Skip to content

Instantly share code, notes, and snippets.

@jevakallio

jevakallio/readme.md

Last active June 20, 2025 08:25
Show Gist options
  • Save jevakallio/452c54ef613792f25e45663ab2db117b to your computer and use it in GitHub Desktop.
Save jevakallio/452c54ef613792f25e45663ab2db117b to your computer and use it in GitHub Desktop.
Download ZIP
`adb pull` from app data directory without root access
Raw
readme.md

TL;DR;

com.package.name is your app identifier, and the file path is relative to the app user's home directory, e.g. '/data/user/0/com.package.name.

adb shell run-as com.package.name cp relative/path/file.ext /sdcard
adb pull /sdcard/file.ext

See long explanation below.

Problem

Trying to adb pull files from our app's directory fails with Permission denied, because the adb user doesn't have access to the home directory.

adb pull /data/user/0/com.package.name/file.ext

Error:

adb: error: failed to stat remote object '/data/user/0/com.package.name/file.ext': Permission denied

You can try to run adb as root first:

adb root

But on a non-rooted device, this fails with:

adbd cannot run as root in production builds`

Here's a workaround on how to download a file from the app data directory using run-as.

Long version

This explains the solution step by step.

Start a shell session on the device. All following commands will be executed in the shell session on your device.

adb shell

Assuming our app identifier is com.package.name, the app data directory is at /data/user/0/com.package.name.

You can try to list files in that directory:

ls /data/user/0/com.package.name

This should result in error:

ls: /data/user/0/com.package.name/: Permission denied

However, you can run a command using the com.package.name application identity with the run-as command

run-as com.package.name ls /data/user/0/com.package.name/

You should now see a directory listing, and you can find the file you want, and copy it to a directory on your device that doesn't require root access, e.g. /sdcard:

run-as com.package.name cp /data/user/0/com.package.name/file.ext /sdcard

We can then exit the adb shell:

exit

Back at our own computer, we can adb pull the file:

adb pull /sdcard/file.ext
@crok
Copy link

crok commented Oct 9, 2023 

# Pull
adb shell "run-as $package dd if=$1" | dd of=$2

# Push
dd of=$1 | adb shell "run-as $package dd of="$2"

The one and only thing that prevents users to make proper backups with this method is that run-as only works with apps that has debuggable set enabled in their Android manifest :\ It does work for you because your RC and dev. builds are definitely has debuggable enabled. Or in case the ROM has an implementation that does not respect the debuggable flag..
Anyway, thank you for the info and effort you put into the this and your article.

@kdrkdrkdr
Copy link

kdrkdrkdr commented Oct 14, 2023 •
edited
Loading

This script can make app debuggable!

apk_name=com.example
apk_location=$(adb shell pm list packages -f -3 | grep $apk_name | sed 's/.*:\(.*\).apk.*/\1/').apk
adb pull $apk_location original.apk
keytool -genkey -v -keystore resign.keystore -storepass androiddbg -alias androiddbg -dname "CN=Android Debug,O=Android,C=US"
python make_debuggable.py apk original.apk patched.apk resign.keystore androiddbg
adb uninstall $apk_name
adb install patched.apk

Push file example!

tmp="/data/local/tmp"
adb push /home/Desktop/a.txt $tmp
adb shell run-as com.example cp $tmp $dst

Pull file example!

app="com.example"
adb -d shell "run-as $app cat /data/user/0/$app/file.txt" > file.txt

@gokaybiz
Copy link

This script can make app debuggable!

apk_name=com.example
apk_location=$(adb shell pm list packages -f -3 | grep $apk_name | sed 's/.*:\(.*\).apk.*/\1/').apk
adb pull $apk_location original.apk
keytool -genkey -v -keystore resign.keystore -storepass androiddbg -alias androiddbg -dname "CN=Android Debug,O=Android,C=US"
python make_debuggable.py apk original.apk patched.apk resign.keystore androiddbg
adb uninstall $apk_name
adb install patched.apk

Push file example!

tmp="/data/local/tmp"
adb push /home/Desktop/a.txt $tmp
adb shell run-as com.example cp $tmp $dst

Pull file example!

app="com.example"
adb -d shell "run-as $app cat /data/user/0/$app/file.txt" > file.txt

https://github.com/julKali/makeDebuggable/raw/master/makeDebuggable.py

@mickael28
Copy link

mickael28 commented Mar 17, 2024 •
edited
Loading

@kdrkdrkdr @gokaybiz @jevakallio , with this script getting this error, any idea what it could be pls?

https://github.com/julKali/makeDebuggable/raw/master/makeDebuggable.py

python make_debuggable.py apk original.apk patched.apk resign.keystore androiddbg

