mvt-project / androidqf

androidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of compromise.
https://mvt.re
Other
35 stars 6 forks source link

Debug Windows issue #35

Closed DrWhax closed 9 months ago

DrWhax commented 10 months ago

AndroidQF is having problems extracting on Windows for some reason, we need to debug this.

I'll get a backtrace of the Go binary and see what's going wrong.

DonnchaC commented 10 months ago

Related to https://github.com/mvt-project/androidqf/issues/27

DrWhax commented 9 months ago

Some preliminary findings:

Now the question is why this happens, I need to dive a bit deeper into this.

DrWhax commented 9 months ago

I should be a bit more clear, it doesn't seem to be able to execute as it can't find them in the path. But it can extract the embedded binaries. Plot thickens.

DrWhax commented 9 months ago

AndroidQF mvt-project version executes adb.exe fine but is having some trouble with: "impossible to initialise the acquisition: failed to upload collector: exit status 1.

But maybe because it's a grapheneOS Android device? :)

This seem to suggest we should aim to backport the changes we have in this version on to the public one from Claudio.

DonnchaC commented 9 months ago

@DrWhax The plan is to make this version public once ready, and publish usable signed builds for Windows, Mac and Linux here. We can also backport fixes but the priority should be to get this version working.

penserbjorne commented 9 months ago

Is there anything we can help?

We are using our own compiled binaries on Linux, Windows and Mac and we don't have any problem.

We been using it on Windows 10, Windows 11, Mac Monterrey and Debian 12 (all of them the latest two weeks).

I'm compiling on Debian 12 with go version go1.19.8 linux/amd64.

The only "issue" that we have is related to certificates, we need to authorize the execution on Windows and Mac, but adb is working well.

r-tx commented 9 months ago

"impossible to initialise the acquisition: failed to upload collector: exit status 1. But maybe because it's a grapheneOS Android device? :)

I have had this error on Samsung S21 and S23 both with Android 13

DrWhax commented 9 months ago

Gotcha, I also had this on an older Nokia android phone. I'll debug the collector as well.

r-tx commented 9 months ago

Based on @penserbjorne's mention of it working with their build using Go 1.19.1 (not in debian12 repo) I cloned the repo again and built (make collector / make windows ) with Go 1.19.1, 1.20 and 1.21.

AndroidQF works on windows for all 3 of the builds, testing against GrapheneOS/Android14 and an old Samsung with Android 10. While v1.6.0-alpha-2 fails with the failed to upload collector: exit status 1 error on both phones.

There seems to have been a good few changes since the release, e.g. command line options for the release version having only -v while building from source gives -f -l -m -v.

So it seems maybe the best option is to do a new release with the latest code and that should get windows users up and running again I think

DonnchaC commented 9 months ago

Thanks so much @penserbjorne, @r-tx and @DrWhax for debugging these issues! I didn't realize we had significant changes from @Te-k that were not include in the released version.

I've tagged a new v1.6.1 release now and the built binaries are available on the releases page. We now have signing certificates for Mac and Windows. Can you test the v1.6.1 build and check that it also works well? If so I will push signed copies of these binaries for easier deployment.

r-tx commented 9 months ago

I am not seeing the Windows binary as signed - right click on exe -> properties -> Digital Signature tab is missing.

Otherwise it now runs as expected on the Android 10 and 14 devices I mentioned, though #32 does mean you can only run it once before having to kill the adb process.

I can check MacOS in the morning if no one else gets to it.

DonnchaC commented 9 months ago

I am not seeing the Windows binary as signed - right click on exe -> properties -> Digital Signature tab is missing.

Otherwise it now runs as expected on the Android 10 and 14 devices I mentioned, though #32 does mean you can only run it once before having to kill the adb process.

I can check MacOS in the morning if no one else gets to it.

I haven't signed the builds yet. I'll also try fix the bug you mention in #32 and then prepare a signed release.

r-tx commented 9 months ago

I haven't signed the builds yet.

That would indeed be a good reason for it not showing up then :D

Linux amd works - tested against Android 10, 11, 14 on Ubuntu 22.04 Linux arm works - tested against Android 10 on Debian 12 Windows amd works - tested against Android 10, 11, 14 on Windows 11 Mac arm works - tested against Android 10, 11, 14 on MacOS Sonoma

DrWhax commented 9 months ago

OK, this build also works for me.

r-tx commented 9 months ago

I haven't signed the builds yet. I'll also try fix the bug you mention in https://github.com/mvt-project/androidqf/issues/32 and then prepare a signed release.

I don't know if there is the bandwidth for it but it would also be useful to see if @penserbjorne's #12 could be fixed, which effects Samsung devices, before a public release.

DonnchaC commented 9 months ago

Thanks all for the very helpful testing and feedback. I think we can close this issue now as the Windows issue appears resolved.

I've have publish update v1.6.1 binaries which are now signed for Windows and Mac. I'll try fix #32 and #12 in their separate issues.