WIP for Triangulation post-processing module

.github/workflows/add-issue-to-project.yml

@@ -1,19 +0,0 @@
-name: Add issue to project
-
-on:
-  issues:
-    types:
-      - opened
-      - reopened
-
-jobs:
-  add-to-project:
-    name: Add issue to project
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/add-to-project@v0.5.0
-        with:
-          # You can target a project in a different organization
-          # to the issue
-          project-url: https://github.com/orgs/mvt-project/projects/1
-          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/black.yml

@@ -1,11 +0,0 @@
-name: Black
-on: [push]
-
-jobs:
-  black:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: psf/black@stable
-        with:
-          options: "--check"

.github/workflows/python-package.yml

@@ -16,19 +16,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.8', '3.9', '3.10']  # , '3.11']
+        python-version: ['3.8', '3.9', '3.10']
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v2
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v2
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
         python -m pip install --upgrade setuptools
         python -m pip install --upgrade pip
-        python -m pip install flake8 pytest safety stix2 pytest-mock pytest-cov
+        python -m pip install flake8 pytest safety stix2 pytest-mock
         if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
         python -m pip install .
     - name: Lint with flake8
@@ -39,14 +39,5 @@ jobs:
         flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
     - name: Safety checks
       run: safety check
-    - name: Test with pytest and coverage
-      run: |
-        set -o pipefail
-        pytest --junitxml=pytest.xml --cov-report=term-missing:skip-covered --cov=mvt tests/ | tee pytest-coverage.txt
-    - name: Pytest coverage comment
-      continue-on-error: true # Workflows running on a fork can't post comments
-      uses: MishaKav/pytest-coverage-comment@main
-      if: github.event_name == 'pull_request'
-      with:
-        pytest-coverage-path: ./pytest-coverage.txt
-        junitxml-path: ./pytest.xml
+    - name: Test with pytest
+      run: pytest

.github/workflows/ruff.yml

@@ -1,19 +1,21 @@
 name: Ruff
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+on: [push]
+
 jobs:
   ruff_py3:
     name: Ruff syntax check
     runs-on: ubuntu-latest
     steps:
+      - name: Setup Python
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.9
+          architecture: x64
       - name: Checkout
         uses: actions/checkout@master
       - name: Install Dependencies
         run: |
-          pip install --user ruff
+          pip install ruff
       - name: ruff
         run: |
-          ruff check --output-format github .
+          ruff check .

.github/workflows/scripts/update-ios-releases.py

@@ -2,8 +2,8 @@
 Python script to download the Apple RSS feed and parse it.
 """
 
-import json
 import os
+import json
 import urllib.request
 from xml.dom.minidom import parseString
 
@@ -12,7 +12,7 @@ from packaging import version
 
 def download_apple_rss(feed_url):
     with urllib.request.urlopen(feed_url) as f:
-        rss_feed = f.read().decode("utf-8")
+        rss_feed = f.read().decode('utf-8')
     print("Downloaded RSS feed from Apple.")
     return rss_feed
 
@@ -27,28 +27,18 @@ def parse_latest_ios_versions(rss_feed_text):
             continue
 
         import re
-
-        build_match = re.match(
-            r"iOS (?P<version>[\d\.]+) (?P<beta>beta )?(\S*)?\((?P<build>.*)\)", title
-        )
+        build_match = re.match(r"iOS (?P<version>[\d\.]+) (?P<beta>beta )?(\S*)?\((?P<build>.*)\)", title)
         if not build_match:
             print("Could not parse iOS build:", title)
             continue
 
-        # Handle iOS beta releases
         release_info = build_match.groupdict()
-        release_beta = release_info.pop("beta")
-        if release_beta:
+        if release_info["beta"]:
             print("Skipping beta release:", title)
             continue
 
-        # Some iOS releases have multiple build number for different hardware models.
-        # We will split these into separate entries and record each build number.
-        build_list = release_info.pop("build")
-        build_variants = build_list.split(" | ")
-        for build_number in build_variants:
-            release_info["build"] = build_number
-            latest_ios_versions.append(release_info)
+        release_info.pop("beta")
+        latest_ios_versions.append(release_info)
 
     return latest_ios_versions
 
@@ -72,22 +62,16 @@ def update_mvt(mvt_checkout_path, latest_ios_versions):
         print("No new iOS versions found.")
     else:
         print("Found {} new iOS versions.".format(new_entry_count))
-        new_version_list = sorted(
-            current_versions, key=lambda x: version.Version(x["version"])
-        )
+        new_version_list = sorted(current_versions, key=lambda x: version.Version(x["version"]))
         with open(version_path, "w") as version_file:
             json.dump(new_version_list, version_file, indent=4)
 
 
 def main():
     print("Downloading RSS feed...")
-    mvt_checkout_path = os.path.abspath(
-        os.path.join(os.path.dirname(__file__), "../../../")
-    )
+    mvt_checkout_path = os.path.abspath(os.path.join(os.path.dirname(__file__), "../../../"))
 
