mvt-project / androidqf

androidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of compromise.
https://mvt.re
Other
40 stars 8 forks source link

adb is left running resulting is issues rerunning androidqf #32

Closed r-tx closed 11 months ago

r-tx commented 1 year ago

Issue

With the Linux, Windows and Mac versions of AndroidQF, the adb process is left running after androidqf completes or is stopped

With some Linux end users I am seeing they are running into problems re-running androidqf. So far this appears to be after androidqf has been manually stopped, either quitting it while it's actively collecting data or after it fails to find a connected device[0].

DEBUG: Starting androidqf
DEBUG: failed to initialize adb: failed to find a usable adb executable: open <SNIP>/androidqf-v1.6.0-a2/adb: text file busy
DEBUG: failed to initialize adb: failed to initialize adb: failed to find a usable adb executable: open <SNIP>/androidqf-v1.6.0-a2/adb: text file busy

0: This has cropped up as a result of one of the below while androidqf is running or waiting for a device

To replicate

I was able to replicate this with v1.6.0 alpha2 on Ubuntu 22.04

  1. Run androidqf with device not yet connected.
  2. After the 2nd Unable to get device state error message you get a somewhat similar error to above:
DEBUG: ADB found at path:  <SNIP>/androidqf-v1.6.0-a2/adb
DEBUG: Starting get-state
DEBUG: get-state failed
DEBUG: failed to get adb state: fork/exec  <SNIP>/androidqf-v1.6.0-a2/adb: text file busy
DEBUG: failed to initialize adb: failed to get adb state (are you sure a device is connected?): fork/exec  <SNIP>/androidqf-v1.6.0-a2/adb: text file busy
Unable to get device state. Please make sure it is connected and authorized. Trying again in 5 seconds...

Work around

  1. Kill the running adb process - this tends to be problematic and assistance needs to be provided.
  2. Delete the adb file dropped by androidqf.
  3. Run androidqf.
r-tx commented 11 months ago

Also seeing similar on Windows, tested with v1.61

r-tx commented 11 months ago

Having played around a little more with v1.61. The existing adb looks to behave differently in a couple of scenarios

DEBUG: Starting androidqf
Impossible to initialize adb

It seems like maybe the best option would be to have androidqf kill adb at the end of the run or if it exits uncleanly.

DonnchaC commented 11 months ago

I've pushed a branch in #36 which I hope fixed these issues. @r-tx does it solve the problem for you on Linux?

r-tx commented 11 months ago

I've tested on Linux, Windows and MacOS and it looks to handle a pre-existing adb process well now, thank you very much for this!

I do note that the 3 platforms produce differing errors through out the process and the extracted data differs. But that's a ticket for another day...

DonnchaC commented 11 months ago

Excellent. I'm happy that we appear to have fixed this breaking issue. Please open a ticket with any other inconsistencies you encounter and we will try resolve those too.