Getting android debuggable default value for release build true

Question

I have not set attribute debuggable in AndroidManifest nor in build gradle. Niether any of library I used in my project does not use this attribute.

As default value for attribute debuggable is false. However, I am getting debuggable true in AndroidManifest by reverse engineering team. How it can be track down. Where I am missing?

Answer 1

You could do a quick check as follows:

If you want to check whether the signed release apk is debuggable use the below aapt command.

aapt dump badging /path/to/apk | grep -c application-debuggable

Outputs 1: Debuggable Outputs 0: Not Debuggable.

If your apk if found to be debuggable using aapt then you might need to try explicitly mentioning android:debuggable=false in your AndroidManifest.xml file.

or,

Do a deep dive of all the dependencies in your project, check whether debuggable is getting set from any where else.

Hope that helps.