base import AndroidExtraction
-
-WHATSAPP_PATH = "data/data/com.whatsapp/databases/msgstore.db"
-
-
-class Whatsapp(AndroidExtraction):
-    """This module extracts all WhatsApp messages containing links."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        text = record["data"].replace("\n", "\\n")
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": f"whatsapp_msg_{record['direction']}",
-            "data": f'"{text}"',
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for message in self.results:
-            if "data" not in message:
-                continue
-
-            message_links = check_for_links(message["data"])
-            if self.indicators.check_domains(message_links):
-                self.detected.append(message)
-
-    def _parse_db(self, db_path: str) -> None:
-        """Parse an Android msgstore.db WhatsApp database file.
-
-        :param db_path: Path to the Android WhatsApp database file to process
-
-        """
-        conn = sqlite3.connect(db_path)
-        cur = conn.cursor()
-        cur.execute(
-            """
-            SELECT * FROM messages;
-        """
-        )
-        names = [description[0] for description in cur.description]
-
-        messages = []
-        for item in cur:
-            message = {}
-            for index, value in enumerate(item):
-                message[names[index]] = value
-
-            if not message["data"]:
-                continue
-
-            message["direction"] = "send" if message["key_from_me"] == 1 else "received"
-            message["isodate"] = convert_unix_to_iso(message["timestamp"])
-
-            # If we find links in the messages or if they are empty we add them
-            # to the list.
-            if check_for_links(message["data"]) or message["data"].strip() == "":
-                if message.get("thumb_image"):
-                    message["thumb_image"] = base64.b64encode(message["thumb_image"])
-
-                messages.append(message)
-
-        cur.close()
-        conn.close()
-
-        self.log.info(
-            "Extracted a total of %d WhatsApp messages containing links", len(messages)
-        )
-        self.results = messages
-
-    def run(self) -> None:
-        self._adb_connect()
-
-        try:
-            self._adb_process_file(os.path.join("/", WHATSAPP_PATH), self._parse_db)
-        except Exception as exc:
-            self.log.error(exc)
-
-        self._adb_disconnect()

mvt/android/modules/androidqf/dumpsys_accessibility.py

@@ -1,51 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
-
-from .base import AndroidQFModule
-
-
-class DumpsysAccessibility(DumpsysAccessibilityArtifact, AndroidQFModule):
-    """This module analyses dumpsys accessibility"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        data = self._get_file_content(dumpsys_file[0]).decode("utf-8", errors="replace")
-        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE accessibility:")
-        self.parse(content)
-
-        for result in self.results:
-            self.log.info(
-                'Found installed accessibility service "%s"', result.get("service")
-            )
-
-        self.log.info(
-            "Identified a total of %d accessibility services", len(self.results)
-        )

mvt/android/modules/androidqf/dumpsys_activities.py

@@ -1,50 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_package_activities import (
-    DumpsysPackageActivitiesArtifact,
-)
-
-from .base import AndroidQFModule
-
-
-class DumpsysActivities(DumpsysPackageActivitiesArtifact, AndroidQFModule):
-    """This module extracts details on receivers for risky activities."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = results if results else []
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        # Get data and extract the dumpsys section
-        data = self._get_file_content(dumpsys_file[0]).decode("utf-8", errors="replace")
-        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE package:")
-        # Parse it
-        self.parse(content)
-
-        self.log.info("Extracted %d package activities", len(self.results))

mvt/android/modules/androidqf/dumpsys_appops.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_appops import DumpsysAppopsArtifact
-
-from .base import AndroidQFModule
-
-
-class DumpsysAppops(DumpsysAppopsArtifact, AndroidQFModule):
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        # Extract section
-        data = self._get_file_content(dumpsys_file[0])
-        section = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE appops:"
-        )
-
-        # Parse it
-        self.parse(section)
-        self.log.info("Identified %d applications in AppOps Manager", len(self.results))

mvt/android/modules/androidqf/dumpsys_battery_daily.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_battery_daily import DumpsysBatteryDailyArtifact
-
-from .base import AndroidQFModule
-
-
-class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, AndroidQFModule):
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        # Extract section
-        data = self._get_file_content(dumpsys_file[0])
-        section = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE batterystats:"
-        )
-
-        # Parse it
-        self.parse(section)
-        self.log.info("Extracted a total of %d battery daily stats", len(self.results))

mvt/android/modules/androidqf/dumpsys_battery_history.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_battery_history import DumpsysBatteryHistoryArtifact
-
-from .base import AndroidQFModule
-
-
-class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, AndroidQFModule):
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        # Extract section
-        data = self._get_file_content(dumpsys_file[0])
-        section = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE batterystats:"
-        )
-
-        # Parse it
-        self.parse(section)
-        self.log.info("Extracted a total of %d battery daily stats", len(self.results))

mvt/android/modules/androidqf/dumpsys_dbinfo.py

@@ -1,46 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfoArtifact
-
-from .base import AndroidQFModule
-
-
-class DumpsysDBInfo(DumpsysDBInfoArtifact, AndroidQFModule):
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-
-        # Extract dumpsys DBInfo section
-        data = self._get_file_content(dumpsys_file[0])
-        section = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE dbinfo:"
-        )
-
-        # Parse it
-        self.parse(section)
-        self.log.info("Identified %d DB Info entries", len(self.results))

mvt/android/modules/androidqf/dumpsys_packages.py

@@ -1,62 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Any, Dict, List, Optional
-
-from mvt.android.artifacts.dumpsys_packages import DumpsysPackagesArtifact
-from mvt.android.modules.adb.packages import (
-    DANGEROUS_PERMISSIONS,
-    DANGEROUS_PERMISSIONS_THRESHOLD,
-)
-
-from .base import AndroidQFModule
-
-
-class DumpsysPackages(DumpsysPackagesArtifact, AndroidQFModule):
-    """This module analyse dumpsys packages"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[List[Dict[str, Any]]] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if len(dumpsys_file) != 1:
-            self.log.info("Dumpsys file not found")
-            return
-
-        data = self._get_file_content(dumpsys_file[0]).decode("utf-8", errors="replace")
-        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE package:")
-        self.parse(content)
-
-        for result in self.results:
-            dangerous_permissions_count = 0
-            for perm in result["permissions"]:
-                if perm["name"] in DANGEROUS_PERMISSIONS:
-                    dangerous_permissions_count += 1
-
-            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
-                self.log.info(
-                    'Found package "%s" requested %d potentially dangerous permissions',
-                    result["package_name"],
-                    dangerous_permissions_count,
-                )
-
-        self.log.info("Extracted details on %d packages", len(self.results))

mvt/android/modules/androidqf/dumpsys_receivers.py

@@ -1,49 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Any, Dict, List, Optional, Union
-
-from mvt.android.artifacts.dumpsys_receivers import DumpsysReceiversArtifact
-
-from .base import AndroidQFModule
-
-
-class DumpsysReceivers(DumpsysReceiversArtifact, AndroidQFModule):
-    """This module analyse dumpsys receivers"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Union[List[Any], Dict[str, Any], None] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.results = results if results else {}
-
-    def run(self) -> None:
-        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
-        if not dumpsys_file:
-            return
-        data = self._get_file_content(dumpsys_file[0])
-
-        dumpsys_section = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE package:"
-        )
-
-        self.parse(dumpsys_section)
-
-        self.log.info("Extracted receivers for %d intents", len(self.results))

