mvt-project / mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
https://mvt.re
Other
10.06k stars 919 forks source link

"No device found" for Android Virtual Devices (AVD) #463

Open Spencer-PW opened 5 months ago

Spencer-PW commented 5 months ago

I'm trying to doing a dynamic malicious APK analysis with AVD & MVT, so I installed & launched AVD in Ubuntu 22.04:

$ emulator -avd AVD_NAME
$ adb devices
List of devices attached
emulator-5554   device

And I started mvt-android and got:


        MVT - Mobile Verification Toolkit
                https://mvt.re
                Version: 2.5.0
                Your indicators files seem to be up to date.

15:40:07 INFO     [mvt.android.cmd_check_adb] Parsing STIX2 indicators file at path 
...
...                                                                                              
         INFO     [mvt.android.cmd_check_adb] Loaded a total of 9585 unique indicators                                         
         INFO     [mvt] Checking Android device over debug bridge                                                              
         INFO     [mvt.android.modules.adb.chrome_history] Running module ChromeHistory...                                     
         CRITICAL [mvt.android.modules.adb.chrome_history] No device found. Make sure it is connected and unlocked.

May I know why is it still "no device found" although my AVD has been connected with adb?

Spencer-PW commented 4 months ago

By doing some tests, I found out that this is because Python's libusb1 lib only supports either USB devices or TCP, while AVD is not connected to the host using these two approaches.

roaree commented 4 months ago

Thanks @Spencer-PW for finding this out - if you see anywhere in the docs we could clarify this, would welcome a PR.

Spencer-PW commented 4 months ago

if you see anywhere in the docs we could clarify this, would welcome a PR

@roaree I'm still searching for a way to connect MVT to AVD, so let me do this after I get a solution... :(