WIP for Triangulation post-processing module

.github/workflows/add-issue-to-project.yml

@@ -1,19 +0,0 @@
-name: Add issue to project
-
-on:
-  issues:
-    types:
-      - opened
-      - reopened
-
-jobs:
-  add-to-project:
-    name: Add issue to project
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/add-to-project@v0.5.0
-        with:
-          # You can target a project in a different organization
-          # to the issue
-          project-url: https://github.com/orgs/mvt-project/projects/1
-          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/black.yml

@@ -1,11 +0,0 @@
-name: Black
-on: [push]
-
-jobs:
-  black:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: psf/black@stable
-        with:
-          options: "--check"

.github/workflows/python-package.yml

@@ -16,19 +16,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.8', '3.9', '3.10']  # , '3.11']
+        python-version: ['3.8', '3.9', '3.10']
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v2
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v2
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
         python -m pip install --upgrade setuptools
         python -m pip install --upgrade pip
-        python -m pip install flake8 pytest safety stix2 pytest-mock pytest-cov
+        python -m pip install flake8 pytest safety stix2 pytest-mock
         if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
         python -m pip install .
     - name: Lint with flake8
@@ -39,12 +39,5 @@ jobs:
         flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
     - name: Safety checks
       run: safety check
-    - name: Test with pytest and coverage
-      run: pytest --junitxml=pytest.xml --cov-report=term-missing:skip-covered --cov=mvt tests/ | tee pytest-coverage.txt
-    - name: Pytest coverage comment
-      continue-on-error: true # Workflows running on a fork can't post comments
-      uses: MishaKav/pytest-coverage-comment@main
-      if: github.event_name == 'pull_request'
-      with:
-        pytest-coverage-path: ./pytest-coverage.txt
-        junitxml-path: ./pytest.xml
+    - name: Test with pytest
+      run: pytest

.github/workflows/ruff.yml

@@ -1,19 +1,21 @@
 name: Ruff
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+on: [push]
+
 jobs:
   ruff_py3:
     name: Ruff syntax check
     runs-on: ubuntu-latest
     steps:
+      - name: Setup Python
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.9
+          architecture: x64
       - name: Checkout
         uses: actions/checkout@master
       - name: Install Dependencies
         run: |
-          pip install --user ruff
+          pip install ruff
       - name: ruff
         run: |
-          ruff check --output-format github .
+          ruff check .

.github/workflows/scripts/update-ios-releases.py

@@ -2,8 +2,8 @@
 Python script to download the Apple RSS feed and parse it.
 """
 
-import json
 import os
+import json
 import urllib.request
 from xml.dom.minidom import parseString
 
@@ -12,7 +12,7 @@ from packaging import version
 
 def download_apple_rss(feed_url):
     with urllib.request.urlopen(feed_url) as f:
-        rss_feed = f.read().decode("utf-8")
+        rss_feed = f.read().decode('utf-8')
     print("Downloaded RSS feed from Apple.")
     return rss_feed
 
@@ -27,28 +27,18 @@ def parse_latest_ios_versions(rss_feed_text):
             continue
 
         import re
-
-        build_match = re.match(
-            r"iOS (?P<version>[\d\.]+) (?P<beta>beta )?(\S*)?\((?P<build>.*)\)", title
-        )
+        build_match = re.match(r"iOS (?P<version>[\d\.]+) (?P<beta>beta )?(\S*)?\((?P<build>.*)\)", title)
         if not build_match:
             print("Could not parse iOS build:", title)
             continue
 
-        # Handle iOS beta releases
         release_info = build_match.groupdict()
-        release_beta = release_info.pop("beta")
-        if release_beta:
+        if release_info["beta"]:
             print("Skipping beta release:", title)
             continue
 
