Check receiver names for IoCs

[viktor3002]

If a known malicious app id is a substring of a receiver name, a warning is shown to the user

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
src/mvt/android
cli.py	168	57	66%	62, 82–85, 96, 115–147, 183–214, 254–255, 318–319, 326, 384–385, 415–428, 436–437
cmd_check_adb.py	11	3	73%	32–48
cmd_check_androidqf.py	106	30	72%	81–84, 88–89, 92, 101–102, 106–115, 124, 127–128, 137, 148–162, 167–171
cmd_check_backup.py	67	17	75%	71–72, 78–79, 85–88, 105–118, 122
cmd_check_bugreport.py	45	8	82%	81–84, 88, 91, 97, 103
cmd_download_apks.py	87	69	21%	38–42, 51–53, 65–99, 105–112, 116–172, 175–177, 180–184
utils.py	16	5	69%	11–20
src/mvt/android/artifacts
dumpsys_accessibility.py	30	1	97%	14
dumpsys_adb.py	92	13	86%	50–51, 91, 99–101, 113–115, 141–142, 148–151
dumpsys_appops.py	106	10	91%	27, 69–71, 117–118, 155, 171–173, 179
dumpsys_battery_daily.py	42	4	90%	17, 27, 42–43
dumpsys_battery_history.py	48	7	85%	16, 47–55
dumpsys_dbinfo.py	42	6	86%	18, 60–65
dumpsys_package_activities.py	40	4	90%	12, 64, 70–71
dumpsys_packages.py	121	5	96%	18–23, 160, 167
dumpsys_platform_compat.py	22	2	91%	16, 31
dumpsys_receivers.py	57	9	84%	24, 29, 34, 39, 45, 51, 97, 103–104
file_timestamps.py	18	1	94%	32
getprop.py	36	4	89%	40, 53, 59, 62
mounts.py	70	30	57%	53, 79–80, 84, 113–118, 129–162, 177–186
processes.py	34	9	74%	20, 24–25, 31, 55, 59, 63–65
tombstone_crashes.py	149	15	90%	97–99, 102–107, 160–161, 187, 227–228, 268
src/mvt/android/modules/adb
base.py	148	112	24%	51–61, 66–73, 77–138, 142, 146–148, 157, 166–167, 171–172, 185, 198–200, 218–224, 234–269, 282–306, 309–351, 355
chrome_history.py	37	24	35%	30–38, 41, 50–56, 64–98, 101–110
dumpsys_full.py	16	9	44%	25, 35–45
files.py	72	57	21%	37–45, 48–56, 59–70, 73–88, 93–121, 124–155
getprop.py	14	7	50%	26–35, 38–43
logcat.py	21	14	33%	25, 35–57
packages.py	172	153	11%	39–47, 50–72, 75–108, 111–167, 171–181, 186–217, 220–317
processes.py	13	6	54%	26, 36–42
root_binaries.py	25	18	28%	24, 34–36, 39–70
selinux_status.py	17	10	41%	26–35, 38–48
settings.py	25	18	28%	26–35, 38–58
sms.py	79	60	24%	56–65, 68–69, 77–90, 98–127, 137–151, 154–179
whatsapp.py	53	39	26%	31, 41–42, 50–60, 68–103, 106–113
src/mvt/android/modules/androidqf
aqf_files.py	78	23	71%	12–13, 78, 87–89, 93, 97–106, 111–114, 120, 129–134
aqf_log_timestamps.py	24	24	0%	6–62
aqf_packages.py	58	7	88%	46–51, 74, 79, 84, 104
aqf_settings.py	24	2	92%	51–52
base.py	43	2	95%	73–74
mounts.py	29	15	48%	51–74
root_binaries.py	44	6	86%	76–78, 81–82, 101
sms.py	49	13	73%	54, 57, 62–63, 79–84, 87, 91–97, 102–103
src/mvt/android/modules/backup
base.py	35	3	91%	61–62, 67
helpers.py	22	1	95%	27
sms.py	33	4	88%	40, 44, 47–48
src/mvt/android/modules/bugreport
base.py	58	18	69%	47–48, 53–54, 61–66, 70, 85–92, 96–97
dumpsys_accessibility.py	17	3	82%	38–42, 51
dumpsys_activities.py	16	2	88%	42–46
dumpsys_adb_state.py	16	3	81%	38–42, 51
dumpsys_appops.py	15	2	87%	38–42
dumpsys_battery_daily.py	15	2	87%	38–42
dumpsys_battery_history.py	15	2	87%	38–42
dumpsys_dbinfo.py	16	2	88%	40–44
dumpsys_getprop.py	26	7	73%	40–44, 51–52, 57–60
dumpsys_packages.py	24	3	88%	39–43, 56
dumpsys_platform_compat.py	16	2	88%	38–42
dumpsys_receivers.py	25	9	64%	39–47, 54–58
tombstones.py	24	5	79%	39–43, 52, 57–59
src/mvt/android/parsers
backup.py	110	9	92%	62, 102–103, 109, 129, 132, 175, 190–191
