maxtac-android-runtime-debugging

What problem does it solve?

This Skill facilitates authorized Android runtime observation and proof collection, streamlining the process of capturing evidence for security research.

Core Features & Use Cases

• Runtime Observation: Monitor and capture ADB, logcat, JDWP, Frida, component launch, content-provider probing, appops, dumpsys, and runtime evidence.
• Evidence Capture: Utilize Core proof folders for durable evidence capture, including raw command output, logs, screenshots, recordings, scripts, inputs, and package metadata.
• Component and IPC Probes: Safely launch activities and send broadcasts, probe content providers, and use Binder or service hypotheses with caution.
• JDWP and Debuggable Apps: Attach to debuggable targets, record debugger attachment requirements, and manage debugger-dependent evidence.
• Frida on Android: Employ Frida for hooks, Java method observation, native JNI tracing, and targeted runtime state checks.
• Output: Persist device/API state, metadata, logs, Frida/JDWP scripts, content-provider outputs, and raw errors, and prepare concise handoffs to auditors.

Quick Start

Run the maxtac-android-runtime-debugging skill to capture runtime evidence for the package 'com.example.app'.