-        # Some iOS releases have multiple build number for different hardware models.
-        # We will split these into separate entries and record each build number.
-        build_list = release_info.pop("build")
-        build_variants = build_list.split(" | ")
-        for build_number in build_variants:
-            release_info["build"] = build_number
-            latest_ios_versions.append(release_info)
+        release_info.pop("beta")
+        latest_ios_versions.append(release_info)
 
     return latest_ios_versions
 
@@ -72,22 +62,16 @@ def update_mvt(mvt_checkout_path, latest_ios_versions):
         print("No new iOS versions found.")
     else:
         print("Found {} new iOS versions.".format(new_entry_count))
-        new_version_list = sorted(
-            current_versions, key=lambda x: version.Version(x["version"])
-        )
+        new_version_list = sorted(current_versions, key=lambda x: version.Version(x["version"]))
         with open(version_path, "w") as version_file:
             json.dump(new_version_list, version_file, indent=4)
 
 
 def main():
     print("Downloading RSS feed...")
-    mvt_checkout_path = os.path.abspath(
-        os.path.join(os.path.dirname(__file__), "../../../")
-    )
+    mvt_checkout_path = os.path.abspath(os.path.join(os.path.dirname(__file__), "../../../"))
 
-    rss_feed = download_apple_rss(
-        "https://developer.apple.com/news/releases/rss/releases.rss"
-    )
+    rss_feed = download_apple_rss("https://developer.apple.com/news/releases/rss/releases.rss")
     latest_ios_version = parse_latest_ios_versions(rss_feed)
     update_mvt(mvt_checkout_path, latest_ios_version)
 

.gitignore

@@ -50,8 +50,6 @@ coverage.xml
 *.py,cover
 .hypothesis/
 .pytest_cache/
-pytest-coverage.txt
-pytest.xml
 
 # Translations
 *.mo

.readthedocs.yaml

@@ -5,15 +5,11 @@
 # Required
 version: 2
 
-build:
-  os: "ubuntu-22.04"
-  tools:
-    python: "3.11"
-
 mkdocs:
   configuration: mkdocs.yml
 
 # Optionally set the version of Python and requirements required to build your docs
 python:
+   version: 3.7
    install:
    - requirements: docs/requirements.txt

Dockerfile

@@ -57,12 +57,12 @@ RUN git clone https://github.com/libimobiledevice/libplist \
 
 # Installing MVT
 # --------------
-RUN pip3 install git+https://github.com/mvt-project/mvt.git@main
+RUN pip3 install mvt
 
 # Installing ABE
 # --------------
 RUN mkdir /opt/abe \
-  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar -O /opt/abe/abe.jar \
+  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/20210709062403-4c55371/abe.jar -O /opt/abe/abe.jar \
 # Create alias for abe
   && echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 

Makefile

@@ -2,10 +2,8 @@ PWD = $(shell pwd)
 
 check:
 	flake8
-	ruff check -q .
-	black --check .
 	pytest -q
-
+	ruff check -q .
 
 clean:
 	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/mvt.egg-info

README.md

@@ -11,28 +11,14 @@
 
 Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
 
-It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
+It has been developed and released by the [Amnesty International Security Lab](https://www.amnesty.org/en/tech/) in July 2021 in the context of the [Pegasus project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology and forensic evidence](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/).
 
-> **Note**
-> MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.
->
+*Warning*: MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
 
-### Indicators of Compromise
-
-MVT supports using public [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other  research groups.
-
-> **Warning**
-> Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
->
-> Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
->
->Such support is available to civil society through [Amnesty International's Security Lab](https://www.amnesty.org/en/tech/) or through our forensic partnership with [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
-
-More information about using indicators of compromise with MVT is available in the [documentation](https://docs.mvt.re/en/latest/iocs/).
 
 ## Installation
 
-MVT can be installed from sources or from [PyPI](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
+MVT can be installed from sources or from [PyPi](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
 
 ```
 pip3 install mvt

docs/android/backup.md

@@ -35,11 +35,7 @@ $ mvt-android check-backup --output /path/to/results/ /path/to/backup.ab
          INFO     [mvt.android.modules.backup.sms] Extracted a total of 64 SMS messages
 ```
 
-If the backup is encrypted, MVT will prompt you to enter the password. A backup password can also be provided with the `--backup-password` command line option or through the `MVT_ANDROID_BACKUP_PASSWORD` environment variable. The same options can also be used to when analysing an encrypted backup collected through AndroidQF in the `mvt-android check-androidqf` command:
-
-```bash
-$ mvt-android check-backup --backup-password "password123" --output /path/to/results/ /path/to/backup.ab
-```
+If the backup is encrypted, MVT will prompt you to enter the password.
 
 Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.
 

docs/development.md

@@ -1,27 +0,0 @@
-# Development
-
-The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
-
-## Testing
-
-MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `flake8`, `ruff` and `black`. All can
-be run automatically with:
-
-```bash
-make check
-```
-
-Run these tests before making new commits or opening pull requests.
-
-## Profiling
-
-Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
-take to avoid inefficient code paths as we add new modules.
-
-MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
-
-```bash
-MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
-```
-
-Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/index.md

@@ -6,9 +6,6 @@
 
 Mobile Verification Toolkit (MVT) is a tool to facilitate the [consensual forensic analysis](introduction.md#consensual-forensics) of Android and iOS devices, for the purpose of identifying traces of compromise.
 
-It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
-
-
 In this documentation you will find instructions on how to install and run the `mvt-ios` and `mvt-android` commands, and guidance on how to interpret the extracted results.
 
 ## Resources

docs/install.md

@@ -42,13 +42,13 @@ It is recommended to try installing and running MVT from [Windows Subsystem Linu
 
 ## Installing MVT
 
-If you haven't done so, you can add this to your `.bashrc` or `.zshrc` file in order to add locally installed PyPI binaries to your `$PATH`:
+If you haven't done so, you can add this to your `.bashrc` or `.zshrc` file in order to add locally installed Pypi binaries to your `$PATH`:
 
 ```bash
 export PATH=$PATH:~/.local/bin
 ```
 
