Update MASTG-DEMO-0006 to cover the remaining MASTG-TEST-0203 logging APIs

[dchapagain]

Following up on discussion #3948, where @cpholguera suggested updating MASTG-DEMO-0006 before adding a new static demo for MASTG-TEST-0231.

Context

MASTG-TEST-0203 lists the following APIs:
apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace]

MASTG-DEMO-0006 is currently its only demo. From what I can see, MastgTest.kt covers android.util.Log (v, i, w, d, e, wtf) and java.util.logging.Logger.severe, while run.sh hooks android.util.Log!* and java.util.logging.Logger!severe.

The API's that are not covered yet:

• System.out.print / println
• System.err.print / println
• Throwable.printStackTrace

Proposed change:

1. Add samples for the three APIs above to MastgTest.kt
2. Extend the hooks to java.io.PrintStream!print* and java.lang.Throwable!printStackTrace* (System.out and System.err are both PrintStream instances)
3. Regenerate output.txt and logcat_output.txt from a real run
4. Update the Steps / Observation / Evaluation sections to match

A few scope questions:

1. Tooling: Should this stay with frida-trace or migrate to frooky + hooks.json? The current demo instructions prefer frooky, and filterEventsByStacktrace looks useful for reducing the noise from hooking java.io.PrintStream.
2. Demo Conventions: MastgTest.kt has no // SUMMARY: comment and no // FAIL: [MASTG-TEST-0203] annotations. Should I bring it in line with the current demo instructions here, or keep the diff minimal?
3. Terminology: The demo title currently uses "...Looking for Secrets", while draft PR Fix and narrow terms for better scoping #3592 changes the terminology in this area toward "authenticators". Should this update stay aligned with the current master, or follow the wording from that PR?

I would like to work on this. Happy to be assigned.

[cpholguera]

It's assigned to you now @deepagain81. Please check if we're missing any other logging API and review the related knowledge (MASTG-KNOW-XXXX) article to ensure it is up to date and properly backing the test.

You can keep Frida for now instead of frooky. We'll port everything to frooky V1 once it's released.

In general, please keep the diff minimal to reduce the review effort.

[dchapagain]

Thanks! I will stick with Frida and keep the diff focused.

I reviewed MASTG-KNOW-0049 along with the related tests and best practice. It currently covers Log and Logger, but it backs MASTG-TEST-0203 and MASTG-TEST-0231, which also declare System.out.print, System.err.print, and Throwable#printStackTrace. The deprecated MASTG-TEST-0003 did note that "many application developers still use System.out.println or printStackTrace instead of a proper logging class", so it looks like this was lost in the v1 → v2 port.

A minimal fix would be adding those three with links to the official docs. The iOS "Logs" article (MASTG-KNOW-0101) is considerably fuller. Do you want the Android (MASTG-KNOW-0049) brought closer to it, or is that better as a separate issue?

Other logging APIs - candidates I found:

• Log.println / Log.isLoggable - currently filtered out in run.sh, but MASTG-BEST-0002 lists isLoggable in its ProGuard block. Should I include?
• Logger levels other than .severe (info, warning, fine, etc.)
• printStackTrace(PrintStream/PrintWriter) overloads, and System.out.printf / format
• Kotlin println - compiles to System.out so the same hook covers it; I would just add one line since it's idiomatic.

I would leave out android.util.Slog (privileged apps only) and third-party facades like Timber (needs a build dependency). Let me know which you want in, and I will get started.

[cpholguera]

In that case, let's start with a PR to update only MASTG-KNOW-0049 and the BEST article. The KNOW article should cover all the theory around logs, similarly to its iOS counterpart.

It should cover all the "native" Android logging available to developers, as well as any privacy options it may offer, e.g., redaction, if applicable. It should also highlight instances where Android doesn't offer these features, contrasting with iOS. You can also briefly mention third-party facades and why some developers opt for them.

You can briefly explain android.util.Slog, even though we won't use it in our tests. At least the reader will be aware of it.

Please align the content and language with the Android documentation. This and other pages:

https://developer.android.com/privacy-and-security/risks/log-info-disclosure

Also, please check whether the corresponding BEST has everything from the above page. I'm not sure if that's the case currently.

This should be a very good starting point for a first PR. After that, we can revisit the tests and demos. Thank you!

[dchapagain]

Thanks! This scope makes sense. I have started on the KNOW article, using MASTG-KNOW-0101 as a reference.

On MASTG-BEST-0002, it does not currently cover most of that material. It's written around ProGuard rather than R8. It is missing log-level management, sanitizing via toString(), the redaction section (tokenization, masking, filtering), the masking wrapper pattern, compile-time constants, and the incident response guidance. I will bring those in while keeping the existing Android-specific StringBuilder note.

One housekeeping question: this issue is currently scoped to the MASTG-DEMO-0006 update. Should I retitle it for the KNOW + BEST work and open a separate issue for the demo later, or would you rather keep this one for the demo and have a new issue for the docs?