From 6cf3f2ce8dbbb741dbc1545e7abc9428e734ae83 Mon Sep 17 00:00:00 2001 From: Janik Besendorf Date: Wed, 27 Aug 2025 18:24:27 +0200 Subject: [PATCH 1/2] Add Mounts module to collect /system mount information --- modules/modules.go | 1 + modules/mounts.go | 76 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 modules/mounts.go diff --git a/modules/modules.go b/modules/modules.go index aa10918..ca87da9 100644 --- a/modules/modules.go +++ b/modules/modules.go @@ -32,6 +32,7 @@ func List() []Module { NewSELinux(), NewEnvironment(), NewRootBinaries(), + NewMounts(), NewLogcat(), NewLogs(), NewTemp(), diff --git a/modules/mounts.go b/modules/mounts.go new file mode 100644 index 0000000..846519e --- /dev/null +++ b/modules/mounts.go @@ -0,0 +1,76 @@ +// androidqf - Android Quick Forensics +// Copyright (c) 2021-2023 Claudio Guarnieri. +// Use of this software is governed by the MVT License 1.1 that can be found at +// https://license.mvt.re/1.1/ + +package modules + +import ( + "slices" + "path/filepath" + "strings" + + "github.com/mvt-project/androidqf/acquisition" + "github.com/mvt-project/androidqf/adb" + "github.com/mvt-project/androidqf/log" +) + +type Mounts struct { + StoragePath string +} + +func NewMounts() *Mounts { + return &Mounts{} +} + +func (m *Mounts) Name() string { + return "mounts" +} + +func (m *Mounts) InitStorage(storagePath string) error { + m.StoragePath = storagePath + return nil +} + +func (m *Mounts) Run(acq *acquisition.Acquisition, fast bool) error { + log.Info("Collecting mount information") + + var mountsData []string + + // Run "mount | grep '/system'" + log.Debug("Running: mount | grep '/system'") + out1, err1 := adb.Client.Shell("mount | grep '/system'") + if err1 == nil && out1 != "" { + lines := strings.Split(strings.TrimSpace(out1), "\n") + for _, line := range lines { + if strings.TrimSpace(line) != "" { + mountsData = append(mountsData, strings.TrimSpace(line)) + } + } + } else { + log.Debug("mount | grep '/system' command failed or returned empty result") + } + + // Run "cat /proc/mounts | grep '/system'" + log.Debug("Running: cat /proc/mounts | grep '/system'") + out2, err2 := adb.Client.Shell("cat /proc/mounts | grep '/system'") + if err2 == nil && out2 != "" { + lines := strings.Split(strings.TrimSpace(out2), "\n") + for _, line := range lines { + if strings.TrimSpace(line) != "" { + trimmedLine := strings.TrimSpace(line) + // Avoid duplicates + found := slices.Contains(mountsData, trimmedLine) + if !found { + mountsData = append(mountsData, trimmedLine) + } + } + } + } else { + log.Debug("cat /proc/mounts | grep '/system' command failed or returned empty result") + } + + log.Debugf("Found %d mount entries", len(mountsData)) + + return saveCommandOutputJson(filepath.Join(m.StoragePath, "mounts.json"), &mountsData) +} From 6da373658ab775ed9a6705cf0a40c5c2e367af5d Mon Sep 17 00:00:00 2001 From: Janik Besendorf Date: Thu, 28 Aug 2025 19:30:56 +0200 Subject: [PATCH 2/2] get all mounts, not just /system --- modules/mounts.go | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/modules/mounts.go b/modules/mounts.go index 846519e..23fb29d 100644 --- a/modules/mounts.go +++ b/modules/mounts.go @@ -6,8 +6,8 @@ package modules import ( - "slices" "path/filepath" + "slices" "strings" "github.com/mvt-project/androidqf/acquisition" @@ -37,9 +37,9 @@ func (m *Mounts) Run(acq *acquisition.Acquisition, fast bool) error { var mountsData []string - // Run "mount | grep '/system'" - log.Debug("Running: mount | grep '/system'") - out1, err1 := adb.Client.Shell("mount | grep '/system'") + // Run "mount" + log.Debug("Running: mount") + out1, err1 := adb.Client.Shell("mount") if err1 == nil && out1 != "" { lines := strings.Split(strings.TrimSpace(out1), "\n") for _, line := range lines { @@ -48,12 +48,12 @@ func (m *Mounts) Run(acq *acquisition.Acquisition, fast bool) error { } } } else { - log.Debug("mount | grep '/system' command failed or returned empty result") + log.Debug("mount command failed or returned empty result") } - // Run "cat /proc/mounts | grep '/system'" - log.Debug("Running: cat /proc/mounts | grep '/system'") - out2, err2 := adb.Client.Shell("cat /proc/mounts | grep '/system'") + // Run "cat /proc/mounts" + log.Debug("Running: cat /proc/mounts") + out2, err2 := adb.Client.Shell("cat /proc/mounts") if err2 == nil && out2 != "" { lines := strings.Split(strings.TrimSpace(out2), "\n") for _, line := range lines { @@ -67,7 +67,7 @@ func (m *Mounts) Run(acq *acquisition.Acquisition, fast bool) error { } } } else { - log.Debug("cat /proc/mounts | grep '/system' command failed or returned empty result") + log.Debug("cat /proc/mounts command failed or returned empty result") } log.Debugf("Found %d mount entries", len(mountsData))