Skip to content

Android Dynamic Debugging

Basic Principles of Android Debugging

Generally speaking, Android determines whether an application can be debugged in the following order:

  1. Check whether ro.debuggable in boot.img is set to 1. If it is 1, any application on the phone can be debugged.
  2. Otherwise, check whether the \<application> element in the corresponding application's AndroidManifest.xml contains android:debuggable="true". If so, debugging support will be enabled.

Naturally, we also have two methods to make an application debuggable:

  1. Unpack an apk file, add android:debuggable="true" to the \<application> element, then repackage and sign it.
  2. Modify ro.debuggable in boot.img to 1.

Generally speaking, since the former requires us to modify the application each time, which is rather cumbersome, we tend to prefer the latter.

For the latter approach, we need to root the phone and flash the relevant image. (!!Find a suitable article!!)

Additionally, emulators generated by Android AVD have ro.debuggable set to 1 by default.

The value of ro.debuggable can be queried using the following command:

adb shell getprop ro.debuggable

Basic Debugging Tools

DDMS

DDMS (Dalvik Debug Monitor Service) is a debugging and monitoring service for the Dalvik virtual machine. It can monitor the state and results of Android programs during execution, which can greatly speed up our program analysis efficiency. This is a tool provided by the Android SDK, which includes features such as device screenshots, viewing running thread information, file browsing, Logcat, Method Profiling, broadcast state information, simulating phone calls, receiving SMS, and more. This tool is generally located in the tools directory of the Android SDK, where ddms.bat is used to launch DDMS. The most important features of DDMS are:

  • File browsing: We can observe and analyze the file creation, modification, and deletion operations performed by the program during execution.
  • Logcat: Can output debugging information of the software.
  • Method Profiling: Can trace the execution flow of the program.

IDEA/Android Studio

Install the smaliidea plugin for dynamic debugging of smali.

IDA Pro

52pojie (Chinese reverse engineering community).