mvt/android/modules/androidqf/sms.py

@@ -1,100 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1
-
-import logging
-from typing import Optional
-
-from mvt.android.modules.backup.helpers import prompt_or_load_android_backup_password
-from mvt.android.parsers.backup import (
-    AndroidBackupParsingError,
-    InvalidBackupPassword,
-    parse_ab_header,
-    parse_backup_file,
-    parse_tar_for_sms,
-)
-
-from .base import AndroidQFModule
-
-
-class SMS(AndroidQFModule):
-    """This module analyse SMS file in backup"""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for message in self.results:
-            if "body" not in message:
-                continue
-
-            if self.indicators.check_domains(message.get("links", [])):
-                self.detected.append(message)
-
-    def parse_backup(self, data):
-        header = parse_ab_header(data)
-        if not header["backup"]:
-            self.log.critical("Invalid backup format, backup.ab was not analysed")
-            return
-
-        password = None
-        if header["encryption"] != "none":
-            password = prompt_or_load_android_backup_password(
-                self.log, self.module_options
-            )
-            if not password:
-                self.log.critical("No backup password provided.")
-                return
-
-        try:
-            tardata = parse_backup_file(data, password=password)
-        except InvalidBackupPassword:
-            self.log.critical("Invalid backup password")
-            return
-        except AndroidBackupParsingError:
-            self.log.critical(
-                "Impossible to parse this backup file, please use"
-                " Android Backup Extractor instead"
-            )
-            return
-
-        if not tardata:
-            return
-
-        try:
-            self.results = parse_tar_for_sms(tardata)
-        except AndroidBackupParsingError:
-            self.log.info(
-                "Impossible to read SMS from the Android Backup, "
-                "please extract the SMS and try extracting it with "
-                "Android Backup Extractor"
-            )
-            return
-
-    def run(self) -> None:
-        files = self._get_files_by_pattern("*/backup.ab")
-        if not files:
-            self.log.info("No backup data found")
-            return
-
-        self.parse_backup(self._get_file_content(files[0]))
-        self.log.info("Identified %d SMS in backup data", len(self.results))

mvt/android/modules/bugreport/__init__.py

@@ -1,26 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .accessibility import Accessibility
-from .activities import Activities
-from .appops import Appops
-from .battery_daily import BatteryDaily
-from .battery_history import BatteryHistory
-from .dbinfo import DBInfo
-from .getprop import Getprop
-from .packages import Packages
-from .receivers import Receivers
-
-BUGREPORT_MODULES = [
-    Accessibility,
-    Activities,
-    Appops,
-    BatteryDaily,
-    BatteryHistory,
-    DBInfo,
-    Getprop,
-    Packages,
-    Receivers,
-]

mvt/common/artifact.py

@@ -1,28 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-
-class Artifact:
-    """
-    Main artifact class
-    """
-
-    def __init__(self, *args, **kwargs):
-        self.results = []
-        self.detected = []
-        self.indicators = None
-        super().__init__(*args, **kwargs)
-
-    def parse(self, entry: str):
-        """
-        Parse the artifact, adds the parsed information to self.results
-        """
-        raise NotImplementedError
-
-    def check_indicators(self) -> None:
-        """Check the results of this module against a provided list of
-        indicators coming from self.indicators
-        """
-        raise NotImplementedError

mvt/common/command.py

@@ -1,243 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import logging
-import os
-import sys
-from datetime import datetime
-from typing import Optional
-
-from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule, run_module, save_timeline
-from mvt.common.utils import (
-    convert_datetime_to_iso,
-    generate_hashes_from_path,
-    get_sha256_from_file_path,
-)
-from mvt.common.version import MVT_VERSION
-
-
-class Command:
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: bool = False,
-        log: logging.Logger = logging.getLogger(__name__),
-    ) -> None:
-        self.name = ""
-        self.modules = []
-
-        self.target_path = target_path
-        self.results_path = results_path
-        self.ioc_files = ioc_files if ioc_files else []
-        self.module_name = module_name
-        self.serial = serial
-        self.log = log
-
-        # This dictionary can contain options that will be passed down from
-        # the Command to all modules. This can for example be used to pass
-        # down a password to decrypt a backup or flags which are need by some modules.
-        self.module_options = module_options if module_options else {}
-
-        # This list will contain all executed modules.
-        # We can use this to reference e.g. self.executed[0].results.
-        self.executed = []
-        self.detected_count = 0
-        self.hashes = hashes
-        self.hash_values = []
-        self.timeline = []
-        self.timeline_detected = []
-
-        # Load IOCs
-        self._create_storage()
-        self._setup_logging()
-        self.iocs = Indicators(log=log)
-        self.iocs.load_indicators_files(self.ioc_files)
-
-    def _create_storage(self) -> None:
-        if self.results_path and not os.path.exists(self.results_path):
-            try:
-                os.makedirs(self.results_path)
-            except Exception as exc:
-                self.log.critical(
-                    "Unable to create output folder %s: %s", self.results_path, exc
-                )
-                sys.exit(1)
-
-    def _setup_logging(self):
-        if not self.results_path:
-            return
-
-        logger = logging.getLogger("mvt")
-        file_handler = logging.FileHandler(
-            os.path.join(self.results_path, "command.log")
-        )
-        formatter = logging.Formatter(
-            "%(asctime)s - %(name)s - " "%(levelname)s - %(message)s"
-        )
-        file_handler.setLevel(logging.DEBUG)
-        file_handler.setFormatter(formatter)
-
-        # MVT can be run in a loop
-        # Old file handlers stick around in subsequent loops
-        # Remove any existing logging.FileHandler instances
-        for handler in logger.handlers:
-            if isinstance(handler, logging.FileHandler):
-                logger.removeHandler(handler)
-
-        # And finally add the new one
-        logger.addHandler(file_handler)
-
-    def _store_timeline(self) -> None:
-        if not self.results_path:
-            return
-
-        if len(self.timeline) > 0:
-            save_timeline(
-                self.timeline, os.path.join(self.results_path, "timeline.csv")
-            )
-
-        if len(self.timeline_detected) > 0:
-            save_timeline(
-                self.timeline_detected,
-                os.path.join(self.results_path, "timeline_detected.csv"),
-            )
-
-    def _store_info(self) -> None:
-        if not self.results_path:
-            return
-
-        target_path = None
-        if self.target_path:
-            target_path = os.path.abspath(self.target_path)
-
-        info = {
-            "target_path": target_path,
-            "mvt_version": MVT_VERSION,
-            "date": convert_datetime_to_iso(datetime.now()),
-            "ioc_files": [],
-            "hashes": [],
-        }
-
-        for coll in self.iocs.ioc_collections:
-            ioc_file_path = coll.get("stix2_file_path", "")
-            if ioc_file_path and ioc_file_path not in info["ioc_files"]:
-                info["ioc_files"].append(ioc_file_path)
-
-        if self.target_path and (os.environ.get("MVT_HASH_FILES") or self.hashes):
-            self.generate_hashes()
-
-        info["hashes"] = self.hash_values
-
-        info_path = os.path.join(self.results_path, "info.json")
-        with open(info_path, "w+", encoding="utf-8") as handle:
-            json.dump(info, handle, indent=4)
-
-        if self.target_path and (os.environ.get("MVT_HASH_FILES") or self.hashes):
-            info_hash = get_sha256_from_file_path(info_path)
-            self.log.info('Reference hash of the info.json file: "%s"', info_hash)
-
-    def generate_hashes(self) -> None:
-        """
-        Compute hashes for files in the target_path
-        """
-        if not self.target_path:
-            return
-
-        for file in generate_hashes_from_path(self.target_path, self.log):
-            self.hash_values.append(file)
-
-    def list_modules(self) -> None:
-        self.log.info("Following is the list of available %s modules:", self.name)
-        for module in self.modules:
-            self.log.info(" - %s", module.__name__)
-
-    def init(self) -> None:
-        raise NotImplementedError
-
-    def module_init(self, module: MVTModule) -> None:
-        raise NotImplementedError
-
-    def finish(self) -> None:
-        raise NotImplementedError
-
-    def _show_disable_adb_warning(self) -> None:
-        """Warn if ADB is enabled"""
-        if type(self).__name__ in ["CmdAndroidCheckADB", "CmdAndroidCheckAndroidQF"]:
-            self.log.info(
-                "Please disable Developer Options and ADB (Android Debug Bridge) on the device once finished with the acquisition. "
-                "ADB is a powerful tool which can allow unauthorized access to the device."
-            )
-
-    def _show_support_message(self) -> None:
-        support_message = "Please seek reputable expert help if you have serious concerns about a possible spyware attack. Such support is available to human rights defenders and civil society through Amnesty International's Security Lab at https://securitylab.amnesty.org/get-help/?c=mvt"
-        if self.detected_count == 0:
-            self.log.info(
-                f"[bold]NOTE:[/bold] Using MVT with public indicators of compromise (IOCs) [bold]WILL NOT[/bold] automatically detect advanced attacks.\n\n{support_message}",
-                extra={"markup": True},
-            )
-        else:
-            self.log.warning(
-                f"[bold]NOTE: Detected indicators of compromise[/bold]. Only expert review can confirm if the detected indicators are signs of an attack.\n\n{support_message}",
-                extra={"markup": True},
-            )
-
-    def run(self) -> None:
-        try:
-            self.init()
-        except NotImplementedError:
-            pass
-
-        for module in self.modules:
-            if self.module_name and module.__name__ != self.module_name:
-                continue
-
-            # FIXME: do we need the logger here
-            module_logger = logging.getLogger(module.__module__)
-
-            m = module(
-                target_path=self.target_path,
-                results_path=self.results_path,
-                module_options=self.module_options,
-                log=module_logger,
-            )
-
-            if self.iocs.total_ioc_count:
-                m.indicators = self.iocs
-                m.indicators.log = m.log
-
-            if self.serial:
-                m.serial = self.serial
-
-            try:
-                self.module_init(m)
-            except NotImplementedError:
-                pass
-
-            run_module(m)
-
-            self.executed.append(m)
-
-            self.detected_count += len(m.detected)
-
-            self.timeline.extend(m.timeline)
-            self.timeline_detected.extend(m.timeline_detected)
-
-        try:
-            self.finish()
-        except NotImplementedError:
-            pass
-
-        self._store_timeline()
-        self._store_info()
-
-        self._show_disable_adb_warning()
-        self._show_support_message()