File "D:\Temp\APKs-for-NvidiaShield\apks\adb\make_debuggable.py", line 611, in
patchApk(sys.argv[2], sys.argv[3], sys.argv[4], sys.argv[5], sys.argv[6])
~~~~~~~~^^^
IndexError: list index out of range

Bypassed the error adding 'androiddbg' at the end, but then it fails with:

$ python make_debuggable.py apk original.apk patched.apk resign.keystore androiddbg androiddbg

17324808 res/raw/wallpaper.apk (OK)
19083357 res/xml/components.xml (OK - compressed)
19084178 res/xml/network_security_config.xml (OK - compressed)
19084553 res/xml/nimble_log.xml (OK - compressed)
19084744 resources.arsc (OK)
Verification succesful
Exception in thread "main" java.security.InvalidKeyException: Failed to sign using signer "ANDROIDD"
at com.android.apksig.internal.apk.v1.V1SchemeSigner.signManifest(V1SchemeSigner.java:293)
at com.android.apksig.internal.apk.v1.V1SchemeSigner.sign(V1SchemeSigner.java:254)
at com.android.apksig.DefaultApkSignerEngine.outputJarEntries(DefaultApkSignerEngine.java:933)
at com.android.apksig.ApkSigner.sign(ApkSigner.java:551)
at com.android.apksig.ApkSigner.sign(ApkSigner.java:223)
at com.android.apksigner.ApkSignerTool.sign(ApkSignerTool.java:395)
at com.android.apksigner.ApkSignerTool.main(ApkSignerTool.java:92)
Caused by: java.security.InvalidKeyException: Failed to sign using SHA1withDSA
at com.android.apksig.internal.apk.v1.V1SchemeSigner.generateSignatureBlock(V1SchemeSigner.java:516)
at com.android.apksig.internal.apk.v1.V1SchemeSigner.signManifest(V1SchemeSigner.java:291)
... 6 more
Caused by: java.security.InvalidKeyException: The security strength of SHA-1 digest algorithm is not sufficient for this key size
at sun.security.provider.DSA.checkKey(DSA.java:111)
at sun.security.provider.DSA.engineInitSign(DSA.java:143)
at java.security.Signature$Delegate.init(Signature.java:1155)
at java.security.Signature$Delegate.chooseProvider(Signature.java:1115)
at java.security.Signature$Delegate.engineInitSign(Signature.java:1179)
at java.security.Signature.initSign(Signature.java:530)
at com.android.apksig.internal.apk.v1.V1SchemeSigner.generateSignatureBlock(V1SchemeSigner.java:512)
... 7 more
Value of sys.argv[2]: original.apk
Patching AndroidManifest.xml ...
Found application tag at 7868 !
Found debuggable attribute!
Copying file ...
Copying rest of files
Using zipalign at .\zipalign.EXE
Aligning...
Verifying alignment...
Using apksigner at .\apksigner.BAT
Signing...
apksigner failed, aborting.

@netgoatfr
Copy link

Here is my fixed version:

apk_name=<app namp>
apk_location="$(adb shell pm list packages -f -3 | grep $apk_name | sed 's/.*:\(.*\).apk.*/\1/').apk"
adb pull $apk_location original.apk
keytool -genkey -v -keystore resign.keystore -storepass androiddbg -alias androiddbg -dname "CN=Android Debug,O=Android,C=US"
python make_debuggable.py apk original.apk patched.apk resign.keystore androiddbg androiddbg
adb uninstall $apk_name
adb shell settings put global verifier_verify_adb_installs 0
adb install patched.apk

This is bash code btw

@briandyy
Copy link

briandyy commented Nov 1, 2024

this will remove the file data before backed up

@sbpetrack
Copy link

The following is the basis of a solution that does not require making an apk debuggable, nor copying any file within the phone, nor any chmod command. MUCH more significantly (I think?), it overcomes a problem that hasn't yet been mentioned here, which is the fact that adb pull doesn't work with wildcards or globbing -- the examples above push or pull a single file (except perhaps for the solutions that use adb backup, and 1. adb backup is deprecated; and 2. i'm not sure, but i think with adb backup you can only back up an individual file or everything. In any case, I hope some might find the following useful.

Preface: I ran adb root before any of this. On my Magisk-rooted phone (OnePlus 10 Pro 5G running Oxygen/Android 15), I can run adb root via the following three commands. (The first can be entered into an adb shell, but the last can only be entered into a root shell on the phone. I just type them all into a rooted termux shell):

#resetprop   ro.debuggable 1  
#adbd stop
#adbd start

Then I can successfully run adb root on my laptop. After that, here is a transcript of part of an xterm session from my laptop (running bash on arch linux; adapt as you see fit). The commands at the beginning are there just to make clear that even after adb root, there are things you can't do without some extra nonsense:

[scott@scott-xps9500 account1]$  adb shell  ls -l /data/data/org.telegram.messenger/files/account1/* 
ls: /data/data/org.telegram.messenger/files/account1/*: Permission denied