-    rss_feed = download_apple_rss(
-        "https://developer.apple.com/news/releases/rss/releases.rss"
-    )
+    rss_feed = download_apple_rss("https://developer.apple.com/news/releases/rss/releases.rss")
     latest_ios_version = parse_latest_ios_versions(rss_feed)
     update_mvt(mvt_checkout_path, latest_ios_version)
 

.gitignore

@@ -50,8 +50,6 @@ coverage.xml
 *.py,cover
 .hypothesis/
 .pytest_cache/
-pytest-coverage.txt
-pytest.xml
 
 # Translations
 *.mo

.readthedocs.yaml

@@ -5,15 +5,11 @@
 # Required
 version: 2
 
-build:
-  os: "ubuntu-22.04"
-  tools:
-    python: "3.11"
-
 mkdocs:
   configuration: mkdocs.yml
 
 # Optionally set the version of Python and requirements required to build your docs
 python:
+   version: 3.7
    install:
    - requirements: docs/requirements.txt

.safety-policy.yml

@@ -1,11 +0,0 @@
-# Safety Security and License Configuration file
-# We recommend checking this file into your source control in the root of your Python project
-# If this file is named .safety-policy.yml and is in the same directory where you run `safety check` it will be used by default.
-# Otherwise, you can use the flag `safety check --policy-file <path-to-this-file>` to specify a custom location and name for the file.
-# To validate and review your policy file, run the validate command: `safety validate policy_file --path <path-to-this-file>`
-security: # configuration for the `safety check` command
-    ignore-vulnerabilities: # Here you can list multiple specific vulnerabilities you want to ignore (optionally for a time period)
-        67599: # Example vulnerability ID
-            reason: disputed, inapplicable
-        70612:
-            reason: disputed, inapplicable

Dockerfile

@@ -57,12 +57,12 @@ RUN git clone https://github.com/libimobiledevice/libplist \
 
 # Installing MVT
 # --------------
-RUN pip3 install git+https://github.com/mvt-project/mvt.git@main
+RUN pip3 install mvt
 
 # Installing ABE
 # --------------
 RUN mkdir /opt/abe \
-  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/master-20221109063121-8fdfc5e/abe.jar -O /opt/abe/abe.jar \
+  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/20210709062403-4c55371/abe.jar -O /opt/abe/abe.jar \
 # Create alias for abe
   && echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
 

Makefile

@@ -2,10 +2,8 @@ PWD = $(shell pwd)
 
 check:
 	flake8
-	ruff check -q .
-	black --check .
 	pytest -q
-
+	ruff check -q .
 
 clean:
 	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/mvt.egg-info

README.md

@@ -11,28 +11,14 @@
 
 Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
 
-It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
+It has been developed and released by the [Amnesty International Security Lab](https://www.amnesty.org/en/tech/) in July 2021 in the context of the [Pegasus project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology and forensic evidence](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/).
 
-> **Note**
-> MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.
->
+*Warning*: MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
 
-### Indicators of Compromise
-
-MVT supports using public [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other  research groups.
-
-> **Warning**
-> Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
->
-> Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
->
->Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/?c=mvt_docs) or through our forensic partnership with [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
-
-More information about using indicators of compromise with MVT is available in the [documentation](https://docs.mvt.re/en/latest/iocs/).
 
 ## Installation
 
-MVT can be installed from sources or from [PyPI](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
+MVT can be installed from sources or from [PyPi](https://pypi.org/project/mvt/) (you will need some dependencies, check the [documentation](https://docs.mvt.re/en/latest/install/)):
 
 ```
 pip3 install mvt

docs/android/backup.md

@@ -35,11 +35,7 @@ $ mvt-android check-backup --output /path/to/results/ /path/to/backup.ab
          INFO     [mvt.android.modules.backup.sms] Extracted a total of 64 SMS messages
 ```
 
-If the backup is encrypted, MVT will prompt you to enter the password. A backup password can also be provided with the `--backup-password` command line option or through the `MVT_ANDROID_BACKUP_PASSWORD` environment variable. The same options can also be used to when analysing an encrypted backup collected through AndroidQF in the `mvt-android check-androidqf` command:
-
-```bash
-$ mvt-android check-backup --backup-password "password123" --output /path/to/results/ /path/to/backup.ab
-```
+If the backup is encrypted, MVT will prompt you to enter the password.
 
 Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.
 

docs/development.md

@@ -1,27 +0,0 @@
-# Development
-
-The Mobile Verification Toolkit team welcomes contributions of new forensic modules or other contributions which help improve the software.
-
-## Testing
-
-MVT uses `pytest` for unit and integration tests. Code style consistency is maintained with `flake8`, `ruff` and `black`. All can
-be run automatically with:
-
-```bash
-make check
-```
-
-Run these tests before making new commits or opening pull requests.
-
-## Profiling
-
-Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
-take to avoid inefficient code paths as we add new modules.
-
-MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
-
-```bash
-MVT_PROFILE=1 dev/mvt-ios check-backup test_backup
-```
-
-Open an issue or PR if you are encountering significant performance issues when analyzing a device with MVT.

docs/index.md

@@ -6,9 +6,6 @@
 
 Mobile Verification Toolkit (MVT) is a tool to facilitate the [consensual forensic analysis](introduction.md#consensual-forensics) of Android and iOS devices, for the purpose of identifying traces of compromise.
 
-It has been developed and released by the [Amnesty International Security Lab](https://securitylab.amnesty.org) in July 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/) along with [a technical forensic methodology](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). It continues to be maintained by Amnesty International and other contributors.
-
-
 In this documentation you will find instructions on how to install and run the `mvt-ios` and `mvt-android` commands, and guidance on how to interpret the extracted results.
 
 ## Resources

docs/install.md

@@ -7,27 +7,11 @@ Before proceeding, please note that MVT requires Python 3.6+ to run. While it sh
 First install some basic dependencies that will be necessary to build all required tools:
 
 ```bash
-sudo apt install python3 python3-venv python3-pip sqlite3 libusb-1.0-0
+sudo apt install python3 python3-pip libusb-1.0-0 sqlite3
 ```
 
 *libusb-1.0-0* is not required if you intend to only use `mvt-ios` and not `mvt-android`.
 
-(Recommended) Set up `pipx`
-
-For Ubuntu 23.04 or above:
-```bash
-sudo apt install pipx
-pipx ensurepath
-```
-
-For Ubuntu 22.04 or below:
-```
-python3 -m pip install --user pipx
-python3 -m pipx ensurepath
-```
-
-Other distributions: check for a `pipx` or `python-pipx` via your package manager.
-
 When working with Android devices you should additionally install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you prefer to install a package made available by your distribution of choice, please make sure the version is recent to ensure compatibility with modern Android devices.
 
 ## Dependencies on macOS
@@ -37,7 +21,7 @@ Running MVT on macOS requires Xcode and [homebrew](https://brew.sh) to be instal
 In order to install dependencies use:
 
 ```bash
-brew install python3 pipx libusb sqlite3
+brew install python3 libusb sqlite3
 ```
 
 *libusb* is not required if you intend to only use `mvt-ios` and not `mvt-android`.
@@ -58,43 +42,24 @@ It is recommended to try installing and running MVT from [Windows Subsystem Linu
 
 ## Installing MVT
 
-### Installing from PyPI with pipx (recommended)
-1. Install `pipx` following the instructions above for your OS/distribution. Make sure to run `pipx ensurepath` and open a new terminal window.
-2. ```bash
-   pipx install mvt
-   ```
+If you haven't done so, you can add this to your `.bashrc` or `.zshrc` file in order to add locally installed Pypi binaries to your `$PATH`:
 
-You now should have the `mvt-ios` and `mvt-android` utilities installed. If you run into problems with these commands not being found, ensure you have run `pipx ensurepath` and opened a new terminal window.
-
-### Installing from PyPI directly into a virtual environment
-You can use `pipenv`, `poetry` etc. for your virtual environment, but the provided example is with the built-in `venv` tool:
-
-1. Create the virtual environment in a folder in the current directory named `env`:
 ```bash
-python3 -m venv env
+export PATH=$PATH:~/.local/bin
 ```
 
-2. Activate the virtual environment:
+Then you can install MVT directly from [pypi](https://pypi.org/project/mvt/)
+
 ```bash
-source env/bin/activate
+pip3 install mvt
 ```
 
-3. Install `mvt` into the virtual environment:
-```bash
-pip install mvt
-```
-
-The `mvt-ios` and `mvt-android` utilities should now be available as commands whenever the virtual environment is active.
-
-### Installing from git source with pipx
-If you want to have the latest features in development, you can install MVT directly from the source code in git.
+If you want to have the latest features in development, you can install MVT directly from the source code. If you installed MVT previously from pypi, you should first uninstall it using `pip3 uninstall mvt` and then install from the source code:
 
 ```bash
-pipx install --force git+https://github.com/mvt-project/mvt.git
+git clone https://github.com/mvt-project/mvt.git
+cd mvt
+pip3 install .
 ```
 
 You now should have the `mvt-ios` and `mvt-android` utilities installed.
-
-**Notes:**
-1. The `--force` flag is necessary to force the reinstallation of the package.
-2. To revert to using a PyPI version, it will be necessary to `pipx uninstall mvt` first.

docs/introduction.md

@@ -12,20 +12,6 @@ Mobile Verification Toolkit (MVT) is a collection of utilities designed to facil
 
 MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. MVT is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
 
-## Indicators of Compromise
-
-MVT supports using [indicators of compromise (IOCs)](https://github.com/mvt-project/mvt-indicators) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by [Amnesty International](https://github.com/AmnestyTech/investigations/) and other research groups.
-
-!!! warning
-    Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
-
-    Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
-
-    Such support is available to civil society through [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/?c=mvt_docs) or [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
-
-More information about using indicators of compromise with MVT is available in the [documentation](iocs.md).
-
-
 ## Consensual Forensics
 
 While MVT is capable of extracting and processing various types of very personal records typically found on a mobile phone (such as calls history, SMS and WhatsApp messages, etc.), this is intended to help identify potential attack vectors such as malicious SMS messages leading to exploitation.

docs/iocs.md

@@ -43,6 +43,6 @@ export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2"
 - [This repository](https://github.com/Te-k/stalkerware-indicators) contains IOCs for Android stalkerware including [a STIX MVT-compatible file](https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/generated/stalkerware.stix2).
 - We are also maintaining [a list of IOCs](https://github.com/mvt-project/mvt-indicators) in STIX format from public spyware campaigns.
 
-You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators from the [mvt-indicators](https://github.com/mvt-project/mvt-indicators/blob/main/indicators.yaml) repository and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
+You can automaticallly download the latest public indicator files with the command `mvt-ios download-iocs` or `mvt-android download-iocs`. These commands download the list of indicators listed [here](https://github.com/mvt-project/mvt/blob/main/public_indicators.json) and store them in the [appdir](https://pypi.org/project/appdirs/) folder. They are then loaded automatically by MVT.
 
 Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs.

docs/ios/backup/itunes.md

@@ -10,7 +10,7 @@ To do that:
 4. If you want to have a more accurate detection, ensure that the encrypted backup option is activated and choose a secure password for the backup.
 5. Start the backup and wait for it to finish (this may take up to 30 minutes).
 
-![](../../img/macos-backup.jpg)
+![](../../../img/macos-backup.jpg)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 Once the backup is done, find its location and copy it to a place where it can be analyzed by MVT. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On macOS, the backup is stored in `~/Library/Application Support/MobileSync/`.
@@ -25,13 +25,13 @@ On more recent MacOS versions, this feature is included in Finder. To do a backu
 4. In the General tab, select `Back up all the data on your iPhone to this Mac` from the options under the Backups section.
 5. Check the box that says `Encrypt local backup`. If it is your first time selecting this option, you may need to enter a password to encrypt the backup.
 
-![](../../img/macos-backup2.png)
+![](../../../img/macos-backup2.png)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 6. Click `Back Up Now` to start the back-up process.
 7. The encrypted backup for your iPhone should now start. Once the process finishes, you can check the backup by opening `Finder`, clicking on the `General` tab, then click on `Manage Backups`. Now you should see a list of your backups like the image below:
 
-![](../../img/macos-backups.png)
+![](../../../img/macos-backups.png)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_
 
 If your backup has a lock next to it like in the image above, then the backup is encrypted. You should also see the date and time when the encrypted backup was created. The backup files are stored in `~/Library/Application Support/MobileSync/`.

docs/ios/install.md

@@ -45,10 +45,10 @@ Once the idevice tools are available you can check if everything works fine by c
 ideviceinfo
 ```
 
-This should show many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
+This should some many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
 
 ```bash
-sudo usbmuxd -f -v
+sudo usbmuxd -f -d
 idevicepair pair
 ```
 

docs/ios/records.md

@@ -142,16 +142,6 @@ If indicators are provided through the command-line, they are checked against th
 
 ---
 
-### `global_preferences.json`
-
-!!! info "Availability"
-    Backup: :material-check:
-    Full filesystem dump: :material-check:
-
-This JSON file is created by mvt-ios' `GlobalPreferences` module. The module extracts records from a Plist file located at */private/var/mobile/Library/Preferences/.GlobalPreferences.plist*, which contains a system preferences including if Lockdown Mode is enabled.
-
----
-
 ### `id_status_cache.json`
 
 !!! info "Availability"

mkdocs.yml

@@ -1,7 +1,7 @@
 site_name: Mobile Verification Toolkit
 repo_url: https://github.com/mvt-project/mvt
 edit_uri: edit/main/docs/
-copyright: Copyright © 2021-2023 MVT Project Developers
+copyright: Copyright © 2021-2022 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
 markdown_extensions:
     - attr_list
@@ -46,5 +46,4 @@ nav:
         - Check an Android Backup (SMS messages): "android/backup.md"
         - Download APKs: "android/download_apks.md"
     - Indicators of Compromise: "iocs.md"
-    - Development: "development.md"
     - License: "license.md"

mvt/__init__.py

@@ -1,4 +1,4 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
+# Copyright (c) 2021-2023 Claudio Guarnieri.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

mvt/android/__init__.py

@@ -1,5 +1,5 @@
 # Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
+# Copyright (c) 2021-2023 Claudio Guarnieri.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 

mvt/android/artifacts/__init__.py

@@ -1,4 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/

mvt/android/artifacts/artifact.py

@@ -1,36 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from mvt.common.artifact import Artifact
-
-
-class AndroidArtifact(Artifact):
-    @staticmethod
-    def extract_dumpsys_section(dumpsys: str, separator: str) -> str:
-        """
-        Extract a section from a full dumpsys file.
-
-        :param dumpsys: content of the full dumpsys file (string)
-        :param separator: content of the first line separator (string)
-        :return: section extracted (string)
-        """
-        lines = []
-        in_section = False
-        for line in dumpsys.splitlines():
-            if line.strip() == separator:
-                in_section = True
-                continue
-
-            if not in_section:
-                continue
-
-            if line.strip().startswith(
-                "------------------------------------------------------------------------------"
-            ):
-                break
-
-            lines.append(line)
-
-        return "\n".join(lines)

mvt/android/artifacts/dumpstate_artifact.py

@@ -1,165 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-import re
-
-from .artifact import AndroidArtifact
-
-
-# The AOSP dumpstate code is available at https://cs.android.com/android/platform/superproject/+/master:frameworks/native/cmds/dumpstate/
-# The dumpstate code is used to generate bugreports on Android devices. It looks like there are
-# bugs in the code that leave some sections with out ending lines. We need to handle these cases.
-#
-# The approach here is to flag probably broken section, and to search for plausible new section headers
-# to close the previous section. This is a heuristic approach, and may not work in all cases. We can't do
-# this for all sections as we will detect subsections as new sections.
-SECTION_BROKEN_TERMINATORS = [
-    b"VM TRACES AT LAST ANR",
-    b"DIGITAL_HALL",
-]
-
-
-class DumpStateArtifact(AndroidArtifact):
-    def __init__(self, *args, **kwargs):
-        self.dumpstate_sections = []
-        self.dumpstate_header = {}
-        self.unparsed_lines = []
-        super().__init__(*args, **kwargs)
-
-    def _parse_dumpstate_header(self, header_text):
-        """
-        Parse dumpstate header metadata
-        """
-        fields = {}
-        for line in header_text.splitlines():
-            if line.startswith(b"="):
-                continue
-
-            if b":" in line:
-                # Save line if it's a key-value pair.
-                key, value = line.split(b":", 1)
-                fields[key] = value[1:]
-
-            if not line and fields:
-                # Finish if we get an empty line and already parsed lines
-                break
-            else:
-                # Skip until we find lines
-                continue
-
-        self.dumpstate_header = fields
-        return fields
-
-    def _get_section_header(self, header_match):
-        """
-        Create internal dictionary to track dumpsys section.
-        """
-        section_full = header_match.group(0).strip(b"-").strip()
-        section_name = header_match.group(1).rstrip()
-
-        if header_match.group(2):
-            section_command = header_match.group(2).strip(b"()")
-        else:
-            # Some headers can missing the command
-            section_command = ""
-
-        has_broken_terminator = False
-        for broken_section in SECTION_BROKEN_TERMINATORS:
-            if broken_section in section_name:
-                has_broken_terminator = True
-                break
-
-        section = {
-            "section_name": section_name,
-            "section_command": section_command,
-            "section_full": section_full,
-            "missing_terminator": has_broken_terminator,
-            "lines": [],
-            "error": False,
-        }
-        self.dumpstate_sections.append(section)
-        return section
-
-    def parse_dumpstate(self, text: str) -> list:
-        """
-        Extract all sections from a full dumpstate file.
-
-        :param text: content of the full dumpstate file (string)
-        """
-        # Parse the header
-        self._parse_dumpstate_header(text)
-
-        header = b"------ "
-
-        # Regexes to parse headers
-        section_name_re = re.compile(rb"------ ([\w\d\s\-\/\&]+)(\(.*\))? ------")
-        end_of_section_re = re.compile(rb"------ End of .* ------")
-        missing_file_error_re = re.compile(rb"\*\*\* (.*): No such file or directory")
-        generic_error_re = re.compile(rb"\*\*\* (.*) (?<!\*\*\*)$")
-
-        section = None
-
-        # Parse each line in dumpstate and look for headers
-        for line in text.splitlines():
-            if not section:
-                # If we find an end section when not in a section, we can skip
-                # It's probably the trailing line of a section.
-                end_of_section_match = re.match(end_of_section_re, line)
-                if end_of_section_match:
-                    self.unparsed_lines.append(line)
-                    continue
-
-                possible_section_header = re.match(section_name_re, line)
-                if possible_section_header:
-                    section = self._get_section_header(possible_section_header)
-                    # print("found section", section)
-                    continue
-                else:
-                    # We continue to next line as we weren't already in a section
-                    self.unparsed_lines.append(line)
-                    continue
-
-            if line.lstrip().startswith(header):
-                # This may be an internal section, or the terminator for our current section
-                # Ending looks like: ------ 0.557s was the duration of 'DUMPSYS CRITICAL' ------
-
-                # Check that we have the end for the right command.
-                section_command_in_quotes = b"'" + section["section_name"] + b"'"
-                if (
-                    section_command_in_quotes in line
-                    or section["section_full"]
-                    in line  # Needed for 0.070s was the duration of 'KERNEL LOG (dmesg)'
-                ):
-                    # Add end line and finish up the section
-                    section["lines"].append(line)
-                    section = None
-                    continue
-
-                # If we haven't closed previous, but this matches a section header, we can try close.
-                # Probably a bug where not closed properly. We explicitly flag known broken fields.
-
-                # This fails on these blocks if we dont blacklist. Maybe we need to make a blacklist of badly closed items
-                # ------ DUMP BLOCK STAT ------
-                # ------ BLOCK STAT (/sys/block/dm-20) ------
-
-                possible_section_header = re.match(section_name_re, line)
-                if possible_section_header and section["missing_terminator"]:
-                    section = self._get_section_header(possible_section_header)
-                else:
-                    # Probably terminator for subsection, ignore and treat as a regular line.
-                    pass
-
-            # Handle lines with special meaning
-            # TODO: This is failing as sometime errors are followed by a terminator and sometimes not.
-            if re.match(missing_file_error_re, line) or re.match(
-                generic_error_re, line
-            ):
-                # The line in a failed file read which is dumped without an header end section.
-                section["failed"] = True
-                section["lines"].append(line)
-                section = None
-            else:
-                section["lines"].append(line)
-
-        return self.dumpstate_sections

mvt/android/artifacts/dumpsys_accessibility.py

@@ -1,67 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-import re
-
-
-class DumpsysAccessibilityArtifact(AndroidArtifact):
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, content: str) -> None:
-        """
-        Parse the Dumpsys Accessibility section/
-        Adds results to self.results (List[Dict[str, str]])
-
-        :param content: content of the accessibility section (string)
-        """
-
-        # "Old" syntax
-        in_services = False
-        for line in content.splitlines():
-            if line.strip().startswith("installed services:"):
-                in_services = True
-                continue
-
-            if not in_services:
-                continue
-
-            if line.strip() == "}":
-                # At end of installed services
-                break
-
-            service = line.split(":")[1].strip()
-
-            self.results.append(
-                {
-                    "package_name": service.split("/")[0],
-                    "service": service,
-                }
-            )
-
-        # "New" syntax - AOSP >= 14 (?)
-        # Looks like:
-        # Enabled services:{{com.azure.authenticator/com.microsoft.brooklyn.module.accessibility.BrooklynAccessibilityService}, {com.agilebits.onepassword/com.agilebits.onepassword.filling.accessibility.FillingAccessibilityService}}
-
-        for line in content.splitlines():
-            if line.strip().startswith("Enabled services:"):
-                matches = re.finditer(r"{([^{]+?)}", line)
-
-                for match in matches:
-                    # Each match is in format: <package_name>/<service>
-                    package_name, _, service = match.group(1).partition("/")
-
-                    self.results.append(
-                        {"package_name": package_name, "service": service}
-                    )

mvt/android/artifacts/dumpsys_appops.py

@@ -1,150 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from datetime import datetime
-from typing import Any, Dict, List, Union
-
-from mvt.common.utils import convert_datetime_to_iso
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysAppopsArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys app ops info
-    """
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-        for perm in record["permissions"]:
-            if "entries" not in perm:
-                continue
-
-            for entry in perm["entries"]:
-                if "timestamp" in entry:
-                    records.append(
-                        {
-                            "timestamp": entry["timestamp"],
-                            "module": self.__class__.__name__,
-                            "event": entry["access"],
-                            "data": f"{record['package_name']} access to "
-                            f"{perm['name']}: {entry['access']}",
-                        }
-                    )
-
-        return records
-
-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            for perm in result["permissions"]:
-                if (
-                    perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                    and perm["access"] == "allow"
-                ):
-                    self.log.info(
-                        "Package %s with REQUEST_INSTALL_PACKAGES " "permission",
-                        result["package_name"],
-                    )
-
-    def parse(self, output: str) -> None:
-        self.results: List[Dict[str, Any]] = []
-        perm = {}
-        package = {}
-        entry = {}
-        uid = None
-        in_packages = False
-
-        for line in output.splitlines():
-            if line.startswith("  Uid 0:"):
-                in_packages = True
-
-            if not in_packages:
-                continue
-
-            if line.startswith("  Uid "):
-                uid = line[6:-1]
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-                if package:
-                    if perm:
-                        package["permissions"].append(perm)
-
-                    perm = {}
-                    self.results.append(package)
-                package = {}
-                continue
-
-            if line.startswith("    Package "):
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-
-                if package:
-                    if perm:
-                        package["permissions"].append(perm)
-
-                    perm = {}
-                    self.results.append(package)
-
-                package = {
-                    "package_name": line[12:-1],
-                    "permissions": [],
-                    "uid": uid,
-                }
-                continue
-
-            if package and line.startswith("      ") and line[6] != " ":
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-                if perm:
-                    package["permissions"].append(perm)
-                    perm = {}
-
-                perm["name"] = line.split()[0]
-                perm["entries"] = []
-                if len(line.split()) > 1:
-                    perm["access"] = line.split()[1][1:-2]
-
-                continue
-
-            if line.startswith("          "):
-                # Permission entry like:
-                # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
-                if entry:
-                    perm["entries"].append(entry)
-                    entry = {}
-
-                entry["access"] = line.split(":")[0].strip()
-                entry["type"] = line[line.find("[") + 1 : line.find("]")]
-
-                try:
-                    entry["timestamp"] = convert_datetime_to_iso(
-                        datetime.strptime(
-                            line[line.find("]") + 1 : line.find("(")].strip(),
-                            "%Y-%m-%d %H:%M:%S.%f",
-                        )
-                    )
-                except ValueError:
-                    # Invalid date format
-                    pass
-
-            if line.strip() == "":
-                break
-
-        if entry:
-            perm["entries"].append(entry)
-        if perm:
-            package["permissions"].append(perm)
-        if package:
-            self.results.append(package)

mvt/android/artifacts/dumpsys_battery_daily.py

@@ -1,78 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from typing import Union
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysBatteryDailyArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys dattery daily updates.
-    """
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["from"],
-            "module": self.__class__.__name__,
-            "event": "battery_daily",
-            "data": f"Recorded update of package {record['package_name']} "
-            f"with vers {record['vers']}",
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, output: str) -> None:
-        daily = None
-        daily_updates = []
-        for line in output.splitlines():
-            if line.startswith("  Daily from "):
-                if len(daily_updates) > 0:
-                    self.results.extend(daily_updates)
-                    daily_updates = []
-
-                timeframe = line[13:].strip()
-                date_from, date_to = timeframe.strip(":").split(" to ", 1)
-                daily = {"from": date_from[0:10], "to": date_to[0:10]}
-                continue
-
-            if not daily:
-                continue
-
-            if not line.strip().startswith("Update "):
-                continue
-
-            line = line.strip().replace("Update ", "")
-            package_name, vers = line.split(" ", 1)
-            vers_nr = vers.split("=", 1)[1]
-
-            already_seen = False
-            for update in daily_updates:
-                if package_name == update["package_name"] and vers_nr == update["vers"]:
-                    already_seen = True
-                    break
-
-            if not already_seen:
-                daily_updates.append(
-                    {
-                        "action": "update",
-                        "from": daily["from"],
-                        "to": daily["to"],
-                        "package_name": package_name,
-                        "vers": vers_nr,
-                    }
-                )
-
-        if len(daily_updates) > 0:
-            self.results.extend(daily_updates)

mvt/android/artifacts/dumpsys_battery_history.py

@@ -1,78 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysBatteryHistoryArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys dattery history events.
-    """
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, data: str) -> None:
-        for line in data.splitlines():
-            if line.startswith("Battery History "):
-                continue
-
-            if line.strip() == "":
-                break
-
-            time_elapsed = line.strip().split(" ", 1)[0]
-
-            event = ""
-            if line.find("+job") > 0:
-                event = "start_job"
-                uid = line[line.find("+job") + 5 : line.find(":")]
-                service = line[line.find(":") + 1 :].strip('"')
-                package_name = service.split("/")[0]
-            elif line.find("-job") > 0:
-                event = "end_job"
-                uid = line[line.find("-job") + 5 : line.find(":")]
-                service = line[line.find(":") + 1 :].strip('"')
-                package_name = service.split("/")[0]
-            elif line.find("+running +wake_lock=") > 0:
-                uid = line[line.find("+running +wake_lock=") + 21 : line.find(":")]
-                event = "wake"
-                service = (
-                    line[line.find("*walarm*:") + 9 :].split(" ")[0].strip('"').strip()
-                )
-                if service == "" or "/" not in service:
-                    continue
-
-                package_name = service.split("/")[0]
-            elif (line.find("+top=") > 0) or (line.find("-top") > 0):
-                if line.find("+top=") > 0:
-                    event = "start_top"
-                    top_pos = line.find("+top=")
-                else:
-                    event = "end_top"
-                    top_pos = line.find("-top=")
-                colon_pos = top_pos + line[top_pos:].find(":")
-                uid = line[top_pos + 5 : colon_pos]
-                service = ""
-                package_name = line[colon_pos + 1 :].strip('"')
-            else:
-                continue
-
-            self.results.append(
-                {
-                    "time_elapsed": time_elapsed,
-                    "event": event,
-                    "uid": uid,
-                    "package_name": package_name,
-                    "service": service,
-                }
-            )

mvt/android/artifacts/dumpsys_dbinfo.py

@@ -1,83 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import re
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysDBInfoArtifact(AndroidArtifact):
-    """
-    Parser for dumpsys DBInfo service
-    """
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            path = result.get("path", "")
-            for part in path.split("/"):
-                ioc = self.indicators.check_app_id(part)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-    def parse(self, output: str) -> None:
-        rxp = re.compile(
-            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\].*\[Pid:\((\d+)\)\](\w+).*sql\=\"(.+?)\""
-        )  # pylint: disable=line-too-long
-        rxp_no_pid = re.compile(
-            r".*\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})\][ ]{1}(\w+).*sql\=\"(.+?)\""
-        )  # pylint: disable=line-too-long
-
-        pool = None
-        in_operations = False
-        for line in output.splitlines():
-            if line.startswith("Connection pool for "):
-                pool = line.replace("Connection pool for ", "").rstrip(":")
-
-            if not pool:
-                continue
-
-            if line.strip() == "Most recently executed operations:":
-                in_operations = True
-                continue
-
-            if not in_operations:
-                continue
-
-            if not line.startswith("        "):
-                in_operations = False
-                pool = None
-                continue
-
-            matches = rxp.findall(line)
-            if not matches:
-                matches = rxp_no_pid.findall(line)
-                if not matches:
-                    continue
-
-                match = matches[0]
-                self.results.append(
-                    {
-                        "isodate": match[0],
-                        "action": match[1],
-                        "sql": match[2],
-                        "path": pool,
-                    }
-                )
-            else:
-                match = matches[0]
-                self.results.append(
-                    {
-                        "isodate": match[0],
-                        "pid": match[1],
-                        "action": match[2],
-                        "sql": match[3],
-                        "path": pool,
-                    }
-                )

mvt/android/artifacts/dumpsys_package_activities.py

@@ -1,84 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysPackageActivitiesArtifact(AndroidArtifact):
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for activity in self.results:
-            ioc = self.indicators.check_app_id(activity["package_name"])
-            if ioc:
-                activity["matched_indicator"] = ioc
-                self.detected.append(activity)
-                continue
-
-    def parse(self, content: str):
-        """
-        Parse the Dumpsys Package section for activities
-        Adds results to self.results
-
-        :param content: content of the package section (string)
-        """
-        self.results = []
-
-        in_activity_resolver_table = False
-        in_non_data_actions = False
-        intent = None
-        for line in content.splitlines():
-            if line.startswith("Activity Resolver Table:"):
-                in_activity_resolver_table = True
-                continue
-
-            if not in_activity_resolver_table:
-                continue
-
-            if line.startswith("  Non-Data Actions:"):
-                in_non_data_actions = True
-                continue
-
-            if not in_non_data_actions:
-                continue
-
-            # If we hit an empty line, the Non-Data Actions section should be
-            # finished.
-            if line.strip() == "":
-                break
-
-            # We detect the action name.
-            if (
-                line.startswith(" " * 6)
-                and not line.startswith(" " * 8)
-                and ":" in line
-            ):
-                intent = line.strip().replace(":", "")
-                continue
-
-            # If we are not in an intent block yet, skip.
-            if not intent:
-                continue
-
-            # If we are in a block but the line does not start with 8 spaces
-            # it means the block ended a new one started, so we reset and
-            # continue.
-            if not line.startswith(" " * 8):
-                intent = None
-                continue
-
-            # If we got this far, we are processing receivers for the
-            # activities we are interested in.
-            activity = line.strip().split(" ")[1]
-            package_name = activity.split("/")[0]
-
-            self.results.append(
-                {
-                    "intent": intent,
-                    "package_name": package_name,
-                    "activity": activity,
-                }
-            )