mvt/common/help.py

@@ -1,18 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-# Help messages of repeating options.
-HELP_MSG_OUTPUT = "Specify a path to a folder where you want to store JSON results"
-HELP_MSG_IOC = "Path to indicators file (can be invoked multiple time)"
-HELP_MSG_FAST = "Avoid running time/resource consuming features"
-HELP_MSG_LIST_MODULES = "Print list of available modules and exit"
-HELP_MSG_MODULE = "Name of a single module you would like to run instead of all"
-HELP_MSG_NONINTERACTIVE = "Don't ask interactive questions during processing"
-HELP_MSG_ANDROID_BACKUP_PASSWORD = "The backup password to use for an Android backup"
-HELP_MSG_HASHES = "Generate hashes of all the files analyzed"
-HELP_MSG_VERBOSE = "Verbose mode"
-
-# Android-specific.
-HELP_MSG_SERIAL = "Specify a device serial number or HOST:PORT connection string"

mvt/common/logo.py

@@ -1,71 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from rich import print as rich_print
-
-from .updates import IndicatorsUpdates, MVTUpdates
-from .version import MVT_VERSION
-
-
-def check_updates() -> None:
-    # First we check for MVT version updates.
-    mvt_updates = MVTUpdates()
-    try:
-        latest_version = mvt_updates.check()
-    except Exception:
-        pass
-    else:
-        if latest_version:
-            rich_print(
-                f"\t\t[bold]Version {latest_version} is available! "
-                "Upgrade mvt with `pip3 install -U mvt`[/bold]"
-            )
-
-    # Then we check for indicators files updates.
-    ioc_updates = IndicatorsUpdates()
-
-    # Before proceeding, we check if we have downloaded an indicators index.
-    # If not, there's no point in proceeding with the updates check.
-    if ioc_updates.get_latest_update() == 0:
-        rich_print(
-            "\t\t[bold]You have not yet downloaded any indicators, check "
-            "the `download-iocs` command![/bold]"
-        )
-        return
-
-    # We only perform this check at a fixed frequency, in order to not
-    # overburden the user with too many lookups if the command is being run
-    # multiple times.
-    should_check, hours = ioc_updates.should_check()
-    if not should_check:
-        rich_print(
-            f"\t\tIndicators updates checked recently, next automatic check "
-            f"in {int(hours)} hours"
-        )
-        return
-
-    try:
-        ioc_to_update = ioc_updates.check()
-    except Exception:
-        pass
-    else:
-        if ioc_to_update:
-            rich_print(
-                "\t\t[bold]There are updates to your indicators files! "
-                "Run the `download-iocs` command to update![/bold]"
-            )
-        else:
-            rich_print("\t\tYour indicators files seem to be up to date.")
-
-
-def logo() -> None:
-    rich_print("\n")
-    rich_print("\t[bold]MVT[/bold] - Mobile Verification Toolkit")
-    rich_print("\t\thttps://mvt.re")
-    rich_print(f"\t\tVersion: {MVT_VERSION}")
-
-    check_updates()
-
-    rich_print("\n")

mvt/ios/cmd_check_backup.py

@@ -1,43 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.common.command import Command
-
-from .modules.backup import BACKUP_MODULES
-from .modules.mixed import MIXED_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdIOSCheckBackup(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: bool = False,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            hashes=hashes,
-            log=log,
-        )
-
-        self.name = "check-backup"
-        self.modules = BACKUP_MODULES + MIXED_MODULES
-
-    def module_init(self, module):
-        module.is_backup = True

mvt/ios/modules/mixed/safari_browserstate.py

@@ -1,186 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import io
-import logging
-import os
-import plistlib
-import sqlite3
-from typing import Optional, Union
-
-from mvt.common.utils import convert_mactime_to_iso, keys_bytes_to_string
-
-from ..base import IOSExtraction
-
-SAFARI_BROWSER_STATE_BACKUP_RELPATH = "Library/Safari/BrowserState.db"
-SAFARI_BROWSER_STATE_ROOT_PATHS = [
-    "private/var/mobile/Library/Safari/BrowserState.db",
-    "private/var/mobile/Containers/Data/Application/*/Library/Safari/BrowserState.db",
-]
-
-
-class SafariBrowserState(IOSExtraction):
-    """This module extracts all Safari browser state records."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self._session_history_count = 0
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["last_viewed_timestamp"],
-            "module": self.__class__.__name__,
-            "event": "tab",
-            "data": f"{record['tab_title']} - {record['tab_url']}",
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            if "tab_url" in result:
-                ioc = self.indicators.check_domain(result["tab_url"])
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            if "session_data" not in result:
-                continue
-
-            for session_entry in result["session_data"]:
-                if "entry_url" in session_entry:
-                    ioc = self.indicators.check_domain(session_entry["entry_url"])
-                    if ioc:
-                        result["matched_indicator"] = ioc
-                        self.detected.append(result)
-
-    def _process_browser_state_db(self, db_path):
-        self._recover_sqlite_db_if_needed(db_path)
-        conn = self._open_sqlite_db(db_path)
-
-        cur = conn.cursor()
-        try:
-            cur.execute(
-                """
-                SELECT
-                    tabs.title,
-                    tabs.url,
-                    tabs.user_visible_url,
-                    tabs.last_viewed_time,
-                    tab_sessions.session_data
-                FROM tabs
-                JOIN tab_sessions ON tabs.uuid = tab_sessions.tab_uuid
-                ORDER BY tabs.last_viewed_time;
-            """
-            )
-        except sqlite3.OperationalError:
-            # Old version iOS <12 likely
-            cur.execute(
-                """
-                SELECT
-                    title, url, user_visible_url, last_viewed_time, session_data
-                FROM tabs
-                ORDER BY last_viewed_time;
-            """
-            )
-
-        for row in cur:
-            session_entries = []
-
-            if row[4]:
-                # Skip a 4 byte header before the plist content.
-                session_plist = row[4][4:]
-                session_data = {}
-                try:
-                    session_data = plistlib.load(io.BytesIO(session_plist))
-                    session_data = keys_bytes_to_string(session_data)
-                except plistlib.InvalidFileException:
-                    pass
-
-                if "SessionHistoryEntries" in session_data.get("SessionHistory", {}):
-                    for session_entry in session_data["SessionHistory"].get(
-                        "SessionHistoryEntries"
-                    ):
-                        self._session_history_count += 1
-
-                        data_length = 0
-                        if "SessionHistoryEntryData" in session_entry:
-                            data_length = len(
-                                session_entry.get("SessionHistoryEntryData")
-                            )
-
-                        session_entries.append(
-                            {
-                                "entry_title": session_entry.get(
-                                    "SessionHistoryEntryOriginalURL"
-                                ),
-                                "entry_url": session_entry.get(
-                                    "SessionHistoryEntryURL"
-                                ),
-                                "data_length": data_length,
-                            }
-                        )
-
-            self.results.append(
-                {
-                    "tab_title": row[0],
-                    "tab_url": row[1],
-                    "tab_visible_url": row[2],
-                    "last_viewed_timestamp": convert_mactime_to_iso(row[3]),
-                    "session_data": session_entries,
-                    "safari_browser_state_db": os.path.relpath(
-                        db_path, self.target_path
-                    ),
-                }
-            )
-
-    def run(self) -> None:
-        if self.is_backup:
-            for backup_file in self._get_backup_files_from_manifest(
-                relative_path=SAFARI_BROWSER_STATE_BACKUP_RELPATH
-            ):
-                browserstate_path = self._get_backup_file_from_id(
-                    backup_file["file_id"]
-                )
-
-                if not browserstate_path:
-                    continue
-
-                self.log.info(
-                    "Found Safari browser state database at path: %s", browserstate_path
-                )
-                self._process_browser_state_db(browserstate_path)
-        elif self.is_fs_dump:
-            for browserstate_path in self._get_fs_files_from_patterns(
-                SAFARI_BROWSER_STATE_ROOT_PATHS
-            ):
-                self.log.info(
-                    "Found Safari browser state database at path: %s", browserstate_path
-                )
-                self._process_browser_state_db(browserstate_path)
-
-        self.log.info(
-            "Extracted a total of %d tab records and %d session history entries",
-            len(self.results),
-            self._session_history_count,
-        )

