Android device analysis produces detections without further information

[Lordakius]

Using the current git-branch (commit 883b450) on an old Pixel 4 with Graphene apparently produces 4 detections while all the modules did not produce any.

WARNING - The analysis of the Android device produced 4 detections!

I was not able to find the mentioned detections anywhere, specially because no module reported any detections.

Any ideas where I can find them? I can also provide the complete log if this helps.

[besendorf]

Could you try generating https://github.com/mvt-project/androidqf/ and then running mvt against it? If the issue persists then you can share the androidqf .zip with us so we can reproduce the error.
Edit: or a bugreport. That contains less data.

[besendorf]

Maybe it's also a misunderstanding. That counter counts all warnings. Did you have warning in stdout/command.log?

[Lordakius]

That one might be the solution:

cat command.log | grep -i warning
2025-06-22 21:15:25,457 - mvt.android.modules.adb.getprop - WARNING - This phone has not received security updates for more than six months (last update: 2022-11-01)
2025-06-22 21:15:25,603 - mvt.android.modules.adb.settings - WARNING - Found suspicious "secure" setting "install_non_market_apps = 1" (enabled installation of non Google Play apps)
2025-06-22 21:15:53,177 - mvt.android.modules.adb.dumpsys_appops - WARNING - Risky package 'com.android.shell' had 'VIBRATE' permission set to 'Access' at 2022-04-29 18:11:48.012000
2025-06-22 21:15:53,177 - mvt.android.modules.adb.dumpsys_appops - WARNING - Risky package 'com.android.shell' had 'TURN_ON_SCREEN' permission set to 'Access' at 2022-04-26 18:48:15.977000
2025-06-22 21:15:53,183 - mvt.android.modules.adb.dumpsys_appops - WARNING - Package 'org.chromium.chrome' had risky permission 'REQUEST_INSTALL_PACKAGES' set to 'Reject' at 2023-06-01 14:19:37.967000
2025-06-22 21:15:53,184 - mvt.android.modules.adb.dumpsys_appops - WARNING - Package 'org.chromium.chrome' had risky permission 'REQUEST_INSTALL_PACKAGES' set to 'Access' at 2023-06-01 14:19:41.555000
2025-06-22 21:15:53,186 - mvt.android.modules.adb.dumpsys_appops - WARNING - Package 'com.aurora.store' had risky permission 'REQUEST_INSTALL_PACKAGES' set to 'Access' at 2023-03-24 19:43:50.230000
2025-06-22 21:15:53,187 - mvt.android.modules.adb.dumpsys_appops - WARNING - Package 'com.aurora.store' had risky permission 'REQUEST_INSTALL_PACKAGES' set to 'Access' at 2024-11-08 12:25:16.672000
2025-06-22 21:15:53,189 - mvt.android.modules.adb.dumpsys_appops - WARNING - Package 'com.machiav3lli.fdroid' had risky permission 'REQUEST_INSTALL_PACKAGES' set to 'Reject' at 2023-02-22 12:07:25.388000
2025-06-22 21:15:53,190 - mvt.android.modules.adb.dumpsys_appops - WARNING - Package 'com.machiav3lli.fdroid' had risky permission 'REQUEST_INSTALL_PACKAGES' set to 'Access' at 2024-06-28 10:36:05.886000
2025-06-22 21:17:34,880 - mvt.android.cmd_check_adb - WARNING - [bold]NOTE: Detected indicators of compromise[/bold]. Only expert review can confirm if the detected indicators are signs of an attack.
2025-06-22 21:17:34,881 - mvt - WARNING - The analysis of the Android device produced 4 detections!

I was confused because there are more than 4 warnings, but looking at it specifically made me realize that the 4 probably corresponds to the 4 different modules finding something.

Ignoring the security updates (its an old phone for testing), all the warnings are false positives.

Maybe the output can be changed to something more understandable, because the way it is written i assumed there were hard matches for IoCs (on that note: it would be awesome to have a match on which rule triggered, to allow specific investigation based on the rule)

[alimama999]

It is obvious that there are more than 4 detections.