-Then you can install MVT directly from [PyPI](https://pypi.org/project/mvt/)
+Then you can install MVT directly from [pypi](https://pypi.org/project/mvt/)
 
 ```bash
 pip3 install mvt

docs/introduction.md

@@ -12,20 +12,6 @@ Mobile Verification Toolkit (MVT) is a collection of utilities designed to facil
 
 MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. MVT is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
 
-## Indicators of Compromise
-
-MVT supports using [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other research groups.
-
-!!! warning
-    Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
-
-    Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
-
-    Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/contact-us/) or [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
-
-More information about using indicators of compromise with MVT is available in the [documentation](iocs.md).
-
-
 ## Consensual Forensics
 
 While MVT is capable of extracting and processing various types of very personal records typically found on a mobile phone (such as calls history, SMS and WhatsApp messages, etc.), this is intended to help identify potential attack vectors such as malicious SMS messages leading to exploitation.

docs/iocs.md

@@ -43,6 +43,6 @@ export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 - [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/generated/stalkerware.stix2).
 - We are also maintaining [a list of IOCs](https://github.com/mvt-project/mvt-indicators) in STIX format from public spyware campaigns.
 
-You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
+You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators listed [here](https://github.com/mvt-project/mvt/blob/main/public_indicators.json) and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.

docs/ios/backup/itunes.md

@@ -10,7 +10,7 @@ To do that:
 4. If you want to have a more accurate detection, ensure that the encrypted backup option is activated and choose a secure password for the backup.
 5. Start the backup and wait for it to finish (this may take up to 30 minutes).
 
-![](../../img/macos-backup.jpg)
+![](../../../img/macos-backup.jpg)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 Once the backup is done, find its location and copy it to a place where it can be analyzed by MVT. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On macOS, the backup is stored in `~/Library/Application Support/MobileSync/`.
@@ -25,13 +25,13 @@ On more recent MacOS versions, this feature is included in Finder. To do a backu
 4. In the General tab, select `Back up all the data on your iPhone to this Mac` from the options under the Backups section.
 5. Check the box that says `Encrypt local backup`. If it is your first time selecting this option, you may need to enter a password to encrypt the backup.
 
-![](../../img/macos-backup2.png)
+![](../../../img/macos-backup2.png)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 6. Click `Back Up Now` to start the back-up process.
 7. The encrypted backup for your iPhone should now start. Once the process finishes, you can check the backup by opening `Finder`, clicking on the `General` tab, then click on `Manage Backups`. Now you should see a list of your backups like the image below:
 
-![](../../img/macos-backups.png)
+![](../../../img/macos-backups.png)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 If your backup has a lock next to it like in the image above, then the backup is encrypted. You should also see the date and time when the encrypted backup was created. The backup files are stored in `~/Library/Application Support/MobileSync/`.

docs/ios/records.md

@@ -142,16 +142,6 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
-### `global_preferences.json`
-
-!!! info "Availability"
-    Backup: :material-check:
-    Full filesystem dump: :material-check:
-
-This JSON file is created by mvt-ios' `GlobalPreferences` module. The module extracts records from a Plist file located at */private/var/mobile/Library/Preferences/.GlobalPreferences.plist*, which contains a system preferences including if Lockdown Mode is enabled.
-
----
-
 ### `id_status_cache.json`
 
 !!! info "Availability"

mkdocs.yml

@@ -1,7 +1,7 @@
 site_name: Mobile Verification Toolkit
 repo_url: https://github.com/mvt-project/mvt
 edit_uri: edit/main/docs/
-copyright: Copyright © 2021-2023 MVT Project Developers
+copyright: Copyright © 2021-2022 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
 markdown_extensions:
     - attr_list
@@ -46,5 +46,4 @@ nav:
         - Check an Android Backup (SMS messages): "android/backup.md"
         - Download APKs: "android/download_apks.md"
     - Indicators of Compromise: "iocs.md"
-    - Development: "development.md"
     - License: "license.md"

mvt/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
+# Copyright (c) 2021-2023 Claudio Guarnieri.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
+# Copyright (c) 2021-2023 Claudio Guarnieri.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/artifacts/__init__.py

@@ -1,4 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/

mvt/android/artifacts/artifact.py

@@ -1,36 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from mvt.common.artifact import Artifact
-
-
-class AndroidArtifact(Artifact):
-    @staticmethod
-    def extract_dumpsys_section(dumpsys: str, separator: str) -> str:
-        """
-        Extract a section from a full dumpsys file.
-
-        :param dumpsys: content of the full dumpsys file (string)
-        :param separator: content of the first line separator (string)
-        :return: section extracted (string)
-        """
-        lines = []
