diff --git a/src/mvt/android/artifacts/dumpsys_adb.py b/src/mvt/android/artifacts/dumpsys_adb.py index f714db27..18d5cfa2 100644 --- a/src/mvt/android/artifacts/dumpsys_adb.py +++ b/src/mvt/android/artifacts/dumpsys_adb.py @@ -10,7 +10,7 @@ class DumpsysADBArtifact(AndroidArtifact): - multiline_fields = ["user_keys"] + multiline_fields = ["user_keys", "keystore"] def indented_dump_parser(self, dump_data): """ @@ -67,9 +67,28 @@ def indented_dump_parser(self, dump_data): return res + def parse_xml(self, xml_data): + """ + Parse XML data from dumpsys ADB output + """ + import xml.etree.ElementTree as ET + + keystore = [] + keystore_root = ET.fromstring(xml_data) + for adb_key in keystore_root.findall("adbKey"): + key_info = self.calculate_key_info(adb_key.get("key").encode("utf-8")) + key_info["last_connected"] = adb_key.get("lastConnection") + keystore.append(key_info) + + return keystore + @staticmethod def calculate_key_info(user_key: bytes) -> str: - key_base64, user = user_key.split(b" ", 1) + if b" " in user_key: + key_base64, user = user_key.split(b" ", 1) + else: + key_base64, user = user_key, b"" + key_raw = base64.b64decode(key_base64) key_fingerprint = hashlib.md5(key_raw).hexdigest().upper() key_fingerprint_colon = ":".join( @@ -115,8 +134,24 @@ def parse(self, content: bytes) -> None: if parsed.get("debugging_manager") is None: self.log.error("Unable to find expected ADB entries in dumpsys output") # noqa return + + # Keystore can be in different levels, as the basic parser + # is not always consistent due to different dumpsys formats. + if parsed.get("keystore"): + keystore_data = b"\n".join(parsed["keystore"]) + elif parsed["debugging_manager"].get("keystore"): + keystore_data = b"\n".join(parsed["debugging_manager"]["keystore"]) else: - parsed = parsed["debugging_manager"] + keystore_data = None + + # Keystore is in XML format on some devices and we need to parse it + if keystore_data and keystore_data.startswith(b" + + + + + } +} +--------- 0.012s was the duration of dumpsys adb, ending at: 2025-02-04 20:25:58 \ No newline at end of file