uraniborg: Major upgrade to version 2.

- added a VERSION file
- amended the README.md to reference the VERSION file.

Hubble:
- changed compileSdkVersion to CompileSdk.

  build.gradle:
  - changed compileSdkVersion to CompileSdk, and set it to 35.
  - also bumped targetSdkVersion to 35.
  - bumped versionCode to 10
  - bumped versionName to "2.0.0".
  - updated some dependencies, except "androidx.appcompat:appcompat",
    which still stays at 1.0.2.

  gradle.properties:
  - disabled enabling Jetifier, as dependency analysis shows that it
    currently isn't being utilized.
  - disabled buildconfig, as it seems to be being deprecated.

  MainActivity:
  - re-encoded version name to VERSION constant since we phased out
    BuildConfig.
  - changed data structure backing a dictionary mapping package name to package
    metadata from HashMap to TreeMap such that it is automatically sorted.
    This helps with output comparison, such that `diff` can provide better
    output.
  - added new result file named `preinstalled_packages.txt` that lists only
    preinstalled APKs, where `packages.txt` would continue to list *all*
    installed packages.

  PackageMetadata:
  - added a new flag and logic to determine whether an APK is preinstalled or not.

docs/hubble_results.md:
- added a new field indicating whether a package is preloaded or not.

prebuilt/APK:
- added a release signed Hubble-v2.0.0.apk
- updated the `latest` pointer to point to Hubble-v2.0.0.apk

scripts/python/automate_observation.py:
- added new capability to pull APKs, by supplying `--pull-all-apks` flag.

scripts/python/data/V-GSI.json:
- added new baseline packages from GSI of Android 15.

scripts/python/package_whitelists.py:
- added new API level mapping to BaselinePackages class.

scripts/python/risk_analyzer.py:
- added risk classes for Android V.
- also updated the permission list within RiskyPermissions class, and it is now
  in sync with https://github.com/DEKRA-Cybersecurity/MAS-Preloaded-Apps-Scripts/blob/main/config/methods_config.yml
  up to Android 14.

Test: Rebuilt everything and ran on a komodo device running Android 15,
and everything worked out, including APK extractions.
Risk scoring also works on results from Android 15.

uraniborg/AndroidStudioProject/Hubble/app/build.gradle

@@ -1,13 +1,13 @@
 apply plugin: 'com.android.application'
 
 android {
-    compileSdkVersion 34
     defaultConfig {
+        compileSdk 35
         applicationId "com.uraniborg.hubble"
         minSdkVersion 23
-        targetSdkVersion 34
-        versionCode 5
-        versionName "1.3.0"
+        targetSdkVersion 35
+        versionCode 10
+        versionName "2.0.0"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
     }
     buildTypes {
@@ -26,9 +26,9 @@ android {
 dependencies {
     implementation fileTree(dir: 'libs', include: ['*.jar'])
     implementation 'androidx.appcompat:appcompat:1.0.2'
-    implementation 'androidx.constraintlayout:constraintlayout:1.1.3'
-    testImplementation 'junit:junit:4.12'
-    androidTestImplementation 'androidx.test:runner:1.1.1'
-    androidTestImplementation 'androidx.test.espresso:espresso-core:3.1.1'
+    implementation 'androidx.constraintlayout:constraintlayout:2.1.4'
+    testImplementation 'junit:junit:4.13.2'
+    androidTestImplementation 'androidx.test:runner:1.6.2'
+    androidTestImplementation 'androidx.test.espresso:espresso-core:3.6.1'
     implementation 'org.jetbrains:annotations-java5:15.0'
 }

uraniborg/AndroidStudioProject/Hubble/app/src/main/java/com/uraniborg/hubble/MainActivity.java

@@ -28,6 +28,7 @@
 import android.util.Base64;
 import android.util.Log;
 
+import java.util.TreeMap;
 import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
 import org.jetbrains.annotations.NotNull;
@@ -46,10 +47,13 @@ public class MainActivity extends AppCompatActivity {
   final String TAG = "HUBBLE";
 
   // semantically tie the notion of app version to versionName, which we will update for every
-  // major and minor release, instead of independently and separately update these values everytime.
-  private final String VERSION = BuildConfig.VERSION_NAME;
+  // major and minor release. Unfortunately, for now, we have to independently and separately
+  // update these values everytime we do any revisions because BuildConfig is phased out.
+  private final String VERSION = "2.0.0";
 
-  private HashMap<String, PackageMetadata> mAllPackages;
+  // We're changing to TreeMap so that package names are sorted. This would ease output comparison.
+  private TreeMap<String, PackageMetadata> mAllPackages;
+  private TreeMap<String, PackageMetadata> mPreinstalledPackages;
   private HashMap<String, byte[]> mAllCertificates;
   private HashMap<String, BinaryInfo> mAllBinaries;
   private HashMap<String, LibraryInfo> mAllLibraries;
@@ -65,7 +69,8 @@ public class MainActivity extends AppCompatActivity {
 