pyproject.toml

@@ -0,0 +1,124 @@
+[project]
+name = "mvt"
+dynamic = ["version"]
+authors = [{ name = "Claudio Guarnieri", email = "nex@nex.sx" }]
+maintainers = [
+    { name = "Etienne Maynier", email = "tek@randhome.io" },
+    { name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org" },
+    { name = "Rory Flynn", email = "rory.flynn@amnesty.org" },
+]
+description = "Mobile Verification Toolkit"
+readme = "README.md"
+keywords = ["security", "mobile", "forensics", "malware"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Information Technology",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python",
+]
+dependencies = [
+    "click==8.3.3",
+    "rich==14.3.3",
+    "tld==0.13.2",
+    "requests==2.33.1",
+    "simplejson==3.20.2",
+    "packaging==26.2",
+    "appdirs==1.4.4",
+    "iOSbackup==0.9.925",
+    "adb-shell[usb]==0.4.4",
+    "libusb1==3.3.1",
+    "cryptography==47.0.0",
+    "PyYAML>=6.0.2",
+    "pyahocorasick==2.3.1",
+    "betterproto2==0.9.1",
+    "pydantic==2.13.3",
+    "pydantic-settings==2.14.0",
+    "NSKeyedUnArchiver==1.5.2",
+    "python-dateutil==2.9.0.post0",
+    "tzdata==2026.2",
+]
+requires-python = ">= 3.10"
+
+[project.urls]
+homepage = "https://docs.mvt.re/en/latest/"
+repository = "https://github.com/mvt-project/mvt"
+
+[project.scripts]
+mvt-ios = "mvt.ios:cli"
+mvt-android = "mvt.android:cli"
+
+[dependency-groups]
+dev = [
+    "requests>=2.31.0",
+    "pytest>=7.4.3",
+    "pytest-cov>=4.1.0",
+    "pytest-github-actions-annotate-failures>=0.2.0",
+    "pytest-mock>=3.14.0",
+    "stix2>=3.0.1",
+    "ruff>=0.1.6",
+    "mypy>=1.7.1",
+    "betterproto2-compiler",
+    "types-PyYAML>=6.0.12.20250516",
+    "types-python-dateutil>=2.9.0.20250822",
+    "types-requests>=2.32.4.20250913",
+]
+docs = [
+    "mkdocs==1.6.1",
+    "mkdocs-autorefs==1.4.4",
+    "mkdocs-material==9.7.6",
+    "mkdocs-material-extensions==1.3.1",
+    "mkdocstrings==1.0.4",
+]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[tool.coverage.run]
+omit = ["tests/*"]
+
+[tool.coverage.html]
+directory = "htmlcov"
+
+[tool.mypy]
+install_types = false
+ignore_missing_imports = true
+packages = "src"
+
+[tool.pytest.ini_options]
+addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
+testpaths = ["tests"]
+
+[tool.ruff]
+lint.select = ["C90", "E", "F", "W"] # flake8 default set
+lint.ignore = [
+    "E501", # don't enforce line length violations
+    "C901", # complex-structure
+
+    # These were previously ignored but don't seem to be required:
+    # "E265",  # no-space-after-block-comment
+    # "F401",  # unused-import
+    # "E127",  # not included in ruff
+    # "W503",  # not included in ruff
+    # "E226",  # missing-whitespace-around-arithmetic-operator
+    # "E203",  # whitespace-before-punctuation
+]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"] # unused-import
+
+[tool.ruff.lint.mccabe]
+max-complexity = 10
+
+[tool.setuptools]
+include-package-data = true
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+mvt = ["ios/data/*.json"]
+
+[tool.setuptools.dynamic]
+version = { attr = "mvt.common.version.MVT_VERSION" }

ruff.toml

@@ -1,6 +0,0 @@
-# Never enforce `E501` (line length violations).
-ignore = ["E501"]
-
-# Ignore `E402` (import violations) in all `__init__.py` files, and in `path/to/file.py`.
-[per-file-ignores]
-"__init__.py" = ["F401"]

scripts/lint.sh

@@ -1,14 +0,0 @@
-#!/bin/sh -e
-
-export SOURCE="mvt tests"
-
-export PREFIX=""
-if [ -d 'venv' ] ; then
-    export PREFIX="venv/bin/"
-fi
-
-set -x
-
-${PREFIX}autoflake --in-place --recursive --exclude venv ${SOURCE}
-${PREFIX}isort ${SOURCE}
-${PREFIX}black --exclude venv ${SOURCE}

setup.cfg

@@ -1,96 +0,0 @@
-[metadata]
-name = mvt
-version = attr: mvt.common.version.MVT_VERSION
-author = Claudio Guarnieri
-author_email = nex@nex.sx
-description = Mobile Verification Toolkit
-long_description = file: README.md
-long_description_content_type = text/markdown
-url = https://github.com/mvt-project/mvt
-keywords = security, mobile, forensics, malware
-license = MVT v1.1
-classifiers =
-    Development Status :: 5 - Production/Stable
-    Intended Audience :: Information Technology
-    Operating System :: OS Independent
-    Programming Language :: Python
-
-[options]
-packages = find:
-package_dir = = ./
-include_package_data = True
-python_requires = >= 3.8
-install_requires =
-    click >=8.1.3
-    rich >=12.6.0
-    tld >=0.12.6
-    requests >=2.28.1
-    simplejson >=3.17.6
-    packaging >=21.3
-    appdirs >=1.4.4
-    iOSbackup >=0.9.923
-    adb-shell >=0.4.3
-    libusb1 >=3.0.0
-    cryptography >=42.0.5
-    pyyaml >=6.0
-    pyahocorasick >= 2.0.0
-
-[options.packages.find]
-where = ./
-
-[options.entry_points]
-console_scripts =
-    mvt-ios = mvt.ios:cli
-    mvt-android = mvt.android:cli
-
-[options.package_data]
-mvt = ios/data/*.json
-
-[flake8]
-max-complexity = 10
-max-line-length = 1000
-ignore =
-    C901,
-    E265,
-    F401,
-    E127,
-    W503,
-    E226,
-    E203
-
-[pylint]
-score = no
-reports = no
-output-format = colorized
-
-max-locals = 25
-max-args = 10
-
-good-names = i,m
-
-min-similarity-lines = 10
-ignore-comments = yes
-ignore-docstrings = yes
-ignore-imports = yes
-
-ignored-argument-names=args|kwargs
-
-# https://pylint.pycqa.org/en/stable/technical_reference/features.html
-disable =
-    too-many-instance-attributes,
-    broad-except,
-    abstract-method,
-    dangerous-default-value,
-    too-few-public-methods,
-    missing-docstring,
-    missing-module-docstring,
-    missing-class-docstring,
-    missing-function-docstring,
-    #duplicate-code,
-    #line-too-long,
-
-[mypy]
-ignore_missing_imports = True
-
-[isort]
-profile=black