-        in_section = False
-        for line in dumpsys.splitlines():
-            if line.strip() == separator:
-                in_section = True
-                continue
-
-            if not in_section:
-                continue
-
-            if line.strip().startswith(
-                "------------------------------------------------------------------------------"
-            ):
-                break
-
-            lines.append(line)
-
-        return "\n".join(lines)

mvt/android/artifacts/dumpsys_accessibility.py

@@ -1,47 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysAccessibilityArtifact(AndroidArtifact):
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, content: str) -> None:
-        """
-        Parse the Dumpsys Accessibility section/
-        Adds results to self.results (List[Dict[str, str]])
-
-        :param content: content of the accessibility section (string)
-        """
-        in_services = False
-        for line in content.splitlines():
-            if line.strip().startswith("installed services:"):
-                in_services = True
-                continue
-
-            if not in_services:
-                continue
-
-            if line.strip() == "}":
-                break
-
-            service = line.split(":")[1].strip()
-
-            self.results.append(
-                {
-                    "package_name": service.split("/")[0],
-                    "service": service,
-                }
-            )

mvt/android/artifacts/dumpsys_appops.py

@@ -1,150 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from datetime import datetime
-from typing import Any, Dict, List, Union
-
-from mvt.common.utils import convert_datetime_to_iso
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysAppopsArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys app ops info
-    """
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-        for perm in record["permissions"]:
-            if "entries" not in perm:
-                continue
-
-            for entry in perm["entries"]:
-                if "timestamp" in entry:
-                    records.append(
-                        {
-                            "timestamp": entry["timestamp"],
-                            "module": self.__class__.__name__,
-                            "event": entry["access"],
-                            "data": f"{record['package_name']} access to "
-                            f"{perm['name']}: {entry['access']}",
-                        }
-                    )
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            for perm in result["permissions"]:
-                if (
-                    perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                    and perm["access"] == "allow"
-                ):
-                    self.log.info(
-                        "Package %s with REQUEST_INSTALL_PACKAGES " "permission",
-                        result["package_name"],
-                    )
-
-    def parse(self, output: str) -> None:
-        self.results: List[Dict[str, Any]] = []
-        perm = {}
-        package = {}
-        entry = {}
-        uid = None
-        in_packages = False
-
-        for line in output.splitlines():
-            if line.startswith("  Uid 0:"):
-                in_packages = True
-
-            if not in_packages:
-                continue
-
-            if line.startswith("  Uid "):
-                uid = line[6:-1]
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-                if package:
-                    if perm:
-                        package["permissions"].append(perm)
-
-                    perm = {}
-                    self.results.append(package)
-                package = {}
-                continue
-
-            if line.startswith("    Package "):
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-
-                if package:
-                    if perm:
-                        package["permissions"].append(perm)
-
-                    perm = {}
-                    self.results.append(package)
-
-                package = {
-                    "package_name": line[12:-1],
-                    "permissions": [],
-                    "uid": uid,
-                }
-                continue
-
-            if package and line.startswith("      ") and line[6] != " ":
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-                if perm:
-                    package["permissions"].append(perm)
-                    perm = {}
-
-                perm["name"] = line.split()[0]
-                perm["entries"] = []
-                if len(line.split()) > 1:
-                    perm["access"] = line.split()[1][1:-2]
-
-                continue
-
-            if line.startswith("          "):
-                # Permission entry like:
-                # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-
-                entry["access"] = line.split(":")[0].strip()
-                entry["type"] = line[line.find("[") + 1 : line.find("]")]
-
-                try:
-                    entry["timestamp"] = convert_datetime_to_iso(
-                        datetime.strptime(
-                            line[line.find("]") + 1 : line.find("(")].strip(),
-                            "%Y-%m-%d %H:%M:%S.%f",
-                        )
-                    )
-                except ValueError:
-                    # Invalid date format
-                    pass
-
-            if line.strip() == "":
-                break
-
-        if entry:
-            perm["entries"].append(entry)
-        if perm:
-            package["permissions"].append(perm)
-        if package:
