crt0mega/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2024-06-18 10:29:01 +00:00
Code Issues Projects Releases Wiki Activity

Add Android device serial specification

Browse Source
This commit is contained in:
Hamza Z 2021-07-21 13:17:58 +02:00
parent af7c45ae22
commit ccf0f3f18e
13 changed files with 48 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
mvt/android/cli.py
View File

@ -49,7 +49,8 @@ def cli():
help="Specify a path to a folder where you want to store JSON results")
@click.option("--from-file", "-f", type=click.Path(exists=True),
help="Instead of acquiring from phone, load an existing packages.json file for lookups (mainly for debug purposes)")
def download_apks(all_apks, virustotal, koodous, all_checks, output, from_file):
@click.option("--serial", "-s", type=str, help="Use the Android device with a given serial")
def download_apks(all_apks, virustotal, koodous, all_checks, output, from_file, serial):
try:
if from_file:
download = DownloadAPKs.from_json(from_file)
@ -58,7 +59,7 @@ def download_apks(all_apks, virustotal, koodous, all_checks, output, from_file):
log.critical("You need to specify an output folder (with --output, -o) when extracting APKs from a device")
sys.exit(-1)
download = DownloadAPKs(output_folder=output, all_apks=all_apks)
download = DownloadAPKs(output_folder=output, all_apks=all_apks, serial=serial)
download.run()
packages = download.packages
@ -85,7 +86,8 @@ def download_apks(all_apks, virustotal, koodous, all_checks, output, from_file):
help="Specify a path to a folder where you want to store JSON results")
@click.option("--list-modules", "-l", is_flag=True, help="Print list of available modules and exit")
@click.option("--module", "-m", help="Name of a single module you would like to run instead of all")
def check_adb(iocs, output, list_modules, module):
@click.option("--serial", "-s", type=str, help="Use the Android device with a given serial")
def check_adb(iocs, output, list_modules, module, serial):
if list_modules:
log.info("Following is the list of available check-adb modules:")
for adb_module in ADB_MODULES:
@ -106,7 +108,7 @@ def check_adb(iocs, output, list_modules, module):
if module and adb_module.__name__ != module:
continue
m = adb_module(output_folder=output, log=logging.getLogger(adb_module.__module__))
m = adb_module(output_folder=output, serial=serial, log=logging.getLogger(adb_module.__module__))
if iocs:
indicators.log = m.log
@ -128,8 +130,9 @@ def check_adb(iocs, output, list_modules, module):
@cli.command("check-backup", help="Check an Android Backup")
@click.option("--iocs", "-i", type=click.Path(exists=True), help="Path to indicators file")
@click.option("--output", "-o", type=click.Path(exists=True), help=OUTPUT_HELP_MESSAGE)
@click.option("--serial", "-s", type=str, help="Use the Android device with a given serial")
@click.argument("BACKUP_PATH", type=click.Path(exists=True))
def check_backup(iocs, output, backup_path):
def check_backup(iocs, output, backup_path, serial):
log.info("Checking ADB backup located at: %s", backup_path)
if iocs:
@ -147,7 +150,7 @@ def check_backup(iocs, output, backup_path):
for module in BACKUP_MODULES:
m = module(base_folder=backup_path, output_folder=output,
log=logging.getLogger(module.__module__))
serial=serial, log=logging.getLogger(module.__module__))
if iocs:
indicators.log = m.log

5
mvt/android/download_apks.py
View File

@ -38,15 +38,16 @@ class DownloadAPKs(AndroidExtraction):
"""DownloadAPKs is the main class operating the download of APKs
from the device."""
def __init__(self, output_folder=None, all_apks=False, packages=None):
def __init__(self, output_folder=None, all_apks=False, packages=None, serial=None):
"""Initialize module.
:param output_folder: Path to the folder where data should be stored
:param all_apks: Boolean indicating whether to download all packages
or filter known-goods
:param packages: Provided list of packages, typically for JSON checks
:param serial: The USB device serial ID
"""
super().__init__(file_path=None, base_folder=None,
output_folder=output_folder)
output_folder=output_folder, serial=serial)
self.output_folder_apk = None
self.packages = packages or []