src/mvt/android/artifacts/artifact.py

@@ -0,0 +1,58 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+from typing import AnyStr
+
+from mvt.common.artifact import Artifact
+
+
+class AndroidArtifact(Artifact):
+    @staticmethod
+    def extract_dumpsys_section(
+        dumpsys: AnyStr, separator: AnyStr, binary=False
+    ) -> AnyStr:
+        """
+        Extract a section from a full dumpsys file.
+
+        :param dumpsys: content of the full dumpsys file (AnyStr)
+        :param separator: content of the first line separator (AnyStr)
+        :param binary: whether the dumpsys should be pared as binary or not (bool)
+        :return: section extracted (string or bytes)
+        """
+        in_section = False
+        delimiter_str = "------------------------------------------------------------------------------"
+        delimiter_bytes = b"------------------------------------------------------------------------------"
+
+        if binary:
+            lines_bytes = []
+            for line in dumpsys.splitlines():  # type: ignore[union-attr]
+                if line.strip() == separator:  # type: ignore[arg-type]
+                    in_section = True
+                    continue
+
+                if not in_section:
+                    continue
+
+                if line.strip().startswith(delimiter_bytes):  # type: ignore[arg-type]
+                    break
+
+                lines_bytes.append(line)  # type: ignore[arg-type]
+
+            return b"\n".join(lines_bytes)  # type: ignore[return-value,arg-type]
+        else:
+            lines_str = []
+            for line in dumpsys.splitlines():  # type: ignore[union-attr]
+                if line.strip() == separator:  # type: ignore[arg-type]
+                    in_section = True
+                    continue
+
+                if not in_section:
+                    continue
+
+                if line.strip().startswith(delimiter_str):  # type: ignore[arg-type]
+                    break
+
+                lines_str.append(line)  # type: ignore[arg-type]
+
+            return "\n".join(lines_str)  # type: ignore[return-value,arg-type]

src/mvt/android/artifacts/dumpsys_accessibility.py

@@ -3,21 +3,27 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-from .artifact import AndroidArtifact
 import re
 
+from .artifact import AndroidArtifact
+
 
 class DumpsysAccessibilityArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
         for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
+            if self.indicators:
+                ioc_match = self.indicators.check_app_id(result["package_name"])
+                if ioc_match:
+                    self.alertstore.critical(
+                        ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                    )
+                    continue
+
+            self.alertstore.medium(
+                f'Found accessibility service: "{result["service"]}"',
+                "",
+                result,
+                )
 
     def parse(self, content: str) -> None:
         """

src/mvt/android/artifacts/dumpsys_adb.py

@@ -0,0 +1,191 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import base64
+import binascii
+import hashlib
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysADBArtifact(AndroidArtifact):
+    multiline_fields = ["user_keys", "keystore"]
+
+    @staticmethod
+    def is_structural_line(key: str, vals: list) -> bool:
+        if key == "}":
+            return True
+        # XML keystore continuations also split on "=", but never into an identifier.
+        return len(vals) == 2 and key.isidentifier()
+
+    def indented_dump_parser(self, dump_data):
+        """
+        Parse the indented dumpsys output, generated by DualDumpOutputStream in Android.
+        """
+        res = {}
+        stack = [res]
+        cur_indent = 0
+        in_multiline = False
+        for line in dump_data.strip(b"\n").split(b"\n"):
+            # Track the level of indentation
+            indent = len(line) - len(line.lstrip())
+            if indent < cur_indent:
+                # If the current line is less indented than the previous one, back out
+                stack.pop()
+                cur_indent = indent
+            else:
+                cur_indent = indent
+
+            # Split key and value by '='
+            vals = line.lstrip().split(b"=", 1)
+            key = vals[0].decode("utf-8")
+            current_dict = stack[-1]
+
+            # Annoyingly, some values are multiline and don't have a key on each line
+            if in_multiline:
+                if key == "":
+                    # If the line is empty, it's the terminator for the multiline value
+                    in_multiline = False
+                    if isinstance(stack[-1], list):
+                        stack.pop()
+                    continue
+
+                if not self.is_structural_line(key, vals):
+                    current_dict.append(line.lstrip())
+                    continue
+
+                in_multiline = False
+                if isinstance(stack[-1], list):
+                    stack.pop()
+                current_dict = stack[-1]
+
+            if key == "}":
+                stack.pop()
+                continue
+
+            if vals[1] == b"{":
+                # If the value is a new dictionary, add it to the stack
+                current_dict[key] = {}
+                stack.append(current_dict[key])
+
+            # Handle continue multiline values
+            elif key in self.multiline_fields:
+                current_dict[key] = []
+                current_dict[key].append(vals[1])
+
+                in_multiline = True
+                stack.append(current_dict[key])
+            else:
+                # If the value something else, store it in the current dictionary
+                current_dict[key] = vals[1]
+
+        return res
+
+    def parse_xml(self, xml_data):
+        """
+        Parse XML data from dumpsys ADB output
+        """
+        import xml.etree.ElementTree as ET
+
+        keystore = []
+        keystore_root = ET.fromstring(xml_data)
+        for adb_key in keystore_root.findall("adbKey"):
+            key_info = self.calculate_key_info(adb_key.get("key").encode("utf-8"))
+            key_info["last_connected"] = adb_key.get("lastConnection")
+            keystore.append(key_info)
+
+        return keystore
+
+    @staticmethod
+    def calculate_key_info(user_key: bytes) -> dict:
+        if b" " in user_key:
+            key_base64, user = user_key.split(b" ", 1)
+        else:
+            key_base64, user = user_key, b""
+
+        try:
+            key_raw = base64.b64decode(key_base64)
+            key_fingerprint = hashlib.md5(key_raw).hexdigest().upper()
+            key_fingerprint_colon = ":".join(
+                [key_fingerprint[i : i + 2] for i in range(0, len(key_fingerprint), 2)]
+            )
+        except binascii.Error:
+            # Impossible to parse base64
+            key_fingerprint_colon = ""
+
+        return {
+            "user": user.decode("utf-8"),
+            "fingerprint": key_fingerprint_colon,
+            "key": key_base64,
+        }
+
+    def check_indicators(self) -> None:
+        if not self.results:
+            return
+
+        for entry in self.results:
+            for user_key in entry.get("user_keys", []):
+                self.log.debug(
+                    f"Found trusted ADB key for user '{user_key['user']}' with fingerprint "
+                    f"'{user_key['fingerprint']}'"
+                )
+
+    def parse(self, content: bytes) -> None:
+        """
+        Parse the Dumpsys ADB section
+        Adds results to self.results (List[Dict[str, str]])
+
+        :param content: content of the ADB section (string)
+        """
+        if not content or b"Can't find service: adb" in content:
+            self.log.error(
+                "Could not load ADB data from dumpsys. "
+                "It may not be supported on this device."
+            )
+            return
+
+        start_of_json = content.find(b"\n{")
+        if start_of_json == -1:
+            self.log.error("Unable to find ADB manager state in dumpsys output")
+            return
+
+        end_of_json = content.rfind(b"}\n")
+        if end_of_json == -1 or end_of_json <= start_of_json:
+            self.log.error("Unable to find complete ADB manager state in dumpsys output")
+            return
+
+        json_content = content[start_of_json + 2 : end_of_json - 2].rstrip()
+
+        parsed = self.indented_dump_parser(json_content)
+        if parsed.get("debugging_manager") is None:
+            self.log.error("Unable to find expected ADB entries in dumpsys output")  # noqa
+            return
+
+        # Keystore can be in different levels, as the basic parser
+        # is not always consistent due to different dumpsys formats.
+        if parsed.get("keystore"):
+            keystore_data = b"\n".join(parsed["keystore"])
+        elif parsed["debugging_manager"].get("keystore"):
+            keystore_data = b"\n".join(parsed["debugging_manager"]["keystore"])
+        else:
+            keystore_data = None
+
+        # Keystore is in XML format on some devices and we need to parse it
+        if keystore_data and keystore_data.startswith(b"<?xml"):
+            parsed["debugging_manager"]["keystore"] = self.parse_xml(keystore_data)
+        else:
+            # Keystore is not XML format
+            parsed["debugging_manager"]["keystore"] = keystore_data
+
+        parsed = parsed["debugging_manager"]
+
+        # Calculate key fingerprints for better readability
+        key_info = []
+        for user_key in parsed.get("user_keys", []):
+            user_info = self.calculate_key_info(user_key)
+            key_info.append(user_info)
+
+        parsed["user_keys"] = key_info
+        self.results = [parsed]

src/mvt/android/artifacts/dumpsys_appops.py

@@ -4,21 +4,25 @@
 #   https://license.mvt.re/1.1/
 
 from datetime import datetime
-from typing import Any, Dict, List, Union
+from typing import Any
 
