From 8db04fc99137496370e2ed4d3e7d785bf89a1c2d Mon Sep 17 00:00:00 2001 From: Nex Date: Sun, 30 Jan 2022 16:02:24 +0100 Subject: [PATCH] Added module to parse battery daily stats package updates --- mvt/android/modules/adb/__init__.py | 7 +- .../modules/adb/dumpsys_battery_daily.py | 87 +++++++++++++++++++ .../modules/adb/dumpsys_battery_history.py | 2 +- 3 files changed, 92 insertions(+), 4 deletions(-) create mode 100644 mvt/android/modules/adb/dumpsys_battery_daily.py diff --git a/mvt/android/modules/adb/__init__.py b/mvt/android/modules/adb/__init__.py index 139cd8c..e5d3fb8 100644 --- a/mvt/android/modules/adb/__init__.py +++ b/mvt/android/modules/adb/__init__.py @@ -9,6 +9,7 @@ from .dumpsys_activities import DumpsysActivities from .dumpsys_battery_history import DumpsysBatteryHistory from .dumpsys_full import DumpsysFull from .dumpsys_receivers import DumpsysReceivers +from .dumpsys_battery_daily import DumpsysBatteryDaily from .files import Files from .getprop import Getprop from .logcat import Logcat @@ -20,6 +21,6 @@ from .sms import SMS from .whatsapp import Whatsapp ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes, Getprop, Settings, - DumpsysAccessibility, DumpsysBatteryHistory, DumpsysReceivers, - DumpsysActivities, DumpsysFull, Packages, RootBinaries, Logcat, - Files] + DumpsysBatteryHistory, DumpsysBatteryDaily, DumpsysReceivers, + DumpsysActivities, DumpsysAccessibility, DumpsysFull, + Packages, RootBinaries, Logcat, Files] diff --git a/mvt/android/modules/adb/dumpsys_battery_daily.py b/mvt/android/modules/adb/dumpsys_battery_daily.py new file mode 100644 index 0000000..47690a6 --- /dev/null +++ b/mvt/android/modules/adb/dumpsys_battery_daily.py @@ -0,0 +1,87 @@ +# Mobile Verification Toolkit (MVT) +# Copyright (c) 2021 The MVT Project Authors. +# Use of this software is governed by the MVT License 1.1 that can be found at +# https://license.mvt.re/1.1/ + +import logging +import os + +from .base import AndroidExtraction + +log = logging.getLogger(__name__) + + +class DumpsysBatteryDaily(AndroidExtraction): + """This module extracts records from battery daily updates.""" + + def __init__(self, file_path=None, base_folder=None, output_folder=None, + serial=None, fast_mode=False, log=None, results=[]): + super().__init__(file_path=file_path, base_folder=base_folder, + output_folder=output_folder, fast_mode=fast_mode, + log=log, results=results) + + def serialize(self, record): + return { + "timestamp": record["from"], + "module": self.__class__.__name__, + "event": f"battery_daily", + "data": f"Recorded update of package {record['package']} with vers {record['vers']}" + } + + def check_indicators(self): + for result in self.results: + ioc = self.indicators.check_app_id(result["package"]) + if ioc: + result["matched_indicators"] = ioc + self.detected.append(result) + continue + + def process_battery_history(self, output): + daily = None + daily_updates = [] + for line in output.split("\n")[1:]: + if line.startswith(" Daily from "): + timeframe = line[13:].strip() + date_from, date_to = timeframe.strip(":").split(" to ", 1) + daily = {"from": date_from[0:10], "to": date_to[0:10]} + + if not daily: + continue + + if line.strip() == "": + self.results.extend(daily_updates) + daily = None + daily_updates = [] + continue + + if not line.strip().startswith("Update "): + continue + + line = line.strip().replace("Update ", "") + package, vers = line.split(" ", 1) + vers_nr = vers.split("=", 1)[1] + + already_seen = False + for update in daily_updates: + if package == update["package"] and vers_nr == update["vers"]: + already_seen = True + break + + if not already_seen: + daily_updates.append({ + "action": "update", + "from": daily["from"], + "to": daily["to"], + "package": package, + "vers": vers_nr, + }) + + self.log.info("Extracted %d records from battery daily stats", len(self.results)) + + def run(self): + self._adb_connect() + + output = self._adb_command("dumpsys batterystats --daily") + self.process_battery_history(output) + + self._adb_disconnect() diff --git a/mvt/android/modules/adb/dumpsys_battery_history.py b/mvt/android/modules/adb/dumpsys_battery_history.py index 3f59640..5fd3e9a 100644 --- a/mvt/android/modules/adb/dumpsys_battery_history.py +++ b/mvt/android/modules/adb/dumpsys_battery_history.py @@ -12,7 +12,7 @@ log = logging.getLogger(__name__) class DumpsysBatteryHistory(AndroidExtraction): - """This module extracts stats on battery consumption by processes.""" + """This module extracts records from battery history events.""" def __init__(self, file_path=None, base_folder=None, output_folder=None, serial=None, fast_mode=False, log=None, results=[]):