src/mvt/common
artifact.py	10	1	90%	22
cmd_check_iocs.py	41	32	22%	30–44, 47–92
command.py	143	50	65%	79–85, 91–109, 117–130, 140–168, 174–178, 181–183, 189, 223, 240, 244–245
indicators.py	325	72	78%	39–41, 54–60, 139, 151, 157, 163, 169, 191, 205–210, 293, 305, 317, 359–362, 379, 404–422, 449, 471, 502, 521, 536–542, 555–563, 574, 598, 623, 632–639, 654, 679–692, 703, 706, 733, 780–793, 804, 822
logo.py	42	35	17%	18–83, 89–96
module.py	126	43	66%	71–79, 84–88, 103–123, 164, 173, 178, 188, 207–208, 224–225, 241–255
options.py	13	3	77%	27–33
updates.py	160	134	16%	27–38, 43–56, 61–69, 72–74, 81–89, 92–94, 97–114, 117–137, 140–178, 185–219, 226–236, 239–269
url.py	25	6	76%	327, 366, 372–376
utils.py	108	37	66%	49–51, 64, 96–97, 111, 125–126, 165–182, 197–198, 211–212, 219–228, 243, 253, 261
virustotal.py	23	13	43%	25–52
src/mvt/ios
cli.py	149	66	56%	62, 82–85, 96, 125–169, 188–211, 254–255, 288–311, 334–347, 355–356
cmd_check_fs.py	14	4	71%	33–48, 51
decrypt.py	114	92	19%	33–36, 39, 48–56, 61–64, 73–123, 131–181, 192–221, 227–231, 244–255
versions.py	32	3	91%	21, 30, 48
src/mvt/ios/modules
base.py	90	23	74%	54, 64, 71–96, 114, 122, 129, 137–138, 157–160, 195–196
net_base.py	123	48	61%	68–70, 100–101, 182–237, 252–263, 275, 320–321, 329–330, 334
src/mvt/ios/modules/backup
backup_info.py	29	2	93%	43, 79
configuration_profiles.py	67	46	31%	43–48, 58, 61–88, 103–178
manifest.py	81	8	90%	59, 66, 112–118, 123, 169–170
profile_events.py	51	32	37%	44, 55, 58–67, 71–97, 103–110, 113
src/mvt/ios/modules/fs
analytics.py	65	50	23%	34, 44, 52–77, 80–137, 140–143, 146–152
analytics_ios_versions.py	36	26	28%	30, 40, 48–86
cache_files.py	46	35	24%	24, 34–45, 48–62, 65–80, 92–99
filesystem.py	42	8	81%	52, 56–57, 61, 77–78, 89–90
net_netusage.py	18	10	44%	34, 44–57
safari_favicon.py	37	26	30%	31, 41, 50–60, 63–115, 118–124
shutdownlog.py	65	54	17%	30, 40, 49–69, 72–127, 130–133
version_history.py	20	9	55%	32, 42, 50–65
webkit_base.py	22	16	27%	17–24, 27–38
webkit_indexeddb.py	13	4	69%	34, 44, 53–54
webkit_localstorage.py	12	4	67%	32, 42, 51–52
webkit_safariviewservice.py	10	3	70%	32, 42–43
src/mvt/ios/modules/mixed
applications.py	75	46	39%	50–57, 61–97, 103–111, 117–122, 132–144, 150, 152–154
calendar.py	49	2	96%	75–78
calls.py	22	10	55%	41, 53–82
chrome_favicon.py	36	23	36%	42, 50–60, 66–104
chrome_history.py	30	17	43%	44, 54–61, 67–102
contacts.py	28	17	39%	45–75
firefox_favicon.py	32	19	41%	43, 52–62, 68–106
firefox_history.py	30	17	43%	47, 55–62, 68–101
global_preferences.py	27	2	93%	45, 47
idstatuscache.py	56	39	30%	46, 55–72, 75–105, 110–120
interactionc.py	55	40	27%	251–275, 281–320
locationd.py	83	65	22%	58–70, 73–133, 136–155, 160–172
osanalytics_addaily.py	31	17	45%	45, 56–63, 70–98
safari_browserstate.py	76	30	61%	68, 71–75, 96–108, 115–135, 170, 176–183
safari_history.py	70	44	37%	48, 59–98, 107, 110–113, 116–151, 163–171
shortcuts.py	67	50	25%	47–55, 71–78, 84–153
sms.py	69	13	81%	74, 86, 110–127, 140, 154
sms_attachments.py	42	24	43%	44, 57–74, 97–128
tcc.py	83	31	63%	68, 85, 108–128, 143–146, 166–208
webkit_resource_load_statistics.py	52	10	81%	67–68, 93–94, 128–135
webkit_session_resource_log.py	86	63	27%	56–66, 70, 73–113, 119–165, 172–189
whatsapp.py	51	38	25%	43–48, 56–63, 69–135
TOTAL	6639	2617	61%

Tests	Skipped	Failures	Errors	Time
109	1 💤	0 ❌	0 🔥	7.719s ⏱️