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 from mvt.common.utils import convert_datetime_to_iso
 
 from .artifact import AndroidArtifact
 
+RISKY_PERMISSIONS = ["REQUEST_INSTALL_PACKAGES"]
+RISKY_PACKAGES = ["com.android.shell"]
+
 
 class DumpsysAppopsArtifact(AndroidArtifact):
     """
     Parser for dumpsys app ops info
     """
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, result: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
-        for perm in record["permissions"]:
+        for perm in result["permissions"]:
             if "entries" not in perm:
                 continue
 
@@ -29,7 +33,7 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                             "timestamp": entry["timestamp"],
                             "module": self.__class__.__name__,
                             "event": entry["access"],
-                            "data": f"{record['package_name']} access to "
+                            "data": f"{result['package_name']} access to "
                             f"{perm['name']}: {entry['access']}",
                         }
                     )
@@ -39,27 +43,51 @@ class DumpsysAppopsArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
         for result in self.results:
             if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_app_id(result.get("package_name"))
+                if ioc_match:
+                    self.alertstore.critical(
+                        ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                    )
                     continue
 
+            # We use a placeholder entry to create a basic alert even without permission entries.
+            placeholder_entry = {"access": "Unknown", "timestamp": ""}
+
             for perm in result["permissions"]:
                 if (
-                    perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                    and perm["access"] == "allow"
+                    perm["name"] in RISKY_PERMISSIONS
+                    # and perm["access"] == "allow"
                 ):
-                    self.log.info(
-                        "Package %s with REQUEST_INSTALL_PACKAGES " "permission",
-                        result["package_name"],
-                    )
+                    for entry in sorted(
+                        perm["entries"] or [placeholder_entry],
+                        key=lambda x: x["timestamp"],
+                    ):
+                        cleaned_result = result.copy()
+                        cleaned_result["permissions"] = [perm]
+                        self.alertstore.medium(
+                            f"Package '{result['package_name']}' had risky permission '{perm['name']}' set to '{entry['access']}' at {entry['timestamp']}",
+                            entry["timestamp"],
+                            cleaned_result,
+                        )
+
+                elif result["package_name"] in RISKY_PACKAGES:
+                    for entry in sorted(
+                        perm["entries"] or [placeholder_entry],
+                        key=lambda x: x["timestamp"],
+                    ):
+                        cleaned_result = result.copy()
+                        cleaned_result["permissions"] = [perm]
+                        self.alertstore.medium(
+                            f"Risky package '{result['package_name']}' had '{perm['name']}' permission set to '{entry['access']}' at {entry['timestamp']}",
+                            entry["timestamp"],
+                            cleaned_result,
+                        )
 
     def parse(self, output: str) -> None:
-        self.results: List[Dict[str, Any]] = []
-        perm = {}
-        package = {}
-        entry = {}
+        # self.results: List[Dict[str, Any]] = []
+        perm: dict[str, Any] = {}
+        package: dict[str, Any] = {}
+        entry: dict[str, Any] = {}
         uid = None
         in_packages = False
 
@@ -121,11 +149,16 @@ class DumpsysAppopsArtifact(AndroidArtifact):
             if line.startswith("          "):
                 # Permission entry like:
                 # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
+                access_type = line.split(":")[0].strip()
+                if access_type not in ["Access", "Reject"]:
+                    # Skipping invalid access type. Some entries are not in the format we expect
+                    continue
+
                 if entry:
                     perm["entries"].append(entry)
                     entry = {}
 
-                entry["access"] = line.split(":")[0].strip()
+                entry["access"] = access_type
                 entry["type"] = line[line.find("[") + 1 : line.find("]")]
 
                 try:

src/mvt/android/artifacts/dumpsys_battery_daily.py

@@ -0,0 +1,139 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from typing import Any
+
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysBatteryDailyArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys dattery daily updates.
+    """
+
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        action = record.get("action", "update")
+        package_name = record["package_name"]
+        vers = record["vers"]
+
+        if vers == "0":
+            data = f"Recorded uninstall of package {package_name} (vers 0)"
+        elif action == "downgrade":
+            prev_vers = record.get("previous_vers", "unknown")
+            data = f"Recorded downgrade of package {package_name} from vers {prev_vers} to vers {vers}"
+        else:
+            data = f"Recorded update of package {package_name} with vers {vers}"
+
+        return {
+            "timestamp": record["from"],
+            "module": self.__class__.__name__,
+            "event": "battery_daily",
+            "data": data,
+        }
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+                continue
+
+    def parse(self, output: str) -> None:
+        daily = None
+        daily_updates: list[dict[str, Any]] = []
+        records: list[dict[str, Any]] = []
+        for line in output.splitlines():
+            if line.startswith("  Daily from "):
+                if len(daily_updates) > 0:
+                    records.extend(daily_updates)
+                    daily_updates = []
+
+                timeframe = line[13:].strip()
+                date_from, date_to = timeframe.strip(":").split(" to ", 1)
+                daily = {"from": date_from[0:10], "to": date_to[0:10]}
+                continue
+
+            if not daily:
+                continue
+
+            if not line.strip().startswith("Update "):
+                continue
+
+            line = line.strip().replace("Update ", "")
+            package_name, vers = line.split(" ", 1)
+            vers_nr = vers.split("=", 1)[1]
+
+            already_seen = False
+            for update in daily_updates:
+                if package_name == update["package_name"] and vers_nr == update["vers"]:
+                    already_seen = True
+                    break
+
+            if not already_seen:
+                update_record: dict[str, Any] = {
+                    "action": "update",
+                    "from": daily["from"],
+                    "to": daily["to"],
+                    "package_name": package_name,
+                    "vers": vers_nr,
+                }
+
+                daily_updates.append(update_record)
+
+        if len(daily_updates) > 0:
+            records.extend(daily_updates)
+
+        self._detect_uninstalls_and_downgrades(records)
+        self.results.extend(records)
+
+    def _detect_uninstalls_and_downgrades(
+        self, records: list[dict[str, Any]]
+    ) -> None:
+        package_versions: dict[str, int] = {}
+
+        for record in sorted(
+            records,
+            key=lambda record: (
+                record["from"],
+                record["to"],
+                record["package_name"],
+            ),
+        ):
+            package_name = record["package_name"]
+            vers_nr = record["vers"]
+
+            if vers_nr == "0":
+                self.alertstore.medium(
+                    f"Detected uninstall of package {package_name} (vers 0)",
+                    record["from"],
+                    record,
+                )
+                package_versions.pop(package_name, None)
+                continue
+
+            try:
+                current_vers = int(vers_nr)
+            except ValueError:
+                continue
+
+            previous_vers = package_versions.get(package_name)
+            if previous_vers is not None and current_vers < previous_vers:
+                record["action"] = "downgrade"
+                record["previous_vers"] = str(previous_vers)
+                self.alertstore.medium(
+                    f"Detected downgrade of package {package_name} "
+                    f"from vers {previous_vers} to vers {current_vers}",
+                    record["from"],
+                    record,
+                )
+
+            package_versions[package_name] = current_vers

src/mvt/android/artifacts/dumpsys_battery_history.py

@@ -16,10 +16,11 @@ class DumpsysBatteryHistoryArtifact(AndroidArtifact):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
                 continue
 
     def parse(self, data: str) -> None:
@@ -30,21 +31,38 @@ class DumpsysBatteryHistoryArtifact(AndroidArtifact):
             if line.strip() == "":
                 break
 
-            time_elapsed = line.strip().split(" ", 1)[0]
+            time_parts = line.strip().split()
+            time_elapsed = time_parts[0]
+            if (
+                len(time_parts) > 1
+                and len(time_parts[0]) == 5
+                and time_parts[0][2] == "-"
+                and ":" in time_parts[1]
+            ):
+                time_elapsed = " ".join(time_parts[:2])
 
             event = ""
             if line.find("+job") > 0:
                 event = "start_job"
-                uid = line[line.find("+job") + 5 : line.find(":")]
-                service = line[line.find(":") + 1 :].strip('"')
+                payload = line.split("+job=", 1)[1]
+                uid, separator, service = payload.partition(":")
+                if not separator:
+                    continue
+                service = service.strip().strip('"')
                 package_name = service.split("/")[0]
             elif line.find("-job") > 0:
                 event = "end_job"
-                uid = line[line.find("-job") + 5 : line.find(":")]
-                service = line[line.find(":") + 1 :].strip('"')
+                payload = line.split("-job=", 1)[1]
+                uid, separator, service = payload.partition(":")
+                if not separator:
+                    continue
+                service = service.strip().strip('"')
                 package_name = service.split("/")[0]
             elif line.find("+running +wake_lock=") > 0:
-                uid = line[line.find("+running +wake_lock=") + 21 : line.find(":")]
+                payload = line.split("+running +wake_lock=", 1)[1]
+                uid, separator, _ = payload.partition(":")
+                if not separator:
+                    continue
                 event = "wake"
                 service = (
                     line[line.find("*walarm*:") + 9 :].split(" ")[0].strip('"').strip()

src/mvt/android/artifacts/dumpsys_dbinfo.py

@@ -0,0 +1,70 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import re
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysDBInfoArtifact(AndroidArtifact):
+    """
+    Parser for dumpsys DBInfo service
+    """
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            path = result.get("path", "")
+            for part in path.split("/"):
+                ioc_match = self.indicators.check_app_id(part)
+                if ioc_match:
+                    self.alertstore.critical(
+                        ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                    )
+                    continue
+
+    def parse(self, output: str) -> None:
+        rxp = re.compile(
+            r".*\[((?:[0-9]{4}-)?[0-9]{2}-[0-9]{2} "
+            r"[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\]\s*"
+            r"(?:\[Pid:\((\d+)\)\])?([\w-]+).*?sql=\"(.+?)\""
+        )  # pylint: disable=line-too-long
+
+        pool = None
+        in_operations = False
+        for line in output.splitlines():
+            if line.startswith("Connection pool for "):
+                pool = line.replace("Connection pool for ", "").rstrip(":")
+
+            if not pool:
+                continue
+
+            if line.strip() == "Most recently executed operations:":
+                in_operations = True
+                continue
+
+            if not in_operations:
+                continue
+
+            if not line.startswith("        "):
+                in_operations = False
+                pool = None
+                continue
+
+            match = rxp.match(line)
+            if not match:
+                continue
+
+            result = {
+                "isodate": match.group(1),
+                "action": match.group(3),
+                "sql": match.group(4),
+                "path": pool,
+            }
+            if match.group(2):
+                result["pid"] = match.group(2)
+            self.results.append(result)

src/mvt/android/artifacts/dumpsys_package_activities.py

@@ -12,10 +12,11 @@ class DumpsysPackageActivitiesArtifact(AndroidArtifact):
             return
 
         for activity in self.results:
-            ioc = self.indicators.check_app_id(activity["package_name"])
-            if ioc:
-                activity["matched_indicator"] = ioc
-                self.detected.append(activity)
+            ioc_match = self.indicators.check_app_id(activity["package_name"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", activity, matched_indicator=ioc_match.ioc
+                )
                 continue
 
     def parse(self, content: str):

src/mvt/android/artifacts/dumpsys_packages.py

@@ -4,36 +4,40 @@
 #   https://license.mvt.re/1.1/
 
 import re
-from typing import Any, Dict, List, Union
+from typing import Any, Dict, List
 
 from mvt.android.utils import ROOT_PACKAGES
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 
 from .artifact import AndroidArtifact
 
 
 class DumpsysPackagesArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
+        alerted_root_packages = set()
         for result in self.results:
             if result["package_name"] in ROOT_PACKAGES:
-                self.log.warning(
-                    "Found an installed package related to "
-                    'rooting/jailbreaking: "%s"',
-                    result["package_name"],
+                if result["package_name"] in alerted_root_packages:
+                    continue
+                alerted_root_packages.add(result["package_name"])
+                self.alertstore.medium(
+                    f'Found an installed package related to rooting/jailbreaking: "{result["package_name"]}"',
+                    "",
+                    result,
                 )
-                self.detected.append(result)
                 continue
 
             if not self.indicators:
                 continue
 
-            ioc = self.indicators.check_app_id(result.get("package_name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result.get("package_name", ""))
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
-
         timestamps = [
             {"event": "package_install", "timestamp": record["timestamp"]},
             {
@@ -60,15 +64,15 @@ class DumpsysPackagesArtifact(AndroidArtifact):
         """
         Parse one entry of a dumpsys package information
         """
-        details = {
+        details: Dict[str, Any] = {
             "uid": "",
             "version_name": "",
             "version_code": "",
             "timestamp": "",
             "first_install_time": "",
             "last_update_time": "",
-            "permissions": [],
-            "requested_permissions": [],
+            "permissions": list(),
+            "requested_permissions": list(),
         }
         in_install_permissions = False
         in_runtime_permissions = False
@@ -146,7 +150,7 @@ class DumpsysPackagesArtifact(AndroidArtifact):
         results = []
         package_name = None
         package = {}
-        lines = []
+        lines: list[str] = []
         for line in output.splitlines():
             if line.startswith("  Package ["):
                 if len(lines) > 0:
@@ -187,7 +191,7 @@ class DumpsysPackagesArtifact(AndroidArtifact):
         package = []
 
         in_package_list = False
-        for line in content.split("\n"):
+        for line in content.splitlines():
             if line.startswith("Packages:"):
                 in_package_list = True
                 continue

src/mvt/android/artifacts/dumpsys_platform_compat.py

@@ -0,0 +1,43 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+
+
+class DumpsysPlatformCompatArtifact(AndroidArtifact):
+    """
+    Parser for uninstalled apps listed in platform_compat section.
+    """
+
+    def check_indicators(self) -> None:
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )
+                continue
+
+    def parse(self, data: str) -> None:
+        for line in data.splitlines():
+            if not line.startswith("ChangeId(168419799; name=DOWNSCALED;"):
+                continue
+
+            if line.strip() == "":
+                break
+
+            # Look for rawOverrides field
+            if "rawOverrides={" in line:
+                # Extract the content inside the braces for rawOverrides
+                overrides_field = line.split("rawOverrides={", 1)[1].split("};", 1)[0]
+
+                for entry in overrides_field.split(", "):
+                    # Extract app name
+                    uninstall_app = entry.split("=")[0].strip()
+
+                    self.results.append({"package_name": uninstall_app})

src/mvt/android/artifacts/dumpsys_receivers.py

@@ -50,14 +50,18 @@ class DumpsysReceiversArtifact(AndroidArtifact):
                 if not self.indicators:
                     continue
 
-                ioc = self.indicators.check_app_id(receiver["package_name"])
-                if ioc:
-                    receiver["matched_indicator"] = ioc
-                    self.detected.append({intent: receiver})
+                ioc_match = self.indicators.check_app_id(receiver["package_name"])
+                if ioc_match:
+                    self.alertstore.critical(
+                        ioc_match.message,
+                        "",
+                        {intent: receiver},
+                        matched_indicator=ioc_match.ioc,
+                    )
                     continue
 
     def parse(self, output: str) -> None:
-        self.results = {}
+        self.results: dict[str, list[dict[str, str]]] = {}
 
         in_receiver_resolver_table = False
         in_non_data_actions = False
@@ -92,6 +96,18 @@ class DumpsysReceiversArtifact(AndroidArtifact):
                 self.results[intent] = []
                 continue
 
+            parts = line.strip().split(" ")
+            if len(parts) < 2:
+                # A single-token line here is not a receiver. Real dumpstate
+                # output can print an action header mis-indented (observed with
+                # 15 leading spaces instead of 6), which used to raise
+                # IndexError and abort the whole module. Treat a trailing-colon
+                # token as the next action, skip anything else.
+                if parts[0].endswith(":"):
+                    intent = parts[0][:-1]
+                    self.results.setdefault(intent, [])
+                continue
+
             # If we are not in an intent block yet, skip.
             if not intent:
                 continue
@@ -105,7 +121,7 @@ class DumpsysReceiversArtifact(AndroidArtifact):
 
             # If we got this far, we are processing receivers for the
             # activities we are interested in.
-            receiver = line.strip().split(" ")[1]
+            receiver = parts[1]
             package_name = receiver.split("/")[0]
 
             self.results[intent].append(

src/mvt/android/artifacts/file_timestamps.py

@@ -0,0 +1,43 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .artifact import AndroidArtifact
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
+
+
+class FileTimestampsArtifact(AndroidArtifact):
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
+        records = []
+
+        for ts in set(
+            [
+                record.get("access_time"),
+                record.get("changed_time"),
+                record.get("modified_time"),
+            ]
+        ):
+            if not ts:
+                continue
+
+            macb = ""
+            macb += "M" if ts == record.get("modified_time") else "-"
+            macb += "A" if ts == record.get("access_time") else "-"
+            macb += "C" if ts == record.get("changed_time") else "-"
+            macb += "-"
+
+            msg = record["path"]
+            if record.get("context"):
+                msg += f" ({record['context']})"
+
+            records.append(
+                {
+                    "timestamp": ts,
+                    "module": self.__class__.__name__,
+                    "event": macb,
+                    "data": msg,
+                }
+            )
+
+        return records

src/mvt/android/artifacts/getprop.py

@@ -39,8 +39,19 @@ class GetProp(AndroidArtifact):
             if not matches or len(matches[0]) != 2:
                 continue
 
-            entry = {"name": matches[0][0], "value": matches[0][1]}
-            self.results.append(entry)
+            prop_entry = {"name": matches[0][0], "value": matches[0][1]}
+            self.results.append(prop_entry)
+
+    def get_device_timezone(self) -> str | None:
+        """
+        Get the device timezone from the getprop results
+
+        Used in other moduels to calculate the timezone offset
+        """
+        for entry in self.results:
+            if entry["name"] == "persist.sys.timezone":
+                return entry["value"]
+        return None
 
     def check_indicators(self) -> None:
         for entry in self.results:
@@ -48,13 +59,18 @@ class GetProp(AndroidArtifact):
                 self.log.info("%s: %s", entry["name"], entry["value"])
 
             if entry["name"] == "ro.build.version.security_patch":
-                warn_android_patch_level(entry["value"], self.log)
+                warning_message = warn_android_patch_level(entry["value"], self.log)
+                if isinstance(warning_message, str):
+                    self.alertstore.medium(warning_message, "", entry)
 
         if not self.indicators:
             return
 
         for result in self.results:
-            ioc = self.indicators.check_android_property_name(result.get("name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_android_property_name(
+                result.get("name", "")
+            )
+            if ioc_match:
+                self.alertstore.critical(
+                    ioc_match.message, "", result, matched_indicator=ioc_match.ioc
+                )

src/mvt/android/artifacts/mounts.py

@@ -0,0 +1,197 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from typing import Any
+
+from .artifact import AndroidArtifact
+
+SUSPICIOUS_MOUNT_POINTS = [
+    "/system",
+    "/vendor",
+    "/product",
+    "/system_ext",
+]
+
+SUSPICIOUS_OPTIONS = [
+    "rw",
+    "remount",
+    "noatime",
+    "nodiratime",
+]
+
+ALLOWLIST_NOATIME = [
+    "/system_dlkm",
+    "/system_ext",
+    "/product",
+    "/vendor",
+    "/vendor_dlkm",
+]
+
+
+class Mounts(AndroidArtifact):
+    """
+    This artifact parses mount information from /proc/mounts or similar mount data.
+    It can detect potentially suspicious mount configurations that may indicate
+    a rooted or compromised device.
+    """
+
+    def parse(self, entry: str) -> None:
+        """
+        Parse mount information from the provided entry.
+
+        Examples:
+        /dev/block/bootdevice/by-name/system /system ext4 ro,seclabel,relatime 0 0
+        /dev/block/dm-12 on / type ext4 (ro,seclabel,noatime)
+        """
+        self.results: list[dict[str, Any]] = []
+
+        for line in entry.splitlines():
+            line = line.strip()
+            if not line:
+                continue
+
+            device = None
+            mount_point = None
+            filesystem_type = None
+            mount_options = ""
+
+            if " on " in line and " type " in line:
+                try:
+                    # Format: device on mount_point type filesystem_type (options)
+                    device_part, rest = line.split(" on ", 1)
+                    device = device_part.strip()
+
+                    # Split by 'type' to get mount_point and filesystem info
+                    mount_part, fs_part = rest.split(" type ", 1)
+                    mount_point = mount_part.strip()
+
+                    # Parse filesystem and options
+                    if "(" in fs_part and fs_part.endswith(")"):
+                        # Format: filesystem_type (options)
+                        fs_and_opts = fs_part.strip()
+                        paren_idx = fs_and_opts.find("(")
+                        filesystem_type = fs_and_opts[:paren_idx].strip()
+                        mount_options = fs_and_opts[paren_idx + 1 : -1].strip()
+                    else:
+                        # No options in parentheses, just filesystem type
+                        filesystem_type = fs_part.strip()
+                        mount_options = ""
+
+                    # Skip if we don't have essential info
+                    if not device or not mount_point or not filesystem_type:
+                        continue
+
+                    # Parse options into list
+                    options_list = (
+                        [opt.strip() for opt in mount_options.split(",") if opt.strip()]
+                        if mount_options
+                        else []
+                    )
+
+                    # Check if it's a system partition
+                    is_system_partition = mount_point in SUSPICIOUS_MOUNT_POINTS or any(
+                        mount_point.startswith(sp) for sp in SUSPICIOUS_MOUNT_POINTS
+                    )
+
+                    # Check if it's mounted read-write
+                    is_read_write = "rw" in options_list
+
+                    mount_entry = {
+                        "device": device,
+                        "mount_point": mount_point,
+                        "filesystem_type": filesystem_type,
+                        "mount_options": mount_options,
+                        "options_list": options_list,
+                        "is_system_partition": is_system_partition,
+                        "is_read_write": is_read_write,
+                    }
+
+                    self.results.append(mount_entry)
+
+                except ValueError:
+                    # If parsing fails, skip this line
+                    continue
+            else:
+                # Skip lines that don't match expected format
+                continue
+
+    def check_indicators(self) -> None:
+        """
+        Check for suspicious mount configurations that may indicate root access
+        or other security concerns.
+        """
+        system_rw_mounts = []
+        suspicious_mounts = []
+
+        for mount in self.results:
+            mount_point = mount["mount_point"]
+            options = mount["options_list"]
+
+            # Check for system partitions mounted as read-write
+            if mount["is_system_partition"] and mount["is_read_write"]:
+                system_rw_mounts.append(mount)
+                if mount_point == "/system":
+                    self.alertstore.high(
+                        "Root detected /system partition is mounted as read-write (rw)",
+                        "",
+                        mount,
+                    )
+                else:
+                    self.alertstore.high(
+                        f"System partition {mount_point} is mounted as read-write (rw). This may indicate system modifications.",
+                        "",
+                        mount,
+                    )
+
+            # Check for other suspicious mount options
+            suspicious_opts = [opt for opt in options if opt in SUSPICIOUS_OPTIONS]
+            if suspicious_opts and mount["is_system_partition"]:
+                if (
+                    "noatime" in mount["mount_options"]
+                    and mount["mount_point"] in ALLOWLIST_NOATIME
+                ):
+                    continue
+                suspicious_mounts.append(mount)
+                self.alertstore.medium(
+                    f"Suspicious mount options found for {mount_point}: {', '.join(suspicious_opts)}",
+                    "",
+                    mount,
+                )
+
+            # Log interesting mount information
+            if mount_point == "/data" or mount_point.startswith("/sdcard"):
+                self.log.info(
+                    "Data partition: %s mounted as %s with options: %s",
+                    mount_point,
+                    mount["filesystem_type"],
+                    mount["mount_options"],
+                )
+
+        self.log.info("Parsed %d mount entries", len(self.results))
+
+        # Check indicators if available
+        if not self.indicators:
+            return
+
+        for mount in self.results:
+            # Check if any mount points match indicators
+            ioc = self.indicators.check_file_path(mount.get("mount_point", ""))
+            if ioc:
+                self.alertstore.critical(
+                    ioc.message,
+                    "",
+                    mount,
+                    matched_indicator=ioc.ioc,
+                )
+
+            # Check device paths for indicators
+            ioc = self.indicators.check_file_path(mount.get("device", ""))
+            if ioc:
+                self.alertstore.critical(
+                    ioc.message,
+                    "",
+                    mount,
+                    matched_indicator=ioc.ioc,
+                )