[scott@scott-xps9500 account1]$  adb shell su -c  ls -l /data/data/org.telegram.messenger/files/account1/* 
-rw------- 1 u0_a325 u0_a325    4096 2025-03-18 08:43 /data/data/org.telegram.messenger/files/account1/cache4.db
-rw------- 1 u0_a325 u0_a325   32768 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/cache4.db-shm
-rw------- 1 u0_a325 u0_a325 2220712 2025-03-18 08:43 /data/data/org.telegram.messenger/files/account1/cache4.db-wal
-rw-rw---- 1 u0_a325 u0_a325      40 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/dc2conf.dat
-rw------- 1 u0_a325 u0_a325     612 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/stats2.dat
-rw-rw---- 1 u0_a325 u0_a325    1580 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/tgnet.dat

[scott@scott-xps9500 account1]$  adb shell su -c  ls  /data/data/org.telegram.messenger/files/account1/* 
/data/data/org.telegram.messenger/files/account1/cache4.db
/data/data/org.telegram.messenger/files/account1/cache4.db-shm
/data/data/org.telegram.messenger/files/account1/cache4.db-wal
/data/data/org.telegram.messenger/files/account1/dc2conf.dat
/data/data/org.telegram.messenger/files/account1/stats2.dat
/data/data/org.telegram.messenger/files/account1/tgnet.dat

[scott@scott-xps9500 account1]$  for file in `adb shell su -c ls /data/user/0/org.telegram.messenger/files/account1/* ` 
> do
> adb shell su -c dd if=$file > `basename $file`
> done
8+0 records in
8+0 records out
4096 bytes (4.0 K) copied, 0.001 s, 3.9 M/s
64+0 records in
64+0 records out
32768 bytes (32 K) copied, 0.002 s, 16 M/s
4337+1 records in
4337+1 records out
2220712 bytes (2.1 M) copied, 0.050 s, 42 M/s
0+1 records in
0+1 records out
40 bytes (40 B) copied, 0.001 s, 39 K/s
1+1 records in
1+1 records out
612 bytes (612 B) copied, 0.001 s, 598 K/s
3+1 records in
3+1 records out
1580 bytes (1.5 K) copied, 0.001 s, 1.5 M/s

[scott@scott-xps9500 account1]$ ls -l
total 2220
-rw-r--r-- 1 scott scott    4096 Mar 29 12:57 cache4.db
-rw-r--r-- 1 scott scott   32768 Mar 29 12:57 cache4.db-shm
-rw-r--r-- 1 scott scott 2220712 Mar 29 12:57 cache4.db-wal
-rw-r--r-- 1 scott scott      40 Mar 29 12:57 dc2conf.dat
-rw-r--r-- 1 scott scott     612 Mar 29 12:57 stats2.dat
-rw-r--r-- 1 scott scott    1580 Mar 29 12:57 tgnet.dat

Note 1: (if you care) that both permissions and ownership of the copied files do not match the originals. (The change in ownership is hardly surprising, as there is no user u0_325 on my laptop. I'll leave as another "exercise for the reader" to add to the bash "for" loop the commands that read the file permissions from the phone and write them on the laptop).

Note 2: I have forever use a command like

adb pull  `adb shell ls path/with/wildcards/*.whatever `      target-dir/

to pull multiple files or directories (recursively or not) with adb pull. I found this page when confronted with the permissions problems as well. So thank you to @tuanchauict and @listvin for mentioning dd! Let us hope that android file security remains as arbitrary and inconsistent as it is today, so that we can get our work done. BTW, on that subject:

Note 3: For many of you, you don't need to do ANY of this: the next time you are having trouble to pull or push a file over adb, try each of the following ways to refer to the directory on the phone you are trying to access: /data/media/0/ or /sdcard/ or /storage/emulated/0 . On my phone, for example, when not using root privileges, I usually can only see files under /sdcard/ (I get "permission denied" for the other two names for the same directory); but when referring to the same directory via adb push or adb pull on my laptop, i can only see/access files under /data/media/0 (the other choices get me "permission denied" ). C'est logique!!

@cleoold
Copy link

cleoold commented Apr 8, 2025

The following is the basis of a solution that does not require making an apk debuggable, nor copying any file within the phone, nor any chmod command. MUCH more significantly (I think?), it overcomes a problem that hasn't yet been mentioned here, which is the fact that adb pull doesn't work with wildcards or globbing -- the examples above push or pull a single file (except perhaps for the solutions that use adb backup, and 1. adb backup is deprecated; and 2. i'm not sure, but i think with adb backup you can only back up an individual file or everything. In any case, I hope some might find the following useful.