10
mvt/android/modules/adb/base.py
View File

@ -25,16 +25,17 @@ class AndroidExtraction(MVTModule):
"""This class provides a base for all Android extraction modules."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
"""Initialize Android extraction module.
:param file_path: Path to the database file to parse
:param base_folder: Path to a base folder containing an Android dump
:param output_folder: Path to the folder where to store extraction
results
:param serial: The USB device serial ID
"""
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
self.device = None
@ -56,7 +57,8 @@ class AndroidExtraction(MVTModule):
priv_key = handle.read()
signer = PythonRSASigner("", priv_key)
self.device = AdbDeviceUsb()
self.device = AdbDeviceUsb(serial=self.serial)
while True:
try:

6
mvt/android/modules/adb/chrome_history.py
View File

@ -19,10 +19,10 @@ class ChromeHistory(AndroidExtraction):
"""This module extracts records from Android's Chrome browsing history."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def serialize(self, record):
return {

6
mvt/android/modules/adb/dumpsys_batterystats.py
View File

@ -14,10 +14,10 @@ class DumpsysBatterystats(AndroidExtraction):
"""This module extracts stats on battery consumption by processes."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def run(self):
self._adb_connect()

6
mvt/android/modules/adb/dumpsys_packages.py
View File

@ -14,10 +14,10 @@ class DumpsysPackages(AndroidExtraction):
"""This module extracts stats on installed packages."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def run(self):
self._adb_connect()

6
mvt/android/modules/adb/dumpsys_procstats.py
View File

@ -14,10 +14,10 @@ class DumpsysProcstats(AndroidExtraction):
"""This module extracts stats on memory consumption by processes."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def run(self):
self._adb_connect()

6
mvt/android/modules/adb/packages.py
View File

@ -15,10 +15,10 @@ class Packages(AndroidExtraction):
"""This module extracts the list of installed packages."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def serialize(self, record):
records = []

6
mvt/android/modules/adb/processes.py
View File

@ -13,10 +13,10 @@ class Processes(AndroidExtraction):
"""This module extracts details on running processes."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def run(self):
self._adb_connect()

6
mvt/android/modules/adb/rootbinaries.py
View File

@ -15,10 +15,10 @@ class RootBinaries(AndroidExtraction):
"""This module extracts the list of installed packages."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def run(self):
root_binaries_path = os.path.join("..", "..", "data", "root_binaries.txt")

6
mvt/android/modules/adb/sms.py
View File

@ -18,10 +18,10 @@ class SMS(AndroidExtraction):
"""This module extracts all SMS messages containing links."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def serialize(self, record):
text = record["text"].replace("\n", "\\n")

6
mvt/android/modules/adb/whatsapp.py
View File

@ -18,10 +18,10 @@ class Whatsapp(AndroidExtraction):
"""This module extracts all WhatsApp messages containing links."""
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
super().__init__(file_path=file_path, base_folder=base_folder,
output_folder=output_folder, fast_mode=fast_mode,
log=log, results=results)
output_folder=output_folder, serial=serial,
fast_mode=fast_mode, log=log, results=results)
def serialize(self, record):
text = record["data"].replace("\n", "\\n")

4
mvt/common/module.py
View File

@ -20,11 +20,12 @@ class MVTModule(object):
slug = None
def __init__(self, file_path=None, base_folder=None, output_folder=None,
fast_mode=False, log=None, results=[]):
serial=None, fast_mode=False, log=None, results=[]):
"""Initialize module.
:param file_path: Path to the module's database file, if there is any.
:param base_folder: Path to the base folder (backup or filesystem dump)
:param output_folder: Folder where results will be stored
:param serial: The USB device serial ID
:param fast_mode: Flag to enable or disable slow modules
:param log: Handle to logger
:param results: Provided list of results entries
@ -32,6 +33,7 @@ class MVTModule(object):
self.file_path = file_path
self.base_folder = base_folder
self.output_folder = output_folder
self.serial= serial
self.fast_mode = fast_mode
self.log = log
self.indicators = None