-            self.results.append(package)

mvt/android/artifacts/dumpsys_battery_daily.py

@@ -1,78 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from typing import Union
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysBatteryDailyArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys dattery daily updates.
-    """
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["from"],
-            "module": self.__class__.__name__,
-            "event": "battery_daily",
-            "data": f"Recorded update of package {record['package_name']} "
-            f"with vers {record['vers']}",
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, output: str) -> None:
-        daily = None
-        daily_updates = []
-        for line in output.splitlines():
-            if line.startswith("  Daily from "):
-                if len(daily_updates) > 0:
-                    self.results.extend(daily_updates)
-                    daily_updates = []
-
-                timeframe = line[13:].strip()
-                date_from, date_to = timeframe.strip(":").split(" to ", 1)
-                daily = {"from": date_from[0:10], "to": date_to[0:10]}
-                continue
-
-            if not daily:
-                continue
-
-            if not line.strip().startswith("Update "):
-                continue
-
-            line = line.strip().replace("Update ", "")
-            package_name, vers = line.split(" ", 1)
-            vers_nr = vers.split("=", 1)[1]
-
-            already_seen = False
-            for update in daily_updates:
-                if package_name == update["package_name"] and vers_nr == update["vers"]:
-                    already_seen = True
-                    break
-
-            if not already_seen:
-                daily_updates.append(
-                    {
-                        "action": "update",
-                        "from": daily["from"],
-                        "to": daily["to"],
-                        "package_name": package_name,
-                        "vers": vers_nr,
-                    }
-                )
-
-        if len(daily_updates) > 0:
-            self.results.extend(daily_updates)

mvt/android/artifacts/dumpsys_battery_history.py

@@ -1,78 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysBatteryHistoryArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys dattery history events.
-    """
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, data: str) -> None:
-        for line in data.splitlines():
-            if line.startswith("Battery History "):
-                continue
-
-            if line.strip() == "":
-                break
-
-            time_elapsed = line.strip().split(" ", 1)[0]
-
-            event = ""
-            if line.find("+job") > 0:
-                event = "start_job"
-                uid = line[line.find("+job") + 5 : line.find(":")]
-                service = line[line.find(":") + 1 :].strip('"')
-                package_name = service.split("/")[0]
-            elif line.find("-job") > 0:
-                event = "end_job"
-                uid = line[line.find("-job") + 5 : line.find(":")]
-                service = line[line.find(":") + 1 :].strip('"')
-                package_name = service.split("/")[0]
-            elif line.find("+running +wake_lock=") > 0:
-                uid = line[line.find("+running +wake_lock=") + 21 : line.find(":")]
-                event = "wake"
-                service = (
-                    line[line.find("*walarm*:") + 9 :].split(" ")[0].strip('"').strip()
-                )
-                if service == "" or "/" not in service:
-                    continue
-
-                package_name = service.split("/")[0]
-            elif (line.find("+top=") > 0) or (line.find("-top") > 0):
-                if line.find("+top=") > 0:
-                    event = "start_top"
-                    top_pos = line.find("+top=")
-                else:
-                    event = "end_top"
-                    top_pos = line.find("-top=")
-                colon_pos = top_pos + line[top_pos:].find(":")
-                uid = line[top_pos + 5 : colon_pos]
-                service = ""
-                package_name = line[colon_pos + 1 :].strip('"')
-            else:
-                continue
-
-            self.results.append(
-                {
-                    "time_elapsed": time_elapsed,
-                    "event": event,
-                    "uid": uid,
-                    "package_name": package_name,
-                    "service": service,
-                }
-            )

mvt/android/artifacts/dumpsys_dbinfo.py

@@ -1,83 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysDBInfoArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys DBInfo service
-    """
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            path = result.get("path", "")
-            for part in path.split("/"):
-                ioc = self.indicators.check_app_id(part)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-    def parse(self, output: str) -> None:
-        rxp = re.compile(
-            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\""
-        )  # pylint: disable=line-too-long
-        rxp_no_pid = re.compile(
-            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\""
-        )  # pylint: disable=line-too-long
-
-        pool = None
-        in_operations = False
-        for line in output.splitlines():
-            if line.startswith("Connection pool for "):
-                pool = line.replace("Connection pool for ", "").rstrip(":")
-
-            if not pool:
-                continue
-
-            if line.strip() == "Most recently executed operations:":
-                in_operations = True
-                continue
-
-            if not in_operations:
-                continue
-
-            if not line.startswith("        "):
-                in_operations = False
-                pool = None
-                continue
-
-            matches = rxp.findall(line)
-            if not matches:
-                matches = rxp_no_pid.findall(line)
-                if not matches:
-                    continue
-
-                match = matches[0]
-                self.results.append(
-                    {
-                        "isodate": match[0],
-                        "action": match[1],
-                        "sql": match[2],
-                        "path": pool,
-                    }
-                )
-            else:
-                match = matches[0]
-                self.results.append(
-                    {
-                        "isodate": match[0],
-                        "pid": match[1],
-                        "action": match[2],
-                        "sql": match[3],
-                        "path": pool,
-                    }
-                )

mvt/android/artifacts/dumpsys_package_activities.py

@@ -1,84 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysPackageActivitiesArtifact(AndroidArtifact):
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for activity in self.results:
-            ioc = self.indicators.check_app_id(activity["package_name"])
-            if ioc:
-                activity["matched_indicator"] = ioc
-                self.detected.append(activity)
-                continue
-
-    def parse(self, content: str):
-        """
-        Parse the Dumpsys Package section for activities
-        Adds results to self.results
-
-        :param content: content of the package section (string)
-        """
-        self.results = []
-
-        in_activity_resolver_table = False
-        in_non_data_actions = False
-        intent = None
-        for line in content.splitlines():
-            if line.startswith("Activity Resolver Table:"):
-                in_activity_resolver_table = True
-                continue
-
-            if not in_activity_resolver_table:
-                continue
-
-            if line.startswith("  Non-Data Actions:"):
-                in_non_data_actions = True
-                continue
-
-            if not in_non_data_actions:
-                continue
-
-            # If we hit an empty line, the Non-Data Actions section should be
-            # finished.
-            if line.strip() == "":
-                break
-
-            # We detect the action name.
-            if (
-                line.startswith(" " * 6)
-                and not line.startswith(" " * 8)
-                and ":" in line
-            ):
-                intent = line.strip().replace(":", "")
-                continue
-
-            # If we are not in an intent block yet, skip.
-            if not intent:
-                continue
-
-            # If we are in a block but the line does not start with 8 spaces
-            # it means the block ended a new one started, so we reset and
-            # continue.
-            if not line.startswith(" " * 8):
-                intent = None
-                continue
-
-            # If we got this far, we are processing receivers for the
-            # activities we are interested in.
-            activity = line.strip().split(" ")[1]
-            package_name = activity.split("/")[0]
-
-            self.results.append(
-                {
-                    "intent": intent,
-                    "package_name": package_name,
-                    "activity": activity,
-                }
-            )

mvt/android/artifacts/dumpsys_receivers.py

@@ -1,116 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-INTENT_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
-INTENT_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
-INTENT_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
-INTENT_PHONE_STATE = "android.intent.action.PHONE_STATE"
-INTENT_NEW_OUTGOING_CALL = "android.intent.action.NEW_OUTGOING_CALL"
-
-
-class DumpsysReceiversArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys receivers in the package section
-    """
-
-    def check_indicators(self) -> None:
-        for intent, receivers in self.results.items():
-            for receiver in receivers:
-                if intent == INTENT_NEW_OUTGOING_SMS:
-                    self.log.info(
-                        'Found a receiver to intercept outgoing SMS messages: "%s"',
-                        receiver["receiver"],
-                    )
-                elif intent == INTENT_SMS_RECEIVED:
-                    self.log.info(
-                        'Found a receiver to intercept incoming SMS messages: "%s"',
-                        receiver["receiver"],
-                    )
-                elif intent == INTENT_DATA_SMS_RECEIVED:
-                    self.log.info(
-                        'Found a receiver to intercept incoming data SMS message: "%s"',
-                        receiver["receiver"],
-                    )
-                elif intent == INTENT_PHONE_STATE:
-                    self.log.info(
-                        "Found a receiver monitoring "
-                        'telephony state/incoming calls: "%s"',
-                        receiver["receiver"],
-                    )
-                elif intent == INTENT_NEW_OUTGOING_CALL:
-                    self.log.info(
-                        'Found a receiver monitoring outgoing calls: "%s"',
-                        receiver["receiver"],
-                    )
-
-                if not self.indicators:
