mirror of
https://github.com/mvt-project/mvt.git
synced 2026-09-03 08:30:51 +02:00
114 lines
4.2 KiB
Python
114 lines
4.2 KiB
Python
# Mobile Verification Toolkit (MVT)
|
|
# Copyright (c) 2021-2023 The MVT Authors.
|
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
|
# https://license.mvt.re/1.1/
|
|
|
|
import os
|
|
import shutil
|
|
from pathlib import Path
|
|
|
|
from mvt.android.modules.bugreport.dumpsys_appops import DumpsysAppops
|
|
from mvt.android.modules.bugreport.dumpsys_getprop import DumpsysGetProp
|
|
from mvt.android.modules.bugreport.dumpsys_packages import DumpsysPackages
|
|
from mvt.android.modules.bugreport.dumpsys_receivers import DumpsysReceivers
|
|
from mvt.android.modules.bugreport.tombstones import Tombstones
|
|
from mvt.common.module import run_module
|
|
|
|
from ..utils import get_artifact_folder
|
|
|
|
|
|
class TestBugreportAnalysis:
|
|
def launch_bug_report_module(self, module):
|
|
fpath = os.path.join(get_artifact_folder(), "android_data/bugreport/")
|
|
m = module(target_path=fpath)
|
|
folder_files = []
|
|
parent_path = Path(fpath).absolute().as_posix()
|
|
for root, subdirs, subfiles in os.walk(os.path.abspath(fpath)):
|
|
for file_name in subfiles:
|
|
folder_files.append(
|
|
os.path.relpath(os.path.join(root, file_name), parent_path)
|
|
)
|
|
m.from_dir(fpath, folder_files)
|
|
run_module(m)
|
|
return m
|
|
|
|
def test_appops_module(self):
|
|
m = self.launch_bug_report_module(DumpsysAppops)
|
|
assert len(m.results) == 12
|
|
assert len(m.timeline) == 16
|
|
|
|
detected_by_ioc = [
|
|
detected
|
|
for detected in m.alertstore.alerts
|
|
if detected.event.get("matched_indicator")
|
|
]
|
|
assert (
|
|
len(m.alertstore.alerts) == 1
|
|
) # Hueristic detection for suspicious permissions
|
|
assert len(detected_by_ioc) == 0
|
|
|
|
def test_packages_module(self):
|
|
m = self.launch_bug_report_module(DumpsysPackages)
|
|
assert len(m.results) == 2
|
|
assert (
|
|
m.results[0]["package_name"]
|
|
== "com.samsung.android.provider.filterprovider"
|
|
)
|
|
assert m.results[1]["package_name"] == "com.instagram.android"
|
|
assert len(m.results[0]["permissions"]) == 4
|
|
assert len(m.results[1]["permissions"]) == 32
|
|
|
|
def test_getprop_module(self):
|
|
m = self.launch_bug_report_module(DumpsysGetProp)
|
|
assert len(m.results) == 0
|
|
|
|
def test_receivers_match_exact_package_name(self, indicators_factory):
|
|
intent = "android.intent.action.PHONE_STATE"
|
|
false_positive = {
|
|
"package_name": "com.android.phone",
|
|
"receiver": (
|
|
"com.android.phone/"
|
|
"com.android.services.telephony.sip.SipIncomingCallReceiver"
|
|
),
|
|
}
|
|
malicious_receiver = {
|
|
"package_name": "com.android.services",
|
|
"receiver": "com.android.services/com.example.SomeReceiver",
|
|
}
|
|
module = DumpsysReceivers(
|
|
results={intent: [false_positive, malicious_receiver]}
|
|
)
|
|
module.indicators = indicators_factory(app_ids=["com.android.services"])
|
|
|
|
module.check_indicators()
|
|
|
|
assert len(module.alertstore.alerts) == 1
|
|
alert = module.alertstore.alerts[0]
|
|
assert alert.event == {intent: malicious_receiver}
|
|
assert alert.matched_indicator.value == "com.android.services"
|
|
|
|
def test_tombstones_modules(self):
|
|
m = self.launch_bug_report_module(Tombstones)
|
|
assert len(m.results) == 2
|
|
assert m.results[1]["pid"] == 3559
|
|
|
|
def test_tombstones_prefers_protobuf_for_paired_files(self, tmp_path):
|
|
tombstone_dir = tmp_path / "FS" / "data" / "tombstones"
|
|
tombstone_dir.mkdir(parents=True)
|
|
artifacts = Path(get_artifact_folder()) / "android_data"
|
|
shutil.copy(artifacts / "tombstone_process.txt", tombstone_dir / "tombstone_00")
|
|
shutil.copy(
|
|
artifacts / "tombstone_process.pb", tombstone_dir / "tombstone_00.pb"
|
|
)
|
|
|
|
module = Tombstones(target_path=str(tmp_path))
|
|
files = [
|
|
str(path.relative_to(tmp_path))
|
|
for path in tombstone_dir.iterdir()
|
|
if path.is_file()
|
|
]
|
|
module.from_dir(str(tmp_path), files)
|
|
run_module(module)
|
|
|
|
assert len(module.results) == 1
|