Preface: I ran adb root before any of this. On my Magisk-rooted phone (OnePlus 10 Pro 5G running Oxygen/Android 15), I can run adb root via the following three commands. (The first can be entered into an adb shell, but the last can only be entered into a root shell on the phone. I just type them all into a rooted termux shell):

#resetprop   ro.debuggable 1  
#adbd stop
#adbd start

Then I can successfully run adb root on my laptop. After that, here is a transcript of part of an xterm session from my laptop (running bash on arch linux; adapt as you see fit). The commands at the beginning are there just to make clear that even after adb root, there are things you can't do without some extra nonsense:

[scott@scott-xps9500 account1]$  adb shell  ls -l /data/data/org.telegram.messenger/files/account1/* 
ls: /data/data/org.telegram.messenger/files/account1/*: Permission denied

[scott@scott-xps9500 account1]$  adb shell su -c  ls -l /data/data/org.telegram.messenger/files/account1/* 
-rw------- 1 u0_a325 u0_a325    4096 2025-03-18 08:43 /data/data/org.telegram.messenger/files/account1/cache4.db
-rw------- 1 u0_a325 u0_a325   32768 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/cache4.db-shm
-rw------- 1 u0_a325 u0_a325 2220712 2025-03-18 08:43 /data/data/org.telegram.messenger/files/account1/cache4.db-wal
-rw-rw---- 1 u0_a325 u0_a325      40 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/dc2conf.dat
-rw------- 1 u0_a325 u0_a325     612 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/stats2.dat
-rw-rw---- 1 u0_a325 u0_a325    1580 2025-03-29 10:35 /data/data/org.telegram.messenger/files/account1/tgnet.dat

[scott@scott-xps9500 account1]$  adb shell su -c  ls  /data/data/org.telegram.messenger/files/account1/* 
/data/data/org.telegram.messenger/files/account1/cache4.db
/data/data/org.telegram.messenger/files/account1/cache4.db-shm
/data/data/org.telegram.messenger/files/account1/cache4.db-wal
/data/data/org.telegram.messenger/files/account1/dc2conf.dat
/data/data/org.telegram.messenger/files/account1/stats2.dat
/data/data/org.telegram.messenger/files/account1/tgnet.dat

[scott@scott-xps9500 account1]$  for file in `adb shell su -c ls /data/user/0/org.telegram.messenger/files/account1/* ` 
> do
> adb shell su -c dd if=$file > `basename $file`
> done
8+0 records in
8+0 records out
4096 bytes (4.0 K) copied, 0.001 s, 3.9 M/s
64+0 records in
64+0 records out
32768 bytes (32 K) copied, 0.002 s, 16 M/s
4337+1 records in
4337+1 records out
2220712 bytes (2.1 M) copied, 0.050 s, 42 M/s
0+1 records in
0+1 records out
40 bytes (40 B) copied, 0.001 s, 39 K/s
1+1 records in
1+1 records out
612 bytes (612 B) copied, 0.001 s, 598 K/s
3+1 records in
3+1 records out
1580 bytes (1.5 K) copied, 0.001 s, 1.5 M/s

[scott@scott-xps9500 account1]$ ls -l
total 2220
-rw-r--r-- 1 scott scott    4096 Mar 29 12:57 cache4.db
-rw-r--r-- 1 scott scott   32768 Mar 29 12:57 cache4.db-shm
-rw-r--r-- 1 scott scott 2220712 Mar 29 12:57 cache4.db-wal
-rw-r--r-- 1 scott scott      40 Mar 29 12:57 dc2conf.dat
-rw-r--r-- 1 scott scott     612 Mar 29 12:57 stats2.dat
-rw-r--r-- 1 scott scott    1580 Mar 29 12:57 tgnet.dat

Note 1: (if you care) that both permissions and ownership of the copied files do not match the originals. (The change in ownership is hardly surprising, as there is no user u0_325 on my laptop. I'll leave as another "exercise for the reader" to add to the bash "for" loop the commands that read the file permissions from the phone and write them on the laptop).

Note 2: I have forever use a command like

adb pull  `adb shell ls path/with/wildcards/*.whatever `      target-dir/

to pull multiple files or directories (recursively or not) with adb pull. I found this page when confronted with the permissions problems as well. So thank you to @tuanchauict and @listvin for mentioning dd! Let us hope that android file security remains as arbitrary and inconsistent as it is today, so that we can get our work done. BTW, on that subject:

Note 3: For many of you, you don't need to do ANY of this: the next time you are having trouble to pull or push a file over adb, try each of the following ways to refer to the directory on the phone you are trying to access: /data/media/0/ or /sdcard/ or /storage/emulated/0 . On my phone, for example, when not using root privileges, I usually can only see files under /sdcard/ (I get "permission denied" for the other two names for the same directory); but when referring to the same directory via adb push or adb pull on my laptop, i can only see/access files under /data/media/0 (the other choices get me "permission denied" ). C'est logique!!

Did you see the description of the gist, ... without root access?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment