Added module to parse battery daily stats package updates

mvt/android/modules/adb/__init__.py

@@ -9,6 +9,7 @@ from .dumpsys_activities import DumpsysActivities
 from .dumpsys_battery_history import DumpsysBatteryHistory
 from .dumpsys_full import DumpsysFull
 from .dumpsys_receivers import DumpsysReceivers
+from .dumpsys_battery_daily import DumpsysBatteryDaily
 from .files import Files
 from .getprop import Getprop
 from .logcat import Logcat
@@ -20,6 +21,6 @@ from .sms import SMS
 from .whatsapp import Whatsapp
 
 ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes, Getprop, Settings,
-               DumpsysAccessibility, DumpsysBatteryHistory, DumpsysReceivers,
-               DumpsysActivities, DumpsysFull, Packages, RootBinaries, Logcat,
-               Files]
+               DumpsysBatteryHistory, DumpsysBatteryDaily, DumpsysReceivers,
+               DumpsysActivities, DumpsysAccessibility, DumpsysFull,
+               Packages, RootBinaries, Logcat, Files]

mvt/android/modules/adb/dumpsys_battery_daily.py

@@ -0,0 +1,87 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class DumpsysBatteryDaily(AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["from"],
+            "module": self.__class__.__name__,
+            "event": f"battery_daily",
+            "data": f"Recorded update of package {record['package']} with vers {record['vers']}"
+        }
+
+    def check_indicators(self):
+        for result in self.results:
+            ioc = self.indicators.check_app_id(result["package"])
+            if ioc:
+                result["matched_indicators"] = ioc
+                self.detected.append(result)
+                continue
+
+    def process_battery_history(self, output):
+        daily = None
+        daily_updates = []
+        for line in output.split("\n")[1:]:
+            if line.startswith("  Daily from "):
+                timeframe = line[13:].strip()
+                date_from, date_to = timeframe.strip(":").split(" to ", 1)
+                daily = {"from": date_from[0:10], "to": date_to[0:10]}
+
+            if not daily:
+                continue
+
+            if line.strip() == "":
+                self.results.extend(daily_updates)
+                daily = None
+                daily_updates = []
+                continue
+
+            if not line.strip().startswith("Update "):
+                continue
+
+            line = line.strip().replace("Update ", "")
+            package, vers = line.split(" ", 1)
+            vers_nr = vers.split("=", 1)[1]
+
+            already_seen = False
+            for update in daily_updates:
+                if package == update["package"] and vers_nr == update["vers"]:
+                    already_seen = True
+                    break
+
+            if not already_seen:
+                daily_updates.append({
+                    "action": "update",
+                    "from": daily["from"],
+                    "to": daily["to"],
+                    "package": package,
+                    "vers": vers_nr,
+                })
+
+        self.log.info("Extracted %d records from battery daily stats", len(self.results))
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys batterystats --daily")
+        self.process_battery_history(output)
+
+        self._adb_disconnect()

mvt/android/modules/adb/dumpsys_battery_history.py

@@ -12,7 +12,7 @@ log = logging.getLogger(__name__)
 
 
 class DumpsysBatteryHistory(AndroidExtraction):
-    """This module extracts stats on battery consumption by processes."""
+    """This module extracts records from battery history events."""
 
     def __init__(self, file_path=None, base_folder=None, output_folder=None,
                  serial=None, fast_mode=False, log=None, results=[]):