Merge pull request #15 from lsd-cat/codex/verify-java-detection-matches-python-implementation

Ensure Java Android detection matches Python logic

Author: lsd-cat

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysBatteryDaily.java

@@ -54,7 +54,7 @@ public void checkIndicators() {
         for (Object obj : results) {
             @SuppressWarnings("unchecked")
             Map<String, String> rec = (Map<String, String>) obj;
-            detected.addAll(indicators.matchString(rec.get("package_name"), IndicatorType.PROCESS));
+            detected.addAll(indicators.matchString(rec.get("package_name"), IndicatorType.APP_ID));
         }
     }
 }

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysBatteryHistory.java

@@ -80,7 +80,7 @@ public void checkIndicators() {
         for (Object obj : results) {
             @SuppressWarnings("unchecked")
             Map<String, String> rec = (Map<String, String>) obj;
-            detected.addAll(indicators.matchString(rec.get("package_name"), IndicatorType.PROCESS));
+            detected.addAll(indicators.matchString(rec.get("package_name"), IndicatorType.APP_ID));
         }
     }
 }

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysDBInfo.java

@@ -61,7 +61,7 @@ public void checkIndicators() {
             Map<String, String> map = (Map<String, String>) obj;
             String path = map.getOrDefault("path", "");
             for (String part : path.split("/")) {
-                detected.addAll(indicators.matchString(part, IndicatorType.PROCESS));
+                detected.addAll(indicators.matchString(part, IndicatorType.APP_ID));
             }
         }
     }

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysPackageActivities.java

@@ -51,7 +51,7 @@ public void checkIndicators() {
         for (Object obj : results) {
             @SuppressWarnings("unchecked")
             Map<String, String> rec = (Map<String, String>) obj;
-            detected.addAll(indicators.matchString(rec.get("package_name"), IndicatorType.PROCESS));
+            detected.addAll(indicators.matchString(rec.get("package_name"), IndicatorType.APP_ID));
         }
     }
 }

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysPlatformCompat.java

@@ -34,7 +34,7 @@ public void checkIndicators() {
             @SuppressWarnings("unchecked")
             Map<String, String> map = (Map<String, String>) obj;
             String pkg = map.get("package_name");
-            detected.addAll(indicators.matchString(pkg, IndicatorType.PROCESS));
+            detected.addAll(indicators.matchString(pkg, IndicatorType.APP_ID));
         }
     }
 }

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysReceivers.java

@@ -42,7 +42,7 @@ public void checkIndicators() {
             @SuppressWarnings("unchecked")
             Map<String, String> map = (Map<String, String>) obj;
             String pkg = map.get("package_name");
-            detected.addAll(indicators.matchString(pkg, IndicatorType.PROCESS));
+            detected.addAll(indicators.matchString(pkg, IndicatorType.APP_ID));
         }
     }
 }

java/src/main/java/org/osservatorionessuno/libmvt/android/artifacts/Processes.java

@@ -61,8 +61,8 @@ public void checkIndicators() {
             Map<String, Object> map = (Map<String, Object>) obj;
             String name = (String) map.get("proc_name");
             if ("gatekeeperd".equals(name)) continue;
-            detected.addAll(indicators.matchString(name, IndicatorType.PROCESS));
             detected.addAll(indicators.matchString(name, IndicatorType.APP_ID));
+            detected.addAll(indicators.matchString(name, IndicatorType.PROCESS));
         }
     }
 }

java/src/test/java/org/osservatorionessuno/libmvt/android/artifacts/DumpsysBatteryDailyTest.java

@@ -30,6 +30,6 @@ public void testIocCheck() throws Exception {
         Indicators ind = Indicators.loadFromDirectory(Path.of("src", "test", "resources", "iocs").toFile());
         bd.setIndicators(ind);
         bd.checkIndicators();
-        assertEquals(0, bd.getDetected().size());
+        assertEquals(1, bd.getDetected().size());
     }
 }