   private boolean initialize() {
     final String tag = TAG + "-INIT";
-    mAllPackages = new HashMap<>();
+    mAllPackages = new TreeMap<>();
+    mPreinstalledPackages = new TreeMap<>();
     mAllCertificates = new HashMap<>();
     mAllBinaries = new HashMap<>();
     mAllLibraries = new HashMap<>();
@@ -115,6 +120,9 @@ private void getInstalledPackagesInformation() {
     for (PackageInfo pkg : installedPackagesAndApexes) {
       PackageMetadata pkgMetadata = PackageMetadata.parse(this, pkg, mPackageManager);
       mAllPackages.put(pkg.packageName, pkgMetadata);
+      if (pkgMetadata.isPreinstalled) {
+        mPreinstalledPackages.put(pkg.packageName, pkgMetadata);
+      }
     }
     Log.d(tag, String.format("There are %d packages (including APEX)", mAllPackages.size()));
   }
@@ -166,7 +174,7 @@ private void getAllBinaries() {
     // first get the system path
     String binPaths = System.getenv("PATH");
     if (binPaths == null) {
-      Log.e(tag, String.format("Error getting system PATH environment value."));
+      Log.e(tag, "Error getting system PATH environment value.");
       return;
     }
     Log.d(tag, String.format("binPaths: %s", binPaths));
@@ -284,6 +292,7 @@ private void getDeviceProperties() {
   private void writePackagesToFile() {
     final String tag = TAG + "-W_PKG";
     final String PKG_FILENAME = "packages.txt";
+    final String PREINSTALL_FILENAME = "preinstalled_packages.txt";
 
     String header = String.format(HEADER_FMT, VERSION, "totalPackages", mAllPackages.size(),
         "packages");
@@ -299,6 +308,22 @@ private void writePackagesToFile() {
       i++;
     }
     Utilities.writeToFile(this, PKG_FILENAME, FOOTER_STR, true);
+
+    // write preload info to preload file.
+    header = String.format(HEADER_FMT, VERSION, "totalPreinstalledPackages",
+            mPreinstalledPackages.size(), "preinstalledPackages");
+    Utilities.writeToFile(this, PREINSTALL_FILENAME, header, false);
+    int j = 0;
+    for (PackageMetadata preinstalledMetadata : mPreinstalledPackages.values()) {
+      Utilities.writeToFile(this, PREINSTALL_FILENAME,
+              preinstalledMetadata.getJSONString(skip), true);
+      if (j == mPreinstalledPackages.size() - 1) {
+        continue;
+      }
+      Utilities.writeToFile(this, PREINSTALL_FILENAME, ",\n", true);
+      j++;
+    }
+    Utilities.writeToFile(this, PREINSTALL_FILENAME, FOOTER_STR, true);
   }
 
   private void writeCertsToFile() {

uraniborg/AndroidStudioProject/Hubble/app/src/main/java/com/uraniborg/hubble/PackageMetadata.java

@@ -55,6 +55,7 @@ public class PackageMetadata extends BaseInfo {
   protected boolean isFactoryTest = false;
   protected boolean isSuspended = false;
   protected boolean isApex = false;
+  protected boolean isPreinstalled = false;
   protected boolean isHidden = false;
   protected boolean hasCode = true;
   protected boolean usesCleartextTraffic = true;
@@ -102,6 +103,9 @@ static public PackageMetadata parse(Context context, @NotNull PackageInfo packag
       result.isFactoryTest = ((appInfo.flags & ApplicationInfo.FLAG_FACTORY_TEST) != 0);
       result.isSuspended = ((appInfo.flags & ApplicationInfo.FLAG_SUSPENDED) != 0);
 
+      result.isPreinstalled = (((appInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) ||
+                                ((appInfo.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0));
+
       if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
         result.usesCleartextTraffic =
             (appInfo.flags & ApplicationInfo.FLAG_USES_CLEARTEXT_TRAFFIC) != 0;

uraniborg/AndroidStudioProject/Hubble/build.gradle

@@ -7,7 +7,7 @@ buildscript {
 
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:8.5.2'
+        classpath 'com.android.tools.build:gradle:8.6.1'
 
         // NOTE: Do not place your application dependencies here; they belong
         // in the individual module build.gradle files

uraniborg/AndroidStudioProject/Hubble/gradle.properties

@@ -16,8 +16,8 @@ org.gradle.jvmargs=-Xmx1536m
 # https://developer.android.com/topic/libraries/support-library/androidx-rn
 android.useAndroidX=true
 # Automatically convert third-party libraries to use AndroidX
-android.enableJetifier=true
-android.defaults.buildfeatures.buildconfig=true
+android.enableJetifier=false
+# android.defaults.buildfeatures.buildconfig=true
 android.nonTransitiveRClass=false
 android.nonFinalResIds=false
 

uraniborg/README.md

@@ -40,5 +40,9 @@ Below are links to more specific documentations.
 - [Scoring device preload risks](docs/device_scoring.md)
 - [Adding new baseline for new OS release](docs/adding_new_baseline.md)
 
+## Version
+The current version info can be found within the VERSION file, and in the
+build.gradle file of the Hubble app.
+
 ## Disclaimer
 This is not an officially supported Google product.

uraniborg/VERSION

@@ -0,0 +1 @@
+2.0.0

uraniborg/docs/hubble_results.md

@@ -93,6 +93,8 @@ indicating app developer's declaration of whether this package contains code or
 is purely data/resource APK.
 - hash: The SHA256 digest of the package/APK.
 - installLocation: The location where the APK is installed on the system.
+- isPreinstalled: A boolean flag indicating whether the APK is preinstalled or
+installed post setup.
 - isApex: A boolean flag indicating if this package is an [APEX](https://source.android.com/devices/tech/ota/apex) or not.
 - isEnabled: A boolean [flag](https://developer.android.com/reference/android/content/pm/ApplicationInfo.html#enabled)
 telling whether at the time of observation, this package is "active" or in the

uraniborg/prebuilts/APK/latest

@@ -1 +1 @@
-Hubble-v1.3.0.apk
+Hubble-v2.0.0.apk