$ git clone https://github.com/SecTheTech/AMDH.git; cd AMDH
$ python3 -m venv amdh
$ source amdh/bin/activate
(amdh) $ pip install -r requirement.txt

$ python amdh.py -h
usage: amdh.py [-h] [-d DEVICES] [-sS] [-sA] [-H] [-a ADB_PATH] [-t {e,d,3,s}] [-D APKS_DUMP_FOLDER] 
          [-rar] [-R] [-l] [-P] [-S SNAPSHOT_DIR] [-cS SNAPSHOT_REPORT] [-rS SNAPSHOT_TO_RESTORE] [-o OUTPUT_DIR]

Android Mobile Device Hardening

optional arguments:
  -h, --help            show this help message and exit
  -d DEVICES, --devices DEVICES
                        list of devices separated by comma or "ALL" for all connected devices
  -sS                   Scan the system settings
  -sA                   Scan the installed applications
  -H                    Harden system settings /!\ Developer Options and ADB will be disabled /!\ 
  -a ADB_PATH, --adb-path ADB_PATH
                        Path to ADB binary
  -t {e,d,3,s}          Type of applications:
                                e: enabled Apps
                                d: disabled Apps
                                3: Third party Apps
                                s: System Apps
  -D APKS_DUMP_FOLDER, --dump-apks APKS_DUMP_FOLDER
                        Dump APKs from device to APKS_DUMP_FOLDER directory
  -rar                  Remove admin receivers: Remove all admin receivers if the app is not a system App
                        Scan application option "-sA" is required
  -R                    For each app revoke all dangerous permissions
                        Scan application option "-sA" is required
  -l                    List numbered applications to disable, uninstall or analyze
  -P                    List current users processes
  -S SNAPSHOT_DIR, --snapshot SNAPSHOT_DIR
                        Snapshot the current state of the phone to a json file and backup applications into SNAPSHOT_DIR
  -cS SNAPSHOT_REPORT, --cmp-snapshot SNAPSHOT_REPORT
                        Compare SNAPSHOT_REPORT with the current phone state
  -rS SNAPSHOT_TO_RESTORE, --restore-snapshot SNAPSHOT_TO_RESTORE
                        Restore SNAPSHOT_TO_RESTORE
  -o OUTPUT_DIR, --output-dir OUTPUT_DIR
                        Output directory for reports and logs. Default: out

(amdh)$ python amdh.py -d SERIAL1,SERIAL2,SERIAL3 -sA -o reports

{
    "com.package.name": {
        "malware": true,
        "permissions": {
            "all_permissions": [
                "com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE",
                "com.google.android.c2dm.permission.RECEIVE",
                "com.google.android.providers.gsf.permission.READ_GSERVICES",
                "android.permission.WRITE_SYNC_SETTINGS",
                "android.permission.RECEIVE_BOOT_COMPLETED",
                "android.permission.AUTHENTICATE_ACCOUNTS"
            ],
            "dangerous_perms": {
                "android.permission.ACCESS_FINE_LOCATION": "This app can get your location based on GPS or network location sources such as cell towers and Wi-Fi networks. These location services must be turned on and available on your phone for the app to be able to use them. This may increase battery consumption.",
                "android.permission.READ_EXTERNAL_STORAGE": "Allows the app to read the contents of your SD card.",
                "android.permission.ACCESS_COARSE_LOCATION": "This app can get your location based on network sources such as cell towers and Wi-Fi networks. These location services must be turned on and available on your phone for the app to be able to use them.",
                "android.permission.CAMERA": "This app can take pictures and record videos using the camera at any time.",
                "android.permission.WRITE_EXTERNAL_STORAGE": "Allows the app to write to the SD card."
            },
            "is_device_admin": false,
        }
    }
}

(amdh)$ python amdh.py -sS

(amdh)$ python amdh.py -sA -R -rar

   "is_device_admin_revoked": true,
   "revoked_dangerous_pemissions": "succeeded"

(amdh)$ python amdh.py -sS -H -o reports

(amdh)$ python amdh.py -l

(amdh)$ python amdh.py -P -d SERIAL1,SERIAL2 

(amdh)$ python amdh.py -S out
[-] INFO: Start ...
Unlock device SERIAL and press ENTER key to continue
[-] INFO: Finished

(amdh)$ python amdh.py -cS out/report.json
[-] INFO: Start ...

[-] INFO: Installed Apps after snapshot was taken
{}
[-] INFO: Apps exists in snapshot
{
    "com.package.name1": {
        "firstInstallTime": "2020-07-06 18:53:07",
        "lastUpdateTime": "2020-07-06 18:53:07",
        "grantedPermissions": [
            "com.google.android.c2dm.permission.RECEIVE",
            "android.permission.USE_CREDENTIALS",
            "android.permission.MODIFY_AUDIO_SETTINGS",
            "com.google.android.providers.gsf.permission.READ_GSERVICES",
            "android.permission.MANAGE_ACCOUNTS",
            "android.permission.NFC"
        ],
        "deviceAdmin": false,
        "apk": "com.package.name1.apk"
    },
    "com.package.name2": {
        "firstInstallTime": "2020-07-10 23:57:53",
        "lastUpdateTime": "2020-07-10 23:57:53",
        "grantedPermissions": [
            "android.permission.DOWNLOAD_WITHOUT_NOTIFICATION",
            "com.google.android.c2dm.permission.RECEIVE",
            "android.permission.USE_CREDENTIALS",
            "android.permission.MODIFY_AUDIO_SETTINGS",
            "org.thoughtcrime.securesms.ACCESS_SECRETS",
            "android.permission.ACCESS_NOTIFICATION_POLICY",
            "android.permission.CHANGE_NETWORK_STATE",
            "android.permission.FOREGROUND_SERVICE",
            "android.permission.WRITE_SYNC_SETTINGS"
        ],
        "deviceAdmin": false,
        "backup": "com.package.name2.ab",
        "apk": "com.package.name2.apk"
    }
}
[-] INFO: Uninstalled after snapshot was taken
{
    "com.package.name3": {
        "firstInstallTime": "2020-07-18 07:56:44",
        "lastUpdateTime": "2020-07-18 07:56:44",
        "grantedPermissions": [
            "android.permission.INTERNET",
            "android.permission.ACCESS_NETWORK_STATE"
        ],
        "deviceAdmin": false,
        "backup": "com.package.name3.ab",
        "apk": "com.package.name3.apk"
    }
}
[-] INFO: Changed settings after snapshot was taken
{
    "global": [
        "stay_on_while_plugged_in"
    ],
    "secure": [],
    "system": []
}

(amdh)$ python amdh.py -d SERIAL -rS out/report.json
[-] INFO: Start ...
Unlock device SERIAL and press ENTER key to continue
[-] INFO: Starting restore
[-] INFO: Restore finished
[-] INFO: Restore report
{
    "apps": {
        {
            "com.package.name1": {
                "install": "success",
                "backup": "restored"
            },
            "com.package.name2": {
                "install": "success",
                "backup": "NOT FOUND"
            },
            "com.package.name3": {
                "install": "success",
                "backup": "restored"
            }
        }
    }
}

(amdh) $ pip install pyinstaller 
(amdh) $ pyinstaller --clean amdh.spec