An Android Police contributor has published a step-by-step account of how they use Google Gemini to audit the data Android apps store locally — and what those apps are actually doing behind the scenes. The workflow combines ADB, Visual Studio Code, Apktool and the AI model to extract, decompile and analyze app sandboxes without root access.
The piece lands as privacy-conscious users look for practical ways to verify what permissions and trackers ship inside the apps they install daily. The author frames the process as a defense against 'Trojan horse' apps that request permissions far beyond their stated function. A flashlight app, they note, has no justifiable reason to access contacts or query all installed packages.
Since Android 11, apps must declare specific package visibility instead of broad device inspection, but Play Store listings still present permissions as plain text with no risk flags. The audit starts with USB debugging enabled and ADB pulling an app's /data/data/ directory to a local workspace. VS Code then opens the extracted databases and shared-preferences files.
For hardened or production-signed apps that block run-as access, the author pulls the base APK and decompiles it with Apktool to read the raw AndroidManifest.xml. That manifest reveals every declared permission, service, receiver and the android:usesCleartextTraffic flag. In a worked example, the sideloaded media downloader Snaptube, removed from the Play Store, showed high-risk permissions including READ_PHONE_STATE, ACCESS_FINE_LOCATION, CAMERA, RECORD_AUDIO and QUERY_ALL_PACKAGES.
Its manifest also enabled cleartext HTTP traffic. Background services named KeeperService and RebirthJobService restart killed tasks, while system receivers trigger on boot, unlock and charging events. Embedded SDKs from ByteDance, InMobi, Mintegral, Vungle, SensorsData and Meta handle ads and analytics. The author says pasting database contents into Gemini cut two to four hours of manual table scanning per app.
The AI surfaced stored flags, tokens and configuration values that would have been easy to miss in raw SQLite dumps. The full command sequence, Homebrew install, ADB pull commands, Apktool decompile flags and VS Code workspace setup, is published in the Android Police piece. Readers with basic shell and SQL knowledge can replicate the workflow.
The author claims it works even without programming experience. The method does not require root, but it does require a PC, a USB cable and willingness to enable developer options on the phone. Android Police published the guide on October 23. The same workflow can be pointed at any installed package, making it a repeatable check for future app updates or new installs.
MDFiled by The Mobile Desk
Phones from leak to launch to price cut: what was announced, what it costs where, and when it goes on sale. Indian launches and prices included, not appended.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.