-                    continue
-
-                ioc = self.indicators.check_app_id(receiver["package_name"])
-                if ioc:
-                    receiver["matched_indicator"] = ioc
-                    self.detected.append({intent: receiver})
-                    continue
-
-    def parse(self, output: str) -> None:
-        self.results = {}
-
-        in_receiver_resolver_table = False
-        in_non_data_actions = False
-        intent = None
-        for line in output.splitlines():
-            if line.startswith("Receiver Resolver Table:"):
-                in_receiver_resolver_table = True
-                continue
-
-            if not in_receiver_resolver_table:
-                continue
-
-            if line.startswith("  Non-Data Actions:"):
-                in_non_data_actions = True
-                continue
-
-            if not in_non_data_actions:
-                continue
-
-            # If we hit an empty line, the Non-Data Actions section should be
-            # finished.
-            if line.strip() == "":
-                break
-
-            # We detect the action name.
-            if (
-                line.startswith(" " * 6)
-                and not line.startswith(" " * 8)
-                and ":" in line
-            ):
-                intent = line.strip().replace(":", "")
-                self.results[intent] = []
-                continue
-
-            # If we are not in an intent block yet, skip.
-            if not intent:
-                continue
-
-            # If we are in a block but the line does not start with 8 spaces
-            # it means the block ended a new one started, so we reset and
-            # continue.
-            if not line.startswith(" " * 8):
-                intent = None
-                continue
-
-            # If we got this far, we are processing receivers for the
-            # activities we are interested in.
-            receiver = line.strip().split(" ")[1]
-            package_name = receiver.split("/")[0]
-
-            self.results[intent].append(
-                {
-                    "package_name": package_name,
-                    "receiver": receiver,
-                }
-            )

mvt/android/artifacts/getprop.py

@@ -1,60 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-from typing import Dict, List
-
-from mvt.android.utils import warn_android_patch_level
-
-from .artifact import AndroidArtifact
-
-INTERESTING_PROPERTIES = [
-    "gsm.sim.operator.alpha",
-    "gsm.sim.operator.iso-country",
-    "persist.sys.timezone",
-    "ro.boot.serialno",
-    "ro.build.version.sdk",
-    "ro.build.version.security_patch",
-    "ro.product.cpu.abi",
-    "ro.product.locale",
-    "ro.product.vendor.manufacturer",
-    "ro.product.vendor.model",
-    "ro.product.vendor.name",
-]
-
-
-class GetProp(AndroidArtifact):
-    def parse(self, entry: str) -> None:
-        self.results: List[Dict[str, str]] = []
-        rxp = re.compile(r"\[(.+?)\]: \[(.+?)\]")
-
-        for line in entry.splitlines():
-            line = line.strip()
-            if line == "":
-                continue
-
-            matches = re.findall(rxp, line)
-            if not matches or len(matches[0]) != 2:
-                continue
-
-            entry = {"name": matches[0][0], "value": matches[0][1]}
-            self.results.append(entry)
-
-    def check_indicators(self) -> None:
-        for entry in self.results:
-            if entry["name"] in INTERESTING_PROPERTIES:
-                self.log.info("%s: %s", entry["name"], entry["value"])
-
-            if entry["name"] == "ro.build.version.security_patch":
-                warn_android_patch_level(entry["value"], self.log)
-
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_android_property_name(result.get("name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)

mvt/android/artifacts/processes.py

@@ -1,70 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class Processes(AndroidArtifact):
-    def parse(self, entry: str) -> None:
-        for line in entry.split("\n")[1:]:
-            proc = line.split()
-
-            # Skip empty lines
-            if len(proc) == 0:
-                continue
-
-            # Sometimes WCHAN is empty.
-            if len(proc) == 8:
-                proc = proc[:5] + [""] + proc[5:]
-
-            # Sometimes there is the security label.
-            if proc[0].startswith("u:r"):
-                label = proc[0]
-                proc = proc[1:]
-            else:
-                label = ""
-
-            # Sometimes there is no WCHAN.
-            if len(proc) < 9:
-                proc = proc[:5] + [""] + proc[5:]
-
-            self.results.append(
-                {
-                    "user": proc[0],
-                    "pid": int(proc[1]),
-                    "ppid": int(proc[2]),
-                    "virtual_memory_size": int(proc[3]),
-                    "resident_set_size": int(proc[4]),
-                    "wchan": proc[5],
-                    "aprocress": proc[6],
-                    "stat": proc[7],
-                    "proc_name": proc[8].strip("[]"),
-                    "label": label,
-                }
-            )
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            proc_name = result.get("proc_name", "")
-            if not proc_name:
-                continue
-
-            # Skipping this process because of false positives.
-            if result["proc_name"] == "gatekeeperd":
-                continue
-
-            ioc = self.indicators.check_app_id(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-            ioc = self.indicators.check_process(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)